Bug 18882

Summary: xserver- server crash when processing event with more than 2 valuators
Product: xorg Reporter: Tom Jaeger <ThJaeger>
Component: Server/Input/CoreAssignee: Peter Hutterer <peter.hutterer>
Status: RESOLVED FIXED QA Contact: Xorg Project Team <xorg-team>
Severity: normal    
Priority: medium    
Version: git   
Hardware: Other   
OS: All   
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 17452    

Description Tom Jaeger 2008-12-03 22:15:30 UTC
Testing xserver- with the latest wacom driver (which needs a few trivial changes to compile), I get a server crash as soon as I try to use the pen.


(gdb) bt
#0  UpdateDeviceState (device=0x904a858, xE=0x9c63ae0, count=2)
    at ../../Xi/exevents.c:793
#1  0x08181665 in ProcessOtherEvent (xE=0x9c63ae0, device=0x904a858, count=2)
    at ../../Xi/exevents.c:982
#2  0x081a20bd in ProcessPointerEvent (xE=0x9c63ae0, mouse=0x904a858, count=2)
    at ../../xkb/xkbAccessX.c:723
#3  0x08111371 in mieqProcessInputEvents () at ../../mi/mieq.c:375
#4  0x080c09b7 in ProcessInputEvents ()
    at ../../../../hw/xfree86/common/xf86Events.c:174
#5  0x0808c95e in Dispatch () at ../../dix/dispatch.c:363
#6  0x080718ed in main (argc=10, argv=0xbfce2a94, envp=Cannot access memory at address 0xe
    at ../../dix/main.c:383
(gdb) print first + xV->num_valuators
$5 = 6
(gdb) print v->numAxes
$6 = 2
(gdb) print device->name
$7 = 0x9052850 "Virtual core pointer"
Comment 1 Peter Hutterer 2008-12-03 23:02:00 UTC
quick fix to stop the crash. Need to have a closer look tomorrow.

From 7dafc83481957c190ca7220736343717f45a1177 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@redhat.com>
Date: Thu, 4 Dec 2008 16:36:23 +1000
Subject: [PATCH] Xi: don't update VCP's valuators from DeviceValuator events #18882

The VCP doesn't need to update the valuators anyway since it cannot send XI
events. Just skip that bit.

X.Org Bug 18882 <http://bugs.freedesktop.org/show_bug.cgi?id=18882>
 Xi/exevents.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Xi/exevents.c b/Xi/exevents.c
index 00a6b21..8eef400 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -781,12 +781,14 @@ UpdateDeviceState(DeviceIntPtr device, xEvent* xE, int count)
     /* Update device axis */
-    for (i = 1; i < count; i++) {
+    /* Don't update valuators for the VCP, it never sends XI events anyway */
+    for (i = 1; !device->isMaster && i < count; i++) {
 	if ((++xV)->type == DeviceValuator) {
 	    int *axisvals;
             int first = xV->first_valuator;
             BOOL change = FALSE;
 	    if (xV->num_valuators &&
                 (!v || (xV->num_valuators &&
                       (first + xV->num_valuators > v->numAxes))))
@@ -1009,7 +1011,9 @@ ProcessOtherEvent(xEventPtr xE, DeviceIntPtr device, int count)
     /* Valuator event handling */
-    for (i = 1; i < count; i++) {
+    /* Don't care about valuators for the VCP, it never sends XI events */
+    for (i = 1; !device->isMaster && i < count; i++) {
 	if ((++xV)->type == DeviceValuator) {
 	    int first = xV->first_valuator;
 	    if (xV->num_valuators
Comment 2 Tom Jaeger 2008-12-04 00:14:28 UTC
Thanks for the quick reply.  This fixes the issue at hand.  Moving the pointer using the pen is working, now, but clicks are not reported for the VCP, even though they are reported for the stylus device.  I'll look into this tomorrow.
Comment 3 Peter Hutterer 2008-12-04 17:20:33 UTC
> --- Comment #2 from Tom Jaeger <ThJaeger@gmail.com>  2008-12-04 00:14:28 PST ---
> Thanks for the quick reply.  This fixes the issue at hand.  Moving the pointer
> using the pen is working, now, but clicks are not reported for the VCP, even
> though they are reported for the stylus device.  I'll look into this tomorrow.

just looked into that, the wacom driver posts the button index, not the button
number. So button 1 is posted as button 0 (and therefore ignored). I'm
surprised this worked with 1.5, tbh. Not sure what changed, there probably the
button map lookup.
Simply adding xf86PostButtonEvent(... button_idx + 1... ) fixes the issue.
Comment 4 Tom Jaeger 2008-12-04 23:32:27 UTC
Thanks.  Unfortunately, there are still issues with the wacom driver and the latest beta.  When I press the button, regular pointer event processing stops, but XInput events continue to work for a while, and then after a few more clicks, event processing comes completely to a halt.  In addition, the server log file is flooded with the following message:

[dix] XIGetDevice failed on XACE restrictions (148)

Weirdly enough, the stylus works fine under gdm.
Comment 5 Tom Jaeger 2008-12-07 13:37:20 UTC
The "[dix] XIGetDevice failed on XACE restrictions (148)" error message is caused by line 1078 in getevents.c:
        kbp->deviceid |= MORE_EVENTS;
dixLookupDevice in XIGetDevice (l. 155 in exevents.c) is then called with a non-existent device id.  Changing line 153 to
        id = ((deviceKeyButtonPointer*)xE)->deviceid & ~MORE_EVENTS;
fixes the error message for me, but unfortunately the problems with the wacom driver remain.
Comment 6 Peter Hutterer 2008-12-07 20:21:05 UTC
Pushed as 
commit 78a62d7713c708d067d8824ec41b0a0225c1997f
Author:     Tom Jaeger <ThJaeger@gmail.com>
Date: Mon Dec 8 11:38:12 2008 +1000

    Xi: XIGetDevice needs to ignore the MORE_EVENTS flag.
Comment 7 Peter Hutterer 2008-12-07 20:38:10 UTC
on my 1.6 branch the tablet now appears to work fine. Thats after
cherry-picking 725eec9ffcdbb19b dix: fix calculation of valuator events in
addition to the two patches here.

I still notice two behaviours: every so often the XI coordinates jump back to
the upper left corner, and there's something that can screw the device's
state, so it doesn't paint but always attempts to move the canvas. I haven't
been able to figure out the source for either problem yet.
Comment 8 Tom Jaeger 2008-12-07 21:20:48 UTC
Thanks, this is working great now.
Comment 9 Peter Hutterer 2008-12-07 21:51:50 UTC
Closing this bug for now, please reopen if you find more issues.
Comment 10 Peter Hutterer 2008-12-14 14:48:17 UTC
Reopening bug, was closed prematurely. Added as 1.6 blocker, will be closed when patch is in 1.6 branch.
Comment 11 Peter Hutterer 2008-12-17 19:47:04 UTC
Patch was merged into server-1.6-branch. Closing


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.