Linux: uinput keyboard repeat thread can re-press a just-released key, leaving it stuck down #197

// Replica of libvirtualhid's Linux UinputKeyboard (ecc8291 / dfff3ea,
// src/platform/linux/uhid_backend.cpp): submit() = emit, then update
// pressed_keys_; repeat thread = every 50 ms, snapshot pressed_keys_, emit a
// press for each, with no lock held across snapshot -> emit. Writes take a
// per-write mutex like UinputDevice::emit_event().
// Mode "lvh": as upstream.  "norepeat": repeat thread off.  "fixed": emit and
// bookkeeping under one lock, repeat re-checks membership under that lock.
// The test device is EVIOCGRAB'd so no event reaches the compositor.
#include <linux/uinput.h>
#include <linux/input.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <atomic>
#include <chrono>
#include <cstdio>
#include <cstring>
#include <mutex>
#include <set>
#include <string>
#include <thread>
#include <vector>

static int ufd;
static std::mutex mtx;
static std::set<int> pressed;
static std::string mode;

static std::mutex write_mtx;  // UinputDevice::write_mutex_, held per write

static void write_event(int type, int code, int value) {
  std::lock_guard l {write_mtx};
  input_event ev {};
  ev.type = type; ev.code = code; ev.value = value;
  if (write(ufd, &ev, sizeof ev) < 0) perror("write");
}

static void emit(int code, int value) {
  // upstream emit_keyboard_event(): emit_event(EV_KEY) then sync(), each a separately locked write
  write_event(EV_KEY, code, value);
  write_event(EV_SYN, SYN_REPORT, 0);
}

static void submit(int code, bool down) {
  if (mode == "fixed") {
    std::lock_guard l {mtx};
    emit(code, down);
    if (down) pressed.insert(code); else pressed.erase(code);
    return;
  }
  emit(code, down);                       // emit_keyboard_event(event)
  std::lock_guard l {mtx};                // update_pressed_keys(event)
  if (down) pressed.insert(code); else pressed.erase(code);
}

int main(int argc, char **argv) {
  mode = argc > 1 ? argv[1] : "lvh";
  double seconds = argc > 2 ? atof(argv[2]) : 5;
  ufd = open("/dev/uinput", O_WRONLY | O_NONBLOCK);
  if (ufd < 0) { perror("/dev/uinput"); return 2; }
  ioctl(ufd, UI_SET_EVBIT, EV_KEY);
  ioctl(ufd, UI_SET_KEYBIT, KEY_F);
  uinput_setup us {};
  us.id.bustype = BUS_VIRTUAL;
  strcpy(us.name, "tc-lvh-race-test");
  ioctl(ufd, UI_DEV_SETUP, &us);
  ioctl(ufd, UI_DEV_CREATE);
  char sys[64] {};
  ioctl(ufd, UI_GET_SYSNAME(sizeof sys), sys);
  // find /dev/input/eventN for /sys/devices/virtual/input/<sys>
  int efd = -1;
  for (int tries = 0; tries < 200 && efd < 0; ++tries) {
    for (int n = 0; n < 512 && efd < 0; ++n) {
      std::string link = "/sys/devices/virtual/input/" + std::string(sys) + "/event" + std::to_string(n);
      if (access(link.c_str(), F_OK) == 0) {
        std::string dev = "/dev/input/event" + std::to_string(n);
        efd = open(dev.c_str(), O_RDONLY | O_NONBLOCK);
      }
    }
    if (efd < 0) std::this_thread::sleep_for(std::chrono::milliseconds(5));
  }
  if (efd < 0 || ioctl(efd, EVIOCGRAB, 1) != 0) { perror("grab"); return 2; }

  std::atomic_bool run {true};
  std::thread rep;
  if (mode != "norepeat") {
    rep = std::thread([&] {
      while (run) {
        std::this_thread::sleep_for(std::chrono::milliseconds(50));
        if (mode == "fixed") {
          std::lock_guard l {mtx};
          for (int k : pressed) emit(k, 1);
          continue;
        }
        std::vector<int> snap;
        { std::lock_guard l {mtx}; snap.assign(pressed.begin(), pressed.end()); }  // pressed_keys_snapshot()
        for (int k : snap) emit(k, 1);    // emit_keyboard_event({key, pressed=true})
      }
    });
  }

  unsigned char bits[KEY_MAX / 8 + 1];
  long cycles = 0, stuck = 0;
  auto end = std::chrono::steady_clock::now() + std::chrono::duration<double>(seconds);
  while (std::chrono::steady_clock::now() < end) {
    submit(KEY_F, true);
    submit(KEY_F, false);
    ++cycles;
    ioctl(efd, EVIOCGKEY(sizeof bits), bits);
    if (bits[KEY_F / 8] & (1 << (KEY_F % 8))) {
      bool tracked; { std::lock_guard l {mtx}; tracked = pressed.count(KEY_F); }
      if (!tracked) ++stuck;              // kernel: down; library: released
    }
  }
  run = false;
  if (rep.joinable()) rep.join();
  submit(KEY_F, false);                   // leave nothing held
  ioctl(efd, EVIOCGRAB, 0);
  close(efd);
  ioctl(ufd, UI_DEV_DESTROY);
  close(ufd);
  printf("%-9s %.0fs: %ld press/release cycles, %ld times KEY_F left down in the kernel with the library tracking it as released\n",
         mode.c_str(), seconds, cycles, stuck);
}