Merge into development-branch : trusted

Status:	Merged
Approved by:	kevin gunn on 2014-06-16
Approved revision:	no longer in the source branch.
Merged at revision:	1701
Proposed branch:	lp:~mir-team/mir/trusted_sessions
Merge into:	lp:mir
Diff against target:	6122 lines (+4349/-363) 87 files modified examples/CMakeLists.txt (+6/-2) examples/demo-inprocess-surface-client/inprocess_egl_client.cpp (+1/-1) examples/prompt_session.c (+231/-0) include/client/mir_toolkit/mir_connection.h (+0/-20) include/client/mir_toolkit/mir_prompt_session.h (+87/-0) include/server/mir/default_server_configuration.h (+6/-0) include/server/mir/frontend/prompt_session.h (+48/-0) include/server/mir/frontend/session_mediator_report.h (+9/-1) include/server/mir/frontend/shell.h (+10/-0) include/server/mir/scene/null_prompt_session_listener.h (+40/-0) include/server/mir/scene/prompt_session.h (+37/-0) include/server/mir/scene/prompt_session_creation_parameters.h (+36/-0) include/server/mir/scene/prompt_session_listener.h (+52/-0) include/server/mir/scene/prompt_session_manager.h (+110/-0) include/server/mir/scene/session.h (+3/-0) include/server/mir/shell/session_coordinator_wrapper.h (+14/-0) include/shared/mir_toolkit/client_types.h (+28/-2) include/shared/mir_toolkit/common.h (+6/-0) include/shared/mir_toolkit/event.h (+10/-1) include/test/mir_test/test_protobuf_client.h (+17/-0) include/test/mir_test_doubles/mock_prompt_session_listener.h (+48/-0) include/test/mir_test_doubles/mock_scene_session.h (+3/-0) include/test/mir_test_doubles/mock_shell.h (+12/-0) include/test/mir_test_doubles/null_client_event_sink.h (+42/-0) include/test/mir_test_doubles/null_prompt_session.h (+37/-0) include/test/mir_test_doubles/null_prompt_session_manager.h (+82/-0) include/test/mir_test_doubles/stub_scene_session.h (+14/-1) include/test/mir_test_doubles/stub_shell.h (+19/-0) src/client/CMakeLists.txt (+4/-1) src/client/connection_configuration.h (+4/-0) src/client/default_connection_configuration.cpp (+20/-1) src/client/default_connection_configuration.h (+4/-0) src/client/event_distributor.h (+37/-0) src/client/event_handler_register.h (+47/-0) src/client/event_sink.h (+44/-0) src/client/mir_connection.cpp (+9/-36) src/client/mir_connection.h (+5/-8) src/client/mir_connection_api.cpp (+0/-18) src/client/mir_event_distributor.cpp (+56/-0) src/client/mir_event_distributor.h (+43/-0) src/client/mir_prompt_session.cpp (+203/-0) src/client/mir_prompt_session.h (+94/-0) src/client/mir_prompt_session_api.cpp (+118/-0) src/client/rpc/make_rpc_channel.h (+3/-1) src/client/rpc/make_socket_rpc_channel.cpp (+4/-3) src/client/rpc/mir_socket_rpc_channel.cpp (+26/-7) src/client/rpc/mir_socket_rpc_channel.h (+6/-2) src/server/default_server_configuration.cpp (+11/-0) src/server/frontend/protobuf_message_processor.cpp (+15/-3) src/server/frontend/session_mediator.cpp (+91/-6) src/server/frontend/session_mediator.h (+23/-6) src/server/report/logging/session_mediator_report.cpp (+15/-0) src/server/report/logging/session_mediator_report.h (+6/-0) src/server/report/lttng/session_mediator_report.cpp (+11/-0) src/server/report/lttng/session_mediator_report.h (+3/-0) src/server/report/lttng/session_mediator_report_tp.h (+21/-0) src/server/report/null/session_mediator_report.cpp (+12/-0) src/server/report/null/session_mediator_report.h (+6/-0) src/server/scene/CMakeLists.txt (+2/-0) src/server/scene/application_session.cpp (+21/-0) src/server/scene/application_session.h (+3/-0) src/server/scene/default_configuration.cpp (+15/-1) src/server/scene/prompt_session_container.cpp (+189/-0) src/server/scene/prompt_session_container.h (+158/-0) src/server/scene/prompt_session_manager_impl.cpp (+232/-0) src/server/scene/prompt_session_manager_impl.h (+96/-0) src/server/scene/session_manager.cpp (+47/-3) src/server/scene/session_manager.h (+14/-2) src/server/shell/session_coordinator_wrapper.cpp (+28/-2) src/shared/protobuf/mir_protobuf.proto (+15/-4) tests/acceptance-tests/CMakeLists.txt (+1/-1) tests/acceptance-tests/test_nested_mir.cpp (+3/-0) tests/acceptance-tests/test_prompt_session_client_api.cpp (+421/-0) tests/acceptance-tests/test_trust_session_helper.cpp (+0/-218) tests/integration-tests/frontend/test_application_mediator_report.cpp (+181/-0) tests/integration-tests/test_session_manager.cpp (+3/-1) tests/mir_test_doubles/test_protobuf_client.cpp (+27/-1) tests/unit-tests/client/CMakeLists.txt (+2/-0) tests/unit-tests/client/test_event_distributor.cpp (+152/-0) tests/unit-tests/client/test_mir_prompt_session.cpp (+233/-0) tests/unit-tests/frontend/stress_protobuf_communicator.cpp (+4/-1) tests/unit-tests/frontend/test_session_mediator.cpp (+4/-4) tests/unit-tests/scene/CMakeLists.txt (+2/-0) tests/unit-tests/scene/test_application_session.cpp (+45/-0) tests/unit-tests/scene/test_prompt_session_container.cpp (+273/-0) tests/unit-tests/scene/test_prompt_session_manager.cpp (+217/-0) tests/unit-tests/scene/test_session_manager.cpp (+12/-5)
To merge this branch:	bzr merge lp:~mir-team/mir/trusted_sessions
Related bugs:	Link a bug report

Reviewer	Review Type	Date Requested	Status
PS Jenkins bot (community)	continuous-integration	2014-05-28	Approve on 2014-06-16
Alan Griffiths			Abstain on 2014-06-16
Alexandros Frantzis (community)		2014-05-28	Approve on 2014-06-16
Cemil Azizoglu (community)			Approve on 2014-06-16
Kevin DuBois (community)			Needs Information on 2014-06-03
Daniel van Vugt		2014-05-28	Pending
Review via email: mp+221191@code.launchpad.net

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-23: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1722/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-23: Posted in a previous version of this proposal

#

The tests that fail shouldn't have been affected: triggering a rebuild.

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-23: Posted in a previous version of this proposal

#

3072 + typedef enum {
3073 + HelperSession,
3074 + TrustedSession,
3075 + } TrustType;

http://unity.ubuntu.com/mir/cppguide/index.html?showone=Enumerator_Names#Enumerator_Names

review: Needs Fixing

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-23: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1723/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-25: Posted in a previous version of this proposal

#

[ FAILED ] 9 tests, listed below:
[ FAILED ] TestClientInput.clients_receive_key_input
[ FAILED ] TestClientInput.clients_receive_us_english_mapped_keys
[ FAILED ] TestClientInput.clients_receive_motion_inside_window
[ FAILED ] TestClientInput.clients_receive_button_events_inside_window
[ FAILED ] TestClientInput.multiple_clients_receive_motion_inside_windows
[ FAILED ] TestClientInput.clients_do_not_receive_motion_outside_input_region
[ FAILED ] TestClientInput.scene_obscure_motion_events_by_stacking
[ FAILED ] TestClientInput.hidden_clients_do_not_receive_pointer_events
[ FAILED ] TestClientInput.clients_receive_motion_within_co_ordinate_system_of_window

I still don't see how these tests are broken by this MP (and just on g++/utopic/armhf too!)

But it's Sunday so I'm leaving the tests running (on my trusty laptop) to see if I can reproduce while I go for a walk.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-25: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1725/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-25: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1726/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-26: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1727/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-27: Posted in a previous version of this proposal

#

FAILED: Continuous integration, rev:1521
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1732/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/332
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/333
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/330/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/251/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/250
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/250/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/931/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1732/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1734/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-27: Posted in a previous version of this proposal

#

A different (probably unrelated) failure.

[----------] 5 tests from ServerShutdown/OnSignal (1604 ms total)

[----------] Global test environment tear-down
[==========] 92 tests from 22 test cases ran. (184934 ms total)
[ PASSED ] 92 tests.

YOU HAVE 11 DISABLED TESTS

==12239==
==12239== HEAP SUMMARY:
==12239== in use at exit: 4,359 bytes in 18 blocks
==12239== total heap usage: 233,099 allocs, 233,081 frees, 12,409,967 bytes allocated
==12239==
==12239== 744 (120 direct, 624 indirect) bytes in 1 blocks are definitely lost in loss record 15 of 17
==12239== at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12239== by 0x56FD701: std::_Function_handler<std::shared_ptr<mir::client::EventDistributor> (), mir::client::DefaultConnectionConfiguration::the_event_distributor()::{lambda()#1}>::_M_invoke(std::_Any_data const&) (new_allocator.h:104)
==12239== by 0x56FDCD6: mir::client::DefaultConnectionConfiguration::the_event_distributor() (functional:2471)
==12239== by 0x57012CF: std::_Function_handler<std::shared_ptr<google::protobuf::RpcChannel> (), mir::client::DefaultConnectionConfiguration::the_rpc_channel()::{lambda()#1}>::_M_invoke(std::_Any_data const&) (default_connection_configuration.cpp:86)
==12239== by 0x56FFE86: mir::client::DefaultConnectionConfiguration::the_rpc_channel() (functional:2471)
==12239== by 0x56E30BC: MirConnection::MirConnection(mir::client::ConnectionConfiguration&) (mir_connection.cpp:87)
==12239== by 0x56E5AE5: (anonymous namespace)::mir_default_connect(char const*, char const*, void (*)(MirConnection*, void*), void*) (mir_connection_api.cpp:76)
==12239== by 0x56E6484: mir_connect (mir_connection_api.cpp:133)
==12239== by 0x56E64F5: mir_connect_sync (mir_connection_api.cpp:149)
==12239== by 0x682752: mir_test_framework::BasicClientServerFixture<mir_test_framework::StubbedServerConfiguration>::SetUp() (basic_client_server_fixture.h:40)
==12239== by 0x832042: void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (gtest.cc:2078)
==12239== by 0x8251BD: testing::Test::Run() (gtest.cc:2146)
==12239==
==12239== LEAK SUMMARY:
==12239== definitely lost: 120 bytes in 1 blocks
==12239== indirectly lost: 624 bytes in 3 blocks
==12239== possibly lost: 34 bytes in 1 blocks
==12239== still reachable: 3,581 bytes in 13 blocks
==12239== suppressed: 0 bytes in 0 blocks
==12239== Reachable blocks (those to which a pointer was found) are not shown.
==12239== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==12239==
==12239== For counts of detected and suppressed errors, rerun with: -v
==12239== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

I'm going to resubmit with the pre-req on lp:~alan-griffiths/mir/remove-process-compexity-from-TestClientInput to reduce the diff while I look into this.

A different (probably unrelated) failure.

[----------] 5 tests from ServerShutdown/OnSignal (1604 ms total)

[----------] Global test environment tear-down
[==========] 92 tests from 22 test cases ran. (184934 ms total)
[  PASSED  ] 92 tests.

YOU HAVE 11 DISABLED TESTS

==12239== 
==12239== HEAP SUMMARY:
==12239==     in use at exit: 4,359 bytes in 18 blocks
==12239==   total heap usage: 233,099 allocs, 233,081 frees, 12,409,967 bytes allocated
==12239== 
==12239== 744 (120 direct, 624 indirect) bytes in 1 blocks are definitely lost in loss record 15 of 17
==12239==    at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12239==    by 0x56FD701: std::_Function_handler<std::shared_ptr<mir::client::EventDistributor> (), mir::client::DefaultConnectionConfiguration::the_event_distributor()::{lambda()#1}>::_M_invoke(std::_Any_data const&) (new_allocator.h:104)
==12239==    by 0x56FDCD6: mir::client::DefaultConnectionConfiguration::the_event_distributor() (functional:2471)
==12239==    by 0x57012CF: std::_Function_handler<std::shared_ptr<google::protobuf::RpcChannel> (), mir::client::DefaultConnectionConfiguration::the_rpc_channel()::{lambda()#1}>::_M_invoke(std::_Any_data const&) (default_connection_configuration.cpp:86)
==12239==    by 0x56FFE86: mir::client::DefaultConnectionConfiguration::the_rpc_channel() (functional:2471)
==12239==    by 0x56E30BC: MirConnection::MirConnection(mir::client::ConnectionConfiguration&) (mir_connection.cpp:87)
==12239==    by 0x56E5AE5: (anonymous namespace)::mir_default_connect(char const*, char const*, void (*)(MirConnection*, void*), void*) (mir_connection_api.cpp:76)
==12239==    by 0x56E6484: mir_connect (mir_connection_api.cpp:133)
==12239==    by 0x56E64F5: mir_connect_sync (mir_connection_api.cpp:149)
==12239==    by 0x682752: mir_test_framework::BasicClientServerFixture<mir_test_framework::StubbedServerConfiguration>::SetUp() (basic_client_server_fixture.h:40)
==12239==    by 0x832042: void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (gtest.cc:2078)
==12239==    by 0x8251BD: testing::Test::Run() (gtest.cc:2146)
==12239== 
==12239== LEAK SUMMARY:
==12239==    definitely lost: 120 bytes in 1 blocks
==12239==    indirectly lost: 624 bytes in 3 blocks
==12239==      possibly lost: 34 bytes in 1 blocks
==12239==    still reachable: 3,581 bytes in 13 blocks
==12239==         suppressed: 0 bytes in 0 blocks
==12239== Reachable blocks (those to which a pointer was found) are not shown.
==12239== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==12239== 
==12239== For counts of detected and suppressed errors, rerun with: -v
==12239== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

I'm going to resubmit with the pre-req on lp:~alan-griffiths/mir/remove-process-compexity-from-TestClientInput to reduce the diff while I look into this.

Revision history for this message

Andreas Pokorny (andreas-pokorny) wrote on 2014-05-27: Posted in a previous version of this proposal

#

First run - not understanding the details completely yet - but here are some nits from the first read:

+ 1163 authored by Alexandros?

+ 1678 , 3314 egyptian style braces

+ 1763 std::string error not used
+ 1764ff why not just call set_state( session.has_error() ? ... )

+ 3160, 3122 style guide

+ 2901 ", "
+ 2991,3012 tsit->second should be easier to

+ 2881 uint?

+ 3294 why the class scope

+ 3495 add_add?

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1738/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-27: Posted in a previous version of this proposal

#

OK, tracked down the leaky test...

$ valgrind bin/mir_acceptance_tests --gtest_filter=TrustSessionClientAPI.can_start_and_stop_a_trust_session
==10781== Memcheck, a memory error detector
==10781== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==10781== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==10781== Command: bin/mir_acceptance_tests --gtest_filter=TrustSessionClientAPI.can_start_and_stop_a_trust_session
==10781==
Running main() from command_line_server_configuration.cpp
Note: Google Test filter = TrustSessionClientAPI.can_start_and_stop_a_trust_session
[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from TrustSessionClientAPI
[ RUN ] TrustSessionClientAPI.can_start_and_stop_a_trust_session
[ OK ] TrustSessionClientAPI.can_start_and_stop_a_trust_session (1106 ms)
[----------] 1 test from TrustSessionClientAPI (1120 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test case ran. (1168 ms total)
[ PASSED ] 1 test.
==10781==
==10781== HEAP SUMMARY:
==10781== in use at exit: 4,359 bytes in 18 blocks
==10781== total heap usage: 7,096 allocs, 7,078 frees, 454,206 bytes allocated
==10781==
==10781== LEAK SUMMARY:
==10781== definitely lost: 120 bytes in 1 blocks

review: Needs Fixing

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-05-27: Posted in a previous version of this proposal

#

343 + * \param [in] start_callback The function to be called when the trust session event occurs

s/event_callback/
s/the trusted session event/a trusted session event/ ?

338 + * Create an new trust session
347 +MirWaitHandle *mir_connection_start_trust_session(MirConnection* connection,

Do we 'create' a new trust session or 'start' it? (also see the last note in this comment).

376 +MirWaitHandle *mir_trust_session_add_trusted_session(MirTrustSession *trust_session,
377 + pid_t session_pid,
378 + mir_trust_session_add_trusted_session_callback callback,
379 + void* context);
... and in other functions

Inconsistent '*' placement (void* vs MirTrustSession *trust_session).

379 + void* context);

Missing \param.

374 + * \return A MirTrustSessionAddTrustResult result of the call

Erroneous comment: function returns MirWaitHandle*

385 + * \return A MirTrustSessionAddTrustResult result of the call

Erroneous comment: function returns MirBool

390 +/**
391 + * Request the cancellation of a trust session
392 + * \param [in] trust_session The trust session
393 + * \return True if the request was made successfully,
394 + * false otherwise
395 + */

Missing \params, erroneous \return.

417 +void mir_trust_session_release(MirTrustSession* trust_session);

Why do we have 'release' as a separate step from 'stop'? I don't see a way to resume a trust session. I am probably missing some background information, but perhaps we can streamline the interfaces or at least improve the documentation.

We have 'start', 'stop' but also 'release', and no matching 'create'. This violates the principle of least surprise (it surprises me at least!). Perhaps create_and_start()?

review: Needs Fixing

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> + 1764ff why not just call set_state( session.has_error() ? ... )

I assume it is to avoid accessing session without a lock.

Revision history for this message

Daniel van Vugt (vanvugt) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Just an amber light on this one; Mir 0.2.0 is already way oversized so we should not land something this size until that's out the way.

review: Needs Resubmitting

Revision history for this message

kevin gunn (kgunn72) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> Just an amber light on this one; Mir 0.2.0 is already way oversized so we
> should not land something this size until that's out the way.

wait, if we treat devel as sacred, it shouldn't matter what the delta is. unless there is a verifiable lack of test/validation for this change?
This is a key item on our list for malta & i had requested that we actually hold off on 0.2.0 until we landed this.

Revision history for this message

kevin gunn (kgunn72) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> Just an amber light on this one; Mir 0.2.0 is already way oversized so we
> should not land something this size until that's out the way.

wait, if we treat devel as sacred, it shouldn't matter what the delta is. unless there is a verifiable lack of test/validation for this change?
This is a key item on our list for malta & i had requested that we actually hold off on 0.2.0 until we landed this.

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> Just an amber light on this one; Mir 0.2.0 is already way oversized so we
> should not land something this size until that's out the way.

Getting this reviewed, fixed and landed is a team goal for this week.

If you really feel there is benefit in landing both 0.2.0 and 0.2.1 then I won't argue. But the real problem is that you don't have confidence in our automated testing. Delaying landing this MP won't change that.

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> 343 + * \param [in] start_callback The function to be called when the trust
> session event occurs
>
> s/event_callback/
> s/the trusted session event/a trusted session event/ ?
>
> 338 + * Create an new trust session
> 347 +MirWaitHandle *mir_connection_start_trust_session(MirConnection*
> connection,
>
> Do we 'create' a new trust session or 'start' it? (also see the last note in
> this comment).
>
> 376 +MirWaitHandle *mir_trust_session_add_trusted_session(MirTrustSession
> *trust_session,
> 377 + pid_t session_pid,
> 378 + mir_trust_session_add_trusted_session_callback callback,
> 379 + void* context);
> ... and in other functions
>
> Inconsistent '*' placement (void* vs MirTrustSession *trust_session).
>
> 379 + void* context);
>
> Missing \param.
>
> 374 + * \return A MirTrustSessionAddTrustResult result of the call
>
> Erroneous comment: function returns MirWaitHandle*
>
> 385 + * \return A MirTrustSessionAddTrustResult result of the call
>
> Erroneous comment: function returns MirBool
>
> 390 +/**
> 391 + * Request the cancellation of a trust session
> 392 + * \param [in] trust_session The trust session
> 393 + * \return True if the request was made successfully,
> 394 + * false otherwise
> 395 + */
>
> Missing \params, erroneous \return.
>
> 417 +void mir_trust_session_release(MirTrustSession* trust_session);
>
> Why do we have 'release' as a separate step from 'stop'? I don't see a way to
> resume a trust session. I am probably missing some background information, but
> perhaps we can streamline the interfaces or at least improve the
> documentation.
>
> We have 'start', 'stop' but also 'release', and no matching 'create'. This
> violates the principle of least surprise (it surprises me at least!). Perhaps
> create_and_start()?

There was a separate create & start, but we removed the create because it was somewhat unnecessary. The reason I left the stop/release as separate methods was that we get asynchronous stop events from the server, so we need to be able to release without sending a stop.
I could change to create_and_start, but the same applies for mir_connect (not mir_create_connection and_connect ;)

> 343 + * \param [in] start_callback The function to be called when the trust
> session event occurs
> 
> s/event_callback/
> s/the trusted session event/a trusted session event/ ?
> 
> 338 + * Create an new trust session
> 347 +MirWaitHandle *mir_connection_start_trust_session(MirConnection*
> connection,
> 
> Do we 'create' a new trust session or 'start' it? (also see the last note in
> this comment).
> 
> 376 +MirWaitHandle *mir_trust_session_add_trusted_session(MirTrustSession
> *trust_session,
> 377 + pid_t session_pid,
> 378 + mir_trust_session_add_trusted_session_callback callback,
> 379 + void* context);
> ... and in other functions
> 
> Inconsistent '*' placement (void* vs MirTrustSession *trust_session).
> 
> 379 + void* context);
> 
> Missing \param.
> 
> 374 + * \return A MirTrustSessionAddTrustResult result of the call
> 
> Erroneous comment: function returns MirWaitHandle*
> 
> 385 + * \return A MirTrustSessionAddTrustResult result of the call
> 
> Erroneous comment: function returns MirBool
> 
> 390 +/**
> 391 + * Request the cancellation of a trust session
> 392 + * \param [in] trust_session The trust session
> 393 + * \return True if the request was made successfully,
> 394 + * false otherwise
> 395 + */
> 
> Missing \params, erroneous \return.
> 
> 417 +void mir_trust_session_release(MirTrustSession* trust_session);
> 
> Why do we have 'release' as a separate step from 'stop'? I don't see a way to
> resume a trust session. I am probably missing some background information, but
> perhaps we can streamline the interfaces or at least improve the
> documentation.
> 
> We have 'start', 'stop' but also 'release', and no matching 'create'. This
> violates the principle of least surprise (it surprises me at least!). Perhaps
> create_and_start()?

There was a separate create & start, but we removed the create because it was somewhat unnecessary. The reason I left the stop/release as separate methods was that we get asynchronous stop events from the server, so we need to be able to release without sending a stop.
I could change to create_and_start, but the same applies for mir_connect (not mir_create_connection and_connect ;)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1744/rebuild

review: Approve (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Broken tests seem fixed

review: Abstain

Revision history for this message

kevin gunn (kgunn72) wrote on 2014-05-27: Posted in a previous version of this proposal

#

> > Just an amber light on this one; Mir 0.2.0 is already way oversized so we
> > should not land something this size until that's out the way.
>
> wait, if we treat devel as sacred, it shouldn't matter what the delta is.
> unless there is a verifiable lack of test/validation for this change?
> This is a key item on our list for malta & i had requested that we actually
> hold off on 0.2.0 until we landed this.

replying to myself - given that we are sacred on devel. we can certainly land 0.2.0 now, and just work to release this as part of 0.2.1 soon after.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-27: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1746/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-28: Posted in a previous version of this proposal

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1747/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-28: Posted in a previous version of this proposal

#

CI seems to have mislaid boost on amd64

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-28: Posted in a previous version of this proposal

#

> There was a separate create & start, but we removed the create because it was
> somewhat unnecessary. The reason I left the stop/release as separate methods
> was that we get asynchronous stop events from the server, so we need to be
> able to release without sending a stop.
> I could change to create_and_start, but the same applies for mir_connect (not
> mir_create_connection and_connect ;)

[after some f2f discussion]

We can release in the API the object "automatically" after signaling the wait handle returned from the mir_trust_session_stop() call. This signal ought to be happen if the server responds or if the IPC fails. (I don't care about scenarios where the IPC succeeds and the server doesn't respond as there are bigger problems than the client potentially leaking an object.)

*s/Needs information/Needs discussion/*

review: Needs Information

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-05-28: Posted in a previous version of this proposal

#

358 + * \param [in] callback Callback function to be invoked when request
359 + * completes
361 + * \param [in] callback The function to be called when the trust session event occurs

Duplicate \param and wrong param name.

615 + NullTrustSessionListener() = default;
616 + virtual ~NullTrustSessionListener() noexcept(true) = default;
625 + NullTrustSessionListener(const NullTrustSessionListener&) = delete;
626 + NullTrustSessionListener& operator=(const NullTrustSessionListener&) = delete;

No need to re-default/re-delete special member functions in derived class.

916 +typedef void (*mir_trust_session_callback)(MirTrustSession* tps, void* context);

tps?

1747 +void MirTrustSession::register_trust_session_event_callback(
1748 + mir_trust_session_event_callback callback,
1749 + void* context)

1948 + auto trust_session = connection->create_trust_session();
1949 + if (event_callback)
1950 + trust_session->register_trust_session_event_callback(event_callback, context);
... and similar code

It seems like the callback information should be passed in the constructor of
MirTrustSession (and MirConnection::create_trust_session()))

1680 + if (handle_trust_session_event)
1681 + {
1682 + handle_trust_session_event(event.trust_session.new_state);
1683 + })

We could initialize handler_trust_session_event with a null handler (not a nullptr),
so we don't need to check if it is valid.

To be continued...

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-28: Posted in a previous version of this proposal

#

> 358 + * \param [in] callback Callback function to be invoked when request
> 359 + * completes
> 361 + * \param [in] callback The function to be called when the trust session
> event occurs
>
> Duplicate \param and wrong param name.
>
> 615 + NullTrustSessionListener() = default;
> 616 + virtual ~NullTrustSessionListener() noexcept(true) = default;
> 625 + NullTrustSessionListener(const NullTrustSessionListener&) = delete;
> 626 + NullTrustSessionListener& operator=(const NullTrustSessionListener&) =
> delete;
>
> No need to re-default/re-delete special member functions in derived class.
>
> 916 +typedef void (*mir_trust_session_callback)(MirTrustSession* tps, void*
> context);
>
> tps?

fixed

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-28:

#

Resubmitted to remove prerequisite that creates spurious conflicts.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-28: Posted in a previous version of this proposal

#

FAILED: Continuous integration, rev:1532
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1748/
Executed test runs:
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/361/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/362/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/359/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/267
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/267/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/266/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1008/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1748/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-28:

#

FAILED: Continuous integration, rev:1533
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1749/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/362
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/363/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/360
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/268
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/268/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/267
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/267/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1009
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1009/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1593
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/7825

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1749/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-05-28:

#

1957 +MirTrustSession* mir_connection_create_trust_session(MirConnection* connection)

Not used.

3852 +TEST_F(TrustSessionClientAPI, can_start_and_stop_a_trust_session)

It seems like this test would benefit from mocks (instead of checking the
expectations manually).

2592 +void ms::ApplicationSession::begin_trust_session()
2602 +void ms::ApplicationSession::end_trust_session()

It would be nice to keep the terminology consistent (start/stop vs begin/end).

4964 +TEST_F(TrustSessionManager, successfully_adds_a_participant_by_pid)
... and similar tests

This test and other similar ones are just testing that the function doesn't
throw; they don't validate that a participant has been added. So, we should
either change the names or change the tests.

