Subject: xorg-server: Changes to 'upstream-unstable'

Rebased ref, commits from common ancestor:
commit ad2facda30f453d749492c51d29f2626aee6326a
Author: Adam Jackson <ajax@xxxxxxxxxx>
Date: Wed Jan 11 16:15:57 2017 -0500

xserver 1.19.1

Signed-off-by: Adam Jackson <ajax@xxxxxxxxxx>

diff --git a/ b/
index f7ab48c..b0daff9 100644
--- a/
+++ b/
@@ -26,9 +26,9 @@ dnl
dnl Process this file with autoconf to create configure.

-AC_INIT([xorg-server], 1.19.0,
[], xorg-server)
+AC_INIT([xorg-server], 1.19.1,
[], xorg-server)
AM_INIT_AUTOMAKE([foreign dist-bzip2])

commit 82dcb68a8782d0cce6e6ce1a375cda05c91fe8c3
Author: Keith Packard <keithp@xxxxxxxxxx>
Date: Mon Jan 9 18:10:21 2017 -0800

AttendClient of grab-pervious client must queue to saved_ready_clients [v2]

A client which is attended while a grab is blocking execution of its
requests needs to be placed in the saved_ready_clients list so that it
will get scheduled once the grab terminates. Otherwise, if the client
never sends another request, there is no way for it to be placed in
the ready_clients list.

v2: Wrap comment above mark_client_saved_ready.
Remove test for OS_COMM_IGNORED which will always be true.

Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>
Signed-off-by: Keith Packard <keithp@xxxxxxxxxx>
(cherry picked from commit 785053d033e73d2deb0ded4b97eabfd881991978)

diff --git a/dix/dispatch.c b/dix/dispatch.c
index 3d0fe26..78ac095 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -266,6 +266,16 @@ mark_client_ready(ClientPtr client)
xorg_list_append(&client->ready, &ready_clients);

+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client)
+ if (xorg_list_is_empty(&client->ready))
+ xorg_list_append(&client->ready, &saved_ready_clients);
/* Client has no requests queued and no data on network */
mark_client_not_ready(ClientPtr client)
diff --git a/include/dixstruct.h b/include/dixstruct.h
index d71b0ac..21a6b8a 100644
--- a/include/dixstruct.h
+++ b/include/dixstruct.h
@@ -143,6 +143,12 @@ extern void SmartScheduleStopTimer(void);
/* Client has requests queued or data on the network */
void mark_client_ready(ClientPtr client);

+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client);
/* Client has no requests queued and no data on network */
void mark_client_not_ready(ClientPtr client);

diff --git a/os/connection.c b/os/connection.c
index a901ebf..62e2980 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -1067,6 +1067,10 @@ AttendClient(ClientPtr client)
if (listen_to_client(client))
+ else {
+ /* grab active, mark ready when grab goes away */
+ mark_client_saved_ready(client);
+ }

/* make client impervious to grabs; assume only executing client calls this */

commit 14516988e095ed748e738c14a87c3656006846f7
Author: Qiang Yu <Qiang.Yu@xxxxxxx>
Date: Tue Jan 10 18:51:55 2017 +0800

randr: fix xserver crash when xrandr setprovideroutputsource

xrandr --setprovideroutputsource <screen> <gpu screen>
Xorg: ../../../xserver/dix/dispatch.c:4018: AttachOutputGPU:
Assertion `new->isGPU' failed.

GPUScreen is not allowed to be sink output.

Signed-off-by: Qiang Yu <Qiang.Yu@xxxxxxx>
Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Signed-off-by: Peter Hutterer <peter.hutterer@xxxxxxxxx>
(cherry picked from commit 555e0a42d138ac8d83af62638752a1bebad602d6)

diff --git a/randr/rrprovider.c b/randr/rrprovider.c
index f9df67e..e4bc2bf 100644
--- a/randr/rrprovider.c
+++ b/randr/rrprovider.c
@@ -338,6 +338,9 @@ ProcRRSetProviderOutputSource(ClientPtr client)
pScreen = provider->pScreen;
pScrPriv = rrGetScrPriv(pScreen);

