This fixes a use-after-free in the Sway patch to filter the Xwayland
shell [1].
The server is destroyed first, then the shell. The Xwayland process
might still be using the shell while running.
When the shell is destroyed, libwayland will invoke the global
filter (to figure out whether to send a wl_registry.global_remove
to clients). Then Sway will compare the client with
wlr_xwayland_server.client. However, at that point, the server is
gone.
Reset the server to NULL so that Sway can check whether the server
is still running.
[1]: https://github.com/swaywm/sway/pull/7647
We'll soon introduce a unified wlr_surface map event. Up until now, compositors
have been using wlr_xwayland_surface's map event to setup various wlr_surface
related listeners (e.g. commit). This will no longer be possible when that
event is moved over to wlr_surface. Introduce new events where the compositor
can add/remove wlr_surface event listeners.
X11 clients expect a ConfigureNotify after a ConfigureRequest. If
the compositor/window manager chooses not to honor the request
(e.g. due to the window being maximized), XWayland will not send a
"real" ConfigureNotify event and the window manager is expected to
send a synthetic event instead. Otherwise, the X11 client is left
waiting and may not repaint its window properly.
For comparison, see Openbox's client_configure() or Weston's
weston_wm_window_send_configure_notify().
v2: Move logic to wlr_xwayland_surface_configure()
This is needed for compositors that want to reserve space for
XWayland panels. Such a feature can be useful in a "transitional"
setup, where only the X11 window manager and compositor is replaced
but other components of an X11 desktop environment are still used.
This change simply reads the X11 property; the compositor is free
to ignore it. Thus, compositors that don't want to support such a
"transitional" feature are not impacted.
v2: Update xwayland_surface_associate()
If a window is unmapped too quickly, we might receive UnmapNotify before
we get the corresponding wl_surface, which will later lead to
associating the same window twice. To fix this, move the NULL surface
check to xwayland_surface_dissociate(), which makes resetting the
unpaired link and the wl_surface object ID unconditional.
Fixes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3552
The dep allows us to check dep variables to discover supported
features. With the binary we assume none of the features are
supported. If a user forgets to install the pkg-config file (e.g.
because it's in a split package) we end up incorrectly disabling
all features. Instead let's error out.
Rename xwm_map_shell_surface() to xwayland_surface_associate().
This function doesn't actually "map" the surface in Wayland
parlance, the wl_surface may not have a buffer attached yet.
This can be used to know when wlr_xwayland_server decides to start
a new Xwayland process. At that point the wl_client has already
been created but the Xwayland process hasn't been started yet.
Always keep it initialized, so that we don't have to check for
xsurface->surface_id.
Will help with WL_SURFACE_SERIAL support, which adds a new way for
a surface to be unpaired.
This allows whatever the user calls from the signal handlers to react to observe
the new state rather than the old, e.g. that a surface is no longer mapped in
the unmap handler.
The original commit introduced a bug by transposing the order of
some of the fields in xcb_size_hints_t. Since XCB ICCCM support is
required now, we can just eliminate the duplicate structs.
With minor changes:
- Remove #ifdef HAS_XCB_ICCCM guards
- Fix #includes
- Fix references to local size_hints struct
This reverts commit 12b9b1a4bd.
Using Xwayland -displayfd means we don't need to worry about handling
SIGUSR1 to second guess when Xwayland is ready and write to the pipe:
just let it do that write when it would be sending SIGUSR1 otherwise.
Closes: #3356
A launchee notifies with a "remove"¹ message when done starting up.
Catch these and forward to the compositor. This allows the compositor to
end the startup sequence that might have been started by another
protocol like xdg-activation.
We don't handle other messages since we expect the launcher to use a
wayland protocol like xdg-activation.
While `_NET_STARTUP_ID` helps to associate toplevels with startup-ids
this signals the end of the startup sequence.
1) https://specifications.freedesktop.org/startup-notification-spec/startup-notification-latest.txt
Currently, upon activating a surface, wlroots restacks it on top of all
others.
This may not necessarily be correct from the calling compositor's point
of view, where having focus may not imply being top-of-stack (e.g.,
focusing a window under an always-on-top window).
In Sway's case, this means that focused tiling windows will always be on
top of floating windows, at least in the order communicated to X11 apps.
This breaks drag-and-drop from a focused tiling X11 window to a floating
X11 window which partially obscures the former.
This is a breaking change; to retain the previous behavior, users that
were calling
wlr_xwayland_surface_activate(xsurface, true);
should now be calling
wlr_xwayland_surface_activate(xsurface, true);
wlr_xwayland_surface_restack(xsurface, NULL, XCB_STACK_MODE_ABOVE);
As more options are added, more fields will be duplicated. Let's
just embed the struct in wlr_xwayland_server so that we don't need
to keep both in sync.
