Fix CVE-2011-4029: File permission change vulnerability.

Use fchmod() to change permissions of the lock file instead
of chmod(), thus avoid the race that can be exploited to set
a symbolic link to any file or directory in the system.

Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b67581cf82)
(cherry picked from commit 12f65819ff)

.gitignore

@@ -45,6 +45,7 @@ xorg-server.pc
 xorg-server-*.tar.bz2
 xorg-server-*.tar.gz
 stamp-h?
+dix/Xserver-dtrace.h
 do-not-use-config.h
 do-not-use-config.h.in
 dix/dix.c

COPYING

@@ -1,10 +1,12 @@
 The following is the 'standard copyright' agreed upon by most contributors,
-and is currently the canonical license, though a modification is currently
-under discussion.  Copyright holders of new code should use this license
-statement where possible, and append their name to this list.  Please sort
-by surname for people, and by the full name for other entities (e.g.
-Juliusz Chroboczek sorts before Intel Corporation sorts before Daniel
-Stone).
+and is currently the canonical license preferred by the X.Org Foundation.
+This is a slight variant of the common MIT license form published by the
+Open Source Initiative at http://www.opensource.org/licenses/mit-license.php
+
+Copyright holders of new code should use this license statement where
+possible, and insert their name to this list.  Please sort by surname
+for people, and by the full name for other entities (e.g.  Juliusz
+Chroboczek sorts before Intel Corporation sorts before Daniel Stone).
 
 Copyright © 2000-2001 Juliusz Chroboczek
 Copyright © 1998 Egbert Eich
@@ -17,6 +19,7 @@ Copyright © 1999 Keith Packard
 Copyright © 2007-2009 Red Hat, Inc.
 Copyright © 2005-2008 Daniel Stone
 Copyright © 2006-2009 Simon Thum
+Copyright © 1987, 2003-2006, 2008-2009 Sun Microsystems, Inc.
 Copyright © 2006 Luc Verhaegen
 
 Permission is hereby granted, free of charge, to any person obtaining a
@@ -162,32 +165,6 @@ OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 
-Copyright 1987 by Sun Microsystems, Inc. Mountain View, CA.
-All Rights Reserved
-
-Permission  to  use,  copy,  modify,  and  distribute   this
-software  and  its documentation for any purpose and without
-fee is hereby granted, provided that the above copyright no-
-tice  appear  in all copies and that both that copyright no-
-tice and this permission notice appear in  supporting  docu-
-mentation,  and  that the names of Sun or X Consortium
-not be used in advertising or publicity pertaining to
-distribution  of  the software  without specific prior
-written permission. Sun and X Consortium make no
-representations about the suitability of this software for
-any purpose. It is provided "as is" without any express or
-implied warranty.
-
-SUN DISCLAIMS ALL WARRANTIES WITH REGARD TO  THIS  SOFTWARE,
-INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FIT-
-NESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SUN BE  LI-
-ABLE  FOR  ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
-ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,  DATA  OR
-PROFITS,  WHETHER  IN  AN  ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION  WITH
-THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-
 Copyright 1987-1991, 1993 by Digital Equipment Corporation, Maynard, Massachusetts.
 Copyright 1991 Massachusetts Institute of Technology, Cambridge, Massachusetts.
 Copyright 1991, 1993 Olivetti Research Limited, Cambridge, England.
@@ -1404,7 +1381,6 @@ Copyright 1987, 1998  The Open Group
 Copyright © 1998-1999, 2001 The XFree86 Project, Inc.
 Copyright © 2000 VA Linux Systems, Inc.
 Copyright (c) 2000, 2001 Nokia Home Communications
-Copyright 2003-2006, 2008 Sun Microsystems, Inc.
 Copyright © 2007, 2008 Red Hat, Inc.
 All rights reserved.
 

Makefile.am

@@ -41,14 +41,21 @@ SUBDIRS = \
 	hw \
 	test
 
+if XORG
 aclocaldir = $(datadir)/aclocal
 aclocal_DATA = xorg-server.m4
 
 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = xorg-server.pc
+endif
 
 EXTRA_DIST = xorg-server.pc.in xorg-server.m4 ChangeLog autogen.sh
 
+DISTCHECK_CONFIGURE_FLAGS=\
+	--with-xkb-path=$(XKB_BASE_DIRECTORY) \
+	--with-xkb-bin-directory=$(XKB_BIN_DIRECTORY) \
+	--with-xkb-output='$${datadir}/X11/xkb/compiled'
+
 DISTCLEANFILES = doltcompile doltlibtool
 MAINTAINERCLEANFILES=ChangeLog
 