529 +class EventDistributor

We should avoid depending on concrete classes. Perhaps something like:

class EventHandlerRegister
{
virtual void register_event_handler(...) = 0;
virtual void unregister_event_handler(...) = 0;
};

class EventSink // perhaps reuse the class from the server?
{
virtual void handle_event(...) = 0;

};

class EventDistributor : public EventHandlerRegister, EventSink {...impl...};

MirTrustSession(..., std::shared_ptr<mir::client::EventHandlerRegister> const&);
MirSocketRpcChannel(..., std::shared_ptr<mir::client::EventSink> const&)

To be continued...

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-28: Posted in a previous version of this proposal

#

FAILED: Continuous integration, rev:1527
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1754/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/370
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/371
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/368/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/273
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/273/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/272/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1028
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1028/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1599/console
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/7843

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1754/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-05-29:

#

> 3852 +TEST_F(TrustSessionClientAPI, can_start_and_stop_a_trust_session)
>
> It seems like this test would benefit from mocks (instead of checking the
> expectations manually).

Done

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-29: Posted in a previous version of this proposal

#

FAILED: Continuous integration, rev:1527
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1765/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/385
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/386
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/383/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/284/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/283
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/283/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1070
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1070/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1609/console
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/7879

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1765/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-29:

#

FAILED: Continuous integration, rev:1534
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1766/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/386
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/387
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/385/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/285
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/285/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/284/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1074
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1074/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1611/console
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/7883

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1766/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-05-29:

#

> 1957 +MirTrustSession* mir_connection_create_trust_session(MirConnection*
> connection)
>
> Not used.
>
> 3852 +TEST_F(TrustSessionClientAPI, can_start_and_stop_a_trust_session)
>
> It seems like this test would benefit from mocks (instead of checking the
> expectations manually).

Alan has done this.

>
> 2592 +void ms::ApplicationSession::begin_trust_session()
> 2602 +void ms::ApplicationSession::end_trust_session()
>
> It would be nice to keep the terminology consistent (start/stop vs begin/end).

Changed:
ms::Session::begin_trust_session -> start_trust_session
ms::Session::end_trust_session -> end_trust_session
ms::TrustSessionListener::trusted_session_beginning -> trusted_participant_starting
ms::TrustSessionListener::trusted_session_ending -> trusted_participant_stopping

>
> 4964 +TEST_F(TrustSessionManager, successfully_adds_a_participant_by_pid)
> ... and similar tests
>
> This test and other similar ones are just testing that the function doesn't
> throw; they don't validate that a participant has been added. So, we should
> either change the names or change the tests.
>
> 529 +class EventDistributor
>
> We should avoid depending on concrete classes. Perhaps something like:
>
> class EventHandlerRegister
> {
> virtual void register_event_handler(...) = 0;
> virtual void unregister_event_handler(...) = 0;
> };
>
> class EventSink // perhaps reuse the class from the server?
> {
> virtual void handle_event(...) = 0;
>
> };
>
> class EventDistributor : public EventHandlerRegister, EventSink {...impl...};
>
> MirTrustSession(..., std::shared_ptr<mir::client::EventHandlerRegister>
> const&);
> MirSocketRpcChannel(..., std::shared_ptr<mir::client::EventSink> const&)
>
> To be continued...

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-05-29:

#

Sorry, mean to say "done with all those :)

ms::Session::begin_trust_session -> start_trust_session
ms::Session::end_trust_session -> end_trust_session
ms::TrustSessionListener::trusted_session_beginning -> trusted_participant_starting
ms::TrustSessionListener::trusted_session_ending -> trusted_participant_stopping

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-29:

#

FAILED: Continuous integration, rev:1537
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1770/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/392
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/393
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/391/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/289/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/288
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/288/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1085
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1085/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1615/console
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/7893

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1770/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-29:

#

FAILED: Continuous integration, rev:1541
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1775/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/398
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/399
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/397/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/294
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/294/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/293
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/293/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1097/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1775/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-05-29:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1777/rebuild

review: Approve (continuous-integration)

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) wrote on 2014-05-30:

#

How does the trust session app (i.e. child in the example) know that the trusted session is established by the parent? In the example, this is not a problem, because of the sleep(1). If we remove it, things may not work. In general, shouldn't the child have a way to know this?

review: Needs Information

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-06-02:

#

The child doesn't know anything about the fact it's running in a trust session. If the child's mir connection is established after the trust session starts, it will be added as a result of:

2852 + trust_session_manager->add_expected_session(new_session);

I used to call the scene::Session::start_trust_session method on all children added to the trust session, but there's no way for them to get the events without having a trust session object (We have no event distributor registration for mir connection yet). Until we have a concrete need for this, we decided to leave it out.

Revision history for this message

Alan Griffiths (alan-griffiths) on 2014-06-02:

#

review: Needs Fixing

Revision history for this message

Alan Griffiths (alan-griffiths) on 2014-06-02:

#

review: Abstain

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-02:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1787/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-02:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1789/rebuild

review: Approve (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-03:

#

> ms::TrustSessionListener::trusted_session_beginning ->
> trusted_participant_starting
> ms::TrustSessionListener::trusted_session_ending ->
> trusted_participant_stopping

How about:

s/trusted_participant_starting/participant_added/g
s/trusted_participant_stopping/participant_removed/g

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-03:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1800/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-03:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1802/rebuild

review: Approve (continuous-integration)

Revision history for this message

Kevin DuBois (kdub) wrote on 2014-06-03:

#

I took a crack at a review. Forgive me if some of the questions are elementary; I haven't wrapped my head around everything that's going on. I guess needs info is the most appropriate review type.

Could you elaborate a bit more on why trust sessions need to be stopped and started?

review: Needs Information

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-04:

#

> I took a crack at a review. Forgive me if some of the questions are
> elementary; I haven't wrapped my head around everything that's going on. I
> guess needs info is the most appropriate review type.

I've addressed a lot of the inline comments.

> Could you elaborate a bit more on why trust sessions need to be stopped and
> started?

This was discussed in Malta: Alexandros and I thought the two-phase teardown probably unnecessary, Nick thought there were synchronization issues with the client code when the (unity) server initiated a stop. We haven't reached consensus yet.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-04:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1813/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-04:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1816/rebuild

review: Approve (continuous-integration)

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-06-05:

#

1684 + std::lock_guard<std::recursive_mutex> thread_lock(thread_mutex);
1695 + std::lock_guard<std::recursive_mutex> thread_lock(thread_mutex);

Are these used to ensure that after returning from unregister() the corresponding handler will not be invoked (i.e. that it can't be in the process of being dispatched currently)?

1714 + for (int id : delete_later_ids)
1715 + event_handlers.erase(id);

We also need to clear delete_later_ids.

2131 + if (trust_session->get_state() == mir_trust_session_state_stopped)
2132 + mir_wait_for(trust_session->stop(null_callback, nullptr));

This doesn't look right (if trust session is stopped, then stop it?)

2765 + the_surface_coordinator(),
2766 + the_session_container(),
2767 + the_shell_focus_setter(),
...

Not indented properly.

2853 + auto old_focus = focus_application.lock();
2854 + if (old_focus == scene_session)
2855 + {
2856 + // only reset the focus if this session had focus
2857 + set_focus_to_locked(lock, app_container->successor_of(std::shared_ptr<Session>()));
2858 + }

How is this related to the trusted sessions functionality?

review: Needs Fixing

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-05:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1825/rebuild

review: Approve (continuous-integration)

Revision history for this message

Kevin DuBois (kdub) wrote on 2014-06-06:

#

~~~~~
1771 + std::atomic<int> next_fn_id;
1772 + std::unordered_set<int> delete_later_ids;
1773 + std::atomic<bool> in_event;

do these have to be atomic? seems they could just be protected by the mutex. Also would be better to do without the recursive_mutex...

~~~~~

1760 + int register_event_handler(std::function<void(MirEvent const&)> const&) override;
1761 + void unregister_event_handler(int id) override;

unregister_event_handler only appears in the destructor of MirTrustSession, so could we have
1760 + RegisteredHandler register_event_handler(std::function<void(MirEvent const&)> const&) override;
and handle the unregistration via RAII?

~~~~
src/client/event_sink.h
seems very close to mf::EventSink, should the interface be shared between client and server?

~~~
Seems strange that we could call 'delete this' in the constructor, depending on ow the event handler register works.
1827 + if (event.trust_session.new_state == mir_trust_session_state_stopped)
1828 + delete this;

~~~~~~
2257 + // todo - surfaces should register with the event handler register.
TODO

~~~~
I'm not really sure how the boost containers work... but this doesn't seem right:
3226 + Session* session_fun() const { return session.lock().get(); }

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> 2131 + if (trust_session->get_state() == mir_trust_session_state_stopped)
> 2132 + mir_wait_for(trust_session->stop(null_callback, nullptr));
>
> This doesn't look right (if trust session is stopped, then stop it?)

It isn't right.

But if we had "!=" then we'd hit another problem:

1. The server generates a "mir_event_type_trust_session_state_change" event to mir_trust_session_state_stopped
1.1 the handler registered in the constructor deletes the MirTrustSession.

2. This typically happens before the call to the server receives its completion message - which is then routed to just deleted MirTrustSession which causes "pure virtual method called".

3. If we got past that then we'd delete the MirTrustSession again in mir_trust_session_release_sync()

Basically, this whole stop/release area of code needs fixing.

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> > 2131 + if (trust_session->get_state() == mir_trust_session_state_stopped)
> > 2132 + mir_wait_for(trust_session->stop(null_callback, nullptr));
> >
> > This doesn't look right (if trust session is stopped, then stop it?)
>
> It isn't right.
>
> But if we had "!=" then we'd hit another problem:
>
> 1. The server generates a "mir_event_type_trust_session_state_change" event to
> mir_trust_session_state_stopped
> 1.1 the handler registered in the constructor deletes the MirTrustSession.
>
> 2. This typically happens before the call to the server receives its
> completion message - which is then routed to just deleted MirTrustSession
> which causes "pure virtual method called".
>
> 3. If we got past that then we'd delete the MirTrustSession again in
> mir_trust_session_release_sync()
>
> Basically, this whole stop/release area of code needs fixing.

review: Needs Fixing

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> Seems strange that we could call 'delete this' in the constructor, depending
> on ow the event handler register works.
> 1827 + if (event.trust_session.new_state ==
> mir_trust_session_state_stopped)
> 1828 + delete this;

It is in a lambda created by the constructor - which might be right if it didn't interact so badly with other code.

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> ~~~~~
> 1771 + std::atomic<int> next_fn_id;
> 1772 + std::unordered_set<int> delete_later_ids;
> 1773 + std::atomic<bool> in_event;
>
> do these have to be atomic? seems they could just be protected by the mutex.

They not only could, they already are. On our target architectures the generated code should be identical, so this is just needless verbosity.

I'll push an update.

> Also would be better to do without the recursive_mutex...

I told Nick this before he pushed it. ;)

The problem is that the "stopped" event handler can delete the MirTrustSession - which then unregisters the event handler. (As this is the one handler we can be sure that won't be encountered again during the iteration I'm not sure of the benefits of delete_later_ids vs "thou shalt not unregister other event handlers when processing events".)

*Needs Discussion* on this last point

review: Needs Information

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> > Also would be better to do without the recursive_mutex...
...
> *Needs Discussion* on this last point

Nevermind, found a simple solution

review: Abstain

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> > > Also would be better to do without the recursive_mutex...
> ...
> > *Needs Discussion* on this last point
>
> Nevermind, found a simple solution

Oh rats! That doesn't work

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-06:

#

> > ~~~~~
> > 1771 + std::atomic<int> next_fn_id;
> > 1772 + std::unordered_set<int> delete_later_ids;
> > 1773 + std::atomic<bool> in_event;
> >
> > do these have to be atomic? seems they could just be protected by the mutex.
>
> They not only could, they already are. On our target architectures the
> generated code should be identical, so this is just needless verbosity.
>
> I'll push an update.
>
> > Also would be better to do without the recursive_mutex...
>
> I told Nick this before he pushed it. ;)
>
> The problem is that the "stopped" event handler can delete the MirTrustSession
> - which then unregisters the event handler. (As this is the one handler we can
> be sure that won't be encountered again during the iteration I'm not sure of
> the benefits of delete_later_ids vs "thou shalt not unregister other event
> handlers when processing events".)
>
> *Needs Discussion* on this last point

The tricky part is that with a single lock there can be an unregister() call after the "unlock()" in handle_event(). But after unregister() returns the client justifiably expects there to be no further callbacks.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-06:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1832/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-06:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1834/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-09:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1839/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-09:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1841/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-09:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1844/rebuild

review: Approve (continuous-integration)

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) wrote on 2014-06-09:

#

Download full text (4.3 KiB)

(Finally I was able to catch back up on this. It's a bit long, so please bear with me.)

First and foremost, it's important for us (the Mir team) to minimize the impact of ABI/API breaks for obvious reasons. So we shall try to get it as close to right as possible the first time. I'm sure there will be inevitable iterations, but we need to make a conscious effort to minimize breaks. From that perspective, the focus is still on defining an API that captures the minimum requirements for the primary trusted sessions use-case, while leaving open the possibility to a more generalized usage.

That said, here are my thoughts in no particular order :

- The phrase "trusted session" probably makes sense when considering the primary use-case where the normal flow of an application is interrupted with a prompt to get a user to confirm her intent. In Mir, being lower on the stack and unaware of the use-case details, I am not convinced "trusted" is the best choice for this name, as there may be (non-security related use-) cases where surfaces originating from different connections would be considered belonging to the same "logical" mir connection for focus and LC purposes. Perhaps, SuperSession, SessionClique, SessionGroup, etc might work better. (I'll continue calling it "trusted session" until we converge on a name.)

- In the primary use-case mentioned above, the TPP's surface(s) would have to be always on top to prevent the app from proceeding without user's confirmation. In general, should the order of surfaces in aggregate and focus policy be selectable? For example, we could have an enum (say, ALWAYS_ON_TOP) passed into mir_connection_start_trust_session_sync for now. Later, we could add more when the need arises.

- For the primary use-case, it makes sense for a third process (in this case, the trusted helper) to request a trusted session be created on behalf of another process. From Mir's perspective, in a more general sense, the process making the request may at times be starting a trusted session for its own use. Api-wise, the pid passed into mir_connection_start_trust_session_sync would be the pid of the process making the call. As in the examples/trusted_session.c, this should work, so no problem there.

- In general, how does Mir stop malicious applications from pretending to be trusted helpers and trying to establish a "trusted" session with just any process?

- mir_trust_session_new_fds_for_prompt_providers : I'm kind of wondering why this was invented in the first place. In general, I don't like having two different ways of adding processes to the session - by pid, and by having a third party pass FDs. It seems superfluous at best. At worst, there could be security issues (for instance we'd need to make sure that a process already belonging to a trust session isn't handed an FD for the same trust session, or worse, that it isn't trying to create another trust session elsewhere). I'm not saying these use-cases are invalid, but having two different methods could be problematic in terms of bookkeeping.

- Assuming the FD method is kept, we should call it something like : mir_trust_session_allocate_new_connections, dropping the reference that ...

> (Finally I was able to catch back up on this. It's a bit long, so please bear
> with me.)
> 
> First and foremost, it's important for us (the Mir team) to minimize the
> impact of ABI/API breaks for obvious reasons. So we shall try to get it as
> close to right as possible the first time. I'm sure there will be inevitable
> iterations, but we need to make a conscious effort to minimize breaks. From
> that perspective, the focus is still on defining an API that captures the
> minimum requirements for the primary trusted sessions use-case, while leaving
> open the possibility to a more generalized usage.
> 
> That said, here are my thoughts in no particular order :
> 
> - The phrase "trusted session" probably makes sense when considering the
> primary use-case where the normal flow of an application is interrupted with a
> prompt to get a user to confirm her intent. In Mir, being lower on the stack
> and unaware of the use-case details, I am not convinced "trusted" is the best
> choice for this name, as there may be (non-security related use-) cases where
> surfaces originating from different connections would be considered belonging
> to the same "logical" mir connection for focus and LC purposes. Perhaps,
> SuperSession, SessionClique, SessionGroup, etc might work better. (I'll
> continue calling it "trusted session" until we converge on a name.)

Once you've been reading the code a bit it becomes clear that there is a fine distinction between "trust session" and "trusted session".

A "trust session" is what https://wiki.ubuntu.com/Security/TrustStoreAndSessions refers to as a "Trusted Prompt Session" while a "trusted session" could be either an "application" or a "trust prompt provider". (And yes, this is unnecessarily confusing.)

This usage isn't consistent: some of the code uses "participant" for "application or trust prompt provider"; and, this branch name should be "trust_sessions" not "trusted _sessions".

> - In the primary use-case mentioned above, the TPP's surface(s) would have to
> be always on top to prevent the app from proceeding without user's
> confirmation. In general, should the order of surfaces in aggregate and focus
> policy be selectable? For example, we could have an enum (say, ALWAYS_ON_TOP)
> passed into mir_connection_start_trust_session_sync for now. Later, we could
> add more when the need arises.
> 
> - For the primary use-case, it makes sense for a third process (in this case,
> the trusted helper) to request a trusted session be created on behalf of
> another process. From Mir's perspective, in a more general sense, the process
> making the request may at times be starting a trusted session for its own use.
> Api-wise, the pid passed into mir_connection_start_trust_session_sync would be
> the pid of the process making the call. As in the examples/trusted_session.c,
> this should work, so no problem there.
> 
> - In general, how does Mir stop malicious applications from pretending to be
> trusted helpers and trying to establish a "trusted" session with just any
> process?
> 
> - mir_trust_session_new_fds_for_prompt_providers : I'm kind of wondering why
> this was invented in the first place. In general, I don't like having two
> different ways of adding processes to the session - by pid, and by having a
> third party pass FDs. It seems superfluous at best. At worst, there could be
> security issues (for instance we'd need to make sure that a process already
> belonging to a trust session isn't handed an FD for the same trust session, or
> worse, that it isn't trying to create another trust session elsewhere). I'm
> not saying these use-cases are invalid, but having two different methods could
> be problematic in terms of bookkeeping.

There's an (internal) document that records the discussion that led to this:
    https://docs.google.com/a/canonical.com/document/d/1GdiAu7ZGUbrw1nBIcPgFP6YHz568NPoQj0XQ6cdlRUI/edit

Essentially, it avoids a race condition when the trusted helper starts a trust prompt provider - if it gets the FD first then the trust prompt provider is recognized by the server before it can start creating surfaces. It is also usable if the trust prompt provider runs in the same process as the trusted helper.

The PID based method is only appropriate if the trust prompt provider is already connected to Mir when the trust session starts. (I'm not sure that this use case is actually needed.)

> - Assuming the FD method is kept, we should call it something like :
> mir_trust_session_allocate_new_connections, dropping the reference that it's a
> bunch of fds, and that it's for "prompt providers". The former is an
> implementation detail that doesn't need to be exposed, and the latter is use-
> case specific info (but there could be other use-cases where a PP isn't
> involved).

Where are these use-cases?

> - How do we handle recursive trust sessions?

The current API and implementation clearly do not support recursive trust prompt sessions nor multiple trust prompt sessions from one trusted helper.

> I'm assuming if we have a trust
> session going with an app and another is needed with the same app then the
> existing trust session will be used, with the understanding that the surfaces
> of the more recently created trust session always be on top of the older
> session. But when the second trust session terminates, it should not tear down
> the entire trust session, it should simply be removed and the older trust
> session be allowed to continue. I don't think we can do this with the current
> api (i.e. mir_trust_session_release_sync's parameter refers to the entire
> trust session). Perhaps we can have something like,
> mir_trust_session_remove_by_pid_sync(MirTrustSession *trust_session, pid_t
> pid) or something like that.
> 
> - In light of recursive trust sessions, are the FDs handed out to TPP
> disposable (i.e. meant to be used only once) or recycleable (TPP removes
> itself from the recursive trust session but then decides to rejoin, to perhaps
> add a second credit card)?

Revision history for this message

Thomas Voß (thomas-voss) on 2014-06-12:

#

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-12:

#

FAILED: Continuous integration, rev:1580
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1869/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/527
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/529/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/526
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/390
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/390/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/387
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/387/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1505
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1505/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1732
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/8340

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1869/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-12:

#

The new names make things a lot clearer.

~~~~

410 +/**
411 + * Return the state of prompt session
412 + * \param [in] prompt_session The prompt session
413 + * \return The state of the prompt session
414 + */
415 +MirPromptSessionState mir_prompt_session_get_state(MirPromptSession *prompt_session);

Is there a need for this function? The client registers an event handler to process state changes, why would it need this as well?

~~~~

815 + virtual std::shared_ptr<Session> application_for_prompt_session(std::shared_ptr<PromptSession> const& prompt_session) const = 0;
816 +
817 + virtual std::shared_ptr<Session> helper_for_prompt_session(std::shared_ptr<PromptSession> const& prompt_session) const = 0;
818 +
819 + virtual void for_each_provider_in_prompt_session(std::shared_ptr<PromptSession> const& prompt_session,
820 + std::function<void(std::shared_ptr<Session> const& prompt_provider)> const& f) const = 0;
821 +

The names for these functions are verbose - I don't think they need the "_prompt_session" suffix as the argument supplied ought to make the meaning clear.