+ if (!pScreen->isGPU)
+ return BadValue;
pScrPriv->rrProviderSetOutputSource(pScreen, provider, source_provider);


commit 3381e2c26b2ac40b1dd909439bf72559b80d0d86
Author: Qiang Yu <Qiang.Yu@xxxxxxx>
Date: Tue Jan 10 18:51:54 2017 +0800

xfree86: fix wrong usage of xf86optionListMerge

Signed-off-by: Qiang Yu <Qiang.Yu@xxxxxxx>
Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Signed-off-by: Peter Hutterer <peter.hutterer@xxxxxxxxx>
(cherry picked from commit 1012510620de7dadd0ab18b19a8e11facd884601)

diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c
index 0e8bc1f..e9393fa 100644
--- a/hw/xfree86/common/xf86Option.c
+++ b/hw/xfree86/common/xf86Option.c
@@ -84,7 +84,7 @@ xf86CollectOptions(ScrnInfoPtr pScrn, XF86OptionPtr extraOpts)
if (device && device->options) {
tmp = xf86optionListDup(device->options);
if (pScrn->options)
- xf86optionListMerge(pScrn->options, tmp);
+ pScrn->options = xf86optionListMerge(pScrn->options, tmp);
pScrn->options = tmp;

commit 27a2772cf3a1bcd656efdf653a7504597911dbc4
Author: Michel Dänzer <michel.daenzer@xxxxxxx>
Date: Fri Nov 25 17:34:05 2016 +0900

present: Only call present_flip_notify if vblank->queued == FALSE

We are no longer using the present_flip_queue list only for presents
which have already been submitted to the driver for page flipping, but
also for those which we are queueing up to be flipped later, marked
with vblank->queued == TRUE. We were incorrectly calling
present_flip_notify for such entries, failing the assertion in
present_flip_notify (or presumably resulting in other undesirable
behaviour with assertions disabled).

Reproduction recipe: Run the JavaFX test case referenced by and alt-tab out
of it while it's fullscreen. May take a few attempts to hit the
assertion failure.

Fixes: bab0f450a719 ("present: Fix presentation of flips out of order")
Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx>
(cherry picked from commit e473b2bc016adacfe3fa47fdf6a8ce9f8cddff62)

diff --git a/present/present.c b/present/present.c
index a7ca06e..ef89045 100644
--- a/present/present.c
+++ b/present/present.c
@@ -536,7 +536,10 @@ present_event_notify(uint64_t event_id, uint64_t ust,
uint64_t msc)
xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
if (vblank->event_id == event_id) {
- present_flip_notify(vblank, ust, msc);
+ if (vblank->queued)
+ present_execute(vblank, ust, msc);
+ else
+ present_flip_notify(vblank, ust, msc);

commit 943e3cbeb0139d719589fc07c4f471195e4efe0a
Author: Kai-Heng Feng <kai.heng.feng@xxxxxxxxxxxxx>
Date: Thu Dec 15 13:56:38 2016 +0800

edid: Add quirk for ADA 1024x600 7" display.

Detailed mode reports 108 mm x 68 mm which is for smaller display.
Maximum image size reports 15 cm x 10 cm which aligns with its physical
size, use this size instead.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@xxxxxxxxxxxxx>
Acked-by: Alex Deucher <alexander.deucher@xxxxxxx>
(cherry picked from commit 9874f73e88678c9eacbcba05e52336fc63a32712)

diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index f24294e..f0e1e97 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -153,6 +153,11 @@ quirk_detailed_v_in_cm(int scrnIndex, xf86MonPtr DDC)
static Bool
quirk_detailed_use_maximum_size(int scrnIndex, xf86MonPtr DDC)
+ /* ADA 1024x600 7" display */
+ if (memcmp(DDC->, "ADA", 4) == 0 &&
+ DDC->vendor.prod_id == 4)
+ return TRUE;
/* Bug #21324: Iiyama Vision Master 450 */
if (memcmp(DDC->, "IVM", 4) == 0 && DDC->vendor.prod_id == 6400)
return TRUE;

commit cb3057da2254f9b6434a9c40486c72865cd1ab5e
Author: Peter Hutterer <peter.hutterer@xxxxxxxxx>
Date: Thu Dec 8 14:32:06 2016 +1000

os: return 0 from check_timers if we touched any of them

Fixes a regression introduced in 0b2f30834b1a9f. If a driver posts input
events during a timer function (wacom and synaptics do this during tap
timeouts), ProcessInputEvents() is not called for these events. There are no
new events on any fds, so the events just sit in the queue waiting for
something else to happen.

Fix this by simply returning 0 from check_timers if we ran at least one of
them or reset them all. This way the callers ospoll_wait will exit and
continue with normal processing.

Signed-off-by: Peter Hutterer <peter.hutterer@xxxxxxxxx>
Reviewed-by: Keith Packard <keithp@xxxxxxxxxx>

diff --git a/os/WaitFor.c b/os/WaitFor.c
index ff1c85e..613608f 100644
--- a/os/WaitFor.c
+++ b/os/WaitFor.c
@@ -143,7 +143,7 @@ check_timers(void)
OsTimerPtr timer;

- while ((timer = first_timer()) != NULL) {
+ if ((timer = first_timer()) != NULL) {
CARD32 now = GetTimeInMillis();
int timeout = timer->expires - now;