Xext/Makefile.am

@@ -32,6 +32,7 @@ BUILTIN_SRCS =			\
 
 # Sources always included in libXextmodule.la & libXext.la. That's right, zero.
 MODULE_SRCS =
+MODULE_LIBS =
 
 # Optional sources included if extension enabled by configure.ac rules
 
@@ -83,6 +84,7 @@ endif
 XSELINUX_SRCS = xselinux.c xselinux.h
 if XSELINUX
 MODULE_SRCS += $(XSELINUX_SRCS)
+MODULE_LIBS += $(SELINUX_LIBS)
 endif
 
 # Security extension: multi-level security to protect clients from each other
@@ -119,11 +121,13 @@ endif
 # Now take all of the above, mix well, bake for 10 minutes and get libXext*.la
 
 libXext_la_SOURCES =		$(BUILTIN_SRCS) $(MODULE_SRCS)
+libXext_la_LIBADD =		$(MODULE_LIBS)
 
 if XORG
 libXextbuiltin_la_SOURCES =	$(BUILTIN_SRCS)
 
 libXextmodule_la_SOURCES =	$(MODULE_SRCS)
+libXextmodule_la_LIBADD =	$(MODULE_LIBS)
 endif
 
 EXTRA_DIST = \

Xext/geext.c

@@ -36,11 +36,8 @@
 
 #define rClient(obj) (clients[CLIENT_ID((obj)->resource)])
 
-int GEEventBase;
-int GEErrorBase;
 static int GEClientPrivateKeyIndex;
 DevPrivateKey GEClientPrivateKey = &GEClientPrivateKeyIndex;
-int GEEventType; /* The opcode for all GenericEvents will have. */
 
 int RT_GECLIENT  = 0;
 
@@ -168,12 +165,6 @@ GEClientCallback(CallbackListPtr *list,
     ClientPtr		pClient = clientinfo->client;
     GEClientInfoPtr     pGEClient = GEGetClient(pClient);
 
-    if (pGEClient == NULL)
-    {
-        pGEClient = xcalloc(1, sizeof(GEClientInfoRec));
-        dixSetPrivate(&pClient->devPrivates, GEClientPrivateKey, pGEClient);
-    }
-
     pGEClient->major_version = 0;
     pGEClient->minor_version = 0;
 }
@@ -184,10 +175,6 @@ GEResetProc(ExtensionEntry *extEntry)
 {
     DeleteCallback(&ClientStateCallback, GEClientCallback, 0);
     EventSwapVector[GenericEvent] = NotImplemented;
-
-    GEEventBase = 0;
-    GEErrorBase = 0;
-    GEEventType = 0;
 }
 
 /*  Calls the registered event swap function for the extension.
@@ -222,20 +209,19 @@ GEExtensionInit(void)
 {
     ExtensionEntry *extEntry;
 
+    if (!dixRequestPrivate(GEClientPrivateKey, sizeof(GEClientInfoRec)))
+        FatalError("GEExtensionInit: GE private request failed.\n");
+
     if(!AddCallback(&ClientStateCallback, GEClientCallback, 0))
     {
         FatalError("GEExtensionInit: register client callback failed.\n");
     }
 
     if((extEntry = AddExtension(GE_NAME,
-                        GENumberEvents, GENumberErrors,
+                        0, GENumberErrors,
                         ProcGEDispatch, SProcGEDispatch,
                         GEResetProc, StandardMinorOpcode)) != 0)
     {
-        GEEventBase = extEntry->eventBase;
-        GEErrorBase = extEntry->errorBase;
-        GEEventType = GEEventBase;
-
         memset(GEExtensions, 0, sizeof(GEExtensions));
 
         EventSwapVector[GenericEvent] = (EventSwapPtr) SGEGenericEvent;

Xext/geint.h

@@ -37,9 +37,6 @@
 #include "extnsionst.h"
 #include <X11/extensions/geproto.h>
 
-extern _X_EXPORT int GEEventType;
-extern _X_EXPORT int GEEventBase;
-extern _X_EXPORT int GEErrorBase;
 extern _X_EXPORT DevPrivateKey GEClientPrivateKey;
 
 typedef struct _GEClientInfo {

Xext/saver.c

@@ -618,10 +618,10 @@ CreateSaverWindow (ScreenPtr pScreen)
     	    	FreeResource (pWin->drawable.id, RT_NONE);
     	    	return FALSE;
 	    }
+	pAttr->pCursor->refcnt++;
 	if (pWin->optional->cursor)
 	    FreeCursor (pWin->optional->cursor, (Cursor)0);
 	pWin->optional->cursor = pAttr->pCursor;
-	pAttr->pCursor->refcnt++;
 	pWin->cursorIsNone = FALSE;
 	CheckWindowOptionalNeed (pWin);
 	mask |= CWCursor;