Also they are not used in the acceptance tests - which should be delineating the functionality Mir needs to provide. I.e. either there are missing tests or these functions are not needed.

~~~~

370 +MirPromptSession *mir_connection_start_prompt_session_sync(MirConnection* connection,
371 + pid_t application_pid,
372 + mir_prompt_session_event_callback event_callback,
373 + void *context);

Better as "create" to match the "release"

review: Needs Fixing

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) wrote on 2014-06-12:

#

Still reviewing... I still see "trusted" in a few places :

87 +///\page prompt_session.c prompt_session.c: A mir client which starts a prompt session and trusted client app.
126 + printf("Trust Session state updated to %d\n", state);
192 + printf("helper: added trusted session pid: %d\n", child_pid);
206 + puts("helper: Trusted session stoped by server");
279 + // This simulates the helper starting a new application which it adds to the trusted session.

review: Needs Fixing

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-12:

#

> Still reviewing... I still see "trusted" in a few places :
>
> 87 +///\page prompt_session.c prompt_session.c: A mir client which starts
> a prompt session and trusted client app.
> 126 + printf("Trust Session state updated to %d\n", state);
> 192 + printf("helper: added trusted session pid: %d\n", child_pid);
> 206 + puts("helper: Trusted session stoped by server");
> 279 + // This simulates the helper starting a new application which it
> adds to the trusted session.

Seems to be just the example .c file. Note also "s/stoped/stopped/

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-12:

#

70 +#define _POSIX_SOURCE

Not needed

review: Needs Fixing

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-12:

#

FAILED: Continuous integration, rev:1584
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1873/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/531
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/535/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/530
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/394
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/394/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/391
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/391/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1518
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1518/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1736
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/8351

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1873/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-12:

#

FAILED: Continuous integration, rev:1589
http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-ci/1875/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-android-utopic-i386-build/533
    FAILURE: http://jenkins.qa.ubuntu.com/job/mir-clang-utopic-amd64-build/538/console
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-utopic-touch/532
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/396
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-amd64-ci/396/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/393
        deb: http://jenkins.qa.ubuntu.com/job/mir-team-mir-development-branch-utopic-armhf-ci/393/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1528
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-utopic-armhf/1528/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/mir-mediumtests-runner-mako/1738
    SUCCESS: http://s-jenkins.ubuntu-ci:8080/job/touch-flash-device/8359

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1875/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) wrote on 2014-06-12:

#

A bunch of comments inlined. After going through it, I have yet to understand what this has to do with Mir. Mir definitely can support it but this functionality doesn't really interact much with other parts of Mir, or conversely, (other parts of) Mir doesn't really depend on it. Hopefully I'm missing something.

review: Needs Fixing

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) on 2014-06-13:

#

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-06-13:

#

> 70 +#define _POSIX_SOURCE
>
> Not needed

kill() seems to require this.

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-13:

#

I hate diff comments in their current form. Too much scrolling to find them.

review: Needs Fixing

Revision history for this message

Nick Dedekind (nick-dedekind) wrote on 2014-06-13:

#

Commented on one's that need commenting on. Fixed others.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-13:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1886/rebuild

review: Needs Fixing (continuous-integration)

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-06-13:

#

478 +#include "mir_toolkit/common.h"
479 +
480 +#include <sys/types.h>
481 +#include <vector>
482 +#include <string>
483 +#include <memory>

Not needed.

1307 + return std::shared_ptr<scene::PromptSession>();

Indentation.

1895 + std::unique_lock<decltype(mutex)> lock(mutex);
1904 + std::unique_lock<decltype(mutex)> lock(mutex);
1911 + std::unique_lock<decltype(mutex)> lock(mutex);

No need for (the more expensive) std::unique_lock<>. std::lock_guard<> is sufficient.

1913 + auto const event_handlers_copy(event_handlers);
1917 + // Ensure handler wasn't unregistered since making copy
1918 + if (event_handlers.find(handler.first) != event_handlers.end())

With the current state of the code (handler called under lock) we don't have to worry about "event_handlers" changing beneath our feet, so neither the copy nor the unregistration check is needed. I presume that the pros and cons of calling the handler under lock have been considered and we have explicitly decided to go with the current approach (I have probably missed some of the discussion around this).

review: Needs Fixing

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-13:

#

> 1913 + auto const event_handlers_copy(event_handlers);
> 1917 + // Ensure handler wasn't unregistered since making copy
> 1918 + if (event_handlers.find(handler.first) != event_handlers.end())
>
> With the current state of the code (handler called under lock) we don't have
> to worry about "event_handlers" changing beneath our feet, so neither the copy
> nor the unregistration check is needed. I presume that the pros and cons of
> calling the handler under lock have been considered and we have explicitly
> decided to go with the current approach (I have probably missed some of the
> discussion around this).

It is a *recursive* mutex so a handler can deregister itself - but it *could* make other changes.

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-13:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1892/rebuild

review: Approve (continuous-integration)

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-06-13:

#

> It is a *recursive* mutex so a handler can deregister itself - but it *could* make other changes.

Right, I forgot that we had a recursive mutex (and using decltype didn't help reminding me).

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-13:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1896/rebuild

review: Approve (continuous-integration)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-14:

#

> I hate diff comments in their current form. Too much scrolling to find them.

The "Needs fixing" was accidental

review: Abstain

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-14:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1899/rebuild

review: Approve (continuous-integration)

Revision history for this message

Cemil Azizoglu (cemil-azizoglu) wrote on 2014-06-16:

#

LGTM

review: Approve

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-16:

#

> I'm not really sure how the boost containers work... but this doesn't seem
> right:
> 3226 + Session* session_fun() const { return session.lock().get(); }

It doesn't seem right to me either.

Using the referent of a weak pointer as a key is going to lead to undefined behavior when the key changes. (I'm not sure why the weak pointer isn't used directly which would avoid problems.)

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-16:

#

> > I'm not really sure how the boost containers work... but this doesn't seem
> > right:
> > 3226 + Session* session_fun() const { return session.lock().get(); }
>
> It doesn't seem right to me either.
>
> Using the referent of a weak pointer as a key is going to lead to undefined
> behavior when the key changes. (I'm not sure why the weak pointer isn't used
> directly which would avoid problems.)

Oops! I thought I'd voted for fixing.

review: Needs Fixing

Revision history for this message

Alexandros Frantzis (afrantzis) wrote on 2014-06-16:

#

I am OK with this as a first take on prompt/trust/? sessions. The size of the MP means that it is likely that we missed something, but we can keep refactoring as the requirements crystallize.

review: Approve

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-16:

#

> > > I'm not really sure how the boost containers work... but this doesn't seem
> > > right:
> > > 3226 + Session* session_fun() const { return session.lock().get(); }
> >
> > It doesn't seem right to me either.
> >
> > Using the referent of a weak pointer as a key is going to lead to undefined
> > behavior when the key changes. (I'm not sure why the weak pointer isn't used
> > directly which would avoid problems.)
>
> Oops! I thought I'd voted for fixing.

And fixed

review: Abstain

Revision history for this message

Alan Griffiths (alan-griffiths) wrote on 2014-06-16:

#

Hmm! There should be acceptance tests that use fds for prompt providers.

(I won't block as I don't mind adding those in a followup MP.)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-16:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1906/rebuild

review: Approve (continuous-integration)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2014-06-16:

#

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/mir-team-mir-development-branch-ci/1910/rebuild

review: Approve (continuous-integration)

Revision history for this message

kevin gunn (kgunn72) wrote on 2014-06-16:

#

re-top-approving...jenkins testing succeeds, but not merging

Revision history for this message

PS Jenkins bot (ps-jenkins) on 2014-06-16:

#

review: Approve (continuous-integration)

Mir

Merge lp:~mir-team/mir/trusted_sessions into lp:mir

Commit message

Description of the change

Preview Diff

Subscribers

 === modified file 'examples/CMakeLists.txt'
 --- examples/CMakeLists.txt	2014-06-02 17:07:02 +0000
 +++ examples/CMakeLists.txt	2014-06-16 15:01:17 +0000
@@ -92,6 +92,9 @@
+ )
++add_executable(mir_demo_client_prompt_session prompt_session.c)
++target_link_libraries(mir_demo_client_prompt_session mirclient)
++
  add_library(mirdraw STATIC graphics_utils.cpp)
  target_link_libraries(mirdraw ${GLESv2_LIBRARIES})
@@ -143,7 +146,7 @@
    server_configuration.cpp
+ )
--target_link_libraries(mir_demo_standalone_input_filter
++target_link_libraries(mir_demo_standalone_input_filter
    mirserver
+ )
@@ -158,8 +161,9 @@
    mir_demo_client_multiwin
    mir_demo_client_display_config
    mir_demo_client_progressbar
++  mir_demo_client_prompt_session
    mir_demo_standalone_input_filter
--  mir_demo_standalone_render_to_fb
++  mir_demo_standalone_render_to_fb
    mir_demo_standalone_render_surfaces
+ )
 === modified file 'examples/demo-inprocess-surface-client/inprocess_egl_client.cpp'
 --- examples/demo-inprocess-surface-client/inprocess_egl_client.cpp	2014-04-15 05:31:19 +0000
 +++ examples/demo-inprocess-surface-client/inprocess_egl_client.cpp	2014-06-16 15:01:17 +0000
@@ -102,7 +102,7 @@
      auto input_platform = mircv::InputPlatform::create();
      input_thread = input_platform->create_input_thread(
--        surface->client_input_fd(),
++        surface->client_input_fd(),
              std::bind(std::mem_fn(&me::InprocessEGLClient::handle_event), this, std::placeholders::_1));
      input_thread->start();
 === added file 'examples/prompt_session.c'
 --- examples/prompt_session.c	1970-01-01 00:00:00 +0000
 +++ examples/prompt_session.c	2014-06-16 15:01:17 +0000
@@ -0,0 +1,231 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 3 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind <nick.dedekind@canonical.com>
++ */
++
++#define _POSIX_SOURCE
++
++#include "mir_toolkit/mir_client_library.h"
++#include "mir_toolkit/mir_prompt_session.h"
++
++#undef NDEBUG
++#include <assert.h>
++#include <string.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <getopt.h>
++#include <unistd.h>
++#include <errno.h>
++#include <sys/wait.h>
++#include <sys/types.h>
++#include <signal.h>
++
++///\page prompt_session.c prompt_session.c: A mir client which starts a prompt session and prompt client app.
++/// mir_demo_client_prompt_session shows the use of mir prompt session API.
++/// This program opens a mir connection and creates a prompt session.
++///\section helper helper()
++/// Opens a mir connection and creates a prompt session
++/// before closing the prompt session and connection.
++///\section prompt_session_app prompt_session_app()
++/// Opens a mir connection and creates a surface
++/// before releasing the surface and closing the connection.
++///\example prompt_session.c A mir client demonstrating prompt sessions.
++///\section MirDemoState MirDemoState
++/// The handles needs to be accessible both to callbacks and to the control function.
++///\snippet prompt_session.c MirDemoState_tag
++///\section Callbacks Callbacks
++///\snippet prompt_session.c Callback_tag
++/// This program creates two processes, both opening a mir connection, one starting
++/// a prompt session with the other process.
++
++///\internal [MirDemoState_tag]
++// Utility structure for the state of a single session.
++typedef struct MirDemoState
++{
++    MirConnection *connection;
++    MirSurface *surface;
++    MirPromptSession *prompt_session;
++    pid_t  child_pid;
++    MirPromptSessionState state;
++
++    int* client_fds;
++    unsigned int client_fd_count;
++} MirDemoState;
++///\internal [MirDemoState_tag]
++
++
++///\internal [Callback_tag]
++// Callback to update MirDemoState on prompt_session_event
++static void prompt_session_event_callback(MirPromptSession* prompt_session,
++                                         MirPromptSessionState state,
++                                         void* context)
++{
++    (void)prompt_session;
++    MirDemoState* demo_state = (MirDemoState*)context;
++    demo_state->state = state;
++
++    printf("helper: Prompt Session state updated to %d\n", state);
++    if (state == mir_prompt_session_state_stopped)
++    {
++        kill(demo_state->child_pid, SIGINT);
++    }
++}
++
++static void client_fd_callback(MirPromptSession* prompt_session, size_t count, int const* fds, void* context)
++{
++    (void)prompt_session;
++    ((MirDemoState*)context)->client_fds = malloc(sizeof(int)*count);
++    unsigned int i = 0;
++    for (; i < count; i++)
++    {
++        ((MirDemoState*)context)->client_fds[i] = fds[i];
++    }
++    ((MirDemoState*)context)->client_fd_count = count;
++}
++///\internal [Callback_tag]
++
++void start_session(const char* server, const char* name, MirDemoState* mcd)
++{
++    // Call mir_connect synchronously
++    mcd->connection = mir_connect_sync(server, name);
++
++    // We expect a connection handle;
++    // we expect it to be valid; and,
++    // we don't expect an error description
++    assert(mcd->connection != NULL);
++    assert(mir_connection_is_valid(mcd->connection));
++    assert(strcmp(mir_connection_get_error_message(mcd->connection), "") == 0);
++    printf("%s: Connected\n", name);
++
++    // We can query information about the platform we're running on
++    {
++        MirPlatformPackage platform_package;
++        platform_package.data_items = -1;
++        platform_package.fd_items = -1;
++
++        mir_connection_get_platform(mcd->connection, &platform_package);
++        assert(0 <= platform_package.data_items);
++        assert(0 <= platform_package.fd_items);
++    }
++}
++
++void stop_session(MirDemoState* mcd, const char* name)
++{
++    if (mcd->surface)
++    {
++        // We should release our surface
++        mir_surface_release_sync(mcd->surface);
++        mcd->surface = 0;
++        printf("%s: Surface released\n", name);
++    }
++
++    // We should release our connection
++    mir_connection_release(mcd->connection);
++    printf("%s: Connection released\n", name);
++}
++
++void helper(const char* server)
++{
++    MirDemoState mcd;
++    mcd.connection = 0;
++    mcd.surface = 0;
++    mcd.prompt_session = 0;
++    mcd.state = mir_prompt_session_state_stopped;
++    mcd.client_fd_count = 0;
++    start_session(server, "helper", &mcd);
++
++    // We create a prompt session
++    mcd.prompt_session = mir_connection_create_prompt_session_sync(mcd.connection, getpid(), prompt_session_event_callback, &mcd);
++    assert(mcd.prompt_session != NULL);
++
++    assert(mcd.state == mir_prompt_session_state_started);
++    puts("helper: Started prompt session");
++
++    mir_wait_for(mir_prompt_session_new_fds_for_prompt_providers(mcd.prompt_session, 1, client_fd_callback, &mcd));
++    assert(mcd.client_fd_count == 1);
++    puts("helper: Added waiting FD");
++
++    printf("helper: Starting child application 'mir_demo_client_basic' with fd://%d\n", mcd.client_fds[0]);
++    mcd.child_pid = fork();
++
++    if (mcd.child_pid == 0)
++    {
++        char buffer[128] = {0};
++        sprintf(buffer, "fd://%d", mcd.client_fds[0]);
++
++        char* args[4];
++        args[0] = "mir_demo_client_basic";
++        args[1] = "-m";
++        args[2] = &buffer[0];
++        args[3] = NULL;
++
++        errno = 0;
++        execvp("mir_demo_client_basic", args);
++        return;
++    }
++
++    int status;
++    printf("helper: Waiting on child application: %d\n", mcd.child_pid);
++    waitpid(mcd.child_pid, &status, 0);
++
++    if (mcd.state == mir_prompt_session_state_started)
++    {
++        mir_prompt_session_release_sync(mcd.prompt_session);
++        mcd.prompt_session = NULL;
++        puts("helper: Stopped prompt session");
++    }
++    else
++    {
++        puts("helper: Prompt session stopped by server");
++    }
++    puts("helper: Done");
++
++    stop_session(&mcd, "helper");
++}
++
++// The main() function deals with parsing arguments and defaults
++int main(int argc, char* argv[])
++{
++    // Some variables for holding command line options
++    char const *server = NULL;
++
++    // Parse the command line
++    {
++        int arg;
++        opterr = 0;
++        while ((arg = getopt (argc, argv, "c:hm:")) != -1)
++        {
++            switch (arg)
++            {
++            case 'm':
++                server = optarg;
++                break;
++
++            case '?':
++            case 'h':
++            default:
++                puts(argv[0]);
++                puts("Usage:");
++                puts("    -m <Mir server socket>");
++                puts("    -h: this help text");
++                return -1;
++            }
++        }
++    }
++
++    helper(server);
++    return 0;
++}
 === modified file 'include/client/mir_toolkit/mir_connection.h'
 --- include/client/mir_toolkit/mir_connection.h	2014-06-02 17:07:02 +0000
 +++ include/client/mir_toolkit/mir_connection.h	2014-06-16 15:01:17 +0000
@@ -169,26 +169,6 @@
      MirConnection* connection, MirPixelFormat* formats,
      unsigned const int format_size, unsigned int *num_valid_formats);
--/**
-- * Allocate some FDs for trusted clients to connect on
-- *
-- * Trust session helpers need to allocate connection FDs it will pass to
-- * trusted clients to use when connecting to the server. The server can
-- * then associate them with the trust session.
-- *
-- *   \warning This API is tentative until the implementation of trust sessions is complete
-- *   \param [in] connection     The connection
-- *   \param [in] no_of_fds      The number of fds to allocate
-- *   \param [in] callback       Callback invoked when request completes
-- *   \param [in,out] context    User data passed to the callback function
-- *   \return                    A handle that can be passed to mir_wait_for
-- */
--MirWaitHandle* mir_connection_new_fds_for_trusted_clients(
--    MirConnection* connection,
--    unsigned int no_of_fds,
--    mir_client_fd_callback callback,
--    void * context);
--
  #ifdef __cplusplus
+ }
  /**@}*/
 === added file 'include/client/mir_toolkit/mir_prompt_session.h'
 --- include/client/mir_toolkit/mir_prompt_session.h	1970-01-01 00:00:00 +0000
 +++ include/client/mir_toolkit/mir_prompt_session.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,87 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef MIR_TOOLKIT_MIR_PROMPT_SESSION_H_
++#define MIR_TOOLKIT_MIR_PROMPT_SESSION_H_
++
++#include "mir_toolkit/mir_client_library.h"
++
++#include <sys/types.h>
++
++#ifdef __cplusplus
++/**
++ * \addtogroup mir_toolkit
++ * @{
++ */
++extern "C" {
++#endif
++
++/**
++ * Create and start a new prompt session
++ *   \param [in] connection             The connection
++ *   \param [in] application_pid        The process id of the initiating application
++ *   \param [in] state_change_callback  The function to be called when a prompt session state change occurs
++ *   \param [in,out] context            User data passed to the callback functions
++ *   \return                            A handle that can be passed to mir_wait_for
++ */
++MirPromptSession *mir_connection_create_prompt_session_sync(
++    MirConnection* connection,
++    pid_t application_pid,
++    mir_prompt_session_state_change_callback state_change_callback,
++    void *context);
++
++/**
++ * Add a prompt provider process id to the prompt session
++ *   \param [in] prompt_session  The prompt session
++ *   \param [in] provider_pid    The process id of the prompt provider to add
++ *   \return                     True if the process id was added, false otherwise
++ */
++MirBool mir_prompt_session_add_prompt_provider_sync(
++    MirPromptSession *prompt_session,
++    pid_t provider_pid);
++
++/**
++ * Allocate some FDs for prompt providers to connect on
++ *
++ * Prompt helpers need to allocate connection FDs it will pass to
++ * prompt providers to use when connecting to the server. The server can
++ * then associate them with the prompt session.
++ *
++ *   \warning This API is tentative until the implementation of prompt sessions is complete
++ *   \param [in] prompt_session  The prompt session
++ *   \param [in] no_of_fds       The number of fds to allocate
++ *   \param [in] callback        Callback invoked when request completes
++ *   \param [in,out] context     User data passed to the callback function
++ *   \return                     A handle that can be passed to mir_wait_for
++ */
++MirWaitHandle* mir_prompt_session_new_fds_for_prompt_providers(
++    MirPromptSession *prompt_session,
++    unsigned int no_of_fds,
++    mir_client_fd_callback callback,
++    void * context);
++
++/**
++ * Stop and release the specified prompt session
++ *   \param [in] prompt_session  The prompt session
++ */
++void mir_prompt_session_release_sync(MirPromptSession *prompt_session);
++
++#ifdef __cplusplus
++}
++/**@}*/
++#endif
++
++#endif /* MIR_TOOLKIT_MIR_PROMPT_SESSION_H_ */
 === modified file 'include/server/mir/default_server_configuration.h'
 --- include/server/mir/default_server_configuration.h	2014-06-09 17:16:32 +0000
 +++ include/server/mir/default_server_configuration.h	2014-06-16 15:01:17 +0000
@@ -93,6 +93,8 @@
  class SurfaceStackModel;
  class SurfaceStack;
  class SceneReport;
++class PromptSessionListener;
++class PromptSessionManager;
+ }
  namespace graphics
+ {
@@ -231,6 +233,8 @@
      virtual std::shared_ptr<scene::PlacementStrategy>   the_placement_strategy();
      virtual std::shared_ptr<scene::SessionListener>     the_session_listener();
      virtual std::shared_ptr<shell::DisplayLayout>       the_shell_display_layout();
++    virtual std::shared_ptr<scene::PromptSessionListener> the_prompt_session_listener();
++    virtual std::shared_ptr<scene::PromptSessionManager>  the_prompt_session_manager();
      /** @} */
      /** @name internal scene configuration
@@ -365,6 +369,8 @@
      CachedPtr<scene::MediatingDisplayChanger> mediating_display_changer;
      CachedPtr<graphics::GLProgramFactory> gl_program_factory;
      CachedPtr<graphics::GLConfig> gl_config;
++    CachedPtr<scene::PromptSessionListener> prompt_session_listener;
++    CachedPtr<scene::PromptSessionManager> prompt_session_manager;
      CachedPtr<scene::SessionCoordinator> session_coordinator;
      CachedPtr<EmergencyCleanup> emergency_cleanup;
 === added file 'include/server/mir/frontend/prompt_session.h'
 --- include/server/mir/frontend/prompt_session.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/frontend/prompt_session.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,48 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_FRONTEND_PROMPT_SESSION_H_
++#define MIR_FRONTEND_PROMPT_SESSION_H_
++
++#include "mir_toolkit/common.h"
++
++#include <sys/types.h>
++#include <vector>
++#include <string>
++#include <memory>
++
++namespace mir
++{
++
++namespace frontend
++{
++class PromptSession
++{
++public:
++    virtual ~PromptSession() = default;
++
++protected:
++    PromptSession() = default;
++    PromptSession(const PromptSession&) = delete;
++    PromptSession& operator=(const PromptSession&) = delete;
++};
++
++}
++}
++
++#endif // MIR_FRONTEND_PROMPT_SESSION_H_
 === modified file 'include/server/mir/frontend/session_mediator_report.h'
 --- include/server/mir/frontend/session_mediator_report.h	2014-05-12 21:11:05 +0000
 +++ include/server/mir/frontend/session_mediator_report.h	2014-06-16 15:01:17 +0000
@@ -1,5 +1,5 @@
  /*
-- * Copyright © 2012 Canonical Ltd.
++ * Copyright © 2012-2014 Canonical Ltd.
+  *
   * This program is free software: you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 3,
@@ -22,6 +22,8 @@
  #include <string>
++#include <sys/types.h>
++
  namespace mir
+ {
  namespace frontend
@@ -50,6 +52,12 @@
      virtual void session_configure_display_called(std::string const& app_name) = 0;
++    virtual void session_start_prompt_session_called(std::string const& app_name, pid_t application_process) = 0;
++
++    virtual void session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process) = 0;
++
++    virtual void session_stop_prompt_session_called(std::string const& app_name) = 0;
++
      virtual void session_error(
          std::string const& app_name,
          char const* method,
 === modified file 'include/server/mir/frontend/shell.h'
 --- include/server/mir/frontend/shell.h	2014-04-15 05:31:19 +0000
 +++ include/server/mir/frontend/shell.h	2014-06-16 15:01:17 +0000
@@ -30,11 +30,13 @@
  namespace scene
+ {
  struct SurfaceCreationParameters;
++struct PromptSessionCreationParameters;
+ }
  namespace frontend
+ {
  class EventSink;
  class Session;
++class PromptSession;
  class Shell
+ {
@@ -54,6 +56,14 @@
      virtual void handle_surface_created(std::shared_ptr<Session> const& session) = 0;
++    virtual std::shared_ptr<PromptSession> start_prompt_session_for(std::shared_ptr<Session> const& session,
++                                                                  scene::PromptSessionCreationParameters const& params) = 0;
++    virtual void add_prompt_provider_process_for(std::shared_ptr<PromptSession> const& prompt_session,
++                                                                  pid_t process_id) = 0;
++    virtual void add_prompt_provider_for(std::shared_ptr<PromptSession> const& prompt_session,
++                                                                  std::shared_ptr<Session> const& session) = 0;
++    virtual void stop_prompt_session(std::shared_ptr<PromptSession> const& prompt_session) = 0;
++
  protected:
      Shell() = default;
      Shell(const Shell&) = delete;
 === added file 'include/server/mir/scene/null_prompt_session_listener.h'
 --- include/server/mir/scene/null_prompt_session_listener.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/scene/null_prompt_session_listener.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,40 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_NULL_PROMPT_SESSION_LISTENER_H_
++#define MIR_SCENE_NULL_PROMPT_SESSION_LISTENER_H_
++
++#include "mir/scene/prompt_session_listener.h"
++
++namespace mir
++{
++namespace scene
++{
++class NullPromptSessionListener : public PromptSessionListener
++{
++public:
++    void starting(std::shared_ptr<PromptSession> const&) override {}
++    void stopping(std::shared_ptr<PromptSession> const&) override {}
++
++    void prompt_provider_added(PromptSession const&, std::shared_ptr<Session> const&) override {}
++    void prompt_provider_removed(PromptSession const&, std::shared_ptr<Session> const&) override {}
++};
++}
++}
++
++#endif // MIR_SHELL_NULL_PROMPT_SESSION_LISTENER_H_
 === added file 'include/server/mir/scene/prompt_session.h'
 --- include/server/mir/scene/prompt_session.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/scene/prompt_session.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,37 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_H_
++#define MIR_SCENE_PROMPT_SESSION_H_
++