This property is present on all modern X11 instances. The nonpresence of
it requires applications to fall back to XQueryTree-based logic to
determine stacking logic (e.g., to determine what surface should get
Xdnd events).
These code paths are effectively untested nowadays, so this makes it
more likely for wlroots to "break" applications. For instance, the
XQueryTree fallback path has been broken in Chromium for the last 10
years.
It's easy enough to maintain this property, so let's just do it.
Fixes#2889.
eec2e1d3b1 introduced logic to use the Xwayland
binary discovered via pkg-config.
While the newly introduced checks correctly used the binary from pkg-config,
the actual execution still used the previous PATH-search logic.
`_NET_WM_PID` is unreliable: it is optional and even if set it may
contain PIDs from sandbox namespaces or remote systems.
Prefer XRes v1.2 QueryClientIds method which returns PIDs as seen by the
Xwayland server.
wlroots' dependency on this library doesn't change the features
exposed to compositors. It's purely a wlroots implementation detail.
Thus downstream compositors shouldn't really care about it.
Introduce an "internal_features" dictionary to store the status of
such internal dependencies.
This dependency is already required by many other widely used X11
programs, such as i3, Qt, and other XWMs. So it should be available
on most systems.
X11 support can be pretty broken without xcb-icccm, with focus issues
for instance. Let's just remove this --please-break-my-desktop footgun
option.
Some X11 clients (e.g. Chromium, sxiv) don't set WM_HINTS. The spec
says:
> Window managers are free to assume convenient values for all fields of the
> WM_HINTS property if a window is mapped without one.
Our wlr_xwayland_icccm_input_model function assumes missing WM_HINTS
means the window doesn't want input, but this is incorrect. Assume the
window wants input unless it explicitly opts-out by setting WM_HINTS.
Closes: https://github.com/swaywm/sway/issues/6107
Instead of walking PATH like a previous proposal [1], this one
checks that the Xwayland path specified in the pkg-config file
exists.
I think this is a reasonable compromise:
- Users that don't have Xwayland installed system-wide won't get
a bogus DISPLAY env variable set up.
- Users that have WLR_XWAYLAND set won't be affected by this check.
- Users that have Xwayland installed system-wide and a different
Xwayland in their PATH still get their custom Xwayland.
- Users that don't have Xwayland installed system-wide but have it
somewhere else in PATH are left out. But this is pretty niche,
and they can just set WLR_XWAYLAND.
[1]: https://github.com/swaywm/wlroots/pull/2314
Check that the pkg-config file is available. This will be required
in the future to check whether xwayland supports features such as
-listenfd, -initfd or -verbose.
If there's no pkg-config file, check that the Xwayland executable
is available.
This effectively makes our relationship with xwayland closer to what
a dynamic library is: checked at build-time, but can be overridden
at run-time.
Our internal state machine gets screwed up if selection events are not
monotonically increasing in time, and we can enter a self-copy loop from
the proxy window that exhausts all pipes.
Snippet of logs when this occurs:
00:00:46.238 [wlr] [xwayland/selection/incoming.c:487] XCB_XFIXES_SELECTION_NOTIFY (selection=277, owner=4194626)
00:00:46.238 [wlr] [xwayland/selection/incoming.c:487] XCB_XFIXES_SELECTION_NOTIFY (selection=277, owner=2097153)
00:00:46.238 [wlr] [xwayland/selection/outgoing.c:378] XCB_SELECTION_REQUEST (time=58979563 owner=2097153, requestor=2097153 selection=277, target=279, property=278)
00:00:46.238 [wlr] [xwayland/selection/outgoing.c:397] ignoring old request from timestamp 58979563; expecting > 58979563
00:00:46.238 [wlr] [xwayland/selection/outgoing.c:29] SendEvent destination=2097153 SelectionNotify(31) time=58979563 requestor=2097153 selection=277 target=279 property=0
00:00:46.238 [wlr] [xwayland/selection/incoming.c:453] XCB_SELECTION_NOTIFY (selection=277, property=0, target=279)
Note that 2097153 is `selection->window`, and 4194626 is Emacs.
The race occurs if the selection owner changes back to our proxy window
between when we get `XCB_XFIXES_SELECTION_NOTIFY` for Emacs and when we
call `xcb_convert_selection` in `incoming.c:source_send` -- the
ConvertSelection request can end up hitting our proxy window, but the
timestamp will be rejected.