Xext/shm.c

@@ -497,15 +497,40 @@ doShmPutImage(DrawablePtr dst, GCPtr pGC,
 	      char *data)
 {
     PixmapPtr pPixmap;
-  
-    pPixmap = GetScratchPixmapHeader(dst->pScreen, w, h, depth,
-				     BitsPerPixel(depth),
-				     PixmapBytePad(w, depth),
-				     data);
-    if (!pPixmap)
-	return;
-    pGC->ops->CopyArea((DrawablePtr)pPixmap, dst, pGC, sx, sy, sw, sh, dx, dy);
-    FreeScratchPixmapHeader(pPixmap);
+
+    if (format == ZPixmap || depth == 1) {
+	pPixmap = GetScratchPixmapHeader(dst->pScreen, w, h, depth,
+					 BitsPerPixel(depth),
+					 PixmapBytePad(w, depth),
+					 data);
+	if (!pPixmap)
+	    return;
+	pGC->ops->CopyArea((DrawablePtr)pPixmap, dst, pGC, sx, sy, sw, sh, dx, dy);
+	FreeScratchPixmapHeader(pPixmap);
+    } else {
+	GCPtr putGC = GetScratchGC(depth, dst->pScreen);
+
+	if (!putGC)
+	    return;
+
+	pPixmap = (*dst->pScreen->CreatePixmap)(dst->pScreen, sw, sh, depth,
+						CREATE_PIXMAP_USAGE_SCRATCH);
+	if (!pPixmap) {
+	    FreeScratchGC(putGC);
+	    return;
+	}
+	ValidateGC(&pPixmap->drawable, putGC);
+	(*putGC->ops->PutImage)(&pPixmap->drawable, putGC, depth, -sx, -sy, w, h, 0,
+				(format == XYPixmap) ? XYPixmap : ZPixmap, data);
+	FreeScratchGC(putGC);
+	if (format == XYBitmap)
+	    (void)(*pGC->ops->CopyPlane)(&pPixmap->drawable, dst, pGC, 0, 0, sw, sh,
+					 dx, dy, 1L);
+	else
+	    (void)(*pGC->ops->CopyArea)(&pPixmap->drawable, dst, pGC, 0, 0, sw, sh,
+					dx, dy);
+	(*pPixmap->drawable.pScreen->DestroyPixmap)(pPixmap);
+    }
 }
 
 #ifdef PANORAMIX

Xext/sync.c

@@ -67,6 +67,7 @@ PERFORMANCE OF THIS SOFTWARE.
 #include "opaque.h"
 #include <X11/extensions/syncproto.h>
 #include "syncsrv.h"
+#include "protocol-versions.h"
 
 #include <stdio.h>
 #if !defined(WIN32)
@@ -1140,8 +1141,8 @@ ProcSyncInitialize(ClientPtr client)
     memset(&rep, 0, sizeof(xSyncInitializeReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
-    rep.majorVersion = SYNC_MAJOR_VERSION;
-    rep.minorVersion = SYNC_MINOR_VERSION;
+    rep.majorVersion = SERVER_SYNC_MAJOR_VERSION;
+    rep.minorVersion = SERVER_SYNC_MINOR_VERSION;
     rep.length = 0;
 
     if (client->swapped)

