[Xquartz-changes] xserver: Branch 'server-1.8-branch' - 34 commits

Jeremy Huddleston jeremyhu at freedesktop.org
Fri Jun 4 22:00:31 PDT 2010


 Xext/sync.c                              |   19 +--
 Xi/extinit.c                             |    1 
 Xi/xiproperty.c                          |    9 +
 Xi/xiproperty.h                          |    3 
 configure.ac                             |    2 
 dix/devices.c                            |    9 -
 dix/events.c                             |   20 ++-
 doc/Xserver.man.pre                      |   26 +---
 glx/glxdri2.c                            |   23 +---
 hw/dmx/dmxextension.c                    |    2 
 hw/xfree86/common/xf86DGA.c              |    4 
 hw/xfree86/common/xf86Xinput.c           |    6 -
 hw/xfree86/doc/Makefile.am               |    1 
 hw/xfree86/dri2/dri2.c                   |  174 +++++++++++++++++++++----------
 hw/xfree86/dri2/dri2.h                   |    6 +
 hw/xfree86/dri2/dri2ext.c                |   11 +
 hw/xfree86/modes/xf86Cursors.c           |    2 
 hw/xfree86/os-support/solaris/sun_init.c |  102 ++++++++++++++----
 hw/xfree86/ramdac/xf86Cursor.c           |    2 
 include/eventstr.h                       |    4 
 include/protocol-versions.h              |    4 
 mi/miarc.c                               |    2 
 mi/midispcur.c                           |    2 
 mi/mipolypnt.c                           |    5 
 os/access.c                              |    9 -
 render/render.c                          |    7 +
 test/xi2/protocol-common.c               |    1 
 xfixes/cursor.c                          |   23 ++--
 28 files changed, 315 insertions(+), 164 deletions(-)

New commits:
commit b65c5be170835db2282192381ef411997e61a6f1
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Wed Jun 2 09:27:33 2010 +1000

    xserver 1.8.1.901
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/configure.ac b/configure.ac
index 637e610..73a7b62 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,7 +26,7 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.8.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+AC_INIT([xorg-server], 1.8.1.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
 RELEASE_DATE="2010-05-11"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
commit 1b71e0a8b9e915c806f6c3596b6ee5913d62fdc3
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon May 24 12:25:15 2010 +1000

    xfree86: fix multiple InputAttributes tag matching.
    
    attr->tags is an array of strings (null-terminated). When matching, match
    against each string instead of each [i,end] substring in the first tag.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit b5e0f6d8f45c5b24eb50b305c66fa80c783ef488)

diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index a1a5527..bfa8dc0 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -551,9 +551,9 @@ InputClassMatches(XF86ConfInputClassPtr iclass, InputAttributes *attrs)
             return FALSE;
 
         for (cur = iclass->match_tag, match = FALSE; *cur && !match; cur++) {
-            const char *tag;
-            for(tag = *attrs->tags; *tag; tag++) {
-                if (!strcmp(tag, *cur)) {
+            char * const *tag;
+            for(tag = attrs->tags; *tag; tag++) {
+                if (!strcmp(*tag, *cur)) {
                     match = TRUE;
                     break;
                 }
commit f7a2da6df80044bf2d92b0bee94a13f7d76960ad
Merge: 2ab11e0... 354e4ce...
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue May 25 15:52:53 2010 +1000

    Merge branch 'server-1.8-branch' of git://people.freedesktop.org/~alanc/xserver into server-1.8-branch

commit 354e4ce3774d6b7f0c571f426bd2db1c8ab272ea
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat May 22 10:29:00 2010 -0700

    Add RandR 1.2 README.modes doc to EXTRA_DIST
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Julien Cristau <jcristau at debian.org>
    (cherry picked from commit 1805c74d9b0ed46802481bcd6beea5feeb60212c)

diff --git a/hw/xfree86/doc/Makefile.am b/hw/xfree86/doc/Makefile.am
index 5809fa0..72bc5d9 100644
--- a/hw/xfree86/doc/Makefile.am
+++ b/hw/xfree86/doc/Makefile.am
@@ -6,4 +6,5 @@ endif
 
 EXTRA_DIST = \
 	README.DRI \
+	README.modes \
 	README.rapidaccess
commit 9a71d21cc27c7b0d35bae9d6dc4eed591dea99a4
Author: Aaron Zang <Aaron.Zang at Sun.COM>
Date:   Thu May 20 17:56:28 2010 -0700

    Solaris: Use VT_SET_CONSUSER ioctl to set Console User rights profile
    
    When Xorg is started on display :0, this ioctl is called to grant the
    user the rights traditionally associated with /dev/console (before VT
    support was added), such as access to local peripheral devices.
    
    Also adds a Solaris-specific -C flag to force starting on /dev/console
    instead of /dev/vt*, allowing programs like xterm -C to access the
    console device.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 989db930d739483759087b13b8d9a043299feafb)

diff --git a/hw/xfree86/os-support/solaris/sun_init.c b/hw/xfree86/os-support/solaris/sun_init.c
index 5846866..edcc60b 100644
--- a/hw/xfree86/os-support/solaris/sun_init.c
+++ b/hw/xfree86/os-support/solaris/sun_init.c
@@ -33,8 +33,21 @@
 # include <sys/kd.h>
 #endif
 
+/*
+ * Applications see VT number as consecutive integers starting from 1.
+ * VT number			VT device
+ * -------------------------------------------------------
+ *     1             :          /dev/vt/0 (Alt + Ctrl + F1)
+ *     2             :          /dev/vt/2 (Alt + Ctrl + F2)
+ *     3             :          /dev/vt/3 (Alt + Ctrl + F3)
+ *  ... ...
+ */
+#define	CONSOLE_VTNO	1
+#define	SOL_CONSOLE_DEV	"/dev/console"
+
 static Bool KeepTty = FALSE;
 static Bool Protect0 = FALSE;
+static Bool UseConsole = FALSE;
 #ifdef HAS_USL_VTS
 static int VTnum = -1;
 static int xf86StartVT = -1;
@@ -112,8 +125,30 @@ xf86OpenConsole(void)
 		vtEnabled = 0;
 	    }
 	}
+#endif /*  HAS_USL_VTS */
 
+	if (UseConsole)
+	{
+	    strlcpy(consoleDev, SOL_CONSOLE_DEV, sizeof(consoleDev));
+
+#ifdef HAS_USL_VTS
+	    xf86Info.vtno = CONSOLE_VTNO;
 
+	    if (vtEnabled == 0)
+	    {
+		xf86StartVT = 0;
+	    }
+	    else
+	    {
+		if (ioctl(fd, VT_GETSTATE, &vtinfo) < 0)
+		    FatalError("xf86OpenConsole: Cannot determine current VT\n");
+		xf86StartVT = vtinfo.v_active;
+	    }
+#endif /*  HAS_USL_VTS */
+	    goto OPENCONSOLE;
+	}
+
+#ifdef HAS_USL_VTS
 	if (vtEnabled == 0)
 	{
 	    /* VT not enabled - kernel too old or Sparc platforms
@@ -123,32 +158,31 @@ xf86OpenConsole(void)
 	    xf86StartVT = 0;
 	    xf86Info.vtno = 0;
 	    strlcpy(consoleDev, xf86SolarisFbDev, sizeof(consoleDev));
+	    goto OPENCONSOLE;
 	}
-	else
-	{
-	    if (ioctl(fd, VT_GETSTATE, &vtinfo) < 0)
-		FatalError("xf86OpenConsole: Cannot determine current VT\n");
 
-	    xf86StartVT = vtinfo.v_active;
+	if (ioctl(fd, VT_GETSTATE, &vtinfo) < 0)
+	    FatalError("xf86OpenConsole: Cannot determine current VT\n");
 
-	    if (VTnum != -1)
-	    {
-		xf86Info.vtno = VTnum;
-		from = X_CMDLINE;
-	    }
-	    else
+	xf86StartVT = vtinfo.v_active;
+
+	if (VTnum != -1)
+	{
+	    xf86Info.vtno = VTnum;
+	    from = X_CMDLINE;
+	}
+	else
+	{
+	    if ((ioctl(fd, VT_OPENQRY, &xf86Info.vtno) < 0) ||
+		(xf86Info.vtno == -1))
 	    {
-		if ((ioctl(fd, VT_OPENQRY, &xf86Info.vtno) < 0) ||
-		    (xf86Info.vtno == -1))
-		{
-		    FatalError("xf86OpenConsole: Cannot find a free VT\n");
-		}
+		FatalError("xf86OpenConsole: Cannot find a free VT\n");
 	    }
-
-	    xf86Msg(from, "using VT number %d\n\n", xf86Info.vtno);
-	    snprintf(consoleDev, PATH_MAX, "/dev/vt/%d", xf86Info.vtno);
 	}
 
+	xf86Msg(from, "using VT number %d\n\n", xf86Info.vtno);
+	snprintf(consoleDev, PATH_MAX, "/dev/vt/%d", xf86Info.vtno);
+
 	if (fd != -1)
 	{
 	    close(fd);
@@ -156,6 +190,7 @@ xf86OpenConsole(void)
 
 #endif /* HAS_USL_VTS */
 
+OPENCONSOLE:
 	if (!KeepTty)
 	    setpgrp();
 
@@ -163,11 +198,10 @@ xf86OpenConsole(void)
 	    FatalError("xf86OpenConsole: Cannot open %s (%s)\n",
 		       consoleDev, strerror(errno));
 
-#ifdef HAS_USL_VTS
-
-	/* Change ownership of the vt */
+	/* Change ownership of the vt or console */
 	chown(consoleDev, getuid(), getgid());
 