++#include "mir/frontend/prompt_session.h"
++
++namespace mir
++{
++namespace scene
++{
++class Session;
++
++class PromptSession : public frontend::PromptSession
++{
++};
++
++}
++}
++
++#endif // MIR_SHELL_PROMPT_SESSION_H_
 === added file 'include/server/mir/scene/prompt_session_creation_parameters.h'
 --- include/server/mir/scene/prompt_session_creation_parameters.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/scene/prompt_session_creation_parameters.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,36 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_CREATION_PARAMETERS_H_
++#define MIR_SCENE_PROMPT_SESSION_CREATION_PARAMETERS_H_
++
++#include <sys/types.h>
++
++namespace mir
++{
++namespace scene
++{
++
++struct PromptSessionCreationParameters
++{
++    pid_t application_pid = 0;
++};
++}
++}
++
++#endif /* MIR_SCENE_PROMPT_SESSION_CREATION_PARAMETERS_H_ */
 === added file 'include/server/mir/scene/prompt_session_listener.h'
 --- include/server/mir/scene/prompt_session_listener.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/scene/prompt_session_listener.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,52 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_LISTENER_H_
++#define MIR_SCENE_PROMPT_SESSION_LISTENER_H_
++
++#include <memory>
++
++namespace mir
++{
++namespace scene
++{
++class Session;
++class PromptSession;
++
++class PromptSessionListener
++{
++public:
++    virtual void starting(std::shared_ptr<PromptSession> const& prompt_session) = 0;
++    virtual void stopping(std::shared_ptr<PromptSession> const& prompt_session) = 0;
++
++    virtual void prompt_provider_added(PromptSession const& prompt_session, std::shared_ptr<Session> const& prompt_provider) = 0;
++    virtual void prompt_provider_removed(PromptSession const& prompt_session, std::shared_ptr<Session> const& prompt_provider) = 0;
++
++protected:
++    PromptSessionListener() = default;
++    virtual ~PromptSessionListener() = default;
++
++    PromptSessionListener(const PromptSessionListener&) = delete;
++    PromptSessionListener& operator=(const PromptSessionListener&) = delete;
++};
++
++}
++}
++
++
++#endif // MIR_SCENE_PROMPT_SESSION_LISTENER_H_
 === added file 'include/server/mir/scene/prompt_session_manager.h'
 --- include/server/mir/scene/prompt_session_manager.h	1970-01-01 00:00:00 +0000
 +++ include/server/mir/scene/prompt_session_manager.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,110 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_MANAGER_H_
++#define MIR_SCENE_PROMPT_SESSION_MANAGER_H_
++
++#include <sys/types.h>
++#include <memory>
++#include <functional>
++
++namespace mir
++{
++namespace scene
++{
++class Session;
++class PromptSession;
++struct PromptSessionCreationParameters;
++
++class PromptSessionManager
++{
++public:
++    virtual ~PromptSessionManager() = default;
++
++    /**
++     * Start a new prompt session
++     *   \param [in] session  The prompt helper session
++     *   \param [in] params   The creation parameters for constructing the prompt session
++     */
++    virtual std::shared_ptr<PromptSession> start_prompt_session_for(std::shared_ptr<Session> const& session,
++                                                                    PromptSessionCreationParameters const& params) const = 0;
++
++    /**
++     * Stop a started prompt session
++     *   \param [in] prompt_session  The prompt session
++     */
++    virtual void stop_prompt_session(std::shared_ptr<PromptSession> const& prompt_session) const = 0;
++
++    /**
++     * Add a prompt provider to an existing prompt session
++     *   \param [in] prompt_session  The prompt session
++     *   \param [in] prompt_provider The prompt provider to add to the prompt session
++     */
++    virtual void add_prompt_provider(std::shared_ptr<PromptSession> const& prompt_session,
++                                     std::shared_ptr<Session> const& prompt_provider) const = 0;
++
++    /**
++     * Add a process id to wait for to the prompt session
++     *   \param [in] prompt_session  The prompt session
++     *   \param [in] process_id      The process id to wait for
++     */
++    virtual void add_prompt_provider_by_pid(std::shared_ptr<PromptSession> const& prompt_session,
++                                            pid_t process_id) const = 0;
++
++    /**
++     * Add a session that may have been expected by a prompt session.
++     *   \param [in] session  The new session that was being expected
++     */
++    virtual void add_expected_session(std::shared_ptr<Session> const& new_session) const = 0;
++
++    /**
++     * Remove a session from all associated prompt sessions
++     *   \param [in] session  The new session that is to be removed
++     */
++    virtual void remove_session(std::shared_ptr<Session> const& session) const = 0;
++
++    /**
++     * Retrieve the application session for a prompt session
++     *   \param [in] prompt_session  The prompt session
++     */
++    virtual std::shared_ptr<Session> application_for(std::shared_ptr<PromptSession> const& prompt_session) const = 0;
++
++    /**
++     * Retrieve the helper session for a prompt session
++     *   \param [in] prompt_session  The prompt session
++     */
++    virtual std::shared_ptr<Session> helper_for(std::shared_ptr<PromptSession> const& prompt_session) const = 0;
++
++    /**
++     * Iterate over all the prompt providers associated with a prompt session
++     *   \param [in] prompt_session  The prompt session
++     *   \param [in] f               The callback function to call for each provider
++     */
++    virtual void for_each_provider_in(std::shared_ptr<PromptSession> const& prompt_session,
++                                      std::function<void(std::shared_ptr<Session> const& prompt_provider)> const& f) const = 0;
++
++protected:
++    PromptSessionManager() = default;
++    PromptSessionManager(const PromptSessionManager&) = delete;
++    PromptSessionManager& operator=(const PromptSessionManager&) = delete;
++};
++
++}
++}
++
++#endif // MIR_SCENE_PROMPT_SESSION_MANAGER_H_
 === modified file 'include/server/mir/scene/session.h'
 --- include/server/mir/scene/session.h	2014-04-15 05:31:19 +0000
 +++ include/server/mir/scene/session.h	2014-06-16 15:01:17 +0000
@@ -40,6 +40,9 @@
      virtual std::shared_ptr<Surface> default_surface() const = 0;
      virtual void set_lifecycle_state(MirLifecycleState state) = 0;
      virtual void send_display_config(graphics::DisplayConfiguration const&) = 0;
++
++    virtual void start_prompt_session() = 0;
++    virtual void stop_prompt_session() = 0;
  };
+ }
+ }
 === modified file 'include/server/mir/shell/session_coordinator_wrapper.h'
 --- include/server/mir/shell/session_coordinator_wrapper.h	2014-05-23 12:59:00 +0000
 +++ include/server/mir/shell/session_coordinator_wrapper.h	2014-06-16 15:01:17 +0000
@@ -48,6 +48,20 @@
      void handle_surface_created(std::shared_ptr<frontend::Session> const& session) override;
++    std::shared_ptr<frontend::PromptSession> start_prompt_session_for(
++        std::shared_ptr<frontend::Session> const& session,
++        scene::PromptSessionCreationParameters const& params) override;
++
++    void add_prompt_provider_process_for(
++        std::shared_ptr<frontend::PromptSession> const& prompt_session,
++        pid_t process_id) override;
++
++    void add_prompt_provider_for(
++        std::shared_ptr<frontend::PromptSession> const& prompt_session,
++        std::shared_ptr<frontend::Session> const& session) override;
++
++    void stop_prompt_session(std::shared_ptr<frontend::PromptSession> const& prompt_session) override;
++
  protected:
      std::shared_ptr<scene::SessionCoordinator> const wrapped;
  };
 === modified file 'include/shared/mir_toolkit/client_types.h'
 --- include/shared/mir_toolkit/client_types.h	2014-06-02 17:07:02 +0000
 +++ include/shared/mir_toolkit/client_types.h	2014-06-16 15:01:17 +0000
@@ -46,6 +46,7 @@
  typedef struct MirConnection MirConnection;
  typedef struct MirSurface MirSurface;
  typedef struct MirScreencast MirScreencast;
++typedef struct MirPromptSession MirPromptSession;
  /**
   * Returned by asynchronous functions. Must not be free'd by
@@ -105,7 +106,7 @@
  /**
   * Callback called when a request for client file descriptors completes
-- *   \param [in] connection     The connection associated with the display change
++ *   \param [in] prompt_session  The prompt session
   *   \param [in] count          The number of FDs allocated
   *   \param [in] fds            Array of FDs
   *   \param [in,out] context    The context provided by client
@@ -114,7 +115,7 @@
   */
  typedef void (*mir_client_fd_callback)(
--    MirConnection* connection, size_t count, int const* fds, void* context);
++    MirPromptSession *prompt_session, size_t count, int const* fds, void* context);
  /**
   * MirBufferUsage specifies how a surface can and will be used. A "hardware"
@@ -319,6 +320,31 @@
   */
  typedef void (*mir_screencast_callback)(MirScreencast *screencast, void *client_context);
++/**
++ * Callback member of MirPromptSession for handling of prompt sessions.
++ *   \param [in] prompt_provider  The prompt session associated with the callback
++ *   \param [in,out] context      The context provided by the client
++ */
++typedef void (*mir_prompt_session_callback)(MirPromptSession* prompt_provider, void* context);
++
++/**
++ * Callback member of MirPromptSession for adding prompt providers
++ *   \param [in] prompt_provider  The prompt session associated with the callback
++ *   \param [in] added            True if the session was added, false otherwise
++ *   \param [in,out] context      The context provided by the client
++ */
++typedef void (*mir_prompt_session_add_prompt_provider_callback)(
++    MirPromptSession* prompt_provider, MirBool added, void* context);
++
++/**
++ * Callback member of MirPromptSession for handling of prompt sessions events.
++ *   \param [in] prompt_provider  The prompt session associated with the callback
++ *   \param [in] state            The state of the prompt session
++ *   \param [in,out] context      The context provided by the client
++ */
++typedef void (*mir_prompt_session_state_change_callback)(
++    MirPromptSession* prompt_provider, MirPromptSessionState state, void* context);
++
  #ifdef __cplusplus
+ }
  /**@}*/
 === modified file 'include/shared/mir_toolkit/common.h'
 --- include/shared/mir_toolkit/common.h	2014-06-09 17:16:32 +0000
 +++ include/shared/mir_toolkit/common.h	2014-06-16 15:01:17 +0000
@@ -88,6 +88,12 @@
      mir_power_mode_off /* Powered down. */
  } MirPowerMode;
++typedef enum MirPromptSessionState
++{
++    mir_prompt_session_state_stopped = 0,
++    mir_prompt_session_state_started
++} MirPromptSessionState;
++
  /**
   * The order of components in a format enum matches the
   * order of the components as they would be written in an
 === modified file 'include/shared/mir_toolkit/event.h'
 --- include/shared/mir_toolkit/event.h	2014-03-06 06:05:17 +0000
 +++ include/shared/mir_toolkit/event.h	2014-06-16 15:01:17 +0000
@@ -40,7 +40,8 @@
      mir_event_type_key,
      mir_event_type_motion,
      mir_event_type_surface,
--    mir_event_type_resize
++    mir_event_type_resize,
++    mir_event_type_prompt_session_state_change
  } MirEventType;
  typedef enum {
@@ -204,6 +205,13 @@
      int height;
  } MirResizeEvent;
++typedef struct
++{
++    MirEventType type;
++
++    MirPromptSessionState new_state;
++} MirPromptSessionEvent;
++
  typedef union
+ {
      MirEventType    type;
@@ -211,6 +219,7 @@
      MirMotionEvent  motion;
      MirSurfaceEvent surface;
      MirResizeEvent  resize;
++    MirPromptSessionEvent  prompt_session;
  } MirEvent;
  #ifdef __cplusplus
 === modified file 'include/test/mir_test/test_protobuf_client.h'
 --- include/test/mir_test/test_protobuf_client.h	2013-08-28 03:41:48 +0000
 +++ include/test/mir_test/test_protobuf_client.h	2014-06-16 15:01:17 +0000
@@ -21,6 +21,7 @@
  #define MIR_TEST_TEST_CLIENT_H_
  #include "mir_protobuf.pb.h"
++#include "wait_condition.h"
  #include <gmock/gmock.h>
@@ -49,6 +50,9 @@
      mir::protobuf::Connection connection;
      mir::protobuf::DisplayConfiguration disp_config;
      mir::protobuf::DisplayConfiguration disp_config_response;
++    mir::protobuf::PromptSessionParameters prompt_session_parameters;
++    mir::protobuf::PromptProvider prompt_provider;
++    mir::protobuf::Void prompt_session;
      MOCK_METHOD0(connect_done, void());
      MOCK_METHOD0(create_surface_done, void());
@@ -57,6 +61,9 @@
      MOCK_METHOD0(disconnect_done, void());
      MOCK_METHOD0(drm_auth_magic_done, void());
      MOCK_METHOD0(display_configure_done, void());
++    MOCK_METHOD0(prompt_session_start_done, void());
++    MOCK_METHOD0(prompt_session_add_prompt_provider_done, void());
++    MOCK_METHOD0(prompt_session_stop_done, void());
      void on_connect_done();
@@ -94,6 +101,12 @@
      void wait_for_configure_display_done();
++    void wait_for_prompt_session_start_done();
++
++    void wait_for_prompt_session_add_prompt_provider_done();
++
++    void wait_for_prompt_session_stop_done();
++
      const int maxwait;
      std::atomic<bool> connect_done_called;
      std::atomic<bool> create_surface_called;
@@ -104,6 +117,10 @@
      std::atomic<bool> configure_display_done_called;
      std::atomic<bool> tfd_done_called;
++    WaitCondition wc_prompt_session_start;
++    WaitCondition wc_prompt_session_add;
++    WaitCondition wc_prompt_session_stop;
++
      std::atomic<int> connect_done_count;
      std::atomic<int> create_surface_done_count;
      std::atomic<int> disconnect_done_count;
 === added file 'include/test/mir_test_doubles/mock_prompt_session_listener.h'
 --- include/test/mir_test_doubles/mock_prompt_session_listener.h	1970-01-01 00:00:00 +0000
 +++ include/test/mir_test_doubles/mock_prompt_session_listener.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,48 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_TEST_DOUBLES_MOCK_PROMPT_SESSION_LISTENER_H_
++#define MIR_TEST_DOUBLES_MOCK_PROMPT_SESSION_LISTENER_H_
++
++#include "mir/scene/prompt_session_listener.h"
++
++#include <gmock/gmock.h>
++
++namespace mir
++{
++namespace test
++{
++namespace doubles
++{
++
++struct MockPromptSessionListener : public scene::PromptSessionListener
++{
++    virtual ~MockPromptSessionListener() noexcept(true) {}
++
++    MOCK_METHOD1(starting, void(std::shared_ptr<scene::PromptSession> const&));
++    MOCK_METHOD1(stopping, void(std::shared_ptr<scene::PromptSession> const&));
++
++    MOCK_METHOD2(prompt_provider_added, void(scene::PromptSession const&, std::shared_ptr<scene::Session> const&));
++    MOCK_METHOD2(prompt_provider_removed, void(scene::PromptSession const&, std::shared_ptr<scene::Session> const&));
++};
++
++}
++}
++} // namespace mir
++
++#endif // MIR_TEST_DOUBLES_MOCK_PROMPT_SESSION_LISTENER_H_
 === modified file 'include/test/mir_test_doubles/mock_scene_session.h'
 --- include/test/mir_test_doubles/mock_scene_session.h	2014-06-02 17:07:02 +0000
 +++ include/test/mir_test_doubles/mock_scene_session.h	2014-06-16 15:01:17 +0000
@@ -52,6 +52,9 @@
      MOCK_METHOD3(configure_surface, int(frontend::SurfaceId, MirSurfaceAttrib, int));
      MOCK_METHOD1(set_lifecycle_state, void(MirLifecycleState state));
++
++    MOCK_METHOD0(start_prompt_session, void());
++    MOCK_METHOD0(stop_prompt_session, void());
  };
+ }
 === modified file 'include/test/mir_test_doubles/mock_shell.h'
 --- include/test/mir_test_doubles/mock_shell.h	2014-04-15 05:31:19 +0000
 +++ include/test/mir_test_doubles/mock_shell.h	2014-06-16 15:01:17 +0000
@@ -22,6 +22,7 @@
  #include "mir/scene/surface_creation_parameters.h"
  #include "mir/frontend/shell.h"
  #include "mir/frontend/surface_id.h"
++#include "mir/scene/prompt_session_creation_parameters.h"
  #include <gmock/gmock.h>
@@ -43,6 +44,17 @@
      MOCK_METHOD2(create_surface_for, frontend::SurfaceId(std::shared_ptr<frontend::Session> const&, scene::SurfaceCreationParameters const&));
      MOCK_METHOD1(handle_surface_created, void(std::shared_ptr<frontend::Session> const&));
++
++    MOCK_METHOD2(start_prompt_session_for, std::shared_ptr<frontend::PromptSession>(
++        std::shared_ptr<frontend::Session> const&,
++        scene::PromptSessionCreationParameters const&));
++    MOCK_METHOD2(add_prompt_provider_process_for, void(
++        std::shared_ptr<frontend::PromptSession> const&,
++        pid_t));
++    MOCK_METHOD2(add_prompt_provider_for, void(
++        std::shared_ptr<frontend::PromptSession> const&,
++        std::shared_ptr<frontend::Session> const&));
++    MOCK_METHOD1(stop_prompt_session, void(std::shared_ptr<frontend::PromptSession> const&));
  };
+ }
 === added file 'include/test/mir_test_doubles/null_client_event_sink.h'
 --- include/test/mir_test_doubles/null_client_event_sink.h	1970-01-01 00:00:00 +0000
 +++ include/test/mir_test_doubles/null_client_event_sink.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,42 @@
++/*
++ * Copyright © 2012 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekink <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_TEST_DOUBLES_NULL_CLIENT_EVENT_SINK_H_
++#define MIR_TEST_DOUBLES_NULL_CLIENT_EVENT_SINK_H_
++
++#include "src/client/event_sink.h"
++
++#include <gmock/gmock.h>
++
++namespace mir
++{
++namespace test
++{
++namespace doubles
++{
++class NullClientEventSink : public client::EventSink
++{
++public:
++    void handle_event(MirEvent const&) override {}
++};
++
++}
++}
++}
++
++#endif /* MIR_TEST_DOUBLES_NULL_CLIENT_EVENT_SINK_H_ */
 === added file 'include/test/mir_test_doubles/null_prompt_session.h'
 --- include/test/mir_test_doubles/null_prompt_session.h	1970-01-01 00:00:00 +0000
 +++ include/test/mir_test_doubles/null_prompt_session.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,37 @@
++/*
++ * Copyright © 2013-2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@gmail.com>
++ */
++
++#ifndef MIR_TEST_DOUBLES_NULL_PROMPT_SESSION_H_
++#define MIR_TEST_DOUBLES_NULL_PROMPT_SESSION_H_
++
++#include "mir/scene/prompt_session.h"
++
++namespace mir
++{
++namespace test
++{
++namespace doubles
++{
++class NullPromptSession : public scene::PromptSession
++{
++};
++}
++}
++}
++
++#endif /* MIR_TEST_DOUBLES_NULL_PROMPT_SESSION_H_ */
 === added file 'include/test/mir_test_doubles/null_prompt_session_manager.h'
 --- include/test/mir_test_doubles/null_prompt_session_manager.h	1970-01-01 00:00:00 +0000
 +++ include/test/mir_test_doubles/null_prompt_session_manager.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,82 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_NULL_PROMPT_SESSION_MANAGER_H_
++#define MIR_SCENE_NULL_PROMPT_SESSION_MANAGER_H_
++
++#include "mir/scene/prompt_session_manager.h"
++
++namespace mir
++{
++namespace test
++{
++namespace doubles
++{
++
++class NullPromptSessionManager: public scene::PromptSessionManager
++{
++public:
++    std::shared_ptr<scene::PromptSession> start_prompt_session_for(std::shared_ptr<scene::Session> const&,
++                                                                   scene::PromptSessionCreationParameters const&) const
++    {
++        return std::shared_ptr<scene::PromptSession>();
++    }
++
++    void stop_prompt_session(std::shared_ptr<scene::PromptSession> const&) const
++    {
++    }
++
++    void add_prompt_provider(std::shared_ptr<scene::PromptSession> const&,
++                             std::shared_ptr<scene::Session> const&) const
++    {
++    }
++
++    void add_prompt_provider_by_pid(std::shared_ptr<scene::PromptSession> const&,
++                                    pid_t) const
++    {
++    }
++
++    void add_expected_session(std::shared_ptr<scene::Session> const&) const
++    {
++    }
++
++    void remove_session(std::shared_ptr<scene::Session> const&) const
++    {
++    }
++
++    std::shared_ptr<scene::Session> application_for(std::shared_ptr<scene::PromptSession> const&) const
++    {
++        return std::shared_ptr<scene::Session>();
++    }
++
++    std::shared_ptr<scene::Session> helper_for(std::shared_ptr<scene::PromptSession> const&) const
++    {
++        return std::shared_ptr<scene::Session>();
++    }
++
++    void for_each_provider_in(std::shared_ptr<scene::PromptSession> const&,
++                              std::function<void(std::shared_ptr<scene::Session> const&)> const&) const
++    {
++    }
++};
++
++}
++}
++}
++
++#endif // MIR_SCENE_NULL_PROMPT_SESSION_MANAGER_H_
 === modified file 'include/test/mir_test_doubles/stub_scene_session.h'
 --- include/test/mir_test_doubles/stub_scene_session.h	2014-06-02 17:07:02 +0000
 +++ include/test/mir_test_doubles/stub_scene_session.h	2014-06-16 15:01:17 +0000
@@ -30,6 +30,8 @@
  struct StubSceneSession : public scene::Session
+ {
++    StubSceneSession(pid_t pid = -1) : pid(pid) {}
++
      frontend::SurfaceId create_surface(scene::SurfaceCreationParameters const& /* params */) override
+     {
          return frontend::SurfaceId{0};
@@ -45,9 +47,10 @@
+     {
          return std::string();
+     }
++
      pid_t process_id() const override
+     {
--        return -1;
++        return pid;
+     }
      void force_requests_to_complete() override
@@ -76,6 +79,16 @@
      void set_lifecycle_state(MirLifecycleState /*state*/)
+     {
+     }
++
++    void start_prompt_session() override
++    {
++    }
++
++    void stop_prompt_session() override
++    {
++    }
++
++    pid_t const pid;
  };
+ }
 === modified file 'include/test/mir_test_doubles/stub_shell.h'
 --- include/test/mir_test_doubles/stub_shell.h	2014-04-15 05:31:19 +0000
 +++ include/test/mir_test_doubles/stub_shell.h	2014-06-16 15:01:17 +0000
@@ -49,6 +49,25 @@
      void handle_surface_created(std::shared_ptr<frontend::Session> const& /* session */) override
+     {
+     }
++    std::shared_ptr<frontend::PromptSession> start_prompt_session_for(std::shared_ptr<frontend::Session> const& /* session */,
++        scene::PromptSessionCreationParameters const& /* params */)
++    {
++        return std::shared_ptr<frontend::PromptSession>();
++    }
++    void add_prompt_provider_process_for(
++        std::shared_ptr<frontend::PromptSession> const&  /* prompt_session */,
++        pid_t /* process_id */)
++    {
++    }
++    void add_prompt_provider_for(
++        std::shared_ptr<frontend::PromptSession> const&  /* prompt_session */,
++        std::shared_ptr<frontend::Session> const& /* session */)
++    {
++    }
++    void stop_prompt_session(std::shared_ptr<frontend::PromptSession>  const& /* prompt_session */)
++    {
++    }
++
      std::shared_ptr<StubSession> const stub_session;
  };
 === modified file 'src/client/CMakeLists.txt'
 --- src/client/CMakeLists.txt	2014-06-02 17:07:02 +0000
 +++ src/client/CMakeLists.txt	2014-06-16 15:01:17 +0000
@@ -48,6 +48,9 @@
    mir_screencast.cpp
    mir_screencast_api.cpp
    mir_cursor_api.cpp
++  mir_prompt_session.cpp
++  mir_prompt_session_api.cpp
++  mir_event_distributor.cpp
+ )
  add_library(
@@ -82,7 +85,7 @@
    mirclientlttngstatic
    ${MIR_COMMON_PLATFORM_LIBRARIES}
--
++
 rd_party
+ )
 === modified file 'src/client/connection_configuration.h'
 --- src/client/connection_configuration.h	2014-03-06 06:05:17 +0000
 +++ src/client/connection_configuration.h	2014-06-16 15:01:17 +0000
@@ -47,6 +47,8 @@
  class ClientPlatformFactory;
  class DisplayConfiguration;
  class LifecycleControl;
++class EventSink;
++class EventHandlerRegister;
  class ConnectionConfiguration
+ {
@@ -60,6 +62,8 @@
      virtual std::shared_ptr<input::receiver::InputPlatform> the_input_platform() = 0;
      virtual std::shared_ptr<DisplayConfiguration> the_display_configuration() = 0;
      virtual std::shared_ptr<LifecycleControl> the_lifecycle_control() = 0;
++    virtual std::shared_ptr<EventSink> the_event_sink() = 0;
++    virtual std::shared_ptr<EventHandlerRegister> the_event_handler_register() = 0;
  protected:
      ConnectionConfiguration() = default;
 === modified file 'src/client/default_connection_configuration.cpp'
 --- src/client/default_connection_configuration.cpp	2014-03-26 05:48:59 +0000
 +++ src/client/default_connection_configuration.cpp	2014-06-16 15:01:17 +0000
@@ -32,6 +32,7 @@
  #include "lifecycle_control.h"
  #include "mir/shared_library.h"
  #include "client_platform_factory.h"
++#include "mir_event_distributor.h"
  namespace mcl = mir::client;
@@ -81,7 +82,7 @@
          [this]
+         {
              return mcl::rpc::make_rpc_channel(
--                the_socket_file(), the_surface_map(), the_display_configuration(), the_rpc_report(), the_lifecycle_control());
++                the_socket_file(), the_surface_map(), the_display_configuration(), the_rpc_report(), the_lifecycle_control(), the_event_sink());
          });
+ }
@@ -182,3 +183,21 @@
              return std::make_shared<mcl::LifecycleControl>();
          });
+ }
++
++std::shared_ptr<mcl::EventSink> mcl::DefaultConnectionConfiguration::the_event_sink()
++{
++    return event_distributor(
++        []
++        {
++            return std::make_shared<MirEventDistributor>();
++        });
++}
++
++std::shared_ptr<mcl::EventHandlerRegister> mcl::DefaultConnectionConfiguration::the_event_handler_register()
++{
++    return event_distributor(
++        []
++        {
++            return std::make_shared<MirEventDistributor>();
++        });
++}
 === modified file 'src/client/default_connection_configuration.h'
 --- src/client/default_connection_configuration.h	2014-03-06 06:05:17 +0000
 +++ src/client/default_connection_configuration.h	2014-06-16 15:01:17 +0000
@@ -36,6 +36,7 @@
+ }
  namespace client
+ {
++class EventDistributor;
  namespace rpc
+ {
@@ -54,6 +55,8 @@
      std::shared_ptr<input::receiver::InputPlatform> the_input_platform();
      std::shared_ptr<DisplayConfiguration> the_display_configuration();
      std::shared_ptr<LifecycleControl> the_lifecycle_control();
++    std::shared_ptr<EventSink> the_event_sink();
++    std::shared_ptr<EventHandlerRegister> the_event_handler_register();
      virtual std::string the_socket_file();
      virtual std::shared_ptr<rpc::RpcReport> the_rpc_report();
@@ -67,6 +70,7 @@
      CachedPtr<ConnectionSurfaceMap> surface_map;
      CachedPtr<DisplayConfiguration> display_configuration;
      CachedPtr<LifecycleControl> lifecycle_control;
++    CachedPtr<EventDistributor> event_distributor;
      CachedPtr<rpc::RpcReport> rpc_report;
      CachedPtr<input::receiver::InputReceiverReport> input_receiver_report;
 === added file 'src/client/event_distributor.h'
 --- src/client/event_distributor.h	1970-01-01 00:00:00 +0000
 +++ src/client/event_distributor.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,37 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_CLIENT_EVENT_DISTRIBUTOR_H_
++#define MIR_CLIENT_EVENT_DISTRIBUTOR_H_
++
++#include "event_sink.h"
++#include "event_handler_register.h"
++
++namespace mir
++{
++namespace client
++{
++
++class EventDistributor : public EventHandlerRegister, public EventSink
++{
++};
++
++} // namespace client
++} // namespace mir
++
++#endif // MIR_CLIENT_EVENT_DISTRIBUTOR_H_
 === added file 'src/client/event_handler_register.h'
 --- src/client/event_handler_register.h	1970-01-01 00:00:00 +0000
 +++ src/client/event_handler_register.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,47 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_CLIENT_EVENT_HANDLER_REGISTER_H_
++#define MIR_CLIENT_EVENT_HANDLER_REGISTER_H_
++
++#include "mir_toolkit/event.h"
++
++#include <functional>
++
++namespace mir
++{
++namespace client
++{
++
++class EventHandlerRegister
++{
++public:
++    virtual ~EventHandlerRegister() = default;
++
++    virtual int register_event_handler(std::function<void(MirEvent const&)> const&) = 0;
++    virtual void unregister_event_handler(int id) = 0;
++
++protected:
++    EventHandlerRegister() = default;
++    EventHandlerRegister(EventHandlerRegister const&) = delete;
++    EventHandlerRegister& operator=(EventHandlerRegister const&) = delete;
++};
++} // namespace client
++} // namespace mir
++
++#endif // MIR_CLIENT_EVENT_HANDLER_REGISTER_H_
 === added file 'src/client/event_sink.h'
 --- src/client/event_sink.h	1970-01-01 00:00:00 +0000
 +++ src/client/event_sink.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,44 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_CLIENT_EVENT_SINK_H_
++#define MIR_CLIENT_EVENT_SINK_H_
++
++#include "mir_toolkit/event.h"
++
++namespace mir
++{
++namespace client
++{
++
++class EventSink
++{
++public:
++    virtual ~EventSink() = default;
++
++    virtual void handle_event(MirEvent const& e) = 0;
++
++protected:
++    EventSink() = default;
++    EventSink(EventSink const&) = delete;
++    EventSink& operator=(EventSink const&) = delete;
++};
++} // namespace client
++} // namespace mir
++
++#endif // MIR_CLIENT_EVENT_SINK_H_
 === modified file 'src/client/mir_connection.cpp'
 --- src/client/mir_connection.cpp	2014-06-11 16:24:02 +0000
 +++ src/client/mir_connection.cpp	2014-06-16 15:01:17 +0000
@@ -18,6 +18,7 @@
  #include "mir_connection.h"
  #include "mir_surface.h"
++#include "mir_prompt_session.h"
  #include "client_platform.h"
  #include "client_platform_factory.h"
  #include "rpc/mir_basic_rpc_channel.h"
@@ -82,7 +83,8 @@
          input_platform(conf.the_input_platform()),
          display_configuration(conf.the_display_configuration()),
          lifecycle_control(conf.the_lifecycle_control()),
--        surface_map(conf.the_surface_map())
++        surface_map(conf.the_surface_map()),