Xext/xace.c

@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
  */
 int XaceHook(int hook, ...)
 {
-    pointer calldata;	/* data passed to callback */
+    union {
+	XaceResourceAccessRec res;
+	XaceDeviceAccessRec dev;
+	XaceSendAccessRec send;
+	XaceReceiveAccessRec recv;
+	XaceClientAccessRec client;
+	XaceExtAccessRec ext;
+	XaceServerAccessRec server;
+	XaceScreenAccessRec screen;
+	XaceAuthAvailRec auth;
+	XaceKeyAvailRec key;
+    } u;
     int *prv = NULL;	/* points to return value from callback */
     va_list ap;		/* argument list */
     va_start(ap, hook);
@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
      */
     switch (hook)
     {
-	case XACE_RESOURCE_ACCESS: {
-	    XaceResourceAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.id = va_arg(ap, XID);
-	    rec.rtype = va_arg(ap, RESTYPE);
-	    rec.res = va_arg(ap, pointer);
-	    rec.ptype = va_arg(ap, RESTYPE);
-	    rec.parent = va_arg(ap, pointer);
-	    rec.access_mode = va_arg(ap, Mask);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_RESOURCE_ACCESS:
+	    u.res.client = va_arg(ap, ClientPtr);
+	    u.res.id = va_arg(ap, XID);
+	    u.res.rtype = va_arg(ap, RESTYPE);
+	    u.res.res = va_arg(ap, pointer);
+	    u.res.ptype = va_arg(ap, RESTYPE);
+	    u.res.parent = va_arg(ap, pointer);
+	    u.res.access_mode = va_arg(ap, Mask);
+	    u.res.status = Success; /* default allow */
+	    prv = &u.res.status;
 	    break;
-	}
-	case XACE_DEVICE_ACCESS: {
-	    XaceDeviceAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.dev = va_arg(ap, DeviceIntPtr);
-	    rec.access_mode = va_arg(ap, Mask);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_DEVICE_ACCESS:
+	    u.dev.client = va_arg(ap, ClientPtr);
+	    u.dev.dev = va_arg(ap, DeviceIntPtr);
+	    u.dev.access_mode = va_arg(ap, Mask);
+	    u.dev.status = Success; /* default allow */
+	    prv = &u.dev.status;
 	    break;
-	}
-	case XACE_SEND_ACCESS: {
-	    XaceSendAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.dev = va_arg(ap, DeviceIntPtr);
-	    rec.pWin = va_arg(ap, WindowPtr);
-	    rec.events = va_arg(ap, xEventPtr);
-	    rec.count = va_arg(ap, int);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_SEND_ACCESS:
+	    u.send.client = va_arg(ap, ClientPtr);
+	    u.send.dev = va_arg(ap, DeviceIntPtr);
+	    u.send.pWin = va_arg(ap, WindowPtr);
+	    u.send.events = va_arg(ap, xEventPtr);
+	    u.send.count = va_arg(ap, int);
+	    u.send.status = Success; /* default allow */
+	    prv = &u.send.status;
 	    break;
-	}
-	case XACE_RECEIVE_ACCESS: {
-	    XaceReceiveAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.pWin = va_arg(ap, WindowPtr);
-	    rec.events = va_arg(ap, xEventPtr);
-	    rec.count = va_arg(ap, int);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_RECEIVE_ACCESS:
+	    u.recv.client = va_arg(ap, ClientPtr);
+	    u.recv.pWin = va_arg(ap, WindowPtr);
+	    u.recv.events = va_arg(ap, xEventPtr);
+	    u.recv.count = va_arg(ap, int);
+	    u.recv.status = Success; /* default allow */
+	    prv = &u.recv.status;
 	    break;
-	}
-	case XACE_CLIENT_ACCESS: {
-	    XaceClientAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.target = va_arg(ap, ClientPtr);
-	    rec.access_mode = va_arg(ap, Mask);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_CLIENT_ACCESS:
+	    u.client.client = va_arg(ap, ClientPtr);
+	    u.client.target = va_arg(ap, ClientPtr);
+	    u.client.access_mode = va_arg(ap, Mask);
+	    u.client.status = Success; /* default allow */
+	    prv = &u.client.status;
 	    break;
-	}
-	case XACE_EXT_ACCESS: {
-	    XaceExtAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.ext = va_arg(ap, ExtensionEntry*);
-	    rec.access_mode = DixGetAttrAccess;
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_EXT_ACCESS:
+	    u.ext.client = va_arg(ap, ClientPtr);
+	    u.ext.ext = va_arg(ap, ExtensionEntry*);
+	    u.ext.access_mode = DixGetAttrAccess;
+	    u.ext.status = Success; /* default allow */
+	    prv = &u.ext.status;
 	    break;
-	}
-	case XACE_SERVER_ACCESS: {
-	    XaceServerAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.access_mode = va_arg(ap, Mask);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_SERVER_ACCESS:
+	    u.server.client = va_arg(ap, ClientPtr);
+	    u.server.access_mode = va_arg(ap, Mask);
+	    u.server.status = Success; /* default allow */
+	    prv = &u.server.status;
 	    break;
-	}
 	case XACE_SCREEN_ACCESS:
-	case XACE_SCREENSAVER_ACCESS: {
-	    XaceScreenAccessRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.screen = va_arg(ap, ScreenPtr);
-	    rec.access_mode = va_arg(ap, Mask);
-	    rec.status = Success; /* default allow */
-	    calldata = &rec;
-	    prv = &rec.status;
+	case XACE_SCREENSAVER_ACCESS:
+	    u.screen.client = va_arg(ap, ClientPtr);
+	    u.screen.screen = va_arg(ap, ScreenPtr);
+	    u.screen.access_mode = va_arg(ap, Mask);
+	    u.screen.status = Success; /* default allow */
+	    prv = &u.screen.status;
 	    break;
-	}
-	case XACE_AUTH_AVAIL: {
-	    XaceAuthAvailRec rec;
-	    rec.client = va_arg(ap, ClientPtr);
-	    rec.authId = va_arg(ap, XID);
-	    calldata = &rec;
+	case XACE_AUTH_AVAIL:
+	    u.auth.client = va_arg(ap, ClientPtr);
+	    u.auth.authId = va_arg(ap, XID);
 	    break;
-	}
-	case XACE_KEY_AVAIL: {
-	    XaceKeyAvailRec rec;
-	    rec.event = va_arg(ap, xEventPtr);
-	    rec.keybd = va_arg(ap, DeviceIntPtr);
-	    rec.count = va_arg(ap, int);
-	    calldata = &rec;
+	case XACE_KEY_AVAIL:
+	    u.key.event = va_arg(ap, xEventPtr);
+	    u.key.keybd = va_arg(ap, DeviceIntPtr);
+	    u.key.count = va_arg(ap, int);
 	    break;
-	}
-	default: {
+	default:
 	    va_end(ap);
 	    return 0;	/* unimplemented hook number */
-	}
     }
     va_end(ap);
  