@@ -157,6 +157,8 @@ check_timers(void)
/* time has rewound. reset the timers. */
+ return 0;
return -1;

commit db03742cd33d6d54834bb138886a4f84bc452a85
Author: Michal Srb <msrb@xxxxxxxx>
Date: Mon Dec 12 17:45:22 2016 +0200

xinerama: Swap the response in RRXineramaWriteMonitor

Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>

diff --git a/randr/rrxinerama.c b/randr/rrxinerama.c
index b6e9586..8f499df 100644
--- a/randr/rrxinerama.c
+++ b/randr/rrxinerama.c
@@ -260,6 +260,13 @@ RRXineramaWriteMonitor(ClientPtr client, RRMonitorPtr
scratch.width = monitor-> - monitor->;
scratch.height = monitor-> - monitor->;

+ if (client->swapped) {
+ swaps(&scratch.x_org);
+ swaps(&scratch.y_org);
+ swaps(&scratch.width);
+ swaps(&scratch.height);
+ }
WriteToClient(client, sz_XineramaScreenInfo, &scratch);

commit 862c1c43c10eda955db1440cc72ff0387e24a35f
Author: Hans De Goede <hdegoede@xxxxxxxxxx>
Date: Tue Dec 20 13:00:43 2016 +0100

glamor: Trust eglGetPlatformDisplayEXT if it exists

If the libEGL we are using has eglGetPlatformDisplayEXT, yet it still
returns NULL, then this very likely means that it does not support the
type (e.g. EGL_PLATFORM_GBM_MESA) passed in, and then returning NULL is
the right thing to do.

This avoids falling back to an eglGetDisplay() implementation which does
not understands the passed in gbm handle, treats it as a pointer to
something else completely, followed by a crash sooner or later.

Specifically this fixes using the nvidia binary driver, with nvidia's
libEGL + the modesetting driver on a secondary GPU crashing inside
glamor_egl_init() sometimes.

[1.19: squash in typo fix from 29a4f3db - ajax]

Cc: Eric Anholt <eric@xxxxxxxxxx>
Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>
Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
(cherry picked from commit 05e19644250698aa126a60bc671e85425df784d1)

diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
index 9cc0f8d..4bde637 100644
--- a/glamor/glamor_egl.c
+++ b/glamor/glamor_egl.c
@@ -769,6 +769,10 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)

glamor_egl->display = glamor_egl_get_display(EGL_PLATFORM_GBM_MESA,
+ if (!glamor_egl->display) {
+ xf86DrvMsg(scrn->scrnIndex, X_ERROR, "eglGetDisplay() failed\n");
+ goto error;
+ }
glamor_egl->display = eglGetDisplay((EGLNativeDisplayType) (intptr_t) fd);
diff --git a/glamor/glamor_egl.h b/glamor/glamor_egl.h
index 6b05f57..6bb1185 100644
--- a/glamor/glamor_egl.h
+++ b/glamor/glamor_egl.h
@@ -60,16 +60,12 @@
static inline EGLDisplay
glamor_egl_get_display(EGLint type, void *native)
- EGLDisplay dpy = NULL;
/* In practise any EGL 1.5 implementation would support the EXT extension
if (epoxy_has_egl_extension(NULL, "EGL_EXT_platform_base")) {
(void *) eglGetProcAddress("eglGetPlatformDisplayEXT");
if (getPlatformDisplayEXT)
- dpy = getPlatformDisplayEXT(type, native, NULL);
- if (dpy)
- return dpy;
+ return getPlatformDisplayEXT(type, native, NULL);

/* Welp, everything is awful. */

commit 8790bd993ac2f8f8dd54a1946312e6b6dc929e00
Author: Mihail Konev <k.mvc@xxxxx>
Date: Thu Dec 29 12:37:18 2016 +0500

os,dix: Depend custom libs on libs, not objects

The custom os/os.O library reuses *.o files of os/

The current rule assumes automake puts all the objects into per-target
am__*_la_OBJECTS variable. At least with AC_REPLACE_FUNCS, this no
longer holds (as wanted objects are put into LTLIBOBJS instead).

Depend on automake's result, the *.la library instead, to express demand
of any its dependencies being built.

Should be fixing randomly occuring "undefined reference to `strlcpy'"
errors when linking Xvfb and other DDX-es that could use os.O.

Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>
Signed-off-by: Mihail Konev <k.mvc@xxxxx>
(cherry picked from commit 5b74e260e009d8bdf26433724495802b85cce7c3)

diff --git a/dix/ b/dix/
index e7ca236..a4171d7 100644
--- a/dix/
+++ b/dix/
@@ -61,13 +61,13 @@ endif

# Generate dtrace object code for probes in libdix
-dtrace-dix.o: $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS)
+dtrace-dix.o: $(top_srcdir)/dix/Xserver.d
$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d

noinst_PROGRAMS = dix.O

-dix.O: dtrace-dix.o $(am_libdix_la_OBJECTS)
+dix.O: dtrace-dix.o
$(AM_V_GEN)ld -r -o $@ $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)

diff --git a/os/ b/os/
index b5fb9d0..c6e78cb 100644
--- a/os/
+++ b/os/
@@ -58,12 +58,12 @@ EXTRA_DIST = $(SECURERPC_SRCS) $(XDMCP_SRCS)

# Generate dtrace object code for probes in libos & libdix
-dtrace.o: $(top_srcdir)/dix/Xserver.d $(am_libos_la_OBJECTS)
+dtrace.o: $(top_srcdir)/dix/Xserver.d
$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d
.libs/*.o ../dix/.libs/*.o

noinst_PROGRAMS = os.O

-os.O: dtrace.o $(am_libos_la_OBJECTS)
+os.O: dtrace.o
$(AM_V_GEN)ld -r -o $@ dtrace.o .libs/*.o

commit 8cf47472bff1d5ca3de6ff83a80f0d2820c3fb93
Author: Ben Crocker <bcrocker@xxxxxxxxxx>
Date: Tue Nov 15 16:34:38 2016 -0500

Fix a segfault that occurs if xorg.conf.d is absent:

In InitOutput, if xf86HandleConfigFile returns CONFIG_NOFILE
(which it does if no config file or directory is present), the
autoconfig flag is set, causing xf86AutoConfig to be called
later on.

xf86AutoConfig calls xf86OutputClassDriverList via the
call tree:

xf86AutoConfig =>
listPossibleVideoDrivers =>
xf86PlatformMatchDriver =>

and xf86OutputClassDriverList attempts to traverse a linked list
that is a member of the XF86ConfigRec struct pointed to by the
global xf86configptr, which is NULL at this point because the
XF86ConfigRec struct is only allocated (by xf86readConfigFile)
AFTER the config file and directory have been successfully
opened; the CONFIG_NOFILE return from xf86HandleConfigFile
occurs BEFORE the call to xf86readConfigFile which allocates
the XF86ConfigRec struct.

Rx: In read.c (for symmetry with xf86freeConfig, which already
appears in this file), add a new function xf86allocateConfig
which tests the value of xf86configptr and, if it's NULL,
allocates the XF86ConfigRec struct and deposits the pointer
in xf86configptr. In xf86Parser.h, add a prototype for the
new xf86allocateConfig function.

Back in read.c, #include "xf86Config.h". In xf86readConfigFile,
change the open-code call to calloc to a call to the new
xf86allocateConfig function.

In xf86AutoConfig.c, add a call to the new xf86allocateConfig function
to the beginning of xf86AutoConfig to make sure the XF86ConfigRec struct
is allocated.

Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>
Signed-off-by: Ben Crocker <bcrocker@xxxxxxxxxx>
(cherry picked from commit 8b335d9068fe4e1f1423a4d86c22b69ffcb819a5)

diff --git a/hw/xfree86/common/xf86AutoConfig.c
index 9402651..c3e17be 100644
--- a/hw/xfree86/common/xf86AutoConfig.c
+++ b/hw/xfree86/common/xf86AutoConfig.c
@@ -149,6 +149,15 @@ xf86AutoConfig(void)
char buf[1024];
ConfigStatus ret;

+ /* Make sure config rec is there */
+ if (xf86allocateConfig() != NULL) {
+ ret = CONFIG_OK; /* OK so far */
+ }
+ else {
+ xf86Msg(X_ERROR, "Couldn't allocate Config record.\n");
+ return FALSE;
+ }
listPossibleVideoDrivers(deviceList, 20);

for (p = deviceList; *p; p++) {
diff --git a/hw/xfree86/parser/read.c b/hw/xfree86/parser/read.c
index ec038ae..d7e7312 100644
--- a/hw/xfree86/parser/read.c
+++ b/hw/xfree86/parser/read.c
@@ -56,6 +56,7 @@
#include <xorg-config.h>

+#include "xf86Config.h"
#include "xf86Parser.h"
#include "xf86tokens.h"
#include "Configint.h"
@@ -91,7 +92,7 @@ xf86readConfigFile(void)
int token;
XF86ConfigPtr ptr = NULL;

- if ((ptr = calloc(1, sizeof(XF86ConfigRec))) == NULL) {
+ if ((ptr = xf86allocateConfig()) == NULL) {
return NULL;

@@ -270,6 +271,19 @@ xf86itemNotSublist(GenericListPtr list_1, GenericListPtr
return (!(last_1 == last_2));