++        event_handler_register(conf.the_event_handler_register())
+ {
      connect_result.set_error("connect not called");
+     {
@@ -194,6 +196,11 @@
      return new_wait_handle;
+ }
++MirPromptSession* MirConnection::create_prompt_session()
++{
++    return new MirPromptSession(display_server(), event_handler_register);
++}
++
  namespace
+ {
  void default_lifecycle_event_handler(MirLifecycleState transition)
@@ -307,40 +314,6 @@
      return &drm_auth_magic_wait_handle;
+ }
--MirWaitHandle* MirConnection::new_fds_for_trusted_clients(
--    unsigned int no_of_fds,
--    mir_client_fd_callback callback,
--    void * context)
--{
--    mir::protobuf::SocketFDRequest request;
--    request.set_number(no_of_fds);
--
--    server.new_fds_for_trusted_clients(
--        nullptr,
--        &request,
--        &socket_fd_response,
--        google::protobuf::NewCallback(this, &MirConnection::done_fds_for_trusted_clients,
--                                              callback, context));
--
--    return &fds_for_trusted_clients_wait_handle;
--}
--
--void MirConnection::done_fds_for_trusted_clients(
--    mir_client_fd_callback callback,
--    void* context)
--{
--    auto const size = socket_fd_response.fd_size();
--
--    std::vector<int> fds;
--    fds.reserve(size);
--
--    for (auto i = 0; i != size; ++i)
--        fds.push_back(socket_fd_response.fd(i));
--
--    callback(this, size, fds.data(), context);
--    fds_for_trusted_clients_wait_handle.result_received();
--}
--
  bool MirConnection::is_valid(MirConnection *connection)
+ {
+     {
@@ -526,6 +499,6 @@
+ }
  mir::protobuf::DisplayServer& MirConnection::display_server()
--{
++{
      return server;
+ }
 === modified file 'src/client/mir_connection.h'
 --- src/client/mir_connection.h	2014-06-02 17:07:02 +0000
 +++ src/client/mir_connection.h	2014-06-16 15:01:17 +0000
@@ -45,6 +45,7 @@
  class ConnectionSurfaceMap;
  class DisplayConfiguration;
  class LifecycleControl;
++class EventHandlerRegister;
  namespace rpc
+ {
@@ -86,6 +87,8 @@
              mir_surface_callback callback,
              void *context);
++    MirPromptSession* create_prompt_session();
++
      char const * get_error_message();
      MirWaitHandle* connect(
@@ -123,11 +126,6 @@
      bool set_extra_platform_data(std::vector<int> const& extra_platform_data);
--    MirWaitHandle* new_fds_for_trusted_clients(
--        unsigned int no_of_fds,
--        mir_client_fd_callback callback,
--        void * context);
--
      std::shared_ptr<google::protobuf::RpcChannel> rpc_channel() const
+     {
          return channel;
@@ -147,7 +145,6 @@
      mir::protobuf::ConnectParameters connect_parameters;
      mir::protobuf::DRMAuthMagicStatus drm_auth_magic_status;
      mir::protobuf::DisplayConfiguration display_configuration_response;
--    mir::protobuf::SocketFD socket_fd_response;
      std::shared_ptr<mir::client::ClientPlatformFactory> const client_platform_factory;
      std::shared_ptr<mir::client::ClientPlatform> platform;
@@ -161,7 +158,6 @@
      MirWaitHandle disconnect_wait_handle;
      MirWaitHandle drm_auth_magic_wait_handle;
      MirWaitHandle configure_display_wait_handle;
--    MirWaitHandle fds_for_trusted_clients_wait_handle;
      std::mutex release_wait_handle_guard;
      std::vector<MirWaitHandle*> release_wait_handles;
@@ -172,6 +168,8 @@
      std::shared_ptr<mir::client::ConnectionSurfaceMap> const surface_map;
++    std::shared_ptr<mir::client::EventHandlerRegister> const event_handler_register;
++
      std::vector<int> extra_platform_data;
      struct SurfaceRelease;
@@ -181,7 +179,6 @@
      void connected(mir_connected_callback callback, void * context);
      void released(SurfaceRelease );
      void done_drm_auth_magic(mir_drm_auth_magic_callback callback, void* context);
--    void done_fds_for_trusted_clients(mir_client_fd_callback callback, void* context);
      bool validate_user_display_config(MirDisplayConfiguration* config);
  };
 === modified file 'src/client/mir_connection_api.cpp'
 --- src/client/mir_connection_api.cpp	2014-06-02 17:07:02 +0000
 +++ src/client/mir_connection_api.cpp	2014-06-16 15:01:17 +0000
@@ -272,24 +272,6 @@
+     }
+ }
--MirWaitHandle* mir_connection_new_fds_for_trusted_clients(
--    MirConnection* connection,
--    unsigned int no_of_fds,
--    mir_client_fd_callback callback,
--    void * context)
--{
--    try
--    {
--        return connection ?
--            connection->new_fds_for_trusted_clients(no_of_fds, callback, context) :
--            nullptr;
--    }
--    catch (std::exception const&)
--    {
--        return nullptr;
--    }
--}
--
  MirEGLNativeDisplayType mir_connection_get_egl_native_display(
      MirConnection* connection)
+ {
 === added file 'src/client/mir_event_distributor.cpp'
 --- src/client/mir_event_distributor.cpp	1970-01-01 00:00:00 +0000
 +++ src/client/mir_event_distributor.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,56 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#include "mir_event_distributor.h"
++
++MirEventDistributor::MirEventDistributor() :
++    next_fn_id{0}
++{
++}
++
++int MirEventDistributor::register_event_handler(std::function<void(MirEvent const&)> const& fn)
++{
++    std::unique_lock<decltype(mutex)> lock(mutex);
++
++    int id = ++next_fn_id;
++    event_handlers[id] = fn;
++    return id;
++}
++
++void MirEventDistributor::unregister_event_handler(int id)
++{
++    std::unique_lock<decltype(mutex)> lock(mutex);
++
++    event_handlers.erase(id);
++}
++
++void MirEventDistributor::handle_event(MirEvent const& event)
++{
++    std::unique_lock<decltype(mutex)> lock(mutex);
++
++    auto const event_handlers_copy(event_handlers);
++
++    for (auto const& handler : event_handlers_copy)
++    {
++        // Ensure handler wasn't unregistered since making copy
++        if (event_handlers.find(handler.first) != event_handlers.end())
++        {
++            handler.second(event);
++        }
++    }
++}
 === added file 'src/client/mir_event_distributor.h'
 --- src/client/mir_event_distributor.h	1970-01-01 00:00:00 +0000
 +++ src/client/mir_event_distributor.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,43 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_EVENT_DISTRIBUTOR_H
++
++#include "event_distributor.h"
++
++#include <mutex>
++#include <map>
++
++class MirEventDistributor : public mir::client::EventDistributor
++{
++public:
++    MirEventDistributor();
++    ~MirEventDistributor() = default;
++
++    int register_event_handler(std::function<void(MirEvent const&)> const&) override;
++    void unregister_event_handler(int id) override;
++
++    void handle_event(MirEvent const& event) override;
++
++private:
++    mutable std::recursive_mutex mutex;
++    std::map<int, std::function<void(MirEvent const&)>> event_handlers;
++    int next_fn_id;
++};
++
++#endif /* MIR_EVENT_DISTRIBUTOR_H */
 === added file 'src/client/mir_prompt_session.cpp'
 --- src/client/mir_prompt_session.cpp	1970-01-01 00:00:00 +0000
 +++ src/client/mir_prompt_session.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,203 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#include "mir_prompt_session.h"
++#include "event_handler_register.h"
++
++namespace mp = mir::protobuf;
++namespace mcl = mir::client;
++
++MirPromptSession::MirPromptSession(
++    mp::DisplayServer& server,
++    std::shared_ptr<mcl::EventHandlerRegister> const& event_handler_register) :
++    server(server),
++    event_handler_register(event_handler_register),
++    event_handler_register_id{event_handler_register->register_event_handler(
++        [this](MirEvent const& event)
++        {
++            if (event.type == mir_event_type_prompt_session_state_change)
++                set_state(event.prompt_session.new_state);
++        })},
++    state(mir_prompt_session_state_stopped),
++    handle_prompt_session_state_change{[](MirPromptSessionState){}}
++{
++}
++
++MirPromptSession::~MirPromptSession()
++{
++    set_state(mir_prompt_session_state_stopped);
++}
++
++void MirPromptSession::set_state(MirPromptSessionState new_state)
++{
++    std::lock_guard<decltype(event_handler_mutex)> lock(event_handler_mutex);
++
++    if (new_state != state)
++    {
++        handle_prompt_session_state_change(new_state);
++
++        if (new_state == mir_prompt_session_state_stopped)
++        {
++            event_handler_register->unregister_event_handler(event_handler_register_id);
++        }
++
++        state = new_state;
++    }
++}
++
++MirWaitHandle* MirPromptSession::start(pid_t application_pid, mir_prompt_session_callback callback, void* context)
++{
++    {
++        std::lock_guard<decltype(mutex)> lock(mutex);
++        parameters.set_application_pid(application_pid);
++    }
++
++    start_wait_handle.expect_result();
++    server.start_prompt_session(
++        0,
++        &parameters,
++        &session,
++        google::protobuf::NewCallback(this, &MirPromptSession::done_start,
++                                      callback, context));
++
++    return &start_wait_handle;
++}
++
++MirWaitHandle* MirPromptSession::stop(mir_prompt_session_callback callback, void* context)
++{
++    stop_wait_handle.expect_result();
++
++    server.stop_prompt_session(
++        0,
++        &protobuf_void,
++        &protobuf_void,
++        google::protobuf::NewCallback(this, &MirPromptSession::done_stop,
++                                      callback, context));
++
++    return &stop_wait_handle;
++}
++
++MirWaitHandle* MirPromptSession::add_prompt_provider(pid_t provider_pid,
++    mir_prompt_session_add_prompt_provider_callback callback,
++    void* context)
++{
++    {
++        std::lock_guard<decltype(mutex)> lock(mutex);
++        prompt_provider.set_pid(provider_pid);
++    }
++
++    add_result_wait_handle.expect_result();
++    server.add_prompt_provider(
++        0,
++        &prompt_provider,
++        &add_result,
++        google::protobuf::NewCallback(this, &MirPromptSession::done_add_prompt_provider,
++                                      callback, context));
++
++    return &add_result_wait_handle;
++}
++
++void MirPromptSession::register_prompt_session_state_change_callback(
++    mir_prompt_session_state_change_callback callback,
++    void* context)
++{
++    std::lock_guard<decltype(event_handler_mutex)> lock(event_handler_mutex);
++
++    handle_prompt_session_state_change =
++        [this, callback, context](MirPromptSessionState new_state)
++        {
++            callback(this, new_state, context);
++        };
++}
++
++void MirPromptSession::done_start(mir_prompt_session_callback callback, void* context)
++{
++    {
++        std::lock_guard<decltype(session_mutex)> lock(session_mutex);
++
++        state = session.has_error() ? mir_prompt_session_state_stopped : mir_prompt_session_state_started;
++    }
++
++    callback(this, context);
++    start_wait_handle.result_received();
++}
++
++void MirPromptSession::done_stop(mir_prompt_session_callback callback, void* context)
++{
++    set_state(mir_prompt_session_state_stopped);
++
++    callback(this, context);
++    stop_wait_handle.result_received();
++}
++
++void MirPromptSession::done_add_prompt_provider(mir_prompt_session_add_prompt_provider_callback callback, void* context)
++{
++    MirBool added = mir_true;
++    if (add_result.has_error())
++    {
++        added = mir_false;
++    }
++    callback(this, added, context);
++    add_result_wait_handle.result_received();
++}
++
++char const* MirPromptSession::get_error_message()
++{
++    std::lock_guard<decltype(session_mutex)> lock(session_mutex);
++
++    if (!session.has_error())
++        session.set_error(std::string{});
++
++    return session.error().c_str();
++}
++
++MirWaitHandle* MirPromptSession::new_fds_for_prompt_providers(
++    unsigned int no_of_fds,
++    mir_client_fd_callback callback,
++    void * context)
++{
++    mir::protobuf::SocketFDRequest request;
++    request.set_number(no_of_fds);
++
++    fds_for_prompt_providers_wait_handle.expect_result();
++
++    server.new_fds_for_prompt_providers(
++        nullptr,
++        &request,
++        &socket_fd_response,
++        google::protobuf::NewCallback(this, &MirPromptSession::done_fds_for_prompt_providers,
++                                              callback, context));
++
++    return &fds_for_prompt_providers_wait_handle;
++}
++
++void MirPromptSession::done_fds_for_prompt_providers(
++    mir_client_fd_callback callback,
++    void* context)
++{
++    auto const size = socket_fd_response.fd_size();
++
++    std::vector<int> fds;
++    fds.reserve(size);
++
++    for (auto i = 0; i != size; ++i)
++        fds.push_back(socket_fd_response.fd(i));
++
++    callback(this, size, fds.data(), context);
++    fds_for_prompt_providers_wait_handle.result_received();
++}
 === added file 'src/client/mir_prompt_session.h'
 --- src/client/mir_prompt_session.h	1970-01-01 00:00:00 +0000
 +++ src/client/mir_prompt_session.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,94 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_CLIENT_MIR_PROMPT_SESSION_H_
++#define MIR_CLIENT_MIR_PROMPT_SESSION_H_
++
++#include "mir_toolkit/mir_client_library.h"
++
++#include "mir_protobuf.pb.h"
++#include "mir_wait_handle.h"
++
++#include <mutex>
++#include <memory>
++#include <atomic>
++
++namespace mir
++{
++/// The client-side library implementation namespace
++namespace client
++{
++class EventHandlerRegister;
++}
++}
++
++struct MirPromptSession
++{
++public:
++    MirPromptSession(mir::protobuf::DisplayServer& server,
++                     std::shared_ptr<mir::client::EventHandlerRegister> const& event_handler_register);
++
++    ~MirPromptSession();
++
++    MirWaitHandle* start(pid_t application_pid, mir_prompt_session_callback callback, void* context);
++    MirWaitHandle* stop(mir_prompt_session_callback callback, void* context);
++    MirWaitHandle* add_prompt_provider(pid_t provider_pid, mir_prompt_session_add_prompt_provider_callback callback, void* context);
++
++    MirWaitHandle* new_fds_for_prompt_providers(
++        unsigned int no_of_fds,
++        mir_client_fd_callback callback,
++        void * context);
++
++    void register_prompt_session_state_change_callback(mir_prompt_session_state_change_callback callback, void* context);
++
++    char const* get_error_message();
++
++private:
++    std::mutex mutable mutex; // Protects parameters, wait_handles & results
++    mir::protobuf::DisplayServer& server;
++    mir::protobuf::PromptProvider prompt_provider;
++    mir::protobuf::PromptSessionParameters parameters;
++    mir::protobuf::Void add_result;
++    mir::protobuf::Void protobuf_void;
++    mir::protobuf::SocketFD socket_fd_response;
++    std::shared_ptr<mir::client::EventHandlerRegister> const event_handler_register;
++    int const event_handler_register_id;
++
++    MirWaitHandle start_wait_handle;
++    MirWaitHandle stop_wait_handle;
++    MirWaitHandle add_result_wait_handle;
++    MirWaitHandle fds_for_prompt_providers_wait_handle;
++    std::atomic<MirPromptSessionState> state;
++
++    std::mutex mutable session_mutex; // Protects session
++    mir::protobuf::Void session;
++
++    std::mutex mutable event_handler_mutex; // Need another mutex for callback access to members
++    std::function<void(MirPromptSessionState)> handle_prompt_session_state_change;
++
++    void set_state(MirPromptSessionState new_state);
++    void done_start(mir_prompt_session_callback callback, void* context);
++    void done_stop(mir_prompt_session_callback callback, void* context);
++    void done_add_prompt_provider(mir_prompt_session_add_prompt_provider_callback callback, void* context);
++    void done_fds_for_prompt_providers(mir_client_fd_callback callback, void* context);
++    MirPromptSession(MirPromptSession const&) = delete;
++    MirPromptSession& operator=(MirPromptSession const&) = delete;
++};
++
++#endif /* MIR_CLIENT_MIR_PROMPT_SESSION_H_ */
++
 === added file 'src/client/mir_prompt_session_api.cpp'
 --- src/client/mir_prompt_session_api.cpp	1970-01-01 00:00:00 +0000
 +++ src/client/mir_prompt_session_api.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,118 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU Lesser General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++
++#include "mir_toolkit/mir_prompt_session.h"
++#include "mir_prompt_session.h"
++#include "mir_connection.h"
++
++#include <stdexcept>
++#include <boost/throw_exception.hpp>
++
++namespace
++{
++void null_callback(MirPromptSession*, void*) {}
++
++void add_prompt_provider_callback(
++    MirPromptSession*,
++    MirBool added,
++    void* context)
++{
++    if (context)
++        *(MirBool*)context = added;
++}
++
++}
++
++MirPromptSession *mir_connection_create_prompt_session_sync(
++    MirConnection* connection,
++    pid_t application_pid,
++    mir_prompt_session_state_change_callback state_change_callback,
++    void* context)
++{
++    try
++    {
++        auto prompt_session = connection->create_prompt_session();
++        if (state_change_callback)
++            prompt_session->register_prompt_session_state_change_callback(state_change_callback, context);
++
++        mir_wait_for(prompt_session->start(application_pid,
++                     null_callback,
++                     nullptr));
++        return prompt_session;
++    }
++    catch (std::exception const&)
++    {
++        // TODO callback with an error
++        return nullptr;
++    }
++}
++
++MirWaitHandle *mir_prompt_session_add_prompt_provider(
++    MirPromptSession *prompt_session,
++    pid_t provider_pid,
++    mir_prompt_session_add_prompt_provider_callback callback,
++    void* context)
++{
++    try
++    {
++        return prompt_session->add_prompt_provider(provider_pid, callback, context);
++    }
++    catch (std::exception const&)
++    {
++        // TODO callback with an error
++        return nullptr;
++    }
++}
++
++MirBool mir_prompt_session_add_prompt_provider_sync(
++    MirPromptSession *prompt_session,
++    pid_t provider_pid)
++{
++    MirBool result;
++    mir_wait_for(mir_prompt_session_add_prompt_provider(prompt_session,
++        provider_pid,
++        add_prompt_provider_callback,
++        &result));
++    return result;
++}
++
++MirWaitHandle* mir_prompt_session_new_fds_for_prompt_providers(
++    MirPromptSession *prompt_session,
++    unsigned int no_of_fds,
++    mir_client_fd_callback callback,
++    void * context)
++{
++    try
++    {
++        return prompt_session ?
++            prompt_session->new_fds_for_prompt_providers(no_of_fds, callback, context) :
++            nullptr;
++    }
++    catch (std::exception const&)
++    {
++        return nullptr;
++    }
++}
++
++void mir_prompt_session_release_sync(
++    MirPromptSession *prompt_session)
++{
++    mir_wait_for(prompt_session->stop(&null_callback, nullptr));
++    delete prompt_session;
++}
 === modified file 'src/client/rpc/make_rpc_channel.h'
 --- src/client/rpc/make_rpc_channel.h	2014-03-06 06:05:17 +0000
 +++ src/client/rpc/make_rpc_channel.h	2014-06-16 15:01:17 +0000
@@ -29,6 +29,7 @@
  class SurfaceMap;
  class DisplayConfiguration;
  class LifecycleControl;
++class EventSink;
  namespace rpc
+ {
@@ -39,7 +40,8 @@
                   std::shared_ptr<SurfaceMap> const& map,
                   std::shared_ptr<DisplayConfiguration> const& disp_conf,
                   std::shared_ptr<RpcReport> const& rpc_report,
--                 std::shared_ptr<LifecycleControl> const& lifecycle_control);
++                 std::shared_ptr<LifecycleControl> const& lifecycle_control,
++                 std::shared_ptr<EventSink> const& event_distributor);
+ }
+ }
+ }
 === modified file 'src/client/rpc/make_socket_rpc_channel.cpp'
 --- src/client/rpc/make_socket_rpc_channel.cpp	2014-03-06 06:05:17 +0000
 +++ src/client/rpc/make_socket_rpc_channel.cpp	2014-06-16 15:01:17 +0000
@@ -44,13 +44,14 @@
                         std::shared_ptr<mcl::SurfaceMap> const& map,
                         std::shared_ptr<mcl::DisplayConfiguration> const& disp_conf,
                         std::shared_ptr<RpcReport> const& rpc_report,
--                       std::shared_ptr<mcl::LifecycleControl> const& lifecycle_control)
++                       std::shared_ptr<mcl::LifecycleControl> const& lifecycle_control,
++                       std::shared_ptr<mcl::EventSink> const& event_sink)
+ {
      if (fd_prefix.is_start_of(name))
+     {
          auto const fd = atoi(name.c_str()+fd_prefix.size);
--        return std::make_shared<MirSocketRpcChannel>(fd, map, disp_conf, rpc_report, lifecycle_control);
++        return std::make_shared<MirSocketRpcChannel>(fd, map, disp_conf, rpc_report, lifecycle_control, event_sink);
+     }
--    return std::make_shared<MirSocketRpcChannel>(name, map, disp_conf, rpc_report, lifecycle_control);
++    return std::make_shared<MirSocketRpcChannel>(name, map, disp_conf, rpc_report, lifecycle_control, event_sink);
+ }
 === modified file 'src/client/rpc/mir_socket_rpc_channel.cpp'
 --- src/client/rpc/mir_socket_rpc_channel.cpp	2014-06-09 17:16:32 +0000
 +++ src/client/rpc/mir_socket_rpc_channel.cpp	2014-06-16 15:01:17 +0000
@@ -24,6 +24,7 @@
  #include "../mir_surface.h"
  #include "../display_configuration.h"
  #include "../lifecycle_control.h"
++#include "../event_sink.h"
  #include "mir/variable_length_array.h"
  #include "mir_protobuf.pb.h"  // For Buffer frig
@@ -50,7 +51,8 @@
      std::shared_ptr<mcl::SurfaceMap> const& surface_map,
      std::shared_ptr<DisplayConfiguration> const& disp_config,
      std::shared_ptr<RpcReport> const& rpc_report,
--    std::shared_ptr<LifecycleControl> const& lifecycle_control) :
++    std::shared_ptr<LifecycleControl> const& lifecycle_control,
++    std::shared_ptr<EventSink> const& event_sink) :
      rpc_report(rpc_report),
      pending_calls(rpc_report),
      work(io_service),
@@ -58,6 +60,7 @@
      surface_map(surface_map),
      display_configuration(disp_config),
      lifecycle_control(lifecycle_control),
++    event_sink(event_sink),
      disconnected(false)
+ {
      socket.connect(endpoint);
@@ -69,7 +72,8 @@
      std::shared_ptr<mcl::SurfaceMap> const& surface_map,
      std::shared_ptr<DisplayConfiguration> const& disp_config,
      std::shared_ptr<RpcReport> const& rpc_report,
--    std::shared_ptr<LifecycleControl> const& lifecycle_control) :
++    std::shared_ptr<LifecycleControl> const& lifecycle_control,
++    std::shared_ptr<EventSink> const& event_sink) :
      rpc_report(rpc_report),
      pending_calls(rpc_report),
      work(io_service),
@@ -77,6 +81,7 @@
      surface_map(surface_map),
      display_configuration(disp_config),
      lifecycle_control(lifecycle_control),
++    event_sink(event_sink),
      disconnected(false)
+ {
      socket.assign(boost::asio::local::stream_protocol(), native_socket);
@@ -413,11 +418,25 @@
                  rpc_report->event_parsing_succeeded(e);
--                surface_map->with_surface_do(e.surface.id,
--                    [&e](MirSurface* surface)
--                    {
--                        surface->handle_event(e);
--                    });
++                event_sink->handle_event(e);
++
++                // todo - surfaces should register with the event handler register.
++                if (e.type == mir_event_type_surface)
++                {
++                    surface_map->with_surface_do(e.surface.id,
++                        [&e](MirSurface* surface)
++                        {
++                            surface->handle_event(e);
++                        });
++                }
++                else if (e.type == mir_event_type_resize)
++                {
++                    surface_map->with_surface_do(e.resize.surface_id,
++                        [&e](MirSurface* surface)
++                        {
++                            surface->handle_event(e);
++                        });
++                }
+             }
              else
+             {
 === modified file 'src/client/rpc/mir_socket_rpc_channel.h'
 --- src/client/rpc/mir_socket_rpc_channel.h	2014-06-02 17:07:02 +0000
 +++ src/client/rpc/mir_socket_rpc_channel.h	2014-06-16 15:01:17 +0000
@@ -44,6 +44,7 @@
  class DisplayConfiguration;
  class SurfaceMap;
  class LifecycleControl;
++class EventSink;
  namespace rpc
+ {
@@ -56,13 +57,15 @@
                          std::shared_ptr<SurfaceMap> const& surface_map,
                          std::shared_ptr<DisplayConfiguration> const& disp_config,
                          std::shared_ptr<RpcReport> const& rpc_report,
--                        std::shared_ptr<LifecycleControl> const& lifecycle_control);
++                        std::shared_ptr<LifecycleControl> const& lifecycle_control,
++                        std::shared_ptr<EventSink> const& event_sink);
      MirSocketRpcChannel(int native_socket,
                          std::shared_ptr<SurfaceMap> const& surface_map,
                          std::shared_ptr<DisplayConfiguration> const& disp_config,
                          std::shared_ptr<RpcReport> const& rpc_report,
--                        std::shared_ptr<LifecycleControl> const& lifecycle_control);
++                        std::shared_ptr<LifecycleControl> const& lifecycle_control,
++                        std::shared_ptr<EventSink> const& event_sink);
      ~MirSocketRpcChannel();
  private:
@@ -102,6 +105,7 @@
      std::shared_ptr<SurfaceMap> surface_map;
      std::shared_ptr<DisplayConfiguration> display_configuration;
      std::shared_ptr<LifecycleControl> lifecycle_control;
++    std::shared_ptr<EventSink> event_sink;
      std::atomic<bool> disconnected;
  };
 === modified file 'src/server/default_server_configuration.cpp'
 --- src/server/default_server_configuration.cpp	2014-06-02 17:07:02 +0000
 +++ src/server/default_server_configuration.cpp	2014-06-16 15:01:17 +0000
@@ -37,6 +37,7 @@
  #include "mir/time/high_resolution_clock.h"
  #include "mir/geometry/rectangles.h"
  #include "mir/default_configuration.h"
++#include "mir/scene/null_prompt_session_listener.h"
  #include <map>
  #include <vector>
@@ -90,6 +91,16 @@
          });
+ }
++std::shared_ptr<ms::PromptSessionListener>
++mir::DefaultServerConfiguration::the_prompt_session_listener()
++{
++    return prompt_session_listener(
++        [this]
++        {
++            return std::make_shared<ms::NullPromptSessionListener>();
++        });
++}
++
  std::shared_ptr<mi::CursorListener>
  mir::DefaultServerConfiguration::the_cursor_listener()
+ {
 === modified file 'src/server/frontend/protobuf_message_processor.cpp'
 --- src/server/frontend/protobuf_message_processor.cpp	2014-06-02 17:07:02 +0000
 +++ src/server/frontend/protobuf_message_processor.cpp	2014-06-16 15:01:17 +0000
@@ -183,9 +183,21 @@
+         {
              invoke(this, display_server.get(), &protobuf::DisplayServer::configure_cursor, invocation);
+         }
--        else if ("new_fds_for_trusted_clients" == invocation.method_name())
--        {
--            invoke(this, display_server.get(), &protobuf::DisplayServer::new_fds_for_trusted_clients, invocation);
++        else if ("new_fds_for_prompt_providers" == invocation.method_name())
++        {
++            invoke(this, display_server.get(), &protobuf::DisplayServer::new_fds_for_prompt_providers, invocation);
++        }
++        else if ("start_prompt_session" == invocation.method_name())
++        {
++            invoke(this, display_server.get(), &protobuf::DisplayServer::start_prompt_session, invocation);
++        }
++        else if ("add_prompt_provider" == invocation.method_name())
++        {
++            invoke(this, display_server.get(), &protobuf::DisplayServer::add_prompt_provider, invocation);
++        }
++        else if ("stop_prompt_session" == invocation.method_name())
++        {
++            invoke(this, display_server.get(), &protobuf::DisplayServer::stop_prompt_session, invocation);
+         }
          else if ("disconnect" == invocation.method_name())
+         {
 === modified file 'src/server/frontend/session_mediator.cpp'
 --- src/server/frontend/session_mediator.cpp	2014-06-03 16:43:38 +0000
 +++ src/server/frontend/session_mediator.cpp	2014-06-16 15:01:17 +0000
@@ -41,6 +41,8 @@
  #include "mir/frontend/client_constants.h"
  #include "mir/frontend/event_sink.h"
  #include "mir/frontend/screencast.h"
++#include "mir/frontend/prompt_session.h"
++#include "mir/scene/prompt_session_creation_parameters.h"
  #include "mir/geometry/rectangles.h"
  #include "client_buffer_tracker.h"
@@ -423,9 +425,16 @@
      done->Run();
+ }
--std::function<void(std::shared_ptr<mf::Session> const&)> mf::SessionMediator::trusted_connect_handler() const
++std::function<void(std::shared_ptr<mf::Session> const&)> mf::SessionMediator::prompt_session_connect_handler() const
+ {
--    return [](std::shared_ptr<frontend::Session> const&) {};
++    return [this](std::shared_ptr<frontend::Session> const& session)
++    {
++        auto prompt_session = weak_prompt_session.lock();
++        if (prompt_session.get() == nullptr)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid prompt session"));
++
++        shell->add_prompt_provider_for(prompt_session, session);
++    };
+ }
  void mf::SessionMediator::configure_cursor(
@@ -446,7 +455,7 @@
          auto const id = frontend::SurfaceId(cursor_request->surfaceid().value());
          auto const surface = session->get_surface(id);
--
++
          if (cursor_request->has_name())