     /* call callbacks and return result, if any. */
-    CallCallbacks(&XaceHooks[hook], calldata);
+    CallCallbacks(&XaceHooks[hook], &u);
     return prv ? *prv : Success;
 }
 

Xext/xselinux.c

@@ -112,9 +112,6 @@ typedef struct {
 /* labeling handle */
 static struct selabel_handle *label_hnd;
 
-/* whether AVC is active */
-static int avc_active;
-
 /* atoms for window label properties */
 static Atom atom_ctx;
 static Atom atom_client_ctx;
@@ -238,20 +235,17 @@ SELinuxSelectionToSID(Atom selection, SELinuxSubjectRec *subj,
 
     /* Check for an override context next */
     if (subj->sel_use_sid) {
-	sidget(tsid = subj->sel_use_sid);
+	tsid = subj->sel_use_sid;
 	goto out;
     }
 
-    sidget(tsid = obj->sid);
+    tsid = obj->sid;
 
     /* Polyinstantiate if necessary to obtain the final SID */
-    if (obj->poly) {
-	sidput(tsid);
-	if (avc_compute_member(subj->sid, obj->sid,
-			       SECCLASS_X_SELECTION, &tsid) < 0) {
-	    ErrorF("SELinux: a compute_member call failed!\n");
-	    return BadValue;
-	}
+    if (obj->poly && avc_compute_member(subj->sid, obj->sid,
+					SECCLASS_X_SELECTION, &tsid) < 0) {
+	ErrorF("SELinux: a compute_member call failed!\n");
+	return BadValue;
     }
 out:
     *sid_rtn = tsid;
@@ -278,7 +272,7 @@ SELinuxPropertyToSID(Atom property, SELinuxSubjectRec *subj,
 
     /* Check for an override context next */
     if (subj->prp_use_sid) {
-	sidget(tsid = subj->prp_use_sid);
+	tsid = subj->prp_use_sid;
 	goto out;
     }
 
@@ -295,10 +289,8 @@ SELinuxPropertyToSID(Atom property, SELinuxSubjectRec *subj,
 	if (avc_compute_member(subj->sid, tsid2,
 			       SECCLASS_X_PROPERTY, &tsid) < 0) {
 	    ErrorF("SELinux: a compute_member call failed!\n");
-	    sidput(tsid2);
 	    return BadValue;
 	}
-	sidput(tsid2);
     }
 out:
     *sid_rtn = tsid;
@@ -438,9 +430,7 @@ SELinuxLabelClient(ClientPtr client)
     security_context_t ctx;
 
     subj = dixLookupPrivate(&client->devPrivates, subjectKey);
-    sidput(subj->sid);
     obj = dixLookupPrivate(&client->devPrivates, objectKey);
-    sidput(obj->sid);
 
     /* Try to get a context from the socket */
     if (fd < 0 || getpeercon_raw(fd, &ctx) < 0) {
@@ -484,7 +474,7 @@ finish:
 	FatalError("SELinux: client %d: context_to_sid_raw(%s) failed\n",
 		   client->index, ctx);
 
-    sidget(obj->sid = subj->sid);
+    obj->sid = subj->sid;
     freecon(ctx);
 }
 
@@ -505,7 +495,6 @@ SELinuxLabelInitial(void)
     subj = dixLookupPrivate(&serverClient->devPrivates, subjectKey);
     obj = dixLookupPrivate(&serverClient->devPrivates, objectKey);
     subj->privileged = 1;
-    sidput(subj->sid);
 
     /* Use the context of the X server process for the serverClient */
     if (getcon_raw(&ctx) < 0)
@@ -515,7 +504,7 @@ SELinuxLabelInitial(void)
     if (avc_context_to_sid_raw(ctx, &subj->sid) < 0)
 	FatalError("SELinux: serverClient: context_to_sid(%s) failed\n", ctx);
 
-    sidget(obj->sid = subj->sid);
+    obj->sid = subj->sid;
     freecon(ctx);
 
     srec.client = serverClient;
@@ -544,8 +533,8 @@ SELinuxLabelResource(XaceResourceAccessRec *rec, SELinuxSubjectRec *subj,
     security_id_t tsid;
 
     /* Check for a create context */
-    if (rec->rtype == RT_WINDOW && subj->win_create_sid) {
-	sidget(obj->sid = subj->win_create_sid);
+    if (rec->rtype & RC_DRAWABLE && subj->win_create_sid) {
+	obj->sid = subj->win_create_sid;
 	return Success;
     }
 