+#ifdef HAS_USL_VTS
 	if (vtEnabled)
 	{
 	    /*
@@ -179,6 +213,13 @@ xf86OpenConsole(void)
 	    if (ioctl(xf86Info.consoleFd, VT_WAITACTIVE, xf86Info.vtno) != 0)
 		xf86Msg(X_WARNING, "xf86OpenConsole: VT_WAITACTIVE failed\n");
 
+#ifdef VT_SET_CONSUSER /* added in snv_139 */
+	    if (strcmp(display, "0") == 0)
+		if (ioctl(xf86Info.consoleFd, VT_SET_CONSUSER) != 0)
+		    xf86Msg(X_WARNING,
+			"xf86OpenConsole: VT_SET_CONSUSER failed\n");
+#endif
+
 	    if (ioctl(xf86Info.consoleFd, VT_GETMODE, &VT) < 0)
 		FatalError("xf86OpenConsole: VT_GETMODE failed\n");
 
@@ -220,6 +261,13 @@ xf86OpenConsole(void)
 	    if (ioctl(xf86Info.consoleFd, VT_WAITACTIVE, xf86Info.vtno) != 0)
 		xf86Msg(X_WARNING, "xf86OpenConsole: VT_WAITACTIVE failed\n");
 
+#ifdef VT_SET_CONSUSER /* added in snv_139 */
+	    if (strcmp(display, "0") == 0)
+		if (ioctl(xf86Info.consoleFd, VT_SET_CONSUSER) != 0)
+		    xf86Msg(X_WARNING,
+			"xf86OpenConsole: VT_SET_CONSUSER failed\n");
+#endif
+
 	    /*
 	     * If the server doesn't have the VT when the reset occurs,
 	     * this is to make sure we don't continue until the activate
@@ -330,6 +378,15 @@ xf86ProcessArgument(int argc, char **argv, int i)
 	return 1;
     }
 
+    /*
+     * Use /dev/console as the console device.
+     */
+    if (!strcmp(argv[i], "-C"))
+    {
+	UseConsole = TRUE;
+	return 1;
+    }
+
 #ifdef HAS_USL_VTS
 
     if ((argv[i][0] == 'v') && (argv[i][1] == 't'))
@@ -364,4 +421,5 @@ void xf86UseMsg()
     ErrorF("-dev <fb>              Framebuffer device\n");
     ErrorF("-keeptty               Don't detach controlling tty\n");
     ErrorF("                       (for debugging only)\n");
+    ErrorF("-C                     Use /dev/console as the console device\n");
 }
commit a8d40f61bf42a55fbd4fcd6468c94cb595e490cc
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Thu May 20 17:56:26 2010 -0700

    Xserver(1) man page updates
    
    - Note that -br is now default.
    - Move -bs after -br for alphabetical ordering.
    - Remove -config option that's been hidden in "ignore" section,
      since ajax removed the -config code a couple years back.
    - Add -nocursor option.
    - Add xinput & xrandr to list of runtime server control programs
    - Replace XDarwin with Xquartz in list of Xservers
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 7b09335a46f9428141811230c69eef7968531359)

diff --git a/doc/Xserver.man.pre b/doc/Xserver.man.pre
index 8144c8a..ce3b3a1 100644
--- a/doc/Xserver.man.pre
+++ b/doc/Xserver.man.pre
@@ -100,12 +100,12 @@ specifies a file which contains a collection of authorization records used
 to authenticate access.  See also the \fIxdm\fP(1) and 
 \fIXsecurity\fP(__miscmansuffix__) manual pages.
 .TP 8
-.B \-bs
-disables backing store support on all screens.
-.TP 8
 .B \-br
 sets the default root window to solid black instead of the standard root weave
-pattern.
+pattern.   This is the default unless -retro or -wr is specified.
+.TP 8
+.B \-bs
+disables backing store support on all screens.
 .TP 8
 .B \-c
 turns off key-click.
@@ -117,17 +117,6 @@ sets key-click volume (allowable range: 0-100).
 sets the visual class for the root window of color screens.
 The class numbers are as specified in the X protocol.
 Not obeyed by all servers.
-.ig
-.TP 8
-.B \-config \fIfilename\fP
-reads more options from the given file.  Options in the file may be separated
-by newlines if desired.  If a '#' character appears on a line, all characters
-between it and the next newline are ignored, providing a simple commenting
-facility.  The \fB\-config\fP option itself may appear in the file.
-.BR NOTE :
-This option is disabled when the Xserver is run with an effective uid
-different from the user's real uid.
-..
 .TP 8
 .B \-core
 causes the server to generate a core dump on fatal errors.
@@ -184,6 +173,9 @@ sets the maximum big request to
 .I size
 MB.
 .TP 8
+.B \-nocursor
+disable the display of the pointer cursor.
+.TP 8
 .B \-nolisten \fItrans-type\fP
 disables a transport type.  For example, TCP/IP connections can be disabled
 with
@@ -584,11 +576,11 @@ Security: \fIXsecurity\fP(__miscmansuffix__), \fIxauth\fP(1), \fIXau\fP(1),
 Starting the server: \fIstartx\fP(1), \fIxdm\fP(1), \fIxinit\fP(1)
 .PP
 Controlling the server once started: \fIxset\fP(1), \fIxsetroot\fP(1),
-\fIxhost\fP(1)
+\fIxhost\fP(1), \fIxinput\fP(1), \fIxrandr\fP(1)
 .PP
 Server-specific man pages:
 \fIXorg\fP(1), \fIXdmx\fP(1), \fIXephyr\fP(1), \fIXnest\fP(1),
-\fIXvfb\fP(1), \fIXDarwin\fP(1), \fIXWin\fP(1).
+\fIXvfb\fP(1), \fIXquartz\fP(1), \fIXWin\fP(1).
 .PP
 Server internal documentation:
 .I "Definition of the Porting Layer for the X v11 Sample Server"
commit 2ab11e09734dec4f119166fa6512eb25b4572e48
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri May 21 13:30:25 2010 +1000

    dix: remove obsolete comment.from EnableDevice.
    
    The code this comment was referring to was removed in
    8b5086250aa5dae8de8b763408ff480d7beac819 "Eliminate bogus event resizing."
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit cf4f3d051858aadedd6e333bb317a1daa3987ad7)

diff --git a/dix/devices.c b/dix/devices.c
index 042f12f..b55df16 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -318,10 +318,6 @@ EnableDevice(DeviceIntPtr dev, BOOL sendevent)
         }
     }
 
-    /* Before actually enabling the device, we need to make sure the event
-     * list's events have enough memory for a ClassesChangedEvent from the
-     * device
-     */
     if ((*prev != dev) || !dev->inited ||
 	((ret = (*dev->deviceProc)(dev, DEVICE_ON)) != Success)) {
         ErrorF("[dix] couldn't enable device %d\n", dev->id);
commit 869d37721425d219c50962b694c3326407d1d2e6
Author: Jamey Sharp <jamey at minilop.net>
Date:   Wed May 19 10:44:33 2010 -0700

    Device init: Don't crash when CreateGC fails.
    
    ActivateDevice was ignoring errors from DeviceCursorInitialize, so
    cursor-related calls failed later. Jeremy Huddleston saw that crash in
    miPointerConstrainCursor, while with Xvfb I saw it in
    miSpriteRealizeCursor.
    
    miDCDeviceCleanup frees any non-NULL GCs. miDCDeviceInitialize calls
    Cleanup on any failure, but if it failed early then some of the pointers
    in the miDCBufferPtr were garbage. Switch from malloc to calloc to
    ensure everything's initialized safely first.
    
    With these two fixes, if CreateGC fails then the server gracefully fails
    in FatalError instead of segfaulting.
    
    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Cc: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    
    (cherry-picked from commit b9f48d60bc0c839bd323c582231e8e7e2b810af6)

diff --git a/dix/devices.c b/dix/devices.c
index 32e067b..042f12f 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -474,7 +474,8 @@ ActivateDevice(DeviceIntPtr dev, BOOL sendevent)
 
     /* Initialize memory for sprites. */
     if (IsMaster(dev) && dev->spriteInfo->spriteOwner)
-        pScreen->DeviceCursorInitialize(dev, pScreen);
+        if (!pScreen->DeviceCursorInitialize(dev, pScreen))
+            ret = BadAlloc;
 
     SendDevicePresenceEvent(dev->id, DeviceAdded);
     if (sendevent)
diff --git a/mi/midispcur.c b/mi/midispcur.c
index 9041630..54a6787 100644
--- a/mi/midispcur.c
+++ b/mi/midispcur.c
@@ -780,7 +780,7 @@ miDCDeviceInitialize(DeviceIntPtr pDev, ScreenPtr pScreen)
     {
         pScreen = screenInfo.screens[i];
 
-        pBuffer = xalloc(sizeof(miDCBufferRec));
+        pBuffer = xcalloc(1, sizeof(miDCBufferRec));
         if (!pBuffer)
             goto failure;
 
commit a8de0866130df62c2b1e4653e028a0fe365e0e3a
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Tue Mar 23 09:47:08 2010 -0700

    GLX/DRI2: expose swap control extensions if DDX support is present
    
    Export DDX swap control status from the DRI2 module and check for it in
    GLX when initializing extensions.
    