+         {
              auto const& image = cursor_images->image(cursor_request->name(), mg::default_cursor_size);
@@ -460,7 +469,7 @@
      done->Run();
+ }
--void mf::SessionMediator::new_fds_for_trusted_clients(
++void mf::SessionMediator::new_fds_for_prompt_providers(
      ::google::protobuf::RpcController* ,
      ::mir::protobuf::SocketFDRequest const* parameters,
      ::mir::protobuf::SocketFD* response,
@@ -473,8 +482,7 @@
          if (session.get() == nullptr)
              BOOST_THROW_EXCEPTION(std::logic_error("Invalid application session"));
--        // TODO write a handler that connects the new session to our trust session
--        auto const connect_handler = trusted_connect_handler();
++        auto const connect_handler = prompt_session_connect_handler();
          auto const fds_requested = parameters->number();
@@ -531,6 +539,83 @@
      done->Run();
+ }
++void mf::SessionMediator::start_prompt_session(
++    ::google::protobuf::RpcController*,
++    const ::mir::protobuf::PromptSessionParameters* request,
++    ::mir::protobuf::Void* /*response*/,
++    ::google::protobuf::Closure* done)
++{
++    {
++        std::unique_lock<std::mutex> lock(session_mutex);
++        auto const session = weak_session.lock();
++
++        if (!session)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid application session"));
++
++        if (weak_prompt_session.lock())
++            BOOST_THROW_EXCEPTION(std::runtime_error("Cannot start another prompt session"));
++
++        ms::PromptSessionCreationParameters parameters;
++        parameters.application_pid = request->application_pid();
++
++        report->session_start_prompt_session_called(session->name(), parameters.application_pid);
++
++        weak_prompt_session = shell->start_prompt_session_for(session, parameters);
++    }
++    done->Run();
++}
++
++void mf::SessionMediator::add_prompt_provider(
++    ::google::protobuf::RpcController*,
++    const ::mir::protobuf::PromptProvider* request,
++    ::mir::protobuf::Void*,
++    ::google::protobuf::Closure* done)
++{
++    {
++        std::unique_lock<std::mutex> lock(session_mutex);
++        auto const session = weak_session.lock();
++
++        if (!session)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid application session"));
++
++        auto const prompt_session = weak_prompt_session.lock();
++
++        if (!prompt_session)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid prompt session"));
++
++        report->session_add_prompt_provider_called(session->name(), request->pid());
++        shell->add_prompt_provider_process_for(prompt_session, request->pid());
++    }
++    done->Run();
++}
++
++void mf::SessionMediator::stop_prompt_session(
++    ::google::protobuf::RpcController*,
++    const ::mir::protobuf::Void*,
++    ::mir::protobuf::Void*,
++    ::google::protobuf::Closure* done)
++{
++    {
++        std::unique_lock<std::mutex> lock(session_mutex);
++        auto const session = weak_session.lock();
++
++        if (!session)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid application session"));
++
++        auto const prompt_session = weak_prompt_session.lock();
++
++        if (!prompt_session)
++            BOOST_THROW_EXCEPTION(std::logic_error("Invalid prompt session"));
++
++        weak_prompt_session.reset();
++
++        report->session_stop_prompt_session_called(session->name());
++
++        shell->stop_prompt_session(prompt_session);
++    }
++    done->Run();
++}
++
  void mf::SessionMediator::pack_protobuf_buffer(
      protobuf::Buffer& protobuf_buffer,
      graphics::Buffer* graphics_buffer,
 === modified file 'src/server/frontend/session_mediator.h'
 --- src/server/frontend/session_mediator.h	2014-06-03 16:43:38 +0000
 +++ src/server/frontend/session_mediator.h	2014-06-16 15:01:17 +0000
@@ -54,6 +54,7 @@
  class EventSink;
  class DisplayChanger;
  class Screencast;
++class PromptSession;
  // SessionMediator relays requests from the client process into the server.
  class SessionMediator : public detail::DisplayServer
@@ -109,9 +110,9 @@
                             google::protobuf::Closure* done) override;
      void configure_display(::google::protobuf::RpcController* controller,
--                       const ::mir::protobuf::DisplayConfiguration* request,
--                       ::mir::protobuf::DisplayConfiguration* response,
--                       ::google::protobuf::Closure* done) override;
++                           const ::mir::protobuf::DisplayConfiguration* request,
++                           ::mir::protobuf::DisplayConfiguration* response,
++                           ::google::protobuf::Closure* done) override;
      void create_screencast(google::protobuf::RpcController*,
                             const mir::protobuf::ScreencastParameters*,
@@ -127,19 +128,34 @@
                             const mir::protobuf::ScreencastId*,
                             mir::protobuf::Buffer*,
                             google::protobuf::Closure* done);
--
++
      void configure_cursor(google::protobuf::RpcController*,
                            mir::protobuf::CursorSetting const*,
                            mir::protobuf::Void*,
                            google::protobuf::Closure* done);
++    void start_prompt_session(::google::protobuf::RpcController* controller,
++                            const ::mir::protobuf::PromptSessionParameters* request,
++                            ::mir::protobuf::Void* response,
++                            ::google::protobuf::Closure* done);
++
++    void add_prompt_provider(::google::protobuf::RpcController* controller,
++                             const ::mir::protobuf::PromptProvider* request,
++                             ::mir::protobuf::Void*,
++                             ::google::protobuf::Closure* done);
++
++    void stop_prompt_session(::google::protobuf::RpcController* controller,
++                            const ::mir::protobuf::Void* request,
++                            ::mir::protobuf::Void* response,
++                            ::google::protobuf::Closure* done);
++
      /* Platform specific requests */
      void drm_auth_magic(google::protobuf::RpcController* controller,
                          const mir::protobuf::DRMMagic* request,
                          mir::protobuf::DRMAuthMagicStatus* response,
                          google::protobuf::Closure* done) override;
--    void new_fds_for_trusted_clients(
++    void new_fds_for_prompt_providers(
          ::google::protobuf::RpcController* controller,
          ::mir::protobuf::SocketFDRequest const* parameters,
          ::mir::protobuf::SocketFD* response,
@@ -152,7 +168,7 @@
      void advance_buffer(SurfaceId surf_id, Surface& surface, std::function<void(graphics::Buffer*, bool)> complete);
--    virtual std::function<void(std::shared_ptr<Session> const&)> trusted_connect_handler() const;
++    virtual std::function<void(std::shared_ptr<Session> const&)> prompt_session_connect_handler() const;
      pid_t client_pid_;
      std::shared_ptr<Shell> const shell;
@@ -173,6 +189,7 @@
      std::mutex session_mutex;
      std::weak_ptr<Session> weak_session;
++    std::weak_ptr<PromptSession> weak_prompt_session;
  };
+ }
 === modified file 'src/server/report/logging/session_mediator_report.cpp'
 --- src/server/report/logging/session_mediator_report.cpp	2014-05-12 21:11:05 +0000
 +++ src/server/report/logging/session_mediator_report.cpp	2014-06-16 15:01:17 +0000
@@ -78,6 +78,21 @@
      log->log(ml::Logger::informational, "session_configure_display_called(\"" + app_name + "\")", component);
+ }
++void mrl::SessionMediatorReport::session_start_prompt_session_called(std::string const& app_name, pid_t application_process)
++{
++    log->log(ml::Logger::informational, "session_start_prompt_session_called(\"" + app_name + ", " + std::to_string(application_process) + ")", component);
++}
++
++void mrl::SessionMediatorReport::session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process)
++{
++    log->log(ml::Logger::informational, "session_add_prompt_provider_called(\"" + app_name + ", " + std::to_string(provider_process) + ")", component);
++}
++
++void mrl::SessionMediatorReport::session_stop_prompt_session_called(std::string const& app_name)
++{
++    log->log(ml::Logger::informational, "session_stop_prompt_session_called(\"" + app_name + "\")", component);
++}
++
  void mrl::SessionMediatorReport::session_error(
          std::string const& app_name,
          char const* method,
 === modified file 'src/server/report/logging/session_mediator_report.h'
 --- src/server/report/logging/session_mediator_report.h	2014-05-12 21:11:05 +0000
 +++ src/server/report/logging/session_mediator_report.h	2014-06-16 15:01:17 +0000
@@ -59,6 +59,12 @@
      virtual void session_configure_display_called(std::string const& app_name);
++    virtual void session_start_prompt_session_called(std::string const& app_name, pid_t application_process);
++
++    virtual void session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process);
++
++    virtual void session_stop_prompt_session_called(std::string const& app_name);
++
      virtual void session_error(
          std::string const& app_name,
          char const* method,
 === modified file 'src/server/report/lttng/session_mediator_report.cpp'
 --- src/server/report/lttng/session_mediator_report.cpp	2014-05-12 21:11:05 +0000
 +++ src/server/report/lttng/session_mediator_report.cpp	2014-06-16 15:01:17 +0000
@@ -39,6 +39,17 @@
  MIR_SESSION_MEDIATOR_EVENT_METHOD(session_configure_surface_called)
  MIR_SESSION_MEDIATOR_EVENT_METHOD(session_configure_surface_cursor_called)
  MIR_SESSION_MEDIATOR_EVENT_METHOD(session_configure_display_called)
++MIR_SESSION_MEDIATOR_EVENT_METHOD(session_stop_prompt_session_called)
++
++void mir::report::lttng::SessionMediatorReport::session_start_prompt_session_called(std::string const& app_name, pid_t application_process)
++{
++    mir_tracepoint(mir_server_session_mediator, session_start_prompt_session_called, app_name.c_str(), application_process);
++}
++
++void mir::report::lttng::SessionMediatorReport::session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process)
++{
++    mir_tracepoint(mir_server_session_mediator, session_add_prompt_provider_called, app_name.c_str(), provider_process);
++}
  void mir::report::lttng::SessionMediatorReport::session_error(std::string const& app_name, char const* method, std::string const& what)
+ {
 === modified file 'src/server/report/lttng/session_mediator_report.h'
 --- src/server/report/lttng/session_mediator_report.h	2014-05-12 21:11:05 +0000
 +++ src/server/report/lttng/session_mediator_report.h	2014-06-16 15:01:17 +0000
@@ -42,6 +42,9 @@
      void session_configure_surface_called(std::string const& app_name) override;
      void session_configure_surface_cursor_called(std::string const& app_name) override;
      void session_configure_display_called(std::string const& app_name) override;
++    void session_start_prompt_session_called(std::string const& app_name, pid_t application_process) override;
++    void session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process) override;
++    void session_stop_prompt_session_called(std::string const& app_name) override;
      void session_error(std::string const& app_name, char const* method, std::string const& what) override;
  private:
 === modified file 'src/server/report/lttng/session_mediator_report_tp.h'
 --- src/server/report/lttng/session_mediator_report_tp.h	2014-05-12 21:11:05 +0000
 +++ src/server/report/lttng/session_mediator_report_tp.h	2014-06-16 15:01:17 +0000
@@ -48,6 +48,27 @@
  MIR_SESSION_MEDIATOR_EVENT(session_configure_surface_called)
  MIR_SESSION_MEDIATOR_EVENT(session_configure_surface_cursor_called)
  MIR_SESSION_MEDIATOR_EVENT(session_configure_display_called)
++MIR_SESSION_MEDIATOR_EVENT(session_stop_prompt_session_called)
++
++TRACEPOINT_EVENT(
++    mir_server_session_mediator,
++    session_start_prompt_session_called,
++    TP_ARGS(char const*, application, pid_t, application_process),
++    TP_FIELDS(
++        ctf_string(application, application)
++        ctf_integer(pid_t, application_process, application_process)
++        )
++    )
++
++TRACEPOINT_EVENT(
++    mir_server_session_mediator,
++    session_add_prompt_provider_called,
++    TP_ARGS(char const*, application, pid_t, provider_process),
++    TP_FIELDS(
++        ctf_string(application, application)
++        ctf_integer(pid_t, provider_process, provider_process)
++        )
++    )
  TRACEPOINT_EVENT(
      mir_server_session_mediator,
 === modified file 'src/server/report/null/session_mediator_report.cpp'
 --- src/server/report/null/session_mediator_report.cpp	2014-05-12 21:11:05 +0000
 +++ src/server/report/null/session_mediator_report.cpp	2014-06-16 15:01:17 +0000
@@ -54,6 +54,18 @@
+ {
+ }
++void mir::report::null::SessionMediatorReport::session_start_prompt_session_called(std::string const&, pid_t)
++{
++}
++
++void mir::report::null::SessionMediatorReport::session_add_prompt_provider_called(std::string const&, pid_t)
++{
++}
++
++void mir::report::null::SessionMediatorReport::session_stop_prompt_session_called(std::string const&)
++{
++}
++
  void mir::report::null::SessionMediatorReport::session_error(
          std::string const&,
          char const* ,
 === modified file 'src/server/report/null/session_mediator_report.h'
 --- src/server/report/null/session_mediator_report.h	2014-05-12 21:11:05 +0000
 +++ src/server/report/null/session_mediator_report.h	2014-06-16 15:01:17 +0000
@@ -53,6 +53,12 @@
      void session_configure_display_called(std::string const& app_name) override;
++    void session_start_prompt_session_called(std::string const& app_name, pid_t application_process) override;
++
++    void session_add_prompt_provider_called(std::string const& app_name, pid_t provider_process) override;
++
++    void session_stop_prompt_session_called(std::string const& app_name) override;
++
      void session_error(
          std::string const& app_name,
          char const* method,
 === modified file 'src/server/scene/CMakeLists.txt'
 --- src/server/scene/CMakeLists.txt	2014-06-02 17:07:02 +0000
 +++ src/server/scene/CMakeLists.txt	2014-06-16 15:01:17 +0000
@@ -20,4 +20,6 @@
    threaded_snapshot_strategy.cpp
    legacy_scene_change_notification.cpp
    legacy_surface_change_notification.cpp
++  prompt_session_container.cpp
++  prompt_session_manager_impl.cpp
+ )
 === modified file 'src/server/scene/application_session.cpp'
 --- src/server/scene/application_session.cpp	2014-06-02 17:07:02 +0000
 +++ src/server/scene/application_session.cpp	2014-06-16 15:01:17 +0000
@@ -23,6 +23,7 @@
  #include "snapshot_strategy.h"
  #include "mir/scene/session_listener.h"
  #include "mir/frontend/event_sink.h"
++#include "default_session_container.h"
  #include <boost/throw_exception.hpp>
@@ -30,6 +31,7 @@
  #include <memory>
  #include <cassert>
  #include <algorithm>
++#include <cstring>
  namespace mf = mir::frontend;
  namespace ms = mir::scene;
@@ -181,3 +183,22 @@
+ {
      event_sink->handle_lifecycle_event(state);
+ }
++
++void ms::ApplicationSession::start_prompt_session()
++{
++    // All sessions which are part of the prompt session get this event.
++    MirEvent start_event;
++    memset(&start_event, 0, sizeof start_event);
++    start_event.type = mir_event_type_prompt_session_state_change;
++    start_event.prompt_session.new_state = mir_prompt_session_state_started;
++    event_sink->handle_event(start_event);
++}
++
++void ms::ApplicationSession::stop_prompt_session()
++{
++    MirEvent stop_event;
++    memset(&stop_event, 0, sizeof stop_event);
++    stop_event.type = mir_event_type_prompt_session_state_change;
++    stop_event.prompt_session.new_state = mir_prompt_session_state_stopped;
++    event_sink->handle_event(stop_event);
++}
 === modified file 'src/server/scene/application_session.h'
 --- src/server/scene/application_session.h	2014-06-02 17:07:02 +0000
 +++ src/server/scene/application_session.h	2014-06-16 15:01:17 +0000
@@ -71,6 +71,9 @@
      void set_lifecycle_state(MirLifecycleState state);
++    void start_prompt_session() override;
++    void stop_prompt_session() override;
++
  protected:
      ApplicationSession(ApplicationSession const&) = delete;
      ApplicationSession& operator=(ApplicationSession const&) = delete;
 === modified file 'src/server/scene/default_configuration.cpp'
 --- src/server/scene/default_configuration.cpp	2014-06-03 16:43:38 +0000
 +++ src/server/scene/default_configuration.cpp	2014-06-16 15:01:17 +0000
@@ -35,6 +35,7 @@
  #include "surface_controller.h"
  #include "surface_stack.h"
  #include "threaded_snapshot_strategy.h"
++#include "prompt_session_manager_impl.h"
  namespace mc = mir::compositor;
  namespace mf = mir::frontend;
@@ -179,7 +180,8 @@
                      the_shell_focus_setter(),
                      the_snapshot_strategy(),
                      the_session_event_sink(),
--                    the_session_listener()));
++                    the_session_listener(),
++                    the_prompt_session_manager()));
          });
+ }
@@ -223,3 +225,15 @@
                  the_pixel_buffer());
          });
+ }
++
++std::shared_ptr<ms::PromptSessionManager>
++mir::DefaultServerConfiguration::the_prompt_session_manager()
++{
++    return prompt_session_manager(
++        [this]()
++        {
++            return std::make_shared<ms::PromptSessionManagerImpl>(
++                the_session_container(),
++                the_prompt_session_listener());
++        });
++}
 === added file 'src/server/scene/prompt_session_container.cpp'
 --- src/server/scene/prompt_session_container.cpp	1970-01-01 00:00:00 +0000
 +++ src/server/scene/prompt_session_container.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,189 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#include "prompt_session_container.h"
++#include "mir/scene/session.h"
++
++#include <boost/throw_exception.hpp>
++#include <atomic>
++
++namespace ms = mir::scene;
++namespace mf = mir::frontend;
++
++namespace
++{
++std::atomic<unsigned> insertion_order{0};
++}
++
++ms::PromptSessionContainer::PromptSessionContainer()
++    : prompt_session_index(participant_map)
++    , participant_index(get<1>(participant_map))
++    , waiting_process_prompt_session_index(waiting_process_map)
++    , waiting_process_index(get<1>(waiting_process_map))
++{
++}
++
++void ms::PromptSessionContainer::insert_prompt_session(std::shared_ptr<PromptSession> const& prompt_session)
++{
++    std::unique_lock<std::mutex> lk(mutex);
++    prompt_sessions[prompt_session.get()] = prompt_session;
++}
++
++void ms::PromptSessionContainer::remove_prompt_session(std::shared_ptr<PromptSession> const& prompt_session)
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    {
++        participant_by_prompt_session::iterator it, end;
++        boost::tie(it, end) = prompt_session_index.equal_range(prompt_session.get());
++        prompt_session_index.erase(it, end);
++    }
++
++    {
++        process_by_prompt_session::iterator it, end;
++        boost::tie(it, end) = waiting_process_prompt_session_index.equal_range(prompt_session.get());
++        waiting_process_prompt_session_index.erase(it, end);
++    }
++
++    prompt_sessions.erase(prompt_session.get());
++}
++
++bool ms::PromptSessionContainer::insert_participant(PromptSession* prompt_session, std::weak_ptr<Session> const& session, ParticipantType participant_type)
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    // the prompt session must have first been added by insert_prompt_session.
++    if (prompt_sessions.find(prompt_session) == prompt_sessions.end())
++        BOOST_THROW_EXCEPTION(std::runtime_error("Prompt Session does not exist"));
++
++    if (auto locked_session = session.lock())
++    {
++        participant_by_prompt_session::iterator it;
++        bool valid = false;
++
++        Participant participant{prompt_session, locked_session, participant_type, insertion_order++};
++        boost::tie(it,valid) = participant_map.insert(participant);
++
++        if (!valid)
++            return false;
++
++        process_by_prompt_session::iterator process_it,end;
++        boost::tie(process_it,end) = waiting_process_prompt_session_index.equal_range(boost::make_tuple(prompt_session, locked_session->process_id()));
++        if (process_it != end)
++            waiting_process_prompt_session_index.erase(process_it);
++        return true;
++    }
++    return false;
++}
++
++bool ms::PromptSessionContainer::remove_participant(PromptSession* prompt_session, std::weak_ptr<Session> const& session, ParticipantType participant_type)
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    participant_by_session::iterator it = participant_index.find(boost::make_tuple(session, participant_type, prompt_session));
++    if (it == participant_index.end())
++        return false;
++
++    participant_index.erase(it);
++    return true;
++}
++
++void ms::PromptSessionContainer::for_each_participant_in_prompt_session(
++    PromptSession* prompt_session,
++    std::function<void(std::weak_ptr<Session> const&, ms::PromptSessionContainer::ParticipantType participant_type)> f) const
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    participant_by_prompt_session::iterator it,end;
++    boost::tie(it,end) = prompt_session_index.equal_range(prompt_session);
++
++    for (; it != end; ++it)
++    {
++        Participant const& participant = *it;
++        f(participant.session, participant.participant_type);
++    }
++}
++
++void ms::PromptSessionContainer::for_each_prompt_session_with_participant(
++    std::weak_ptr<Session> const& participant,
++    ParticipantType participant_type,
++    std::function<void(std::shared_ptr<PromptSession> const&)> f) const
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    participant_by_session::iterator it,end;
++    boost::tie(it,end) = participant_index.equal_range(boost::make_tuple(participant, participant_type));
++
++    for (; it != end; ++it)
++    {
++        Participant const& participant = *it;
++
++        auto tsit = prompt_sessions.find(participant.prompt_session);
++        if (tsit != prompt_sessions.end())
++            f(tsit->second);
++    }
++}
++
++void ms::PromptSessionContainer::for_each_prompt_session_with_participant(
++    std::weak_ptr<Session> const& participant,
++    std::function<void(std::shared_ptr<PromptSession> const&, ParticipantType)> f) const
++{
++    std::unique_lock<std::mutex> lk(mutex);
++    participant_by_session::iterator it,end;
++    boost::tie(it,end) = participant_index.equal_range(participant);
++
++    for (; it != end; ++it)
++    {
++        Participant const& participant = *it;
++
++        auto tsit = prompt_sessions.find(participant.prompt_session);
++        if (tsit != prompt_sessions.end())
++            f(tsit->second, participant.participant_type);
++    }
++}
++
++void ms::PromptSessionContainer::insert_waiting_process(
++    PromptSession* prompt_session,
++    pid_t process_id)
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    // the prompt session must have first been added by insert_prompt_session.
++    if (prompt_sessions.find(prompt_session) == prompt_sessions.end())
++        BOOST_THROW_EXCEPTION(std::runtime_error("Prompt Session does not exist"));
++
++    waiting_process_map.insert(WaitingProcess{prompt_session, process_id});
++}
++
++void ms::PromptSessionContainer::for_each_prompt_session_expecting_process(
++    pid_t process_id,
++    std::function<void(std::shared_ptr<PromptSession> const&)> f) const
++{
++    std::unique_lock<std::mutex> lk(mutex);
++
++    prompt_session_by_process::iterator it,end;
++    boost::tie(it,end) = waiting_process_index.equal_range(process_id);
++
++    for (; it != end; ++it)
++    {
++        WaitingProcess const& waiting_process = *it;
++        auto tsit = prompt_sessions.find(waiting_process.prompt_session);
++        if (tsit != prompt_sessions.end())
++            f(tsit->second);
++    }
++}
 === added file 'src/server/scene/prompt_session_container.h'
 --- src/server/scene/prompt_session_container.h	1970-01-01 00:00:00 +0000
 +++ src/server/scene/prompt_session_container.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,158 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored By: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_CONTAINER_H_
++#define MIR_SCENE_PROMPT_SESSION_CONTAINER_H_
++
++#include <sys/types.h>
++#include <mutex>
++#include <unordered_map>
++
++#include <boost/multi_index_container.hpp>
++#include <boost/multi_index/member.hpp>
++#include <boost/multi_index/ordered_index.hpp>
++#include <boost/multi_index/composite_key.hpp>
++#include <boost/multi_index/mem_fun.hpp>
++
++namespace mir
++{
++using boost::multi_index_container;
++using namespace boost::multi_index;
++
++namespace scene
++{
++class Session;
++class PromptSession;
++
++class PromptSessionContainer
++{
++public:
++    PromptSessionContainer();
++    virtual ~PromptSessionContainer() = default;
++
++    enum class ParticipantType
++    {
++        helper,
++        application,
++        prompt_provider,
++    };
++
++    void insert_prompt_session(std::shared_ptr<PromptSession> const& prompt_session);
++    void remove_prompt_session(std::shared_ptr<PromptSession> const& prompt_session);
++
++    bool insert_participant(PromptSession* prompt_session, std::weak_ptr<Session> const& session, ParticipantType participant_type);
++    bool remove_participant(PromptSession* prompt_session, std::weak_ptr<Session> const& session, ParticipantType participant_type);
++
++    void for_each_participant_in_prompt_session(PromptSession* prompt_session, std::function<void(std::weak_ptr<Session> const&, ParticipantType)> f) const;
++    void for_each_prompt_session_with_participant(std::weak_ptr<Session> const& participant, ParticipantType participant_type, std::function<void(std::shared_ptr<PromptSession> const&)> f) const;
++    void for_each_prompt_session_with_participant(std::weak_ptr<Session> const& participant, std::function<void(std::shared_ptr<PromptSession> const&, ParticipantType)> f) const;
++
++    void insert_waiting_process(PromptSession* prompt_session, pid_t process_id);
++    void for_each_prompt_session_expecting_process(pid_t process_id, std::function<void(std::shared_ptr<PromptSession> const&)> f) const;
++
++private:
++    std::mutex mutable mutex;
++
++    std::unordered_map<PromptSession*, std::shared_ptr<PromptSession>> prompt_sessions;
++
++    struct Participant
++    {
++        PromptSession* prompt_session;
++        std::weak_ptr<Session> session;
++        ParticipantType participant_type;
++        uint insert_order;
++    };
++
++    /**
++     * A multi map for associating PromptSessions <-> Sessions.
++     * indexed by insertion order for determining the Sessions participating in a PromptSession
++     * and indexed for determining the Prompt Sessions in which a Session is participating.
++     * A Session can be associated a number of times with a single PromptSession, providing it has a different type
++     * eg A Session can be both a helper and a provider for a PromptSession.
++     */
++    typedef multi_index_container<
++        Participant,
++        indexed_by<
++            ordered_non_unique<
++                composite_key<
++                    Participant,
++                    member<Participant, PromptSession*, &Participant::prompt_session>,
++                    member<Participant, uint, &Participant::insert_order>
++                >
++            >,
++            ordered_unique<
++                composite_key<
++                    Participant,
++                    member<Participant, std::weak_ptr<Session>, &Participant::session>,
++                    member<Participant, ParticipantType, &Participant::participant_type>,
++                    member<Participant, PromptSession*, &Participant::prompt_session>
++                >,
++                composite_key_compare<
++                    std::owner_less<std::weak_ptr<Session>>,
++                    std::less<ParticipantType>,
++                    std::less<PromptSession*>>
++            >
++        >
++    > PromptSessionParticipants;
++
++    typedef nth_index<PromptSessionParticipants,0>::type participant_by_prompt_session;
++    typedef nth_index<PromptSessionParticipants,1>::type participant_by_session;
++
++    PromptSessionParticipants participant_map;
++    participant_by_prompt_session& prompt_session_index;
++    participant_by_session& participant_index;
++
++    struct WaitingProcess
++    {
++        PromptSession* prompt_session;
++        pid_t process_id;
++    };
++
++    /**
++     * A multimap for associating PromptSessions <-> process ids
++     * indexed for determining which process ids a Prompt Session is waiting for
++     * and the prompt sessions which are waiting for a speicific process.
++     */
++    typedef multi_index_container<
++        WaitingProcess,
++        indexed_by<
++            ordered_non_unique<
++                composite_key<
++                    WaitingProcess,
++                    member<WaitingProcess, PromptSession*, &WaitingProcess::prompt_session>,
++                    member<WaitingProcess, pid_t, &WaitingProcess::process_id>
++                >
++            >,
++            ordered_non_unique<