@@ -662,6 +651,7 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     SELinuxSubjectRec *subj;
     SELinuxObjectRec *obj;
     SELinuxAuditRec auditdata = { .client = rec->client, .dev = rec->dev };
+    security_class_t cls;
     int rc;
 
     subj = dixLookupPrivate(&rec->client->devPrivates, subjectKey);
@@ -672,33 +662,19 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 	SELinuxSubjectRec *dsubj;
 	dsubj = dixLookupPrivate(&rec->dev->devPrivates, subjectKey);
 
-	sidput(dsubj->sid);
-	sidput(obj->sid);
-
 	if (subj->dev_create_sid) {
 	    /* Label the device with the create context */
-	    sidget(obj->sid = subj->dev_create_sid);
-	    sidget(dsubj->sid = subj->dev_create_sid);
+	    obj->sid = subj->dev_create_sid;
+	    dsubj->sid = subj->dev_create_sid;
 	} else {
 	    /* Label the device directly with the process SID */
-	    sidget(obj->sid = subj->sid);
-	    sidget(dsubj->sid = subj->sid);
+	    obj->sid = subj->sid;
+	    dsubj->sid = subj->sid;
 	}
     }
 
-    /* XXX only check read permission on XQueryKeymap */
-    /* This is to allow the numerous apps that call XQueryPointer to work */
-    if (rec->access_mode & DixReadAccess) {
-	ClientPtr client = rec->client;
-	REQUEST(xReq);
-	if (stuff && stuff->reqType != X_QueryKeymap) {
-	    rec->access_mode &= ~DixReadAccess;
-	    rec->access_mode |= DixGetAttrAccess;
-	}
-    }
-
-    rc = SELinuxDoCheck(subj, obj, SECCLASS_X_DEVICE, rec->access_mode,
-			&auditdata);
+    cls = IsPointerDevice(rec->dev) ? SECCLASS_X_POINTER : SECCLASS_X_KEYBOARD;
+    rc = SELinuxDoCheck(subj, obj, cls, rec->access_mode, &auditdata);
     if (rc != Success)
 	rec->status = rc;
 }
@@ -817,8 +793,6 @@ SELinuxExtension(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 	    return;
 	}
 
-	sidput(obj->sid);
-
 	/* Perform a transition to obtain the final SID */
 	if (avc_compute_create(serv->sid, sid, SECCLASS_X_EXTENSION,
 			       &obj->sid) < 0) {
@@ -856,7 +830,6 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (access_mode & DixCreateAccess) {
-	sidput(obj->sid);
 	rc = SELinuxSelectionToSID(name, subj, &obj->sid, &obj->poly);
 	if (rc != Success)
 	    obj->sid = unlabeled_sid;
@@ -874,7 +847,6 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 		break;
 	    obj = dixLookupPrivate(&pSel->devPrivates, objectKey);
 	}
-	sidput(tsid);
 	
 	if (pSel)
 	    *rec->ppSel = pSel;
@@ -893,11 +865,10 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     /* Label the content (advisory only) */
     if (access_mode & DixSetAttrAccess) {
 	data = dixLookupPrivate(&pSel->devPrivates, dataKey);
-	sidput(data->sid);
 	if (subj->sel_create_sid)
-	    sidget(data->sid = subj->sel_create_sid);
+	    data->sid = subj->sel_create_sid;
 	else
-	    sidget(data->sid = obj->sid);
+	    data->sid = obj->sid;
     }
 }
 
@@ -922,7 +893,6 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (rec->access_mode & DixCreateAccess) {
-	sidput(obj->sid);
 	rc = SELinuxPropertyToSID(name, subj, &obj->sid, &obj->poly);
 	if (rc != Success) {
 	    rec->status = rc;
@@ -941,7 +911,6 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 		break;
 	    obj = dixLookupPrivate(&pProp->devPrivates, objectKey);
 	}
-	sidput(tsid);
 
 	if (pProp)
 	    *rec->ppProp = pProp;
@@ -960,11 +929,10 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     /* Label the content (advisory only) */
     if (rec->access_mode & DixWriteAccess) {
 	data = dixLookupPrivate(&pProp->devPrivates, dataKey);
-	sidput(data->sid);
 	if (subj->prp_create_sid)
-	    sidget(data->sid = subj->prp_create_sid);
+	    data->sid = subj->prp_create_sid;
 	else
-	    sidget(data->sid = obj->sid);
+	    data->sid = obj->sid;
     }
 }
 
@@ -1041,8 +1009,6 @@ SELinuxScreen(CallbackListPtr *pcbl, pointer is_saver, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (access_mode & DixCreateAccess) {
-	sidput(obj->sid);
-
 	/* Perform a transition to obtain the final SID */
 	if (avc_compute_create(subj->sid, subj->sid, SECCLASS_X_SCREEN,
 			       &obj->sid) < 0) {
@@ -1174,7 +1140,6 @@ SELinuxSubjectInit(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     PrivateCallbackRec *rec = calldata;
     SELinuxSubjectRec *subj = *rec->value;
 