Fixes#2192.
There seems to be no reason why we can't service multiple Wayland-to-X11
transfers concurrently, so long as they are to different windows (or
possibly, same windows but different target properties?)
This commit removes the queuing logic, but retains the request
de-duplication from #2428.
Previously, the clipboard and primary selections shared the same window.
This was racey, and could have led to pasting failures.
On xfixes selection owner change notification, the logic for requesting
the supported mimetypes of the new owner's selection looks like:
xcb_convert_selection(
xwm->xcb_conn,
selection->window,
selection->atom,
xwm->atoms[TARGETS],
xwm->atoms[WL_SELECTION],
selection->timestamp
);
This means ask the selection owner to write its TARGETS for the
`selection->atom` selection (one of PRIMARY, CLIPBOARD, DND_SELECTION)
to `selection->window`'s WL_SELECTION atom.
However, `selection->window` is shared for both PRIMARY and CLIPBOARD
selections, and WL_SELECTION is used as the target atom in both cases.
So, there's a race when both selections change at the same time.
The CLIPBOARD selection might support mimetypes {A, B, C}, and the
PRIMARY only {A, B}. If the ConvertSelection requests/responses "cross
on the wire", so to speak, wlroots can end up believing that the PRIMARY
selection also supports C.
A Wayland client may then ask for the PRIMARY selection in C format,
which will fail with "convert selection failed".
This commit fixes this by using a separate window for PRIMARY and
CLIPBOARD target requests, so that WL_SELECTION can be used as the
target atom in both cases.
This commit introduces logic for using a new X11 window for each
incoming transfer, rather than having a global window for each selection
source.
This eliminates a whole class of bugs involving multiple concurrent
incoming transfers.
For now, we retain the outgoing transfer queue, and the selection
source-specific windows to support it. Source-specific windows are no
longer used in the incoming path, and will be removed in a future PR.
Refs #1497.
Previously, Xwayland could restart, and we'd get events for transfers
pointing to the previous (now freed) xwm instance. This led to
use-after-free segfaults.
Closes#2565.
This will hopefully be fixed in the future by having separate windows
for each X11-to-Wayland transfer, but until then, let's avoid a
compositor crash.
Previously, `transfer->incr` was being cleared on the next selection.
However, if the next selection was *also* incremental, it's possible
that `xwm_handle_selection_property_notify` would route us to
`xwm_get_incr_chunk` instead of `xwm_selection_get_data`.
Apart from reducing duplication, this has the positive side-effect of
allowing all deallocs to use
`xwm_selection_transfer_destroy_property_reply`, as opposed to the
latter and a mix of ad-hoc `free`s.
Previously, if the Wayland client died before an incremental transfer
was complete, the logs would be spammed by "write error to target fd" as
wlroots entered some control flow wherein it'd continually try
scheduling further writes to the already-dead pipe.
This commit contains no behavioral changes, but introduces explicit
handling for draining the X11 selection in case of Wayland client death.
If `xwm_data_source_write` failed, it's failed permanently. In fact, a
failing `xwm_data_source_write` sets `transfer->property_reply` to
null as part of its error handling.
Instead of relying on an indirect check (whether
`transfer->property_reply` is still non-null), explicitly use the return
value from `xwm_data_source_write`.
The `fd` is marked `O_NONBLOCK`, so `write` will never spuriously return
`EINTR`. Therefore, `write` failing is permanent, and we can return 0 to
make the return value meaningful.
wlroots would log "Unhandled NET_WM_STATE property change" log
messages for atoms we know about. Simplify the code structure
and remove these extra messages.
Previously, wlr_xwm_selection_transfer.source_fd meant:
- the source of data in a Wayland -> X11 copy (good)
- the destination of data in a X11 -> Wayland copy (confusing)
This made reading through xwayland/selection/incoming.c difficult: in
many places, "source" actually means "destination".
Previously, any error would be masked by an internal isatty call:
24:31:48.174 [DEBUG] [wlr] [xwayland/selection/incoming.c:386] XCB_SELECTION_NOTIFY (selection=277, property=278, target=256)
24:31:48.174 [ERROR] [wlr] [xwayland/selection/incoming.c:30] write error to target fd: Inappropriate ioctl for device
Kirill Primak
Simon Ser
novenary
John Lindgren
Alexander Orzechowski
Kenny Levinsen
Joshua Ashton
zsugabubus
Dominique Martinet
Guido Günther
Tudor Brindus
Michele Sorcinelli
Thomas Weißschuh
Aleksei Bavshin
Ryan Farley
Isaac Freund
Ilia Mirkin
Manuel Stoeckl