++                member<WaitingProcess, pid_t, &WaitingProcess::process_id>
++            >
++        >
++    > WaitingPromptSessionsProcesses;
++
++    typedef nth_index<WaitingPromptSessionsProcesses,0>::type process_by_prompt_session;
++    typedef nth_index<WaitingPromptSessionsProcesses,1>::type prompt_session_by_process;
++
++    WaitingPromptSessionsProcesses waiting_process_map;
++    process_by_prompt_session& waiting_process_prompt_session_index;
++    prompt_session_by_process& waiting_process_index;
++};
++
++}
++}
++
++#endif // MIR_SCENE_PROMPT_SESSION_CONTAINER_H_
 === added file 'src/server/scene/prompt_session_manager_impl.cpp'
 --- src/server/scene/prompt_session_manager_impl.cpp	1970-01-01 00:00:00 +0000
 +++ src/server/scene/prompt_session_manager_impl.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,232 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Alan Griffiths <alan@octopull.co.uk>
++ */
++
++#include "prompt_session_manager_impl.h"
++
++#include "mir/scene/prompt_session_creation_parameters.h"
++#include "mir/scene/prompt_session_listener.h"
++#include "mir/scene/session.h"
++#include "mir/scene/prompt_session.h"
++#include "session_container.h"
++#include "prompt_session_container.h"
++
++namespace ms = mir::scene;
++
++ms::PromptSessionManagerImpl::PromptSessionManagerImpl(
++    std::shared_ptr<SessionContainer> const& app_container,
++    std::shared_ptr<PromptSessionListener> const& prompt_session_listener) :
++    prompt_session_container(std::make_shared<PromptSessionContainer>()),
++    prompt_session_listener(prompt_session_listener),
++    app_container(app_container)
++{
++}
++
++void ms::PromptSessionManagerImpl::stop_prompt_session_locked(
++    std::lock_guard<std::mutex> const&,
++    std::shared_ptr<PromptSession> const& prompt_session) const
++{
++    std::vector<std::shared_ptr<Session>> participants;
++
++    prompt_session_container->for_each_participant_in_prompt_session(prompt_session.get(),
++        [&](std::weak_ptr<Session> const& session, PromptSessionContainer::ParticipantType type)
++        {
++            if (type == PromptSessionContainer::ParticipantType::helper)
++            {
++                if (auto locked_session = session.lock())
++                    locked_session->stop_prompt_session();
++            }
++            else if (type == PromptSessionContainer::ParticipantType::prompt_provider)
++            {
++                if (auto locked_session = session.lock())
++                    participants.push_back(locked_session);
++            }
++        });
++
++    for (auto const& participant : participants)
++    {
++        if (prompt_session_container->remove_participant(prompt_session.get(), participant, PromptSessionContainer::ParticipantType::prompt_provider))
++            prompt_session_listener->prompt_provider_removed(*prompt_session, participant);
++    }
++
++    prompt_session_container->remove_prompt_session(prompt_session);
++
++    prompt_session_listener->stopping(prompt_session);
++}
++
++void ms::PromptSessionManagerImpl::remove_session(std::shared_ptr<Session> const& session) const
++{
++    std::lock_guard<std::mutex> lock(prompt_sessions_mutex);
++
++    std::vector<std::pair<std::shared_ptr<PromptSession>, PromptSessionContainer::ParticipantType>> prompt_sessions;
++
++    prompt_session_container->for_each_prompt_session_with_participant(session,
++        [&](std::shared_ptr<PromptSession> const& prompt_session, PromptSessionContainer::ParticipantType participant_type)
++        {
++            prompt_sessions.push_back(std::make_pair(prompt_session, participant_type));
++        });
++
++    for(auto const& prompt_session : prompt_sessions)
++    {
++        if (prompt_session.second == PromptSessionContainer::ParticipantType::helper)
++        {
++            stop_prompt_session_locked(lock, prompt_session.first);
++        }
++        else
++        {
++            if (prompt_session_container->remove_participant(prompt_session.first.get(), session, prompt_session.second))
++            {
++                if (prompt_session.second == PromptSessionContainer::ParticipantType::prompt_provider)
++                    prompt_session_listener->prompt_provider_removed(*prompt_session.first, session);
++            }
++        }
++    }
++}
++
++void ms::PromptSessionManagerImpl::stop_prompt_session(std::shared_ptr<PromptSession> const& prompt_session) const
++{
++    std::lock_guard<std::mutex> lock(prompt_sessions_mutex);
++
++    stop_prompt_session_locked(lock, prompt_session);
++}
++
++void ms::PromptSessionManagerImpl::add_prompt_provider_by_pid_locked(std::lock_guard<std::mutex> const&,
++    std::shared_ptr<PromptSession> const& prompt_session,
++    pid_t process_id) const
++{
++    prompt_session_container->insert_waiting_process(prompt_session.get(), process_id);
++
++    app_container->for_each(
++        [&](std::shared_ptr<Session> const& session)
++        {
++            if (session->process_id() == process_id)
++            {
++                if (prompt_session_container->insert_participant(prompt_session.get(), session, PromptSessionContainer::ParticipantType::prompt_provider))
++                    prompt_session_listener->prompt_provider_added(*prompt_session, session);
++            }
++        });
++}
++
++void ms::PromptSessionManagerImpl::add_prompt_provider_by_pid(
++    std::shared_ptr<PromptSession> const& prompt_session,
++    pid_t process_id) const
++{
++    std::lock_guard<std::mutex> lock(prompt_sessions_mutex);
++
++    add_prompt_provider_by_pid_locked(lock, prompt_session, process_id);
++}
++
++std::shared_ptr<ms::PromptSession> ms::PromptSessionManagerImpl::start_prompt_session_for(
++    std::shared_ptr<Session> const& session,
++    PromptSessionCreationParameters const& params) const
++{
++    auto prompt_session = std::make_shared<PromptSession>();
++
++    std::lock_guard<std::mutex> lock(prompt_sessions_mutex);
++
++    prompt_session_container->insert_prompt_session(prompt_session);
++    if (!prompt_session_container->insert_participant(prompt_session.get(), session, PromptSessionContainer::ParticipantType::helper))
++        BOOST_THROW_EXCEPTION(std::runtime_error("Could not set prompt session helper"));
++
++    session->start_prompt_session();
++    prompt_session_listener->starting(prompt_session);
++
++    app_container->for_each(
++    [&](std::shared_ptr<Session> const& session)
++    {
++        if (session->process_id() == params.application_pid)
++        {
++            prompt_session_container->insert_participant(prompt_session.get(), session, PromptSessionContainer::ParticipantType::application);
++        }
++    });
++
++    return prompt_session;
++}
++
++void ms::PromptSessionManagerImpl::add_expected_session(std::shared_ptr<Session> const& session) const
++{
++    std::unique_lock<std::mutex> lock(prompt_sessions_mutex);
++
++    std::vector<std::shared_ptr<PromptSession>> prompt_sessions;
++
++    prompt_session_container->for_each_prompt_session_expecting_process(session->process_id(),
++        [&](std::shared_ptr<PromptSession> const& prompt_session)
++        {
++            prompt_sessions.push_back(prompt_session);
++        });
++
++    for(auto const& prompt_session : prompt_sessions)
++    {
++        if (prompt_session_container->insert_participant(prompt_session.get(), session, PromptSessionContainer::ParticipantType::prompt_provider))
++            prompt_session_listener->prompt_provider_added(*prompt_session, session);
++    }
++}
++
++void ms::PromptSessionManagerImpl::add_prompt_provider(
++    std::shared_ptr<PromptSession> const& prompt_session,
++    std::shared_ptr<Session> const& prompt_provider) const
++{
++    std::unique_lock<std::mutex> lock(prompt_sessions_mutex);
++
++    if (prompt_session_container->insert_participant(prompt_session.get(), prompt_provider, PromptSessionContainer::ParticipantType::prompt_provider))
++        prompt_session_listener->prompt_provider_added(*prompt_session, prompt_provider);
++}
++
++std::shared_ptr<ms::Session> ms::PromptSessionManagerImpl::application_for(
++    std::shared_ptr<PromptSession> const& prompt_session) const
++{
++    std::shared_ptr<Session> application_session;
++    std::unique_lock<std::mutex> lock(prompt_sessions_mutex);
++
++    prompt_session_container->for_each_participant_in_prompt_session(prompt_session.get(),
++        [&](std::weak_ptr<Session> const& session, PromptSessionContainer::ParticipantType type)
++        {
++            if (type == PromptSessionContainer::ParticipantType::application)
++                application_session = session.lock();
++        });
++    return application_session;
++}
++
++std::shared_ptr<ms::Session> ms::PromptSessionManagerImpl::helper_for(
++    std::shared_ptr<PromptSession> const& prompt_session) const
++{
++    std::shared_ptr<Session> helper_session;
++    std::unique_lock<std::mutex> lock(prompt_sessions_mutex);
++
++    prompt_session_container->for_each_participant_in_prompt_session(prompt_session.get(),
++        [&](std::weak_ptr<Session> const& session, PromptSessionContainer::ParticipantType type)
++        {
++            if (type == PromptSessionContainer::ParticipantType::helper)
++                helper_session = session.lock();
++        });
++    return helper_session;
++}
++
++void ms::PromptSessionManagerImpl::for_each_provider_in(
++    std::shared_ptr<PromptSession> const& prompt_session,
++    std::function<void(std::shared_ptr<Session> const& prompt_provider)> const& f) const
++{
++    std::unique_lock<std::mutex> lock(prompt_sessions_mutex);
++
++    prompt_session_container->for_each_participant_in_prompt_session(prompt_session.get(),
++        [&](std::weak_ptr<Session> const& session, PromptSessionContainer::ParticipantType type)
++        {
++            if (type == PromptSessionContainer::ParticipantType::prompt_provider)
++                if (auto locked_session = session.lock())
++                    f(locked_session);
++        });
++}
 === added file 'src/server/scene/prompt_session_manager_impl.h'
 --- src/server/scene/prompt_session_manager_impl.h	1970-01-01 00:00:00 +0000
 +++ src/server/scene/prompt_session_manager_impl.h	2014-06-16 15:01:17 +0000
@@ -0,0 +1,96 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 3,
++ * as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Alan Griffiths <alan@octopull.co.uk>
++ */
++
++#ifndef MIR_SCENE_PROMPT_SESSION_MANAGERIMPL_H_
++#define MIR_SCENE_PROMPT_SESSION_MANAGERIMPL_H_
++
++#include "mir/scene/prompt_session_manager.h"
++#include "mir_toolkit/common.h"
++
++#include <mutex>
++#include <memory>
++
++namespace mir
++{
++namespace scene
++{
++class Session;
++class SessionContainer;
++class PromptSession;
++class PromptSessionContainer;
++class PromptSessionCreationParameters;
++class PromptSessionListener;
++
++class PromptSessionManagerImpl : public scene::PromptSessionManager
++{
++public:
++    explicit PromptSessionManagerImpl(
++        std::shared_ptr<SessionContainer> const& app_container,
++        std::shared_ptr<PromptSessionListener> const& prompt_session_listener);
++
++    std::shared_ptr<PromptSession> start_prompt_session_for(
++        std::shared_ptr<Session> const& session,
++        PromptSessionCreationParameters const& params) const override;
++
++    void stop_prompt_session(
++        std::shared_ptr<PromptSession> const& prompt_session) const override;
++
++    void add_prompt_provider(
++        std::shared_ptr<PromptSession> const& prompt_session,
++        std::shared_ptr<Session> const& prompt_provider) const override;
++
++    void add_prompt_provider_by_pid(
++        std::shared_ptr<PromptSession> const& prompt_session,
++        pid_t process_id) const override;
++
++    void add_expected_session(
++        std::shared_ptr<Session> const& new_session) const override;
++
++    void remove_session(
++        std::shared_ptr<Session> const& session) const override;
++
++    std::shared_ptr<Session> application_for(
++        std::shared_ptr<PromptSession> const& prompt_session) const override;
++
++    std::shared_ptr<Session> helper_for(
++        std::shared_ptr<PromptSession> const& prompt_session) const override;
++
++    void for_each_provider_in(
++        std::shared_ptr<PromptSession> const& prompt_session,
++        std::function<void(std::shared_ptr<Session> const& prompt_provider)> const& f) const override;
++
++private:
++    std::shared_ptr<PromptSessionContainer> const prompt_session_container;
++    std::shared_ptr<PromptSessionListener> const prompt_session_listener;
++    std::shared_ptr<SessionContainer> const app_container;
++
++    std::mutex mutable prompt_sessions_mutex;
++
++    void add_prompt_provider_by_pid_locked(
++        std::lock_guard<std::mutex> const&,
++        std::shared_ptr<PromptSession> const& prompt_session,
++        pid_t process_id) const;
++
++    void stop_prompt_session_locked(
++        std::lock_guard<std::mutex> const&,
++        std::shared_ptr<PromptSession> const& prompt_session) const;
++};
++}
++}
++
++#endif // MIR_SCENE_PROMPT_SESSION_MANAGERIMPL_H_
 === modified file 'src/server/scene/session_manager.cpp'
 --- src/server/scene/session_manager.cpp	2014-04-15 05:31:19 +0000
 +++ src/server/scene/session_manager.cpp	2014-06-16 15:01:17 +0000
@@ -23,6 +23,8 @@
  #include "mir/shell/focus_setter.h"
  #include "mir/scene/session.h"
  #include "mir/scene/session_listener.h"
++#include "mir/scene/prompt_session.h"
++#include "mir/scene/prompt_session_manager.h"
  #include "session_event_sink.h"
  #include <memory>
@@ -38,13 +40,15 @@
      std::shared_ptr<msh::FocusSetter> const& focus_setter,
      std::shared_ptr<SnapshotStrategy> const& snapshot_strategy,
      std::shared_ptr<SessionEventSink> const& session_event_sink,
--    std::shared_ptr<SessionListener> const& session_listener) :
++    std::shared_ptr<SessionListener> const& session_listener,
++    std::shared_ptr<PromptSessionManager> const& prompt_session_manager) :
      surface_coordinator(surface_factory),
      app_container(container),
      focus_setter(focus_setter),
      snapshot_strategy(snapshot_strategy),
      session_event_sink(session_event_sink),
--    session_listener(session_listener)
++    session_listener(session_listener),
++    prompt_session_manager(prompt_session_manager)
+ {
      assert(surface_factory);
      assert(container);
@@ -52,7 +56,7 @@
      assert(session_listener);
+ }
--ms::SessionManager::~SessionManager()
++ms::SessionManager::~SessionManager() noexcept
+ {
      /*
       * Close all open sessions. We need to do this manually here
@@ -85,6 +89,8 @@
      session_listener->starting(new_session);
++    prompt_session_manager->add_expected_session(new_session);
++
      set_focus_to(new_session);
      return new_session;
@@ -122,6 +128,9 @@
      scene_session->force_requests_to_complete();
      session_event_sink->handle_session_stopping(scene_session);
++
++    prompt_session_manager->remove_session(scene_session);
++
      session_listener->stopping(scene_session);
      app_container->remove_session(scene_session);
@@ -169,3 +178,38 @@
+ {
      set_focus_to(std::dynamic_pointer_cast<Session>(session));
+ }
++
++std::shared_ptr<mf::PromptSession> ms::SessionManager::start_prompt_session_for(std::shared_ptr<mf::Session> const& session,
++    PromptSessionCreationParameters const& params)
++{
++    auto shell_session = std::dynamic_pointer_cast<Session>(session);
++
++    return prompt_session_manager->start_prompt_session_for(
++        shell_session, params);
++
++}
++
++void ms::SessionManager::add_prompt_provider_process_for(
++    std::shared_ptr<mf::PromptSession> const& prompt_session,
++    pid_t process_id)
++{
++    auto scene_prompt_session = std::dynamic_pointer_cast<PromptSession>(prompt_session);
++
++    prompt_session_manager->add_prompt_provider_by_pid(scene_prompt_session, process_id);
++}
++
++void ms::SessionManager::add_prompt_provider_for(
++    std::shared_ptr<mf::PromptSession> const& prompt_session,
++    std::shared_ptr<frontend::Session> const& session)
++{
++    auto scene_prompt_session = std::dynamic_pointer_cast<PromptSession>(prompt_session);
++    auto scene_session = std::dynamic_pointer_cast<Session>(session);
++
++    prompt_session_manager->add_prompt_provider(scene_prompt_session, scene_session);
++}
++
++void ms::SessionManager::stop_prompt_session(std::shared_ptr<mf::PromptSession> const& prompt_session)
++{
++    auto scene_prompt_session = std::dynamic_pointer_cast<PromptSession>(prompt_session);
++    prompt_session_manager->stop_prompt_session(scene_prompt_session);
++}
 === modified file 'src/server/scene/session_manager.h'
 --- src/server/scene/session_manager.h	2014-05-23 11:18:09 +0000
 +++ src/server/scene/session_manager.h	2014-06-16 15:01:17 +0000
@@ -40,6 +40,8 @@
  class SessionListener;
  class SnapshotStrategy;
  class SurfaceCoordinator;
++class PromptSessionManager;
++
  class SessionManager : public SessionCoordinator
+ {
@@ -49,8 +51,9 @@
                              std::shared_ptr<shell::FocusSetter> const& focus_setter,
                              std::shared_ptr<SnapshotStrategy> const& snapshot_strategy,
                              std::shared_ptr<SessionEventSink> const& session_event_sink,
--                            std::shared_ptr<SessionListener> const& session_listener);
--    virtual ~SessionManager();
++                            std::shared_ptr<SessionListener> const& session_listener,
++                            std::shared_ptr<PromptSessionManager> const& prompt_session_manager);
++    virtual ~SessionManager() noexcept;
      virtual std::shared_ptr<frontend::Session> open_session(
          pid_t client_pid,
@@ -69,6 +72,14 @@
      void handle_surface_created(std::shared_ptr<frontend::Session> const& session) override;
++    std::shared_ptr<frontend::PromptSession> start_prompt_session_for(std::shared_ptr<frontend::Session> const& session,
++                                                  PromptSessionCreationParameters const& params) override;
++    void add_prompt_provider_process_for(std::shared_ptr<frontend::PromptSession> const& prompt_session,
++                                 pid_t process_id) override;
++    void add_prompt_provider_for(std::shared_ptr<frontend::PromptSession> const& prompt_session,
++                                 std::shared_ptr<frontend::Session> const& session) override;
++    void stop_prompt_session(std::shared_ptr<frontend::PromptSession> const& prompt_session) override;
++
  protected:
      SessionManager(const SessionManager&) = delete;
      SessionManager& operator=(const SessionManager&) = delete;
@@ -80,6 +91,7 @@
      std::shared_ptr<SnapshotStrategy> const snapshot_strategy;
      std::shared_ptr<SessionEventSink> const session_event_sink;
      std::shared_ptr<SessionListener> const session_listener;
++    std::shared_ptr<PromptSessionManager> const prompt_session_manager;
      std::mutex mutex;
      std::weak_ptr<Session> focus_application;
 === modified file 'src/server/shell/session_coordinator_wrapper.cpp'
 --- src/server/shell/session_coordinator_wrapper.cpp	2014-05-23 12:59:00 +0000
 +++ src/server/shell/session_coordinator_wrapper.cpp	2014-06-16 15:01:17 +0000
@@ -32,7 +32,7 @@
  std::shared_ptr<mf::Session> msh::SessionCoordinatorWrapper::open_session(
      pid_t client_pid,
      std::string const& name,
--    std::shared_ptr<frontend::EventSink> const& sink)
++    std::shared_ptr<mf::EventSink> const& sink)
+ {
      return wrapped->open_session(client_pid, name, sink);
+ }
@@ -67,7 +67,33 @@
+ }
  void msh::SessionCoordinatorWrapper::handle_surface_created(
--    std::shared_ptr<frontend::Session> const& session)
++    std::shared_ptr<mf::Session> const& session)
+ {
      wrapped->handle_surface_created(session);
+ }
++
++std::shared_ptr<mf::PromptSession> msh::SessionCoordinatorWrapper::start_prompt_session_for(
++    std::shared_ptr<mf::Session> const& session,
++    scene::PromptSessionCreationParameters const& params)
++{
++    return wrapped->start_prompt_session_for(session, params);
++}
++
++void msh::SessionCoordinatorWrapper::add_prompt_provider_process_for(
++    std::shared_ptr<mf::PromptSession> const& prompt_session,
++    pid_t process_id)
++{
++    wrapped->add_prompt_provider_process_for(prompt_session, process_id);
++}
++
++void msh::SessionCoordinatorWrapper::add_prompt_provider_for(
++    std::shared_ptr<mf::PromptSession> const& prompt_session,
++    std::shared_ptr<mf::Session> const& session)
++{
++    wrapped->add_prompt_provider_for(prompt_session, session);
++}
++
++void msh::SessionCoordinatorWrapper::stop_prompt_session(std::shared_ptr<mf::PromptSession> const& prompt_session)
++{
++    wrapped->stop_prompt_session(prompt_session);
++}
 === modified file 'src/shared/protobuf/mir_protobuf.proto'
 --- src/shared/protobuf/mir_protobuf.proto	2014-06-02 17:07:02 +0000
 +++ src/shared/protobuf/mir_protobuf.proto	2014-06-16 15:01:17 +0000
@@ -100,7 +100,7 @@
    optional int32 pixel_format = 4;
    optional int32 buffer_usage = 5;
    optional Buffer buffer = 6;
--
++
    repeated sint32 fd = 7;
    optional int32 fds_on_side_channel = 8;
@@ -185,7 +185,6 @@
    required int32 number = 1;
+ }
--
  message SocketFD {
    repeated sint32 fd = 1;
    optional int32  fds_on_side_channel = 2;
@@ -193,6 +192,14 @@
    optional string error = 127;
+ }
++message PromptProvider {
++  required int32 pid = 1;
++}
++
++message PromptSessionParameters {
++  required int32 application_pid = 1;
++}
++
  service DisplayServer {
    // Platform independent requests
    rpc connect(ConnectParameters) returns (Connection);
@@ -212,7 +219,11 @@
    rpc create_screencast(ScreencastParameters) returns (Screencast);
    rpc screencast_buffer(ScreencastId) returns (Buffer);
    rpc release_screencast(ScreencastId) returns (Void);
--
++
    rpc configure_cursor(CursorSetting) returns (Void);
--  rpc new_fds_for_trusted_clients(SocketFDRequest) returns (SocketFD);
++  rpc new_fds_for_prompt_providers(SocketFDRequest) returns (SocketFD);
++
++  rpc start_prompt_session(PromptSessionParameters) returns (Void);
++  rpc add_prompt_provider(PromptProvider) returns (Void);
++  rpc stop_prompt_session(Void) returns (Void);
+ }
 === modified file 'tests/acceptance-tests/CMakeLists.txt'
 --- tests/acceptance-tests/CMakeLists.txt	2014-06-10 13:45:51 +0000
 +++ tests/acceptance-tests/CMakeLists.txt	2014-06-16 15:01:17 +0000
@@ -30,11 +30,11 @@
    test_surfaces_with_output_id.cpp
    test_server_disconnect.cpp
    test_client_library_drm.cpp
++  test_prompt_session_client_api.cpp
    test_protobuf.cpp
    test_client_screencast.cpp
    test_client_surface_swap_buffers.cpp
    test_client_cursor_api.cpp
--  test_trust_session_helper.cpp
    test_large_messages.cpp
    ${GENERATED_PROTOBUF_SRCS}
    ${GENERATED_PROTOBUF_HDRS}
 === modified file 'tests/acceptance-tests/test_nested_mir.cpp'
 --- tests/acceptance-tests/test_nested_mir.cpp	2014-05-12 21:11:05 +0000
 +++ tests/acceptance-tests/test_nested_mir.cpp	2014-06-16 15:01:17 +0000
@@ -56,6 +56,9 @@
      MOCK_METHOD1(session_next_buffer_called, void (std::string const&));
      MOCK_METHOD1(session_release_surface_called, void (std::string const&));
      MOCK_METHOD1(session_disconnect_called, void (std::string const&));
++    MOCK_METHOD2(session_start_prompt_session_called, void (std::string const&, pid_t));
++    MOCK_METHOD2(session_add_prompt_provider_called, void (std::string const&, pid_t));
++    MOCK_METHOD1(session_stop_prompt_session_called, void (std::string const&));
      void session_drm_auth_magic_called(const std::string&) override {};
      void session_configure_surface_called(std::string const&) override {};
 === added file 'tests/acceptance-tests/test_prompt_session_client_api.cpp'
 --- tests/acceptance-tests/test_prompt_session_client_api.cpp	1970-01-01 00:00:00 +0000
 +++ tests/acceptance-tests/test_prompt_session_client_api.cpp	2014-06-16 15:01:17 +0000
@@ -0,0 +1,421 @@
++/*
++ * Copyright © 2014 Canonical Ltd.
++ *
++ * This program is free software: you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 3 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ * Authored by: Nick Dedekind <nick.dedekind@canonical.com>
++ */
++
++#include "mir_toolkit/mir_prompt_session.h"
++#include "mir/scene/prompt_session_listener.h"
++#include "mir/scene/prompt_session.h"
++#include "mir/scene/prompt_session_manager.h"
++#include "mir/scene/session.h"
++#include "mir/frontend/shell.h"
++
++#include "mir_test_framework/stubbed_server_configuration.h"
++#include "mir_test_framework/basic_client_server_fixture.h"
++#include "mir_test/popen.h"
++
++#include <gtest/gtest.h>
++#include <gmock/gmock.h>
++
++#include <condition_variable>
++#include <mutex>
++
++namespace mtf = mir_test_framework;
++namespace ms = mir::scene;
++namespace mf = mir::frontend;
++
++using namespace testing;
++
++namespace
++{
++struct MockPromptSessionListener : ms::PromptSessionListener
++{
++    MockPromptSessionListener(std::shared_ptr<ms::PromptSessionListener> const& wrapped) :
++        wrapped(wrapped)
++    {
++        ON_CALL(*this, starting(_)).WillByDefault(Invoke(wrapped.get(), &ms::PromptSessionListener::starting));
++        ON_CALL(*this, stopping(_)).WillByDefault(Invoke(wrapped.get(), &ms::PromptSessionListener::stopping));
++        ON_CALL(*this, prompt_provider_added(_, _)).WillByDefault(Invoke(wrapped.get(), &ms::PromptSessionListener::prompt_provider_added));
++        ON_CALL(*this, prompt_provider_removed(_, _)).WillByDefault(Invoke(wrapped.get(), &ms::PromptSessionListener::prompt_provider_removed));
++    }
++
++    MOCK_METHOD1(starting, void(std::shared_ptr<ms::PromptSession> const& prompt_session));
++    MOCK_METHOD1(stopping, void(std::shared_ptr<ms::PromptSession> const& prompt_session));
++
++    MOCK_METHOD2(prompt_provider_added, void(ms::PromptSession const& prompt_session, std::shared_ptr<ms::Session> const& prompt_provider));
++    MOCK_METHOD2(prompt_provider_removed, void(ms::PromptSession const& prompt_session, std::shared_ptr<ms::Session> const& prompt_provider));
++
++    std::shared_ptr<ms::PromptSessionListener> const wrapped;
++};
++
++struct PromptSessionListenerConfiguration : mtf::StubbedServerConfiguration
++{
++    std::shared_ptr<ms::PromptSessionListener> the_prompt_session_listener()
++    {
++        return prompt_session_listener([this]()
++           ->std::shared_ptr<ms::PromptSessionListener>
++           {
++               return the_mock_prompt_session_listener();
++           });
++    }
++
++    std::shared_ptr<MockPromptSessionListener> the_mock_prompt_session_listener()
++    {
++        return mock_prompt_session_listener([this]
++            {
++                return std::make_shared<NiceMock<MockPromptSessionListener>>(
++                    mtf::StubbedServerConfiguration::the_prompt_session_listener());
++            });
++    }
++
++    mir::CachedPtr<MockPromptSessionListener> mock_prompt_session_listener;
++};
++
++using BasicClientServerFixture = mtf::BasicClientServerFixture<PromptSessionListenerConfiguration>;
++
++struct PromptSessionClientAPI : BasicClientServerFixture
++{
++    static constexpr mir_prompt_session_state_change_callback null_state_change_callback = nullptr;
++
++    static constexpr pid_t application_session_pid = __LINE__;
++    std::shared_ptr<mf::Session> application_session;
++
++    static constexpr pid_t existing_prompt_provider_pid = __LINE__;
++    std::shared_ptr<mf::Session> existing_prompt_provider_session;
++
++    static constexpr pid_t another_prompt_provider_pid = __LINE__;
++    std::shared_ptr<mf::Session> another_existing_prompt_provider;
++
++    std::shared_ptr<ms::PromptSession> server_prompt_session;
++
++    void SetUp() override
++    {
++        BasicClientServerFixture::SetUp();
++        application_session = server_config().the_frontend_shell()->open_session(application_session_pid, __PRETTY_FUNCTION__,  std::shared_ptr<mf::EventSink>());
++        existing_prompt_provider_session = server_config().the_frontend_shell()->open_session(existing_prompt_provider_pid, __PRETTY_FUNCTION__,  std::shared_ptr<mf::EventSink>());
++        another_existing_prompt_provider = server_config().the_frontend_shell()->open_session(another_prompt_provider_pid, __PRETTY_FUNCTION__,  std::shared_ptr<mf::EventSink>());
++    }
++
++    void capture_server_prompt_session()
++    {
++        EXPECT_CALL(*the_mock_prompt_session_listener(), starting(_)).
++            WillOnce(DoAll(
++                Invoke(the_mock_prompt_session_listener()->wrapped.get(), &ms::PromptSessionListener::starting),
++                SaveArg<0>(&server_prompt_session)));
++    }
++
++    void TearDown() override
++    {
++        // TODO It really shouldn't be necessary to close these sessions.
++        // TODO But the MediatingDisplayChanger id destroyed without deregistering
++        // TODO callbacks from the BroadcastingSessionEventSink which gets called in
++        // TODO SessionManager::~SessionManager() in code that the comments claim
++        // TODO works around broken ownership.
++        server_config().the_frontend_shell()->close_session(another_existing_prompt_provider);
++        server_config().the_frontend_shell()->close_session(existing_prompt_provider_session);
++        server_config().the_frontend_shell()->close_session(application_session);
++
++        BasicClientServerFixture::TearDown();