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 165a4a9c7de0fcc6ef6a6421736b412ccb35965e)

diff --git a/glx/glxdri2.c b/glx/glxdri2.c
index edd29b0..e791bf6 100644
--- a/glx/glxdri2.c
+++ b/glx/glxdri2.c
@@ -616,6 +616,7 @@ glxDRILeaveVT (int index, int flags)
 static void
 initializeExtensions(__GLXDRIscreen *screen)
 {
+    ScreenPtr pScreen = screen->base.pScreen;
     const __DRIextension **extensions;
     int i;
 
@@ -625,10 +626,17 @@ initializeExtensions(__GLXDRIscreen *screen)
 			 "GLX_MESA_copy_sub_buffer");
     LogMessage(X_INFO, "AIGLX: enabled GLX_MESA_copy_sub_buffer\n");
 
-    /* FIXME: only if DDX supports it */
     __glXEnableExtension(screen->glx_enable_bits, "GLX_INTEL_swap_event");
     LogMessage(X_INFO, "AIGLX: enabled GLX_INTEL_swap_event\n");
 
+    if (DRI2HasSwapControl(pScreen)) {
+	__glXEnableExtension(screen->glx_enable_bits,
+			     "GLX_SGI_swap_control");
+	__glXEnableExtension(screen->glx_enable_bits,
+			     "GLX_MESA_swap_control");
+	LogMessage(X_INFO, "AIGLX: enabled GLX_SGI_swap_control and GLX_MESA_swap_control\n");
+    }
+
     for (i = 0; extensions[i]; i++) {
 #ifdef __DRI_READ_DRAWABLE
 	if (strcmp(extensions[i]->name, __DRI_READ_DRAWABLE) == 0) {
@@ -639,19 +647,6 @@ initializeExtensions(__GLXDRIscreen *screen)
 	}
 #endif
 
-#ifdef __DRI_SWAP_CONTROL
-	if (strcmp(extensions[i]->name, __DRI_SWAP_CONTROL) == 0) {
-	    screen->swapControl =
-		(const __DRIswapControlExtension *) extensions[i];
-	    __glXEnableExtension(screen->glx_enable_bits,
-				 "GLX_SGI_swap_control");
-	    __glXEnableExtension(screen->glx_enable_bits,
-				 "GLX_MESA_swap_control");
-	    
-	    LogMessage(X_INFO, "AIGLX: enabled GLX_SGI_swap_control and GLX_MESA_swap_control\n");
-	}
-#endif
-
 #ifdef __DRI_TEX_BUFFER
 	if (strcmp(extensions[i]->name, __DRI_TEX_BUFFER) == 0) {
 	    screen->texBuffer =
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 8b4c36f..2bdb733 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -831,6 +831,14 @@ DRI2DestroyDrawable(DrawablePtr pDraw)
 }
 
 Bool
+DRI2HasSwapControl(ScreenPtr pScreen)
+{
+    DRI2ScreenPtr ds = DRI2GetScreen(pScreen);
+
+    return (ds->ScheduleSwap && ds->GetMSC);
+}
+
+Bool
 DRI2Connect(ScreenPtr pScreen, unsigned int driverType, int *fd,
 	    const char **driverName, const char **deviceName)
 {
diff --git a/hw/xfree86/dri2/dri2.h b/hw/xfree86/dri2/dri2.h
index e1881ba..ce8a5df 100644
--- a/hw/xfree86/dri2/dri2.h
+++ b/hw/xfree86/dri2/dri2.h
@@ -188,6 +188,8 @@ extern _X_EXPORT Bool DRI2ScreenInit(ScreenPtr	pScreen,
 
 extern _X_EXPORT void DRI2CloseScreen(ScreenPtr pScreen);
 
+extern _X_EXPORT Bool DRI2HasSwapControl(ScreenPtr pScreen);
+
 extern _X_EXPORT Bool DRI2Connect(ScreenPtr pScreen,
 		 unsigned int driverType,
 		 int *fd,
commit b24856626e1836657ebf35ad4c61984e0a407c5b
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Mon Mar 8 15:10:47 2010 -0800

    DRI2: prevent swap wakes from waking MSC waiters
    
    If a few swaps were queued leading to a throttle related block on the
    client, and then the client submitted an MSC wait, one of the previous
    swap wakeups could have caused the MSC wait to complete early.  Add a
    flag for this to prevent a swap wake from prematurely waking an MSC
    waiter.
    
    Reported-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 5933b0abc6a76aaea84aa534df89900cd795c888)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 8a67122..8b4c36f 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -63,6 +63,7 @@ typedef struct _DRI2Drawable {
     int			 bufferCount;
     unsigned int	 swapsPending;
     ClientPtr		 blockedClient;
+    Bool		 blockedOnMsc;
     int			 swap_interval;
     CARD64		 swap_count;
     int64_t		 target_sbc; /* -1 means no SBC wait outstanding */
@@ -145,6 +146,7 @@ DRI2CreateDrawable(DrawablePtr pDraw)
     pPriv->bufferCount = 0;
     pPriv->swapsPending = 0;
     pPriv->blockedClient = NULL;
+    pPriv->blockedOnMsc = FALSE;
     pPriv->swap_count = 0;
     pPriv->target_sbc = -1;
     pPriv->swap_interval = 1;
@@ -402,6 +404,15 @@ DRI2ThrottleClient(ClientPtr client, DrawablePtr pDraw)
     return FALSE;
 }
 
+static void
+__DRI2BlockClient(ClientPtr client, DRI2DrawablePtr pPriv)
+{
+    if (pPriv->blockedClient == NULL) {
+	IgnoreClient(client);
+	pPriv->blockedClient = client;
+    }
+}
+
 void
 DRI2BlockClient(ClientPtr client, DrawablePtr pDraw)
 {
@@ -411,10 +422,8 @@ DRI2BlockClient(ClientPtr client, DrawablePtr pDraw)
     if (pPriv == NULL)
 	return;
 
-    if (pPriv->blockedClient == NULL) {
-	IgnoreClient(client);
-	pPriv->blockedClient = client;
-    }
+    __DRI2BlockClient(client, pPriv);
+    pPriv->blockedOnMsc = TRUE;
 }
 
 int
@@ -495,6 +504,7 @@ DRI2WaitMSCComplete(ClientPtr client, DrawablePtr pDraw, int frame,
 	AttendClient(pPriv->blockedClient);
 
     pPriv->blockedClient = NULL;
+    pPriv->blockedOnMsc = FALSE;
 
     /* If there's still a swap pending, let DRI2SwapComplete free it */
     if (pPriv->refCount == 0 && pPriv->swapsPending == 0)
@@ -516,8 +526,12 @@ DRI2WakeClient(ClientPtr client, DrawablePtr pDraw, int frame,
     }
 
     /*
-     * Swap completed.  Either wake up an SBC waiter or a client that was
-     * blocked due to GLX activity during a swap.
+     * Swap completed.
+     * Wake the client iff:
+     *   - it was waiting on SBC
+     *   - was blocked due to GLX make current
+     *   - was blocked due to swap throttling
+     *   - is not blocked due to an MSC wait
      */
     if (pPriv->target_sbc != -1 &&
 	pPriv->target_sbc <= pPriv->swap_count) {
@@ -527,10 +541,11 @@ DRI2WakeClient(ClientPtr client, DrawablePtr pDraw, int frame,
 
 	AttendClient(pPriv->blockedClient);
 	pPriv->blockedClient = NULL;
-    } else if (pPriv->target_sbc == -1) {
-	if (pPriv->blockedClient)
+    } else if (pPriv->target_sbc == -1 && !pPriv->blockedOnMsc) {
+	if (pPriv->blockedClient) {
 	    AttendClient(pPriv->blockedClient);
-	pPriv->blockedClient = NULL;
+	    pPriv->blockedClient = NULL;
+	}
     }
 }
 
@@ -582,7 +597,7 @@ DRI2WaitSwap(ClientPtr client, DrawablePtr pDrawable)
 	pPriv->blockedClient == NULL) {
 	ResetCurrentRequest(client);
 	client->sequence--;
-	DRI2BlockClient(client, pDrawable);
+	__DRI2BlockClient(client, pPriv);
 	return TRUE;
     }
 
@@ -780,7 +795,7 @@ DRI2WaitSBC(ClientPtr client, DrawablePtr pDraw, CARD64 target_sbc,
     }
 
     pPriv->target_sbc = target_sbc;
-    DRI2BlockClient(client, pDraw);
+    __DRI2BlockClient(client, pPriv);
 
     return Success;
 }
diff --git a/hw/xfree86/dri2/dri2.h b/hw/xfree86/dri2/dri2.h
index 066cc39..e1881ba 100644
--- a/hw/xfree86/dri2/dri2.h
+++ b/hw/xfree86/dri2/dri2.h
@@ -257,6 +257,7 @@ extern _X_EXPORT Bool DRI2CanFlip(DrawablePtr pDraw);
 
 extern _X_EXPORT Bool DRI2CanExchange(DrawablePtr pDraw);
 
+/* Note: use *only* for MSC related waits */
 extern _X_EXPORT void DRI2BlockClient(ClientPtr client, DrawablePtr pDraw);
 
 extern _X_EXPORT void DRI2SwapComplete(ClientPtr client, DrawablePtr pDraw,
commit 5c54e7fa004532d595160a815177dda467b3cc9c
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Mon Mar 8 12:41:25 2010 -0800

    DRI2: handle swapsPending better
    
    Avoid a potential swapsPending underflow by incrementing it before
    ScheduleSwap, which may complete it immediately.  And be sure to
    decrement it again in case the schedule failed.
    