-    sidget(unlabeled_sid);
     subj->sid = unlabeled_sid;
 
     avc_entry_ref_init(&subj->aeref);
@@ -1187,14 +1152,6 @@ SELinuxSubjectFree(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     SELinuxSubjectRec *subj = *rec->value;
 
     xfree(subj->command);
-
-    if (avc_active) {
-	sidput(subj->sid);
-	sidput(subj->dev_create_sid);
-	sidput(subj->win_create_sid);
-	sidput(subj->sel_create_sid);
-	sidput(subj->prp_create_sid);
-    }
 }
 
 static void
@@ -1203,20 +1160,9 @@ SELinuxObjectInit(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     PrivateCallbackRec *rec = calldata;
     SELinuxObjectRec *obj = *rec->value;
 
-    sidget(unlabeled_sid);
     obj->sid = unlabeled_sid;
 }
 
-static void
-SELinuxObjectFree(CallbackListPtr *pcbl, pointer unused, pointer calldata)
-{
-    PrivateCallbackRec *rec = calldata;
-    SELinuxObjectRec *obj = *rec->value;
-
-    if (avc_active)
-	sidput(obj->sid);
-}
-
 
 /*
  * Extension Dispatch
@@ -1320,7 +1266,6 @@ ProcSELinuxSetCreateContext(ClientPtr client, unsigned offset)
 
     ptr = dixLookupPrivate(privPtr, subjectKey);
     pSid = (security_id_t *)(ptr + offset);
-    sidput(*pSid);
     *pSid = NULL;
 
     rc = Success;
@@ -1381,11 +1326,9 @@ ProcSELinuxSetDeviceContext(ClientPtr client)
     }
 
     subj = dixLookupPrivate(&dev->devPrivates, subjectKey);
-    sidput(subj->sid);
     subj->sid = sid;
     obj = dixLookupPrivate(&dev->devPrivates, objectKey);
-    sidput(obj->sid);
-    sidget(obj->sid = sid);
+    obj->sid = sid;
 
     rc = Success;
 out:
@@ -1412,20 +1355,28 @@ ProcSELinuxGetDeviceContext(ClientPtr client)
 }
 
 static int
-ProcSELinuxGetWindowContext(ClientPtr client)
+ProcSELinuxGetDrawableContext(ClientPtr client)
 {
-    WindowPtr pWin;
+    DrawablePtr pDraw;
+    PrivateRec **privatePtr;
     SELinuxObjectRec *obj;
     int rc;
 
     REQUEST(SELinuxGetContextReq);
     REQUEST_SIZE_MATCH(SELinuxGetContextReq);
 
-    rc = dixLookupWindow(&pWin, stuff->id, client, DixGetAttrAccess);
+    rc = dixLookupDrawable(&pDraw, stuff->id, client,
+			   M_WINDOW | M_DRAWABLE_PIXMAP,
+			   DixGetAttrAccess);
     if (rc != Success)
 	return rc;
 
-    obj = dixLookupPrivate(&pWin->devPrivates, objectKey);
+    if (pDraw->type == M_DRAWABLE_PIXMAP)
+	privatePtr = &((PixmapPtr)pDraw)->devPrivates;
+    else
+	privatePtr = &((WindowPtr)pDraw)->devPrivates;
+
+    obj = dixLookupPrivate(privatePtr, objectKey);
     return SELinuxSendContextReply(client, obj->sid);
 }
 
@@ -1669,12 +1620,12 @@ ProcSELinuxDispatch(ClientPtr client)
 	return ProcSELinuxSetDeviceContext(client);
     case X_SELinuxGetDeviceContext:
 	return ProcSELinuxGetDeviceContext(client);
-    case X_SELinuxSetWindowCreateContext:
+    case X_SELinuxSetDrawableCreateContext:
 	return ProcSELinuxSetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowCreateContext:
+    case X_SELinuxGetDrawableCreateContext:
 	return ProcSELinuxGetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowContext:
-	return ProcSELinuxGetWindowContext(client);
+    case X_SELinuxGetDrawableContext:
+	return ProcSELinuxGetDrawableContext(client);
     case X_SELinuxSetPropertyCreateContext:
 	return ProcSELinuxSetCreateContext(client, CTX_PRP);
     case X_SELinuxGetPropertyCreateContext:
@@ -1757,14 +1708,14 @@ SProcSELinuxGetDeviceContext(ClientPtr client)
 }
 
 static int
-SProcSELinuxGetWindowContext(ClientPtr client)
+SProcSELinuxGetDrawableContext(ClientPtr client)
 {
     REQUEST(SELinuxGetContextReq);
     int n;
 