+ * Conditionally allocate config struct, but only allocate it
+ * if it's not already there. In either event, return the pointer
+ * to the global config struct.
+ */
+XF86ConfigPtr xf86allocateConfig(void)
+ if (!xf86configptr) {
+ xf86configptr = calloc(1, sizeof(XF86ConfigRec));
+ }
+ return xf86configptr;
xf86freeConfig(XF86ConfigPtr p)
diff --git a/hw/xfree86/parser/xf86Parser.h b/hw/xfree86/parser/xf86Parser.h
index ff35846..9c4b403 100644
--- a/hw/xfree86/parser/xf86Parser.h
+++ b/hw/xfree86/parser/xf86Parser.h
@@ -449,6 +449,7 @@ extern char *xf86openConfigDirFiles(const char *path, const
char *cmdline,
extern void xf86setBuiltinConfig(const char *config[]);
extern XF86ConfigPtr xf86readConfigFile(void);
extern void xf86closeConfigFile(void);
+extern XF86ConfigPtr xf86allocateConfig(void);
extern void xf86freeConfig(XF86ConfigPtr p);
extern int xf86writeConfigFile(const char *, XF86ConfigPtr);
extern _X_EXPORT XF86ConfDevicePtr xf86findDevice(const char *ident,

commit 06a3e7ef3bf9a907f1fba84a3601870a5697f657
Author: Pekka Paalanen <pekka.paalanen@xxxxxxxxxxxxxxx>
Date: Wed Dec 7 15:43:06 2016 +0200

test: fix distributing scripts

Fix the following error on 'make distcheck':

make[6]: *** No rule to make target 'scripts/', needed by
'scripts/'. Stop.
make[6]: Leaving directory
Makefile:1367: recipe for target 'check-TESTS' failed

The setup to trigger this is:
$ ./configure --prefix=/home/pq/local --disable-docs
--disable-devel-docs --enable-xwayland --disable-xorg --disable-xvfb
--disable-xnest --disable-xquartz --disable-xwin --enable-debug

SCRIPT_TESTS is populated conditionally, but we should distribute the
scripts in any case.

Reviewed-by: Adam Jackson <ajax@xxxxxxxxxx>
Signed-off-by: Pekka Paalanen <pekka.paalanen@xxxxxxxxxxxxxxx>
(cherry picked from commit b365c5d16894a259dbf29db4ca2640d8ed768063)

diff --git a/test/ b/test/
index b8a0f4d..064e1c5 100644
--- a/test/
+++ b/test/
@@ -166,7 +166,8 @@ libxservertest_la_DEPENDENCIES = $(libxservertest_la_LIBADD)

+ scripts/ \
+ scripts/ \
scripts/ \
scripts/ \
ddxstubs.c \

commit 543287e60af5e9d91b5fc7e4a42e51eafa63db21
Author: Adam Jackson <ajax@xxxxxxxxxx>
Date: Tue Dec 6 14:11:11 2016 -0500

composite: Fix repaint of borders (v2)

When going from border width zero to a non-zero border width, the
Composite extension is informed via the ConfigNotify callback. The
call-chain looks like this: compConfigNotify -> compReallocPixmap ->
compSetPixmap -> TraverseTree -> compSetPixmapVisitWindow. However, at
this time, pWindow->borderWidth was not yet updated. Thus, HasBorder()
is false and the window border will not be repainted.

To fix this, thread the new bw through to the window visitor, and
inspect that rather than HasBorder(). For the other callers of
compSetPixmap the border does not change size, so we can pass
pWin->borderWidth instead.

Signed-off-by: Adam Jackson <ajax@xxxxxxxxxx>
Reviewed-by: Keith Packard <keithp@xxxxxxxxxx>
(cherry picked from commit f31875510d818ba517f082e124adb294db906e51)

diff --git a/composite/compalloc.c b/composite/compalloc.c
index e6a203f..05ffc7e 100644
--- a/composite/compalloc.c
+++ b/composite/compalloc.c
@@ -612,7 +612,7 @@ compAllocPixmap(WindowPtr pWin)
pWin->redirectDraw = RedirectDrawManual;

- compSetPixmap(pWin, pPixmap);
+ compSetPixmap(pWin, pPixmap, bw);
cw->damageRegistered = FALSE;
@@ -651,7 +651,7 @@ compSetParentPixmap(WindowPtr pWin)
RegionCopy(&pWin->borderClip, &cw->borderClip);
pParentPixmap = (*pScreen->GetWindowPixmap) (pWin->parent);
pWin->redirectDraw = RedirectDrawNone;
- compSetPixmap(pWin, pParentPixmap);
+ compSetPixmap(pWin, pParentPixmap, pWin->borderWidth);

@@ -682,7 +682,7 @@ compReallocPixmap(WindowPtr pWin, int draw_x, int draw_y,
if (!pNew)
return FALSE;
cw->pOldPixmap = pOld;
- compSetPixmap(pWin, pNew);
+ compSetPixmap(pWin, pNew, bw);
else {
pNew = pOld;
diff --git a/composite/compint.h b/composite/compint.h
index 09241f2..f05c2d8 100644
--- a/composite/compint.h
+++ b/composite/compint.h
@@ -274,7 +274,7 @@ void

- compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap);
+ compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap, int bw);

compCheckRedirect(WindowPtr pWin);
diff --git a/composite/compwindow.c b/composite/compwindow.c
index 344138a..bcd230c 100644
--- a/composite/compwindow.c
+++ b/composite/compwindow.c
@@ -89,6 +89,7 @@ compCheckTree(ScreenPtr pScreen)
typedef struct _compPixmapVisit {
WindowPtr pWindow;
PixmapPtr pPixmap;
+ int bw;
} CompPixmapVisitRec, *CompPixmapVisitPtr;

static Bool
@@ -126,19 +127,20 @@ compSetPixmapVisitWindow(WindowPtr pWindow, void *data)
- if (HasBorder(pWindow))
+ if (pVisit->bw)
QueueWorkProc(compRepaintBorder, serverClient,
(void *) (intptr_t) pWindow->;

-compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap)
+compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap, int bw)
CompPixmapVisitRec visitRec;

visitRec.pWindow = pWindow;
visitRec.pPixmap = pPixmap;
+ = bw;
TraverseTree(pWindow, compSetPixmapVisitWindow, (void *) &visitRec);
@@ -463,7 +465,8 @@ compReparentWindow(WindowPtr pWin, WindowPtr pPriorParent)
* Reset pixmap pointers as appropriate
if (pWin->parent && pWin->redirectDraw == RedirectDrawNone)
- compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent));
+ compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent),
+ pWin->borderWidth);
* Call down to next function

commit c24c9cc956038a61922f8b11ee68b8b0fc6b9f83
Author: Hans de Goede <hdegoede@xxxxxxxxxx>
Date: Tue Nov 22 14:53:20 2016 +0100

randr: rrCheckPixmapBounding: do not shrink the screen_pixmap

The purpose of rrCheckPixmapBounding is to make sure that the
screen_pixmap is *large* enough for the slave-output which crtc is
being configured.

However until now rrCheckPixmapBounding would also shrink the
screen_pixmap in certain scenarios leading to various problems.

For example: Take a laptop with its internalscreen on a slave-output and
currently disabled and an external monitor at 1920x1080+0+0.
Now lets say that we want to drive the external monitor at its native
resolution of 2560x1440 and have the internal screen mirror the top left
part of the external monitor, so we run:

$ xrandr --output eDP --mode 1920x1080 --pos 0x0 --output HDMI \
--mode 2560x1440 --pos 0x0

Here xrandr utility first calls RRSetScreenSize to 2560x1440, then it
calls RRSetCrtc 1920x1080+0+0 on the eDP, since this is a slave output,
rrCheckPixmapBounding gets called and resizes the screen_pixmap to
1920x1080, undoing the RRSetScreenSize. Then RRSetCrtc 2560x1440+0+0
gets called on the HDMI, depending on crtc->transforms this will
either result in a BadValue error from ProcRRSetCrtcConfig; or
it will succeed, but the monitor ends up running at 2560x1440
while showing a 1920x1080 screen_pixmap + black borders on the right
and bottom. Neither of which is what we want.

This commit removes the troublesome shrinking behavior, fixing this.


1) One could argue that this will leave us with a too large screen_pixmap
in some cases, but rrCheckPixmapBounding only gets called for slave
outputs, so xrandr clients already must manually shrink the screen_pixmap
after disabling crtcs in normal setups.

2) An alternative approach would be to also call rrCheckPixmapBounding
on RRSetCrtc on normal (non-slave) outputs, but that would result in
2 unnecessary resizes of the screen_pixmap in the above example, which
seems undesirable.

Cc: Nikhil Mahale <nmahale@xxxxxxxxxx>
Cc: Dave Airlie <airlied@xxxxxxxxxx>
Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Reviewed-by: Dave Airlie <airlied@xxxxxxxxxx>
(cherry picked from commit a46afee84d45fbff4e4dad9376afc95bbcc31d7c)

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index ac853ea..d1a51f0 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -689,6 +689,12 @@ rrCheckPixmapBounding(ScreenPtr pScreen,
new_width = newsize->x2;
new_height = newsize->y2;

+ if (new_width < screen_pixmap->drawable.width)
+ new_width = screen_pixmap->drawable.width;
+ if (new_height < screen_pixmap->drawable.height)
+ new_height = screen_pixmap->drawable.height;
if (new_width == screen_pixmap->drawable.width &&
new_height == screen_pixmap->drawable.height) {
} else {

commit 26132f57ee6fae9376955e7990ac2fbad5b49fac
Author: Hans de Goede <hdegoede@xxxxxxxxxx>
Date: Tue Nov 22 14:48:14 2016 +0100

randr: rrCheckPixmapBounding: Do not substract crtc non 0 x,y from screen

The purpose of rrCheckPixmapBounding is to make sure that the
screen_pixmap is large enough for the slave-output which crtc is
being configured.