    Reported-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit b00d435ddf2e9817e33bfd5f7e9b905442dc23c7)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 3fc7f4e..8a67122 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -654,15 +654,16 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
 	*swap_target = target_msc;
     }
 
+    pPriv->swapsPending++;
     ret = (*ds->ScheduleSwap)(client, pDraw, pDestBuffer, pSrcBuffer,
 			      swap_target, divisor, remainder, func, data);
     if (!ret) {
+	pPriv->swapsPending--; /* didn't schedule */
         xf86DrvMsg(pScreen->myNum, X_ERROR,
 		   "[DRI2] %s: driver failed to schedule swap\n", __func__);
 	return BadDrawable;
     }
 
-    pPriv->swapsPending++;
     pPriv->last_swap_target = *swap_target;
 
     /* According to spec, return expected swapbuffers count SBC after this swap
commit fcd76ddfc59de6a1d37ca2aa6e6e91cb8d814744
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Mon Mar 8 12:39:54 2010 -0800

    DRI2: throttle swaps at submission time too
    
    We need to throttle swaps here in addition to when the context is made
    current to avoid causing problems with clients that just swap.
    Throttling here also ensures our swaps get ordered as long as we block
    the client occasionally.
    
    Reported-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 0294ff2a5cadddc8fcc77ba9a851f979f0b91fc3)

diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c
index 7a9f8ca..094d54d 100644
--- a/hw/xfree86/dri2/dri2ext.c
+++ b/hw/xfree86/dri2/dri2ext.c
@@ -384,6 +384,13 @@ ProcDRI2SwapBuffers(ClientPtr client)
 		       DixReadAccess | DixWriteAccess, &pDrawable, &status))
 	return status;
 
+    /*
+     * Ensures an out of control client can't exhaust our swap queue, and
+     * also orders swaps.
+     */
+    if (DRI2ThrottleClient(client, pDrawable))
+	return client->noClientException;
+
     target_msc = vals_to_card64(stuff->target_msc_lo, stuff->target_msc_hi);
     divisor = vals_to_card64(stuff->divisor_lo, stuff->divisor_hi);
     remainder = vals_to_card64(stuff->remainder_lo, stuff->remainder_hi);
commit c7e9e36fd3cdb889704d3b0e1333653d06ef9069
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Mon Mar 8 12:38:37 2010 -0800

    DRI2: advertise lowest supported DRI2 protocol version
    
    Update our supported DRI2 protocol version as each driver does
    DRI2ScreenInit, since depending on available kernel features, each DDX
    may support different callbacks and therefore protocol.
    
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit db1c7cb604167baf49e61be4c09ccf7b592c4af3)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 9825a55..3fc7f4e 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -45,6 +45,9 @@
 
 #include "xf86.h"
 
+CARD8 dri2_major; /* version of DRI2 supported by DDX */
+CARD8 dri2_minor;
+
 static int dri2ScreenPrivateKeyIndex;
 static DevPrivateKey dri2ScreenPrivateKey = &dri2ScreenPrivateKeyIndex;
 static int dri2WindowPrivateKeyIndex;
@@ -848,6 +851,7 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
 	"VDPAU", /* DRI2DriverVDPAU */
     };
     unsigned int i;
+    CARD8 cur_minor;
 
     if (info->version < 3)
 	return FALSE;
@@ -864,6 +868,7 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
 
     ds->fd	       = info->fd;
     ds->deviceName     = info->deviceName;
+    dri2_major         = 1;
 
     ds->CreateBuffer   = info->CreateBuffer;
     ds->DestroyBuffer  = info->DestroyBuffer;
@@ -873,8 +878,15 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
 	ds->ScheduleSwap = info->ScheduleSwap;
 	ds->ScheduleWaitMSC = info->ScheduleWaitMSC;
 	ds->GetMSC = info->GetMSC;
+	cur_minor = 2;
+    } else {
+	cur_minor = 1;
     }
 
+    /* Initialize minor if needed and set to minimum provied by DDX */
+    if (!dri2_minor || dri2_minor > cur_minor)
+	dri2_minor = cur_minor;
+
     if (info->version == 3 || info->numDrivers == 0) {
 	/* Driver too old: use the old-style driverName field */
 	ds->numDrivers = 1;
diff --git a/hw/xfree86/dri2/dri2.h b/hw/xfree86/dri2/dri2.h
index 1c8626b..066cc39 100644
--- a/hw/xfree86/dri2/dri2.h
+++ b/hw/xfree86/dri2/dri2.h
@@ -46,6 +46,9 @@ typedef struct {
     void *driverPrivate;
 } DRI2BufferRec, *DRI2BufferPtr;
 
+extern CARD8 dri2_major; /* version of DRI2 supported by DDX */
+extern CARD8 dri2_minor;
+
 typedef DRI2BufferRec DRI2Buffer2Rec, *DRI2Buffer2Ptr;
 typedef void (*DRI2SwapEventPtr)(ClientPtr client, void *data, int type,
 				 CARD64 ust, CARD64 msc, CARD64 sbc);
diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c
index bd92fd3..7a9f8ca 100644
--- a/hw/xfree86/dri2/dri2ext.c
+++ b/hw/xfree86/dri2/dri2ext.c
@@ -80,8 +80,8 @@ ProcDRI2QueryVersion(ClientPtr client)
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
-    rep.majorVersion = SERVER_DRI2_MAJOR_VERSION;
-    rep.minorVersion = SERVER_DRI2_MINOR_VERSION;
+    rep.majorVersion = dri2_major;
+    rep.minorVersion = dri2_minor;
 
     if (client->swapped) {
     	swaps(&rep.sequenceNumber, n);
diff --git a/include/protocol-versions.h b/include/protocol-versions.h
index c74b7fa..97ef5da 100644
--- a/include/protocol-versions.h
+++ b/include/protocol-versions.h
@@ -51,10 +51,6 @@
 #define SERVER_DMX_MINOR_VERSION		2
 #define SERVER_DMX_PATCH_VERSION		20040604
 
-/* DRI2 */
-#define SERVER_DRI2_MAJOR_VERSION		1
-#define SERVER_DRI2_MINOR_VERSION		2
-
 /* Generic event extension */
 #define SERVER_GE_MAJOR_VERSION                 1
 #define SERVER_GE_MINOR_VERSION                 0
commit 20708781d43501f116b4161c1cc96b0eb39e96b1
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Fri Mar 5 09:49:03 2010 -0800

    DRI2: handle swap_interval of 0 correctly
    
    A 0 swap interval means that swaps shouldn't be sync'd to vblank, so
    just complete the swap immediately in that case.
    
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 87ca6320f26eb3129e3c19056e1d8fa5c1784723)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 58f478f..9825a55 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -616,8 +616,8 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
 	return BadDrawable;
     }
 
-    /* Old DDX, just blit */
-    if (!ds->ScheduleSwap) {
+    /* Old DDX or no swap interval, just blit */
+    if (!ds->ScheduleSwap || !pPriv->swap_interval) {
 	BoxRec box;
 	RegionRec region;
 
commit 73fe4a0952b5c8aea90bce6f758546c13d0754b5
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Fri Mar 5 09:15:24 2010 -0800

    DRI2: drawable lifetime fixes
    
    Handle drawable destruction and lifetime correctly.
    
    Check whether the drawable priv is valid in DRI2SwapInterval(),
    DRI2WaitSBC() and DRI2WaitMSC(); it may have gone away, so be sure to
    check it before using it.
    
    If more than 1 outstanding swap is queued, we may complete several after
    an app has exited.  If we free it after the first one completes and the
    refcount reaches 0, we'll crash the server on subsequent completions.
    So delay freeing until all swaps complete and remove the error message
    as this is a normal occurence.  To do this properly, we must also avoid
    destroying drawables in DRI2DestroyDrawable() if a swap or wait event is
    pending.
    
    And finally, make sure we free drawables in DRI2WaitMSCComplete() if
    necessary (i.e. if the refcount has reached 0 and this MSC was the last
    pending event on the object).
    
    Reported-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 8476d99231cb725c090305d60f1c1c889d25c8dc)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 354b724..58f478f 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -492,6 +492,10 @@ DRI2WaitMSCComplete(ClientPtr client, DrawablePtr pDraw, int frame,
 	AttendClient(pPriv->blockedClient);
 
     pPriv->blockedClient = NULL;
+
+    /* If there's still a swap pending, let DRI2SwapComplete free it */
+    if (pPriv->refCount == 0 && pPriv->swapsPending == 0)
+	DRI2FreeDrawable(pDraw);
 }
 
 static void
@@ -543,13 +547,6 @@ DRI2SwapComplete(ClientPtr client, DrawablePtr pDraw, int frame,
 	return;
     }
 
-    if (pPriv->refCount == 0) {
-        xf86DrvMsg(pScreen->myNum, X_ERROR,
-		   "[DRI2] %s: bad drawable refcount\n", __func__);
-	DRI2FreeDrawable(pDraw);
-	return;
-    }
-
     pPriv->swapsPending--;
     pPriv->swap_count++;
 
@@ -561,6 +558,13 @@ DRI2SwapComplete(ClientPtr client, DrawablePtr pDraw, int frame,
     pPriv->last_swap_ust = ust;
 
     DRI2WakeClient(client, pDraw, frame, tv_sec, tv_usec);
+
+    /*
+     * It's normal for the app to have exited with a swap outstanding, but
+     * don't free the drawable until they're all complete.
+     */
+    if (pPriv->swapsPending == 0 && pPriv->refCount == 0)
+	DRI2FreeDrawable(pDraw);
 }
 
 Bool
@@ -669,10 +673,16 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
 void
 DRI2SwapInterval(DrawablePtr pDrawable, int interval)
 {
+    ScreenPtr       pScreen = pDrawable->pScreen;
     DRI2DrawablePtr pPriv = DRI2GetDrawable(pDrawable);
 
-    /* fixme: check against arbitrary max? */
+    if (pPriv == NULL) {
+        xf86DrvMsg(pScreen->myNum, X_ERROR,
+		   "[DRI2] %s: bad drawable\n", __func__);
+	return;
+    }
 