++    }
++
++    MockPromptSessionListener* the_mock_prompt_session_listener()
++    {
++        return server_configuration.the_mock_prompt_session_listener().get();
++    }
++
++    MOCK_METHOD2(prompt_session_state_change, void(MirPromptSession* prompt_provider, MirPromptSessionState state));
++
++    static std::size_t const arbritary_fd_request_count = 3;
++    std::mutex mutex;
++    std::size_t actual_fd_count = 0;
++    int actual_fds[arbritary_fd_request_count] = {};
++    std::condition_variable cv;
++    bool called_back = false;
++
++    bool wait_for_callback(std::chrono::milliseconds timeout)
++    {
++        std::unique_lock<decltype(mutex)> lock(mutex);
++        return cv.wait_for(lock, timeout, [this]{ return called_back; });
++    }
++
++    char const* fd_connect_string(int fd)
++    {
++        static char client_connect_string[32] = {0};
++
++        sprintf(client_connect_string, "fd://%d", fd);
++        return client_connect_string;
++    }
++
++    MOCK_METHOD1(process_line, void(std::string const&));
++
++    std::vector<std::shared_ptr<mf::Session>> list_providers_for(std::shared_ptr<ms::PromptSession> const& prompt_session)
++    {
++        std::vector<std::shared_ptr<mf::Session>> results;
++        auto providers_fn = [&results](std::weak_ptr<ms::Session> const& session)
++        {
++            results.push_back(session.lock());
++        };
++
++        server_configuration.the_prompt_session_manager()->for_each_provider_in(prompt_session, providers_fn);
++
++        return results;
++    }
++};
++
++extern "C" void prompt_session_state_change_callback(MirPromptSession* prompt_provider, MirPromptSessionState state, void* context)
++{
++    PromptSessionClientAPI* self = static_cast<PromptSessionClientAPI*>(context);
++    self->prompt_session_state_change(prompt_provider, state);
++}
++
++void client_fd_callback(MirPromptSession*, size_t count, int const* fds, void* context)
++{
++    auto const self = static_cast<PromptSessionClientAPI*>(context);
++
++    std::unique_lock<decltype(self->mutex)> lock(self->mutex);
++    self->actual_fd_count = count;
++
++    std::copy(fds, fds+count, self->actual_fds);
++    self->called_back = true;
++    self->cv.notify_one();
++}
++
++struct DummyPromptProvider
++{
++    DummyPromptProvider(char const* connect_string, char const* app_name) :
++        connection{mir_connect_sync(connect_string, app_name)}
++    {
++        EXPECT_THAT(connection, NotNull());
++    }
++
++    ~DummyPromptProvider() noexcept
++    {
++        mir_connection_release(connection);
++    }
++
++    MirConnection* const connection;
++};
++
++MATCHER_P(SessionWithPid, pid, "")
++{
++    return arg->process_id() == pid;
++}
++
++MATCHER_P(SessionWithName, name, "")
++{
++    return arg->name() == name;
++}
++}
++
++TEST_F(PromptSessionClientAPI, can_start_and_stop_a_prompt_session)
++{
++    {
++        InSequence server_seq;
++        EXPECT_CALL(*the_mock_prompt_session_listener(), starting(_));
++        EXPECT_CALL(*the_mock_prompt_session_listener(), stopping(_));
++    }
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++    ASSERT_THAT(prompt_session, Ne(nullptr));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, notifies_start_and_stop)
++{
++    InSequence seq;
++    EXPECT_CALL(*this, prompt_session_state_change(_, mir_prompt_session_state_started));
++    EXPECT_CALL(*this, prompt_session_state_change(_, mir_prompt_session_state_stopped));
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, prompt_session_state_change_callback, this);
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, can_add_preexisting_prompt_provider)
++{
++    {
++        auto const prompt_provider = std::dynamic_pointer_cast<ms::Session>(existing_prompt_provider_session);
++        InSequence server_seq;
++        EXPECT_CALL(*the_mock_prompt_session_listener(), prompt_provider_added(_, Eq(prompt_provider)));
++        EXPECT_CALL(*the_mock_prompt_session_listener(), prompt_provider_removed(_, Eq(prompt_provider)));
++    }
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    EXPECT_TRUE(mir_prompt_session_add_prompt_provider_sync(prompt_session, existing_prompt_provider_pid));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, can_get_fds_for_prompt_providers)
++{
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    mir_prompt_session_new_fds_for_prompt_providers(prompt_session, arbritary_fd_request_count, &client_fd_callback, this);
++    EXPECT_TRUE(wait_for_callback(std::chrono::milliseconds(500)));
++
++    EXPECT_THAT(actual_fd_count, Eq(arbritary_fd_request_count));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, when_prompt_provider_connects_over_fd_prompt_provider_added_with_right_pid)
++{
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    mir_prompt_session_new_fds_for_prompt_providers(prompt_session, 1, &client_fd_callback, this);
++    ASSERT_TRUE(wait_for_callback(std::chrono::milliseconds(500)));
++
++    auto const expected_pid = getpid();
++
++    EXPECT_CALL(*the_mock_prompt_session_listener(), prompt_provider_added(_, SessionWithPid(expected_pid)));
++
++    DummyPromptProvider{fd_connect_string(actual_fds[0]), __PRETTY_FUNCTION__};
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++// TODO we need a nice way to run this (and similar tests that require a separate client process) in CI
++// Disabled as we can't be sure the mir_demo_client_basic is about
++TEST_F(PromptSessionClientAPI, DISABLED_client_pid_is_associated_with_session)
++{
++    auto const server_pid = getpid();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    mir_prompt_session_new_fds_for_prompt_providers(prompt_session, 1, &client_fd_callback, this);
++    wait_for_callback(std::chrono::milliseconds(500));
++
++    EXPECT_CALL(*the_mock_prompt_session_listener(), prompt_provider_added(_, Not(SessionWithPid(server_pid))));
++
++    InSequence seq;
++    EXPECT_CALL(*this, process_line(StrEq("Starting")));
++    EXPECT_CALL(*this, process_line(StrEq("Connected")));
++    EXPECT_CALL(*this, process_line(StrEq("Surface created")));
++    EXPECT_CALL(*this, process_line(StrEq("Surface released")));
++    EXPECT_CALL(*this, process_line(StrEq("Connection released")));
++
++    mir::test::Popen output(std::string("bin/mir_demo_client_basic -m ") + fd_connect_string(actual_fds[0]));
++
++    std::string line;
++    while (output.get_line(line)) process_line(line);
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, notifies_when_server_closes_prompt_session)
++{
++    EXPECT_CALL(*this, prompt_session_state_change(_, mir_prompt_session_state_started));
++
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, prompt_session_state_change_callback, this);
++
++    EXPECT_CALL(*this, prompt_session_state_change(_, mir_prompt_session_state_stopped));
++
++    server_configuration.the_prompt_session_manager()->stop_prompt_session(server_prompt_session);
++
++    // Verify we have got the "stopped" notification before we go on and release the session
++    Mock::VerifyAndClearExpectations(the_mock_prompt_session_listener());
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, after_server_closes_prompt_session_api_isnt_broken)
++{
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    server_configuration.the_prompt_session_manager()->stop_prompt_session(server_prompt_session);
++
++    EXPECT_FALSE(mir_prompt_session_add_prompt_provider_sync(prompt_session, existing_prompt_provider_pid));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, server_retrieves_application_session)
++{
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    EXPECT_THAT(server_configuration.the_prompt_session_manager()->application_for(server_prompt_session), Eq(application_session));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, server_retrieves_helper_session)
++{
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    // can get the helper session. but it will be the current pid.
++    EXPECT_THAT(server_configuration.the_prompt_session_manager()->helper_for(server_prompt_session), SessionWithPid(getpid()));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, server_retrieves_existing_provider_sessions)
++{
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    mir_prompt_session_add_prompt_provider_sync(prompt_session, existing_prompt_provider_pid);
++    mir_prompt_session_add_prompt_provider_sync(prompt_session, another_prompt_provider_pid);
++
++    EXPECT_THAT(list_providers_for(server_prompt_session), ElementsAre(existing_prompt_provider_session, another_existing_prompt_provider));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
++
++TEST_F(PromptSessionClientAPI, server_retrieves_child_provider_sessions)
++{
++    static int const no_of_prompt_providers = 2;
++    char const* const child_provider_name[no_of_prompt_providers] =
++    {
++        "child_provider0",
++        "child_provider1"
++    };
++
++    capture_server_prompt_session();
++
++    MirPromptSession* prompt_session = mir_connection_create_prompt_session_sync(
++        connection, application_session_pid, null_state_change_callback, this);
++
++    mir_wait_for(mir_prompt_session_new_fds_for_prompt_providers(prompt_session, no_of_prompt_providers, &client_fd_callback, this));
++
++    DummyPromptProvider child_provider1{fd_connect_string(actual_fds[0]), child_provider_name[0]};
++    DummyPromptProvider child_provider2{fd_connect_string(actual_fds[1]), child_provider_name[1]};
++
++    EXPECT_THAT(list_providers_for(server_prompt_session), ElementsAre(SessionWithName(child_provider_name[0]), SessionWithName(child_provider_name[1])));
++
++    mir_prompt_session_release_sync(prompt_session);
++}
 === removed file 'tests/acceptance-tests/test_trust_session_helper.cpp'
 --- tests/acceptance-tests/test_trust_session_helper.cpp	2014-06-03 16:43:38 +0000
 +++ tests/acceptance-tests/test_trust_session_helper.cpp	1970-01-01 00:00:00 +0000
@@ -1,218 +0,0 @@
--/*
-- * Copyright © 2014 Canonical Ltd.
-- *
-- * This program is free software: you can redistribute it and/or modify it
-- * under the terms of the GNU General Public License version 3,
-- * as published by the Free Software Foundation.
-- *
-- * This program is distributed in the hope that it will be useful,
-- * but WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- * GNU General Public License for more details.
-- *
-- * You should have received a copy of the GNU General Public License
-- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-- *
-- * Authored by: Alan Griffiths <alan@octopull.co.uk>
-- */
--
--#include "mir_toolkit/mir_client_library.h"
--
--#include "src/server/frontend/session_mediator.h"
--
--#include "mir/frontend/connection_context.h"
--#include "mir/scene/session.h"
--#include "mir/graphics/graphic_buffer_allocator.h"
--
--#include "mir_test_framework/stubbed_server_configuration.h"
--#include "mir_test_framework/basic_client_server_fixture.h"
--#include "mir_test_doubles/fake_ipc_factory.h"
--#include "mir_test/popen.h"
--
--#include <gtest/gtest.h>
--#include <gmock/gmock.h>
--
--#include <algorithm>
--#include <condition_variable>
--#include <mutex>
--
--using namespace testing;
--
--namespace
--{
--struct TrustedHelperSessionMediator : mir::frontend::SessionMediator
--{
--    using mir::frontend::SessionMediator::SessionMediator;
--
--    std::function<void(std::shared_ptr<mir::frontend::Session> const&)> trusted_connect_handler() const override
--    {
--        return [this](std::shared_ptr<mir::frontend::Session> const& session)
--            {
--                auto const ss = std::dynamic_pointer_cast<mir::scene::Session>(session);
--                client_pid = ss->process_id();
--            };
--    }
--
--    pid_t mutable client_pid = 0;
--};
--
--std::shared_ptr<TrustedHelperSessionMediator> trusted_helper_mediator;
--
--struct FakeIpcFactory : mir::test::doubles::FakeIpcFactory
--{
--    using mir::test::doubles::FakeIpcFactory::FakeIpcFactory;
--
--    std::shared_ptr<mir::frontend::detail::DisplayServer> make_helper_mediator(
--        std::shared_ptr<mir::frontend::Shell> const& shell,
--        std::shared_ptr<mir::graphics::Platform> const& graphics_platform,
--        std::shared_ptr<mir::frontend::DisplayChanger> const& changer,
--        std::shared_ptr<mir::graphics::GraphicBufferAllocator> const& buffer_allocator,
--        std::shared_ptr<mir::frontend::SessionMediatorReport> const& sm_report,
--        std::shared_ptr<mir::frontend::EventSink> const& sink,
--        std::shared_ptr<mir::frontend::Screencast> const& effective_screencast,
--        mir::frontend::ConnectionContext const& connection_context,
--        std::shared_ptr<mir::graphics::CursorImages> const& cursor_images)
--    {
--        trusted_helper_mediator = std::make_shared<TrustedHelperSessionMediator>(
--            shell,
--            graphics_platform,
--            changer,
--            buffer_allocator->supported_pixel_formats(),
--            sm_report,
--            sink,
--            resource_cache(),
--            effective_screencast,
--            connection_context,
--            cursor_images);
--
--        return trusted_helper_mediator;
--    }
--};
--
--struct MyServerConfiguration : mir_test_framework::StubbedServerConfiguration
--{
--    std::shared_ptr<FakeIpcFactory> mediator_factory;
--
--    auto the_ipc_factory(
--        std::shared_ptr<mir::frontend::Shell> const& shell,
--        std::shared_ptr<mir::graphics::GraphicBufferAllocator> const& allocator)
--    -> std::shared_ptr<mir::frontend::ProtobufIpcFactory> override
--    {
--        return ipc_factory(
--            [&]()
--            {
--                mediator_factory = std::make_shared<FakeIpcFactory>(
--                    shell,
--                    the_session_mediator_report(),
--                    the_graphics_platform(),
--                    the_frontend_display_changer(),
--                    allocator,
--                    the_screencast(),
--                    the_session_authorizer(),
--                    the_cursor_images());
--
--                EXPECT_CALL(*mediator_factory,
--                    make_mediator(_, _, _, _, _, _, _, _, _)).Times(AnyNumber())
--                    .WillOnce(Invoke(mediator_factory.get(), &FakeIpcFactory::make_helper_mediator))
--                    .WillRepeatedly(Invoke(mediator_factory.get(), &FakeIpcFactory::make_default_mediator));
--
--                return mediator_factory;
--            });
--    }
--};
--
--using MyBasicClientServerFixture = mir_test_framework::BasicClientServerFixture<MyServerConfiguration>;
--
--struct TrustSessionHelper : MyBasicClientServerFixture
--{
--
--    void TearDown()
--    {
--        trusted_helper_mediator.reset();
--        MyBasicClientServerFixture::TearDown();
--    }
--
--    static std::size_t const arbritary_fd_request_count = 3;
--
--    std::mutex mutex;
--    std::size_t actual_fd_count = 0;
--    int actual_fds[arbritary_fd_request_count] = {};
--    std::condition_variable cv;
--    bool called_back = false;
--
--    bool wait_for_callback(std::chrono::milliseconds timeout)
--    {
--        std::unique_lock<decltype(mutex)> lock(mutex);
--        return cv.wait_for(lock, timeout, [this]{ return called_back; });
--    }
--
--    char client_connect_string[128] = {0};
--
--    char const* fd_connect_string(int fd)
--    {
--        sprintf(client_connect_string, "fd://%d", fd);
--        return client_connect_string;
--    }
--
--    MOCK_METHOD1(process_line, void(std::string const&));
--};
--
--void client_fd_callback(MirConnection*, size_t count, int const* fds, void* context)
--{
--    auto const self = static_cast<TrustSessionHelper*>(context);
--
--    std::unique_lock<decltype(self->mutex)> lock(self->mutex);
--    self->actual_fd_count = count;
--
--    std::copy(fds, fds+count, self->actual_fds);
--    self->called_back = true;
--    self->cv.notify_one();
--}
--}
--
--TEST_F(TrustSessionHelper, can_get_fds_for_trusted_clients)
--{
--    mir_connection_new_fds_for_trusted_clients(connection, arbritary_fd_request_count, &client_fd_callback, this);
--    EXPECT_TRUE(wait_for_callback(std::chrono::milliseconds(500)));
--
--    EXPECT_THAT(actual_fd_count, Eq(arbritary_fd_request_count));
--}
--
--TEST_F(TrustSessionHelper, gets_pid_when_trusted_client_connects_over_fd)
--{
--    mir_connection_new_fds_for_trusted_clients(connection, 1, &client_fd_callback, this);
--    wait_for_callback(std::chrono::milliseconds(500));
--
--    auto const expected_pid = getpid();
--
--    EXPECT_THAT(trusted_helper_mediator->client_pid, Eq(0)); // Before the client connects we don't have a pid
--    auto client_connection = mir_connect_sync(fd_connect_string(actual_fds[0]), __PRETTY_FUNCTION__);
--    EXPECT_THAT(trusted_helper_mediator->client_pid, Eq(expected_pid)); // After the client connects we do have a pid
--
--    mir_connection_release(client_connection);
--}
--
--// TODO we need a nice way to run this (and similar tests that require a separate client process) in CI
--// Disabled as we can't be sure the mir_demo_client_basic is about
--TEST_F(TrustSessionHelper, DISABLED_client_pid_is_associated_with_session)
--{
--    auto const server_pid = getpid();
--
--    mir_connection_new_fds_for_trusted_clients(connection, 1, &client_fd_callback, this);
--    wait_for_callback(std::chrono::milliseconds(500));
--
--    InSequence seq;
--    EXPECT_CALL(*this, process_line(StrEq("Starting")));
--    EXPECT_CALL(*this, process_line(StrEq("Connected")));
--    EXPECT_CALL(*this, process_line(StrEq("Surface created")));
--    EXPECT_CALL(*this, process_line(StrEq("Surface released")));
--    EXPECT_CALL(*this, process_line(StrEq("Connection released")));
--
--    mir::test::Popen output(std::string("bin/mir_demo_client_basic -m ") + fd_connect_string(actual_fds[0]));
--
--    std::string line;
--    while (output.get_line(line)) process_line(line);
--
--    EXPECT_THAT(trusted_helper_mediator->client_pid, Ne(0));
--    EXPECT_THAT(trusted_helper_mediator->client_pid, Ne(server_pid));
--}
 === modified file 'tests/integration-tests/frontend/test_application_mediator_report.cpp'
 --- tests/integration-tests/frontend/test_application_mediator_report.cpp	2014-05-12 21:11:05 +0000
 +++ tests/integration-tests/frontend/test_application_mediator_report.cpp	2014-06-16 15:01:17 +0000
@@ -50,6 +50,12 @@
          EXPECT_CALL(*this, session_disconnect_called(testing::_)).
              Times(testing::AtLeast(0));
++
++        EXPECT_CALL(*this, session_start_prompt_session_called(testing::_, testing::_)).
++            Times(testing::AtLeast(0));
++
++        EXPECT_CALL(*this, session_stop_prompt_session_called(testing::_)).
++            Times(testing::AtLeast(0));
+     }
      MOCK_METHOD1(session_connect_called, void (std::string const&));
@@ -57,6 +63,9 @@
      MOCK_METHOD1(session_next_buffer_called, void (std::string const&));
      MOCK_METHOD1(session_release_surface_called, void (std::string const&));
      MOCK_METHOD1(session_disconnect_called, void (std::string const&));
++    MOCK_METHOD2(session_start_prompt_session_called, void (std::string const&, pid_t));
++    MOCK_METHOD2(session_add_prompt_provider_called, void (std::string const&, pid_t));
++    MOCK_METHOD1(session_stop_prompt_session_called, void (std::string const&));
      void session_drm_auth_magic_called(const std::string&) override {};
      void session_configure_surface_called(std::string const&) override {};
@@ -359,3 +368,175 @@
      launch_client_process(client_process);
+ }
++
++TEST_F(ApplicationMediatorReport, prompt_session_start_called)
++{
++    struct Server : TestingServerConfiguration
++    {
++        std::shared_ptr<mf::SessionMediatorReport>
++        the_application_mediator_report()
++        {
++            auto result = std::make_shared<MockApplicationMediatorReport>();
++
++            EXPECT_CALL(*result, session_start_prompt_session_called(testing::_, testing::_)).
++                Times(1);
++
++            return result;
++        }
++    } server_processing;
++
++    launch_server_process(server_processing);
++
++    struct Client: TestingClientConfiguration
++    {
++        void exec()
++        {
++            mt::TestProtobufClient client(mtf::test_socket_file(), rpc_timeout_ms);
++
++            client.connect_parameters.set_application_name(__PRETTY_FUNCTION__);
++            EXPECT_CALL(client, connect_done()).
++                Times(testing::AtLeast(0));
++            EXPECT_CALL(client, prompt_session_start_done()).
++                Times(testing::AtLeast(0));
++
++            client.display_server.connect(
++                0,
++                &client.connect_parameters,
++                &client.connection,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::connect_done));
++
++            client.wait_for_connect_done();
++
++            client.display_server.start_prompt_session(
++                0,
++                &client.prompt_session_parameters,
++                &client.prompt_session,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::prompt_session_start_done));
++            client.wait_for_prompt_session_start_done();
++
++        }
++    } client_process;
++
++    launch_client_process(client_process);
++}
++
++TEST_F(ApplicationMediatorReport, prompt_session_add_prompt_provider_called)
++{
++    struct Server : TestingServerConfiguration
++    {
++        std::shared_ptr<mf::SessionMediatorReport>
++        the_application_mediator_report()
++        {
++            auto result = std::make_shared<MockApplicationMediatorReport>();
++
++            EXPECT_CALL(*result, session_start_prompt_session_called(testing::_, testing::_)).
++                Times(1);
++
++            return result;
++        }
++    } server_processing;
++
++    launch_server_process(server_processing);
++
++    struct Client: TestingClientConfiguration
++    {
++        void exec()
++        {
++            mt::TestProtobufClient client(mtf::test_socket_file(), rpc_timeout_ms);
++
++            client.connect_parameters.set_application_name(__PRETTY_FUNCTION__);
++            EXPECT_CALL(client, connect_done()).
++                Times(testing::AtLeast(0));
++            EXPECT_CALL(client, prompt_session_start_done()).
++                Times(testing::AtLeast(0));
++            EXPECT_CALL(client, prompt_session_add_prompt_provider_done()).
++                Times(testing::AtLeast(0));
++
++            client.display_server.connect(
++                0,
++                &client.connect_parameters,
++                &client.connection,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::connect_done));
++
++            client.wait_for_connect_done();
++
++            client.display_server.start_prompt_session(
++                0,
++                &client.prompt_session_parameters,
++                &client.prompt_session,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::prompt_session_start_done));
++            client.wait_for_prompt_session_start_done();
++
++            client.display_server.add_prompt_provider(
++                0,
++                &client.prompt_provider,
++                &client.ignored,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::prompt_session_add_prompt_provider_done));
++            client.wait_for_prompt_session_add_prompt_provider_done();
++
++        }
++    } client_process;
++
++    launch_client_process(client_process);
++}
++
++TEST_F(ApplicationMediatorReport, prompt_session_stop_called)
++{
++    struct Server : TestingServerConfiguration
++    {
++        std::shared_ptr<mf::SessionMediatorReport>
++        the_application_mediator_report()
++        {
++            auto result = std::make_shared<MockApplicationMediatorReport>();
++
++            EXPECT_CALL(*result, session_stop_prompt_session_called(testing::_)).
++                Times(1);
++
++            return result;
++        }
++    } server_processing;
++
++    launch_server_process(server_processing);
++
++    struct Client: TestingClientConfiguration
++    {
++        void exec()
++        {
++            mt::TestProtobufClient client(mtf::test_socket_file(), rpc_timeout_ms);
++
++            client.connect_parameters.set_application_name(__PRETTY_FUNCTION__);
++            EXPECT_CALL(client, connect_done()).
++                Times(testing::AtLeast(0));
++            EXPECT_CALL(client, prompt_session_start_done()).
++                Times(testing::AtLeast(0));
++            EXPECT_CALL(client, prompt_session_stop_done()).
++                Times(testing::AtLeast(0));
++
++            client.display_server.connect(
++                0,
++                &client.connect_parameters,
++                &client.connection,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::connect_done));
++
++            client.wait_for_connect_done();
++
++            client.display_server.start_prompt_session(
++                0,
++                &client.prompt_session_parameters,
++                &client.prompt_session,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::prompt_session_start_done));
++            client.wait_for_prompt_session_start_done();
++
++            client.display_server.stop_prompt_session(
++                0,
++                &client.ignored,
++                &client.ignored,
++                google::protobuf::NewCallback(&client, &mt::TestProtobufClient::prompt_session_stop_done));
++            client.wait_for_prompt_session_stop_done();
++        }
++    } client_process;
++
++    launch_client_process(client_process);
++}
++
++
 === modified file 'tests/integration-tests/test_session_manager.cpp'
 --- tests/integration-tests/test_session_manager.cpp	2014-04-15 05:31:19 +0000
 +++ tests/integration-tests/test_session_manager.cpp	2014-06-16 15:01:17 +0000
@@ -32,6 +32,7 @@
  #include "mir_test_doubles/null_snapshot_strategy.h"
  #include "mir_test_doubles/null_event_sink.h"
  #include "mir_test_doubles/null_session_event_sink.h"
++#include "mir_test_doubles/null_prompt_session_manager.h"
  #include <gmock/gmock.h>
  #include <gtest/gtest.h>
@@ -55,7 +56,8 @@
                mt::fake_shared(focus_setter),
                std::make_shared<mtd::NullSnapshotStrategy>(),
                std::make_shared<mtd::NullSessionEventSink>(),
--              mt::fake_shared(session_listener))
++              mt::fake_shared(session_listener),
++              std::make_shared<mtd::NullPromptSessionManager>())
+     {
+     }
 === modified file 'tests/mir_test_doubles/test_protobuf_client.cpp'
 --- tests/mir_test_doubles/test_protobuf_client.cpp	2014-03-06 06:05:17 +0000
 +++ tests/mir_test_doubles/test_protobuf_client.cpp	2014-06-16 15:01:17 +0000
@@ -18,6 +18,7 @@
  #include "mir_test/test_protobuf_client.h"
  #include "mir_test_doubles/mock_rpc_report.h"
++#include "mir_test_doubles/null_client_event_sink.h"
  #include "src/client/connection_surface_map.h"
  #include "src/client/display_configuration.h"
@@ -38,7 +39,8 @@
          std::make_shared<mir::client::ConnectionSurfaceMap>(),
          std::make_shared<mir::client::DisplayConfiguration>(),
          rpc_report,
--        std::make_shared<mir::client::LifecycleControl>())),
++        std::make_shared<mir::client::LifecycleControl>(),
++        std::make_shared<mtd::NullClientEventSink>())),
      display_server(channel.get(), ::google::protobuf::Service::STUB_DOESNT_OWN_CHANNEL),
      maxwait(timeout_ms),
      connect_done_called(false),
@@ -59,6 +61,9 @@
      surface_parameters.set_buffer_usage(0);
      surface_parameters.set_output_id(mir_display_output_id_invalid);
++    prompt_provider.set_pid(__LINE__);
++    prompt_session_parameters.set_application_pid(__LINE__);
++
      ON_CALL(*this, connect_done())
          .WillByDefault(testing::Invoke(this, &TestProtobufClient::on_connect_done));
      ON_CALL(*this, create_surface_done())
@@ -73,6 +78,12 @@
          .WillByDefault(testing::Invoke(this, &TestProtobufClient::on_drm_auth_magic_done));
      ON_CALL(*this, display_configure_done())
          .WillByDefault(testing::Invoke(this, &TestProtobufClient::on_configure_display_done));
++    ON_CALL(*this, prompt_session_start_done())
++        .WillByDefault(testing::Invoke(&wc_prompt_session_start, &WaitCondition::wake_up_everyone));
++    ON_CALL(*this, prompt_session_add_prompt_provider_done())
++        .WillByDefault(testing::Invoke(&wc_prompt_session_add, &WaitCondition::wake_up_everyone));
++    ON_CALL(*this, prompt_session_stop_done())
++        .WillByDefault(testing::Invoke(&wc_prompt_session_stop, &WaitCondition::wake_up_everyone));
+ }
  void mir::test::TestProtobufClient::on_connect_done()
@@ -225,3 +236,18 @@
+     }
      tfd_done_called.store(false);
+ }
++
++void mir::test::TestProtobufClient::wait_for_prompt_session_start_done()
++{
++    wc_prompt_session_start.wait_for_at_most_seconds(maxwait);
++}
++
++void mir::test::TestProtobufClient::wait_for_prompt_session_add_prompt_provider_done()
++{
++    wc_prompt_session_add.wait_for_at_most_seconds(maxwait);
++}
++
++void mir::test::TestProtobufClient::wait_for_prompt_session_stop_done()
++{
++    wc_prompt_session_stop.wait_for_at_most_seconds(maxwait);
++}
 === modified file 'tests/unit-tests/client/CMakeLists.txt'
 --- tests/unit-tests/client/CMakeLists.txt	2014-03-06 06:05:17 +0000
 +++ tests/unit-tests/client/CMakeLists.txt	2014-06-16 15:01:17 +0000
@@ -8,6 +8,8 @@
    ${CMAKE_CURRENT_SOURCE_DIR}/test_wait_handle.cpp