This should include crtc->x and crtc->y, otherwise the crtc might
still end up scanning out an area outside of the screen-pixmap.

For example: Take a laptop with an external monitor on a slave-output at
1920x1080+0+0 and its internal-screen at 3840x2160+1920+0 and in
gnome-settings-daemon move the external monitor to be on the ri ght of
the internal screen rather then on the left. First g-s-d will do a
RRSetScreenSize to 5760*2160 (which is a nop), then it calls RRSetCrtc
to move the slave output to 1920x1080+3840+0, since this is a slave
output, rrCheckPixmapBounding gets called, since the 2 crtcs now overlap
the code before this commit would shrinks the screen_pixmap to 3180*2160.
Then g-s-d calls RRSetCrtc to move the internal screen to 3180*2160+0+0.

And we end up with the slave-output configured to scan-out an area
which completely falls outside of the screen-pixmap (and end up with
a black display on the external monitor).

This commit fixes this by not substracting the x1 and y1 coordinates
of the union-ed region when determining the new screen_pixmap size.

Cc: Nikhil Mahale <nmahale@xxxxxxxxxx>
Cc: Dave Airlie <airlied@xxxxxxxxxx>
Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Reviewed-by: Dave Airlie <airlied@xxxxxxxxxx>
(cherry picked from commit 3b624aa9a9df86dc7d48149e0f18ca223b4355f1)

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 5d404e8..ac853ea 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -686,8 +686,8 @@ rrCheckPixmapBounding(ScreenPtr pScreen,

newsize = RegionExtents(&total_region);
- new_width = newsize->x2 - newsize->x1;
- new_height = newsize->y2 - newsize->y1;
+ new_width = newsize->x2;
+ new_height = newsize->y2;

if (new_width == screen_pixmap->drawable.width &&
new_height == screen_pixmap->drawable.height) {

commit 6c51845e6b0f313a90e4375f2821f1da9cc53014
Author: Olivier Fourdan <ofourdan@xxxxxxxxxx>
Date: Wed Nov 30 09:42:43 2016 +0100

xwayland: Fix use after free of cursors

Sometimes, Xwayland will try to use a cursor that has just been freed,
leading to a crash when trying to access that cursor data either in
miPointerUpdateSprite() or AnimCurTimerNotify().

CheckMotion() updates the pointer's cursor based on which xwindow
XYToWindow() returns, and Xwayland implements its own xwl_xy_to_window()
to fake a crossing to the root window when the pointer has left the
Wayland surface but is still within the xwindow.

But after an xwindow is unrealized, the last xwindow used to match the
xwindows is cleared so two consecutive calls to xwl_xy_to_window() may
not return the same xwindow.

To avoid this issue, update the last_xwindow based on enter and leave
notifications instead of xwl_xy_to_window(), and check if the xwindow
found by the regular miXYToWindow() is a child of the known last
xwindow, so that multiple consecutive calls to xwl_xy_to_window()
return the same xwindow, being either the one found by miXYToWindow()
or the root window.

Signed-off-by: Olivier Fourdan <ofourdan@xxxxxxxxxx>
Tested-by: Vít Ondruch <vondruch@xxxxxxxxxx>
Tested-by: Satish Balay <balay@xxxxxxxxxxx>
Reviewed-by: Jonas Ådahl <jadahl@xxxxxxxxx>
(cherry picked from commit 59ad0e6a416d8e23f9d962af67a16ee28ec7867b)

diff --git a/hw/xwayland/xwayland-input.c b/hw/xwayland/xwayland-input.c
index 4d0a457..ecf0b7a 100644
--- a/hw/xwayland/xwayland-input.c
+++ b/hw/xwayland/xwayland-input.c
@@ -318,6 +318,9 @@ pointer_handle_enter(void *data, struct wl_pointer *pointer,
dx = xwl_seat->focus_window->window->drawable.x;
dy = xwl_seat->focus_window->window->drawable.y;

+ /* We just entered a new xwindow, forget about the old last xwindow */
+ xwl_seat->last_xwindow = NullWindow;
master = GetMaster(dev, POINTER_OR_FLOAT);
(*pScreen->SetCursorPosition) (dev, pScreen, dx + sx, dy + sy, TRUE);

@@ -366,8 +369,14 @@ pointer_handle_leave(void *data, struct wl_pointer

xwl_seat->xwl_screen->serial = serial;