+    /* fixme: check against arbitrary max? */
     pPriv->swap_interval = interval;
 }
 
@@ -721,7 +731,7 @@ DRI2WaitMSC(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
     Bool ret;
 
     pPriv = DRI2GetDrawable(pDraw);
-    if (pPriv == NULL)
+    if (pPriv == NULL || pPriv->refCount == 0)
 	return BadDrawable;
 
     /* Old DDX just completes immediately */
@@ -745,7 +755,7 @@ DRI2WaitSBC(ClientPtr client, DrawablePtr pDraw, CARD64 target_sbc,
     DRI2DrawablePtr pPriv;
 
     pPriv = DRI2GetDrawable(pDraw);
-    if (pPriv == NULL)
+    if (pPriv == NULL || pPriv->refCount == 0)
 	return BadDrawable;
 
     /* target_sbc == 0 means to block until all pending swaps are
@@ -794,10 +804,10 @@ DRI2DestroyDrawable(DrawablePtr pDraw)
 	xfree(pPriv->buffers);
     }
 
-    /* If the window is destroyed while we have a swap pending, don't
+    /* If the window is destroyed while we have a swap or wait pending, don't
      * actually free the priv yet.  We'll need it in the DRI2SwapComplete()
      * callback and we'll free it there once we're done. */
-    if (!pPriv->swapsPending)
+    if (!pPriv->swapsPending && !pPriv->blockedClient)
 	DRI2FreeDrawable(pDraw);
 }
 
commit 23d78005b06b15f7b68fc4eed7e325ad29d0880a
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Thu Mar 4 10:31:59 2010 -0800

    DRI2: fix swapbuffers handling of SBC and target MSC
    
    Returns expected SBC after completion of swap to caller, as required by
    OML_sync_control spec, instead of the last_swap_target value.
    
    Passes target_msc, divisor, remainder, correctly for
    glXSwapBuffersMscOML() call, while retaining old behaviour for simple
    glXSwapBuffers() call.
    
    An OML swap can have a 0 target_msc, which just means it needs to
    satisfy the divisor/remainder equation.  Pass this down to the driver as
    needed so we can support it.
    
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    (cherry picked from commit b180e43977710b56ccfd6780f204ddcc952987a1)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index ef838ff..354b724 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -632,11 +632,20 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
     }
 
     /*
-     * Swap target for this swap is last swap target + swap interval since
-     * we have to account for the current swap count, interval, and the
-     * number of pending swaps.
+     * In the simple glXSwapBuffers case, all params will be 0, and we just
+     * need to schedule a swap for the last swap target + the swap interval.
      */
-    *swap_target = pPriv->last_swap_target + pPriv->swap_interval;
+    if (target_msc == 0 && divisor == 0 && remainder == 0) {
+	/*
+	 * Swap target for this swap is last swap target + swap interval since
+	 * we have to account for the current swap count, interval, and the
+	 * number of pending swaps.
+	 */
+	*swap_target = pPriv->last_swap_target + pPriv->swap_interval;
+    } else {
+	/* glXSwapBuffersMscOML could have a 0 target_msc, honor it */
+	*swap_target = target_msc;
+    }
 
     ret = (*ds->ScheduleSwap)(client, pDraw, pDestBuffer, pSrcBuffer,
 			      swap_target, divisor, remainder, func, data);
@@ -649,6 +658,11 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
     pPriv->swapsPending++;
     pPriv->last_swap_target = *swap_target;
 
+    /* According to spec, return expected swapbuffers count SBC after this swap
+     * will complete.
+     */
+    *swap_target = pPriv->swap_count + pPriv->swapsPending;
+
     return Success;
 }
 
commit a56178402ede82ed3ffd81439b2efc4a39f2779e
Author: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
Date:   Sun Feb 21 05:26:00 2010 +0100

    DRI2WaitSbc(): Fixes for correct semantic of glXWaitForSbcOML()
    
    Added implementation for case target_sbc == 0. In that case, the
    function shall schedule a wait until all pending swaps for the drawable
    have completed.
    
    Fix for non-blocking case. Old implementation returned random,
    uninitialized values for (ust,msc,sbc) if it returned immediately
    without scheduling a wait due to sbc >= target_sbc.
    
    Now if function doesn't schedule a wait, but returns immediately,
    it returns the (ust,msc,sbc) of the most recently completed swap,
    i.e., the UST and MSC corresponding to the time when the returned
    current SBC was reached.
    
    Signed-off-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    (cherry picked from commit 751e8c09d34df4b41e8d8384a3ec1bf5cb8ca028)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index cb227be..ef838ff 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -64,6 +64,8 @@ typedef struct _DRI2Drawable {
     CARD64		 swap_count;
     int64_t		 target_sbc; /* -1 means no SBC wait outstanding */
     CARD64		 last_swap_target; /* most recently queued swap target */
+    CARD64		 last_swap_msc; /* msc at completion of most recent swap */
+    CARD64		 last_swap_ust; /* ust at completion of most recent swap */
     int			 swap_limit; /* for N-buffering */
 } DRI2DrawableRec, *DRI2DrawablePtr;
 
@@ -148,6 +150,8 @@ DRI2CreateDrawable(DrawablePtr pDraw)
 	pPriv->last_swap_target = 0;
 
     pPriv->swap_limit = 1; /* default to double buffering */
+    pPriv->last_swap_msc = 0;
+    pPriv->last_swap_ust = 0;
 
     if (pDraw->type == DRAWABLE_WINDOW)
     {
@@ -553,6 +557,9 @@ DRI2SwapComplete(ClientPtr client, DrawablePtr pDraw, int frame,
     if (swap_complete)
 	swap_complete(client, swap_data, type, ust, frame, pPriv->swap_count);
 
+    pPriv->last_swap_msc = frame;
+    pPriv->last_swap_ust = ust;
+
     DRI2WakeClient(client, pDraw, frame, tv_sec, tv_usec);
 }
 
@@ -727,8 +734,22 @@ DRI2WaitSBC(ClientPtr client, DrawablePtr pDraw, CARD64 target_sbc,
     if (pPriv == NULL)
 	return BadDrawable;
 
-    if (pPriv->swap_count >= target_sbc)
-	return Success;
+    /* target_sbc == 0 means to block until all pending swaps are
+     * finished. Recalculate target_sbc to get that behaviour.
+     */
+    if (target_sbc == 0)
+        target_sbc = pPriv->swap_count + pPriv->swapsPending;
+
+    /* If current swap count already >= target_sbc,
+     * return immediately with (ust, msc, sbc) triplet of
+     * most recent completed swap.
+     */
+    if (pPriv->swap_count >= target_sbc) {
+        *sbc = pPriv->swap_count;
+        *msc = pPriv->last_swap_msc;
+        *ust = pPriv->last_swap_ust;
+        return Success;
+    }
 
     pPriv->target_sbc = target_sbc;
     DRI2BlockClient(client, pDraw);
commit a9b70da1afe7361955a19d34bb5e9b94dc156889
Author: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
Date:   Sun Feb 21 05:25:59 2010 +0100

    DRI2: Fix glitches in DRI2SwapComplete() and DRI2WakeupClient()
    
    DRI2SwapComplete(): Increment pPriv->swap_count++; before calling
    into callback for INTEL_swap_events extension, so the swap event
    contains the current SBC after swap completion instead of the
    previous one.
    
    DRI2WakeupClient: Check for pPriv->target_sbc <= pPriv->swap_count,
    had wrong comparison pPriv->target_sbc >= pPriv->swap_count for
    unblocking of clients of DRI2WaitSBC().
    
    Signed-off-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    (cherry picked from commit 0de4974b90b10fa6a447cdf980b4a114c6c9e5a8)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index ec4f982..cb227be 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -509,7 +509,7 @@ DRI2WakeClient(ClientPtr client, DrawablePtr pDraw, int frame,
      * blocked due to GLX activity during a swap.
      */
     if (pPriv->target_sbc != -1 &&
-	pPriv->target_sbc >= pPriv->swap_count) {
+	pPriv->target_sbc <= pPriv->swap_count) {
 	ProcDRI2WaitMSCReply(client, ((CARD64)tv_sec * 1000000) + tv_usec,
 			     frame, pPriv->swap_count);
 	pPriv->target_sbc = -1;
@@ -546,13 +546,13 @@ DRI2SwapComplete(ClientPtr client, DrawablePtr pDraw, int frame,
 	return;
     }
 
+    pPriv->swapsPending--;
+    pPriv->swap_count++;
+
     ust = ((CARD64)tv_sec * 1000000) + tv_usec;
     if (swap_complete)
 	swap_complete(client, swap_data, type, ust, frame, pPriv->swap_count);
 
-    pPriv->swapsPending--;
-    pPriv->swap_count++;
-
     DRI2WakeClient(client, pDraw, frame, tv_sec, tv_usec);
 }
 
commit 96a12314ae41a2edec67d388c1c4770bd099d9ec
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Thu Mar 4 09:54:15 2010 -0800

    DRI2: make target_sbc signed
    
    We need to track invalid targets as well as 0 targets, so just make it
    signed so our comparisons work like they should.
    
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Reported-by: Kristian Høgsberg <krh at bitplanet.net>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit 4c8ec49826a46eb3b36c69d2ad3f82320c179c38)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index d60bd5e..ec4f982 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -62,7 +62,7 @@ typedef struct _DRI2Drawable {
     ClientPtr		 blockedClient;
     int			 swap_interval;
     CARD64		 swap_count;
-    CARD64		 target_sbc; /* -1 means no SBC wait outstanding */
+    int64_t		 target_sbc; /* -1 means no SBC wait outstanding */
     CARD64		 last_swap_target; /* most recently queued swap target */
     int			 swap_limit; /* for N-buffering */
 } DRI2DrawableRec, *DRI2DrawablePtr;
commit 18dc5d1f15fe0df7e836b057d34c4ca596e31e8f
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Thu Mar 4 09:19:13 2010 -0800

    DRI2: fixup handling of last_swap_target
    
    We need to initialize the swap target, which is passed to the driver to
    schedule events.  Rather than using -1 to indicate that the field is
    uninitialized, just make sure we initialize it at drawable creation
    time.
    
    Reviewed-by: Mario Kleiner <mario.kleiner at tuebingen.mpg.de>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    (cherry picked from commit c4d54816f2ee4883d8f9bcf4595474fb58c95146)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 48618e1..d60bd5e 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -116,9 +116,11 @@ DRI2GetDrawable(DrawablePtr pDraw)
 int
 DRI2CreateDrawable(DrawablePtr pDraw)
 {
+    DRI2ScreenPtr   ds = DRI2GetScreen(pDraw->pScreen);
     WindowPtr	    pWin;
     PixmapPtr	    pPixmap;
     DRI2DrawablePtr pPriv;
+    CARD64          ust;
 
     pPriv = DRI2GetDrawable(pDraw);
     if (pPriv != NULL)
@@ -141,7 +143,10 @@ DRI2CreateDrawable(DrawablePtr pDraw)
     pPriv->swap_count = 0;
     pPriv->target_sbc = -1;
     pPriv->swap_interval = 1;
-    pPriv->last_swap_target = -1;
+    /* Initialize last swap target from DDX if possible */
+    if (!ds->GetMSC || !(*ds->GetMSC)(pDraw, &ust, &pPriv->last_swap_target))
+	pPriv->last_swap_target = 0;
+
     pPriv->swap_limit = 1; /* default to double buffering */
 
     if (pDraw->type == DRAWABLE_WINDOW)
@@ -579,7 +584,6 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
     DRI2ScreenPtr   ds = DRI2GetScreen(pDraw->pScreen);
     DRI2DrawablePtr pPriv;
     DRI2BufferPtr   pDestBuffer = NULL, pSrcBuffer = NULL;
-    CARD64          ust;
     int             ret, i;
 
     pPriv = DRI2GetDrawable(pDraw);
@@ -621,27 +625,6 @@ DRI2SwapBuffers(ClientPtr client, DrawablePtr pDraw, CARD64 target_msc,
     }
 
     /*
-     * In the simple glXSwapBuffers case, all params will be 0, and we just
-     * need to schedule a swap for the last swap target + the swap interval.
-     * If the last swap target hasn't been set yet, call into the driver
-     * to get the current count.
-     */
-    if (target_msc == 0 && divisor == 0 && remainder == 0 &&
-	pPriv->last_swap_target < 0) {
-	ret = (*ds->GetMSC)(pDraw, &ust, &target_msc);
-	if (!ret) {
-	    xf86DrvMsg(pScreen->myNum, X_ERROR,
-		       "[DRI2] %s: driver failed to return current MSC\n",
-		       __func__);
-	    return BadDrawable;
-	}
-    }
-
-    /* First swap needs to initialize last_swap_target */
-    if (pPriv->last_swap_target < 0)
-	pPriv->last_swap_target = target_msc;
-
-    /*
      * Swap target for this swap is last swap target + swap interval since
      * we have to account for the current swap count, interval, and the
      * number of pending swaps.
commit 0d9d1e114322878fb50503f69b308b25a812dfb1
Merge: 4b7ff07... 7be5527...
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue May 18 14:46:42 2010 +1000

    Merge branch 'server-1.8-branch' of git://people.freedesktop.org/~jeremyhu/xserver into server-1.8-branch

commit 4b7ff07db28ea5302a1965496d1fd71a9d99780e
Author: Keith Packard <keithp at keithp.com>
Date:   Mon May 10 11:46:25 2010 -0700

    Check pixmap allocation return value when creating glyphs
    
    The driver may decide that the pixmap is too large or something and
    fail to allocate a pixmap; not checking would lead to a segfault.
    
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    (cherry picked from commit 87ea5760f86eb60840e6e2c10012915952df5377)

diff --git a/render/render.c b/render/render.c
index 2d9e47a..afe4c92 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1159,6 +1159,12 @@ ProcRenderAddGlyphs (ClientPtr client)
 						   width, height, depth,
 						   CREATE_PIXMAP_USAGE_GLYPH_PICTURE);
 
+		if (!pDstPix)
+		{
+		    err = BadAlloc;
+		    goto bail;
+		}
+
 		GlyphPicture (glyph)[screen] = pDst =
 			CreatePicture (0, &pDstPix->drawable,
 				       glyphSet->format,
@@ -1168,6 +1174,7 @@ ProcRenderAddGlyphs (ClientPtr client)
 		/* The picture takes a reference to the pixmap, so we
 		   drop ours. */
 		(pScreen->DestroyPixmap) (pDstPix);
+		pDstPix = NULL;
 
 		if (! pDst)
 		{
commit e789c860a682454fc86032e88b618f255409c33a
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Thu Apr 29 18:45:34 2010 -0700

    Fix compiler issues with getifaddrs() call on OpenSolaris
    
    OpenSolaris recently added support for the getifaddrs() API.
    
    Building with that uncovered two compiler issues (one warning, one error)
    in the code that was now being built for the first time in our builds:
    
    "access.c", line 768: warning: argument #1 is incompatible with prototype:
            prototype: pointer to struct sockaddr {unsigned short sa_family, array[14] of char sa_data} : "access.c", line 213
            argument : pointer to struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
    
    "access.c", line 838: assignment type mismatch:
            struct sockaddr {unsigned short sa_family, array[14] of char sa_data} "=" struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    (cherry picked from commit e42a29d269fadc11e065c63ee369e3165196f2d7)

diff --git a/os/access.c b/os/access.c
index 74c340a..3572da0 100644
--- a/os/access.c
+++ b/os/access.c
@@ -765,7 +765,8 @@ DefineSelf (int fd)
 	    continue;
 #endif /* DNETCONN */
 	len = sizeof(*(ifr->ifa_addr));
-	family = ConvertAddr(ifr->ifa_addr, &len, (pointer *)&addr);
+	family = ConvertAddr((struct sockaddr *) ifr->ifa_addr, &len,
+			     (pointer *)&addr);
 	if (family == -1 || family == FamilyLocal) 
 	    continue;
 #if defined(IPv6) && defined(AF_INET6)
@@ -789,7 +790,6 @@ DefineSelf (int fd)
 	}
 #ifdef XDMCP
 	{
-	    struct sockaddr broad_addr;
 	    /*
 	     * If this isn't an Internet Address, don't register it.
 	     */
@@ -835,11 +835,10 @@ DefineSelf (int fd)
 	    if ((ifr->ifa_flags & IFF_BROADCAST) &&
 		(ifr->ifa_flags & IFF_UP) &&
                 ifr->ifa_broadaddr)
-		broad_addr = *ifr->ifa_broadaddr;
+		XdmcpRegisterBroadcastAddress(
+		    (struct sockaddr_in *) ifr->ifa_broadaddr);
 	    else
 		continue;
-	    XdmcpRegisterBroadcastAddress((struct sockaddr_in *)
-					  &broad_addr);
 	}
 #endif /* XDMCP */
 		
commit 3b6d2b0026f5c37eaeb50441eb2392b9cde962e8
Author: Jamey Sharp <jamey at minilop.net>
Date:   Fri May 14 10:36:13 2010 -0700

    test/xi2: Initialize predefined atoms before XInputExtensionInit.
    
    XInputExtensionInit calls MakeAtom, which doesn't work without the atoms
    table initialized.
    
    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Cc: Peter Hutterer <peter.hutterer at who-t.net>
    Tested-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit c6613cfc26e76b296e620640bf33e756eb4ae178)

diff --git a/test/xi2/protocol-common.c b/test/xi2/protocol-common.c
index 2dff1ad..8638fd9 100644
--- a/test/xi2/protocol-common.c
+++ b/test/xi2/protocol-common.c
@@ -153,6 +153,7 @@ void init_simple(void)
     screen.SetCursorPosition = set_cursor_pos;
 
     dixResetPrivates();
+    InitAtoms();
     XInputExtensionInit();
     init_window(&root, NULL, ROOT_WINDOW_ID);
     init_window(&window, &root, CLIENT_WINDOW_ID);
commit 3a3edb2c3d63a3849a95c7911612b57c9af6a341
Author: Cyril Brulebois <kibi at debian.org>
Date:   Mon Mar 1 02:11:36 2010 +0100

    Fix null pointer dereference in xf86_reload_cursors().
    
    Upon resume, X may try to dereference a null pointer, which has been
    reported in Debian bug #507916 (http://bugs.debian.org/507916).
    
    Jim Paris came up with a patch which solves the problem for him. Here's
    a (hopefully) fixed version of his patch (without the typo).
    