- xwl_seat->focus_window = NULL;
- CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+ /* The pointer has left a known xwindow, save it for a possible match
+ * in sprite_check_lost_focus()
+ */
+ if (xwl_seat->focus_window) {
+ xwl_seat->last_xwindow = xwl_seat->focus_window->window;
+ xwl_seat->focus_window = NULL;
+ CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+ }

static void
@@ -1258,10 +1267,10 @@ sprite_check_lost_focus(SpritePtr sprite, WindowPtr
if (master->lastSlave == xwl_seat->pointer &&
xwl_seat->focus_window == NULL &&
- xwl_seat->last_xwindow == window)
+ xwl_seat->last_xwindow != NullWindow &&
+ IsParent(xwl_seat->last_xwindow, window))
return TRUE;

- xwl_seat->last_xwindow = window;
return FALSE;

commit b711efb05714bf3d0a102c717a05cde4fefdae3f
Author: Olivier Fourdan <ofourdan@xxxxxxxxxx>
Date: Thu Nov 3 09:59:30 2016 +0100

glamor: restore vfunc handlers on init failure

In glamor_init(), if the minimum requirements are not met, glamor may
fail after setting up its own CloseScreen() and DestroyPixmap()
routines, leading to a crash when either of the two routines is called
if glamor failed to complete its initialization, e.g:

(EE) Backtrace:
(EE) 0: Xwayland (OsSigHandler+0x29)
(EE) 1: /lib64/ (__restore_rt+0x0)
(EE) 2: Xwayland (glamor_sync_close+0x2a)
(EE) 3: Xwayland (glamor_close_screen+0x52)
(EE) 4: Xwayland (CursorCloseScreen+0x88)
(EE) 5: Xwayland (AnimCurCloseScreen+0xa4)
(EE) 6: Xwayland (present_close_screen+0x42)
(EE) 7: Xwayland (dix_main+0x4f9)
(EE) 8: /lib64/ (__libc_start_main+0xf1)
(EE) 9: Xwayland (_start+0x2a)

Restore the previous CloseScreen() and DestroyPixmap() vfunc handlers in
case of failure when checking for the minimum requirements, so that if
any of the requirement is not met we don't leave the CloseScreen() and
DestroyPixmap() from glamor handlers in place.


Signed-off-by: Olivier Fourdan <ofourdan@xxxxxxxxxx>
Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Reviewed-by: Eric Anholt <eric@xxxxxxxxxx>
(cherry picked from commit f43207c1c4a8487600cf3ea116c10437417c861b)

diff --git a/glamor/glamor.c b/glamor/glamor.c
index b771832..c54cf3b 100644
--- a/glamor/glamor.c
+++ b/glamor/glamor.c
@@ -470,7 +470,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
"glamor%d: Failed to allocate screen private\n",
- goto fail;
+ goto free_glamor_private;

glamor_set_screen_private(screen, glamor_priv);
@@ -480,7 +480,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
"glamor%d: Failed to allocate pixmap private\n",
- goto fail;
+ goto free_glamor_private;

if (!dixRegisterPrivateKey(&glamor_gc_private_key, PRIVATE_GC,
@@ -488,7 +488,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
"glamor%d: Failed to allocate gc private\n",
- goto fail;
+ goto free_glamor_private;

glamor_priv->saved_procs.close_screen = screen->CloseScreen;
@@ -731,6 +731,11 @@ glamor_init(ScreenPtr screen, unsigned int flags)
return TRUE;

+ /* Restore default CloseScreen and DestroyPixmap handlers */
+ screen->CloseScreen = glamor_priv->saved_procs.close_screen;
+ screen->DestroyPixmap = glamor_priv->saved_procs.destroy_pixmap;
+ free_glamor_private:
glamor_set_screen_private(screen, NULL);
return FALSE;

commit 201ff45c2d7e6c7d73fd29d28871bb8b944074be
Author: Peter Hutterer <peter.hutterer@xxxxxxxxx>
Date: Fri Nov 11 15:28:50 2016 +1000

Xi: when creating a new master device, update barries for all clients

The previous code only worked when the barrier was created by the same
as the one calling XIChangeDeviceHierarchy.

Signed-off-by: Peter Hutterer <peter.hutterer@xxxxxxxxx>
Reviewed-by: Daniel Stone <daniels@xxxxxxxxxxxxx>
(cherry picked from commit d6a6e1d6abb110ff00ad31b94cd29d92ca7c71a5)

diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
index 8d5b577..f2b7785 100644
--- a/Xi/xichangehierarchy.c
+++ b/Xi/xichangehierarchy.c
@@ -194,7 +194,8 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int
flags[XTestptr->id] |= XISlaveAttached;
flags[XTestkeybd->id] |= XISlaveAttached;

Programming list archiving by: Enterprise Git Hosting