    Cc: Jim Paris <jim at jtan.com>
    Signed-off-by: Cyril Brulebois <kibi at debian.org>
    Reviewed-By: Matthias Hopf <mhopf at suse.de>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit fa6c7012572093a82c9389682977efff85590719)

diff --git a/hw/xfree86/modes/xf86Cursors.c b/hw/xfree86/modes/xf86Cursors.c
index e2e174e..4162999 100644
--- a/hw/xfree86/modes/xf86Cursors.c
+++ b/hw/xfree86/modes/xf86Cursors.c
@@ -611,7 +611,7 @@ xf86_reload_cursors (ScreenPtr screen)
     cursor_screen_priv = dixLookupPrivate(&screen->devPrivates,
 					  xf86CursorScreenKey);
     /* return if HW cursor is inactive, to avoid displaying two cursors */
-    if (!cursor_screen_priv->isUp)
+    if (!cursor_screen_priv || !cursor_screen_priv->isUp)
 	return;
 
     scrn = xf86Screens[screen->myNum];
commit 6bb86db2eb6e27e06bd2270429a76008af2dcd94
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri Apr 16 16:35:22 2010 +1000

    xfree86: dga needs to use the master keyboard state (#27573)
    
    GetPairedDevice() may not always return the keyboard, resulting in a
    null-pointer dereference when accessing the XKB state.
    For floating devices, the GetMaster() returns the device itself.
    
    X.Org Bug 27573 <http://bugs.freedesktop.org/show_bug.cgi?id=27573>
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    Tested-by: Ben Hutchings <ben at decadent.org.uk>
    (cherry picked from commit 10de9e8ee37265a35ceeceb2007d711da70d4f2d)

diff --git a/hw/xfree86/common/xf86DGA.c b/hw/xfree86/common/xf86DGA.c
index 804fd37..5d8addb 100644
--- a/hw/xfree86/common/xf86DGA.c
+++ b/hw/xfree86/common/xf86DGA.c
@@ -1088,13 +1088,15 @@ DGAProcessPointerEvent (ScreenPtr pScreen, DGAEvent *event, DeviceIntPtr mouse)
     ButtonClassPtr  butc = mouse->button;
     DGAScreenPtr    pScreenPriv = DGA_GET_SCREEN_PRIV(pScreen);
     DeviceEvent     ev;
+    DeviceIntPtr    master = GetMaster(mouse, MASTER_KEYBOARD);
 
     memset(&ev, 0, sizeof(ev));
     ev.header = ET_Internal;
     ev.length = sizeof(ev);
     ev.type = event->subtype;
     ev.corestate  = butc->state;
-    ev.corestate |= XkbStateFieldFromRec(&GetPairedDevice(mouse)->key->xkbInfo->state);
+    if (master && master->key)
+        ev.corestate |= XkbStateFieldFromRec(&master->key->xkbInfo->state);
 
     UpdateDeviceState(mouse, &ev);
 
commit fd562d11d6cbde2b227e524ae2a9ce4e347b944b
Author: David James <davidjames at google.com>
Date:   Mon May 10 14:00:49 2010 -0700

    Fix wrong bracket values when startOver = FALSE.
    
    Currently, SyncComputeBracketValues reuses old values of bracket_greater
    and bracket_less when startOver = FALSE. This can result in incorrect bracket
    values. To fix this issue, the startOver parameter is removed, and we do not
    reuse old values of bracket_greater and bracket_less.
    
    X.Org Bug 27023 <http://bugs.freedesktop.org/show_bug.cgi?id=27023>
    
    Signed-off-by: David James <davidjames at google.com>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 758b8614477b53dc3de2b884fec5ccaf8a736432)

diff --git a/Xext/sync.c b/Xext/sync.c
index ce65314..2015fc1 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -94,7 +94,7 @@ static SyncCounter **SysCounterList = NULL;
 #define XSyncCAAllTrigger \
     (XSyncCACounter | XSyncCAValueType | XSyncCAValue | XSyncCATestType)
 
-static void SyncComputeBracketValues(SyncCounter *, Bool);
+static void SyncComputeBracketValues(SyncCounter *);
 
 static void SyncInitServerTime(void);
 
@@ -167,7 +167,7 @@ SyncDeleteTriggerFromCounter(SyncTrigger *pTrigger)
     }
 
     if (IsSystemCounter(pTrigger->pCounter))
-	SyncComputeBracketValues(pTrigger->pCounter, /*startOver*/ TRUE);
+	SyncComputeBracketValues(pTrigger->pCounter);
 }
 
 
@@ -194,7 +194,7 @@ SyncAddTriggerToCounter(SyncTrigger *pTrigger)
     pTrigger->pCounter->pTriglist = pCur;
 
     if (IsSystemCounter(pTrigger->pCounter))
-	SyncComputeBracketValues(pTrigger->pCounter, /*startOver*/ TRUE);
+	SyncComputeBracketValues(pTrigger->pCounter);
 
     return Success;
 }
@@ -351,7 +351,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger *pTrigger, XSyncCounter counter,
     }
     else if (IsSystemCounter(pCounter))
     {
-	SyncComputeBracketValues(pCounter, /*startOver*/ TRUE);
+	SyncComputeBracketValues(pCounter);
     }
 
     return Success;
@@ -646,7 +646,7 @@ SyncChangeCounter(SyncCounter *pCounter, CARD64 newval)
 
     if (IsSystemCounter(pCounter))
     {
-	SyncComputeBracketValues(pCounter, /* startOver */ FALSE);
+	SyncComputeBracketValues(pCounter);
     }
 }
 
@@ -913,7 +913,7 @@ SyncDestroySystemCounter(pointer pSysCounter)
 }
 
 static void
-SyncComputeBracketValues(SyncCounter *pCounter, Bool startOver)
+SyncComputeBracketValues(SyncCounter *pCounter)
 {
     SyncTriggerList *pCur;
     SyncTrigger *pTrigger;
@@ -930,11 +930,8 @@ SyncComputeBracketValues(SyncCounter *pCounter, Bool startOver)
     if (ct == XSyncCounterNeverChanges)
 	return;
 
-    if (startOver)
-    {
-	XSyncMaxValue(&psci->bracket_greater);
-	XSyncMinValue(&psci->bracket_less);
-    }
+    XSyncMaxValue(&psci->bracket_greater);
+    XSyncMinValue(&psci->bracket_less);
 
     for (pCur = pCounter->pTriglist; pCur; pCur = pCur->next)
     {
commit 4bcc0448b42b06ec133886ccb4f029b57b6f2b3e
Author: Jamey Sharp <jamey at minilop.net>
Date:   Sat May 8 09:41:46 2010 -0700

    miPolyPoint bugfix: Check memory allocation before changing the GC.
    
    miPolyPoint ought to leave the GC unchanged even if it fails. ajax says:
    
    > We have a new winner for the oldest-bug competition!  It's actually
    > been like that since X11R1:
    >
    > -rw-r--r--. 1 ajax ajax 2817 1987-09-12 01:20 ddx/mi/mipolypnt.c
    
    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    (cherry picked from commit 4080cd42fde8b4c693eab7557581af2622479109)

diff --git a/mi/mipolypnt.c b/mi/mipolypnt.c
index 5d6243a..12771ee 100644
--- a/mi/mipolypnt.c
+++ b/mi/mipolypnt.c
@@ -73,6 +73,9 @@ miPolyPoint(
     int			i;
     xPoint 		*ppt;
 
+    if(!(pwidthInit = xalloc(npt * sizeof(int))))
+	return;
+
     /* make pointlist origin relative */
     if (mode == CoordModePrevious)
     {
@@ -107,8 +110,6 @@ miPolyPoint(
 	DoChangeGC(pGC, GCFillStyle, &fsNew, 0);
 	ValidateGC(pDrawable, pGC);
     }
-    if(!(pwidthInit = xalloc(npt * sizeof(int))))
-	return;
     pwidth = pwidthInit;
     for(i = 0; i < npt; i++)
 	*pwidth++ = 1;
commit c1e6e7ea968f86f61fd1bfdf4764c57be2a93605
Author: Keith Packard <keithp at keithp.com>
Date:   Mon Apr 26 17:22:12 2010 -0700

    dmxBERestoreRenderGlyph was passing wrong value to free
    
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>
    (cherry picked from commit c0799779dffeef8cef228bdc57aa6c8b323e7485)

diff --git a/hw/dmx/dmxextension.c b/hw/dmx/dmxextension.c
index 2266041..1a52e80 100644
--- a/hw/dmx/dmxextension.c
+++ b/hw/dmx/dmxextension.c
@@ -1160,7 +1160,7 @@ static void dmxBERestoreRenderGlyph(pointer value, XID id, pointer n)
 		     len_images);
 
     /* Clean up */
-    free(len_images);
+    free(images);
     free(gids);
     free(glyphs);    
 }
commit de3275537db09065510ca2a697cbbe184da9f207
Author: Matthias Hopf <mhopf at suse.de>
Date:   Fri May 7 18:46:30 2010 +0200

    Fix mod() definition.
    
    Presumably no implications, especially security-wise.
    
    Signed-off-by: Matthias Hopf <mhopf at suse.de>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit e2e2747f40c4b9e23dba38ea656d4c082e83a794)

diff --git a/mi/miarc.c b/mi/miarc.c
index 5fd1a67..ddcbff7 100644
--- a/mi/miarc.c
+++ b/mi/miarc.c
@@ -1524,7 +1524,7 @@ miRoundCap(
 
 # define Dsin(d)	((d) == 0.0 ? 0.0 : ((d) == 90.0 ? 1.0 : sin(d*M_PI/180.0)))
 # define Dcos(d)	((d) == 0.0 ? 1.0 : ((d) == 90.0 ? 0.0 : cos(d*M_PI/180.0)))
-# define mod(a,b)	((a) >= 0 ? (a) % (b) : (b) - (-a) % (b))
+# define mod(a,b)	((a) >= 0 ? (a) % (b) : (b) - (-(a)) % (b))
 
 static double
 miDcos (double a)
commit 80547b14a85e4c44631e8b2dc3cd67ccfda7fb43
Author: Chris Humbert <freedesktop at mahadri.com>
Date:   Fri May 7 17:02:43 2010 +1000

    dix: make DeviceEvent coordinates signed for Xinerama. #24986
    
    With Xinerama enabled, event coordinates are relative to Screen 0, so
    they can be negative.  The new DeviceEvent's coordinates are of type
    uint16_t, making screens above and to the left of Screen 0 unusable.
    
    X.Org Bug 24986 <https://bugs.freedesktop.org/show_bug.cgi?id=24986>
    
    Signed-off-by: Chris Humbert <freedesktop at mahadri.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 21ed660f30a3f96c787ab00a16499e0fb034b2ad)

diff --git a/include/eventstr.h b/include/eventstr.h
index 79685c1..433227e 100644
--- a/include/eventstr.h
+++ b/include/eventstr.h
@@ -91,9 +91,9 @@ struct _DeviceEvent
         uint32_t button;  /**< Button number */
         uint32_t key;     /**< Key code */
     } detail;
-    uint16_t root_x;      /**< Pos relative to root window in integral data */
+    int16_t root_x;       /**< Pos relative to root window in integral data */
     float root_x_frac;    /**< Pos relative to root window in frac part */
-    uint16_t root_y;      /**< Pos relative to root window in integral part */
+    int16_t root_y;       /**< Pos relative to root window in integral part */
     float root_y_frac;    /**< Pos relative to root window in frac part */
     uint8_t    buttons[(MAX_BUTTONS + 7)/8]; /**< Button mask */
     struct {
commit 331e9720b5c05e43b8343d5c71d821dee0463c3e
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri May 7 16:22:12 2010 +1000

    Xi: reset the known properties at the end of the server generation.
    
    Properties allocated through XIGetKnownProperty() aren't reset on the second
    server generation but keep the old value. As a result, wrong Atoms are
    supplied to the driver, resulting in potential data corruption or weird
    error message.
    
    Reproducible by running "xlsatom | grep FLOAT" twice on a plain X server.
    The second X server generation won't have the FLOAT atom defined anymore,
    despite the users of this atom not noticing any errors.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Julien Cristau <jcristau at debian.org>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 9802839d35aaf788790f1d0e8300db4693a70096)

diff --git a/Xi/extinit.c b/Xi/extinit.c
index b7910cd..37f9856 100644
--- a/Xi/extinit.c
+++ b/Xi/extinit.c
@@ -1122,6 +1122,7 @@ RestoreExtensionEvents(void)
 static void
 IResetProc(ExtensionEntry * unused)
 {
+    XIResetProperties();
 
     ReplySwapVector[IReqCode] = ReplyNotSwappd;
     EventSwapVector[DeviceValuator] = NotImplemented;
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index be07831..8b80637 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -403,6 +403,15 @@ XIGetKnownProperty(char *name)
     return 0;
 }
 
+void
+XIResetProperties(void)
+{
+    int i;
+
+    for (i = 0; i < (sizeof(dev_properties)/sizeof(struct dev_properties)); i++)
+        dev_properties[i].type = None;
+}
+
 /**
  * Convert the given property's value(s) into @nelem_return integer values and
  * store them in @buf_return. If @nelem_return is larger than the number of
diff --git a/Xi/xiproperty.h b/Xi/xiproperty.h
index 69b41fa..d8b8863 100644
--- a/Xi/xiproperty.h
+++ b/Xi/xiproperty.h
@@ -62,4 +62,7 @@ void SRepXIListProperties(ClientPtr client, int size,
                           xXIListPropertiesReply *rep);
 void SRepXIGetProperty(ClientPtr client, int size,
                        xXIGetPropertyReply *rep);
+
+void XIResetProperties(void);
+
 #endif /* XIPROPERTY_H */
commit dee99e6925c8e51263398bd2c8fb70289dae748c
Author: Keith Packard <keithp at keithp.com>
Date:   Fri Apr 30 16:10:32 2010 -0700

    Make sure XFixes invisible cursor gets freed on server reset
    
    This uses the same hack that dix uses for the rootCursor -- allocate
    a resource ID for the invisible cursor so that it gets freed at reset
    time. This also allows us to unconditionally create it during
    extension initialization; necessary as the privates layout may well be
    different on subsequent generations.
    
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit a3f5d30ba61e70b3de8b48754dea32715ba93c40)
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 1471a58..2aba0ce 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -1054,11 +1054,15 @@ createInvisibleCursor (void)
     cm.xhot = 0;
     cm.yhot = 0;
 
-    AllocARGBCursor(psrcbits, pmaskbits,
-		NULL, &cm,
-		0, 0, 0,
-		0, 0, 0,
-		&pCursor, serverClient, (XID)0);
+    if (AllocARGBCursor(psrcbits, pmaskbits,
+			NULL, &cm,
+			0, 0, 0,
+			0, 0, 0,
+			&pCursor, serverClient, (XID)0) != Success)
+	return NullCursor;
+
+    if (!AddResource(FakeClientID(0), RT_CURSOR, (pointer) pCursor))
+	return NullCursor;
 
     return pCursor;
 }
@@ -1091,12 +1095,9 @@ XFixesCursorInit (void)
     CursorWindowType = CreateNewResourceType(CursorFreeWindow,
 					     "XFixesCursorWindow");
 
-    if (pInvisibleCursor == NULL) {
-	pInvisibleCursor = createInvisibleCursor();
-	if (pInvisibleCursor == NULL) {
-	    return BadAlloc;
-	}
-    }
+    pInvisibleCursor = createInvisibleCursor();
+    if (pInvisibleCursor == NULL)
+	return BadAlloc;
 
     return CursorClientType && CursorHideCountType && CursorWindowType;
 }
commit ede10681c4f9d835fa8af115e349e2fd9feeb697
Author: Keith Packard <keithp at keithp.com>
Date:   Fri Apr 30 12:18:09 2010 -0700

    Fix cursor ref counting mistakes with sprites and xf86Cursor.c
    
    A few cursor value assignments weren't getting correctly ref counted,
    causing leaks of cursor objects.
    
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit cdeb2c23f80ced961fe205125547e16905885534)

diff --git a/dix/devices.c b/dix/devices.c
index 6119dce..32e067b 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -857,6 +857,8 @@ CloseDevice(DeviceIntPtr dev)
     }
 
     if (DevHasCursor(dev) && dev->spriteInfo->sprite) {
+	if (dev->spriteInfo->sprite->current)
+	    FreeCursor(dev->spriteInfo->sprite->current, None);
         xfree(dev->spriteInfo->sprite->spriteTrace);
         xfree(dev->spriteInfo->sprite);
     }
diff --git a/dix/events.c b/dix/events.c
index 6d0137d..5de1505 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -2943,6 +2943,7 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 {
     SpritePtr pSprite;
     ScreenPtr pScreen;
+    CursorPtr pCursor;
 
     if (!pDev->spriteInfo->sprite)
     {
@@ -2986,8 +2987,7 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 
     if (pWin)
     {
-        pSprite->current = wCursor(pWin);
-        pSprite->current->refcnt++;
+	pCursor = wCursor(pWin);
 	pSprite->spriteTrace = (WindowPtr *)xcalloc(1, 32*sizeof(WindowPtr));
 	if (!pSprite->spriteTrace)
 	    FatalError("Failed to allocate spriteTrace");
@@ -3000,13 +3000,18 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 	pSprite->pDequeueScreen = pSprite->pEnqueueScreen;
 
     } else {
-        pSprite->current = NullCursor;
+        pCursor = NullCursor;
 	pSprite->spriteTrace = NULL;
 	pSprite->spriteTraceSize = 0;
 	pSprite->spriteTraceGood = 0;
 	pSprite->pEnqueueScreen = screenInfo.screens[0];
 	pSprite->pDequeueScreen = pSprite->pEnqueueScreen;
     }
+    if (pCursor)
+	pCursor->refcnt++;
+    if (pSprite->current)
+	FreeCursor(pSprite->current, None);
+    pSprite->current = pCursor;
 
     if (pScreen)
     {
@@ -3059,6 +3064,7 @@ UpdateSpriteForScreen(DeviceIntPtr pDev, ScreenPtr pScreen)
 {
     SpritePtr pSprite = NULL;
     WindowPtr win = NULL;
+    CursorPtr pCursor;
     if (!pScreen)
         return ;
 
@@ -3074,8 +3080,12 @@ UpdateSpriteForScreen(DeviceIntPtr pDev, ScreenPtr pScreen)
     pSprite->hotLimits.x2 = pScreen->width;
     pSprite->hotLimits.y2 = pScreen->height;
     pSprite->win = win;
-    pSprite->current = wCursor (win);
-    pSprite->current->refcnt++;
+    pCursor = wCursor(win);
+    if (pCursor)
+	pCursor->refcnt++;
+    if (pSprite->current)
+	FreeCursor(pSprite->current, 0);
+    pSprite->current = pCursor;
     pSprite->spriteTraceGood = 1;
     pSprite->spriteTrace[0] = win;
     (*pScreen->CursorLimits) (pDev,
diff --git a/hw/xfree86/ramdac/xf86Cursor.c b/hw/xfree86/ramdac/xf86Cursor.c
index f5f0873..346e994 100644
--- a/hw/xfree86/ramdac/xf86Cursor.c
+++ b/hw/xfree86/ramdac/xf86Cursor.c
@@ -312,6 +312,8 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
             xf86SetCursor(pScreen, NullCursor, x, y);
             ScreenPriv->isUp = FALSE;
         }
+	if (ScreenPriv->CurrentCursor)
+	    FreeCursor(ScreenPriv->CurrentCursor, None);
         ScreenPriv->CurrentCursor = NullCursor;
         return;
     }


More information about the Xquartz-changes mailing list