     REQUEST_SIZE_MATCH(SELinuxGetContextReq);
     swapl(&stuff->id, n);
-    return ProcSELinuxGetWindowContext(client);
+    return ProcSELinuxGetDrawableContext(client);
 }
 
 static int
@@ -1831,12 +1782,12 @@ SProcSELinuxDispatch(ClientPtr client)
 	return SProcSELinuxSetDeviceContext(client);
     case X_SELinuxGetDeviceContext:
 	return SProcSELinuxGetDeviceContext(client);
-    case X_SELinuxSetWindowCreateContext:
+    case X_SELinuxSetDrawableCreateContext:
 	return SProcSELinuxSetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowCreateContext:
+    case X_SELinuxGetDrawableCreateContext:
 	return ProcSELinuxGetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowContext:
-	return SProcSELinuxGetWindowContext(client);
+    case X_SELinuxGetDrawableContext:
+	return SProcSELinuxGetDrawableContext(client);
     case X_SELinuxSetPropertyCreateContext:
 	return SProcSELinuxSetCreateContext(client, CTX_PRP);
     case X_SELinuxGetPropertyCreateContext:
@@ -1872,7 +1823,6 @@ SProcSELinuxDispatch(ClientPtr client)
     }
 }
 
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
 static int netlink_fd;
 
 static void
@@ -1886,7 +1836,6 @@ SELinuxWakeupHandler(void *data, int err, void *read_mask)
     if (FD_ISSET(netlink_fd, (fd_set *)read_mask))
         avc_netlink_check_nb();
 }
-#endif
 
 
 /*
@@ -1918,15 +1867,12 @@ SELinuxResetProc(ExtensionEntry *extEntry)
     label_hnd = NULL;
 
     audit_close(audit_fd);
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
     avc_netlink_release_fd();
     RemoveBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
                                  NULL);
     RemoveGeneralSocket(netlink_fd);
-#endif
 
     avc_destroy();
-    avc_active = 0;
 
     /* Free local state */
     xfree(knownAtoms);
@@ -1958,8 +1904,10 @@ SELinuxExtensionInit(INITARGS)
     }
 
     /* Don't init unless there's something to do */
-    if (!security_get_boolean_active("xserver_object_manager"))
+    if (!security_get_boolean_active("xserver_object_manager")) {
+	LogMessage(X_INFO, "SELinux: Disabled by boolean\n");
         return;
+    }
 
     /* Check SELinux mode in configuration file */
     switch(selinuxEnforcingState) {
@@ -1993,7 +1941,6 @@ SELinuxExtensionInit(INITARGS)
 
     if (avc_open(&avc_option, 1) < 0)
 	FatalError("SELinux: Couldn't initialize SELinux userspace AVC\n");
-    avc_active = 1;
 
     label_hnd = selabel_open(SELABEL_CTX_X, &selabel_option, 1);
     if (!label_hnd)
@@ -2024,20 +1971,16 @@ SELinuxExtensionInit(INITARGS)
     if (atom_client_ctx == BAD_RESOURCE)
 	FatalError("SELinux: Failed to create atom\n");
 
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
     netlink_fd = avc_netlink_acquire_fd();
     AddGeneralSocket(netlink_fd);
     RegisterBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
                                    NULL);
-#endif
 
     /* Register callbacks */
     ret &= dixRegisterPrivateInitFunc(subjectKey, SELinuxSubjectInit, NULL);
     ret &= dixRegisterPrivateDeleteFunc(subjectKey, SELinuxSubjectFree, NULL);
     ret &= dixRegisterPrivateInitFunc(objectKey, SELinuxObjectInit, NULL);
-    ret &= dixRegisterPrivateDeleteFunc(objectKey, SELinuxObjectFree, NULL);
     ret &= dixRegisterPrivateInitFunc(dataKey, SELinuxObjectInit, NULL);
-    ret &= dixRegisterPrivateDeleteFunc(dataKey, SELinuxObjectFree, NULL);
 
     ret &= AddCallback(&ClientStateCallback, SELinuxClientState, NULL);
     ret &= AddCallback(&ResourceStateCallback, SELinuxResourceState, NULL);

Xext/xselinux.h

@@ -25,7 +25,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 /* Extension info */
 #define SELINUX_EXTENSION_NAME		"SELinux"
 #define SELINUX_MAJOR_VERSION		1
-#define SELINUX_MINOR_VERSION		0
+#define SELINUX_MINOR_VERSION		1
 #define SELinuxNumberEvents		0
 #define SELinuxNumberErrors		0
 
@@ -35,9 +35,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define X_SELinuxGetDeviceCreateContext		2
 #define X_SELinuxSetDeviceContext		3
 #define X_SELinuxGetDeviceContext		4
-#define X_SELinuxSetWindowCreateContext		5
-#define X_SELinuxGetWindowCreateContext		6
-#define X_SELinuxGetWindowContext		7
+#define X_SELinuxSetDrawableCreateContext	5
+#define X_SELinuxGetDrawableCreateContext	6
+#define X_SELinuxGetDrawableContext		7
 #define X_SELinuxSetPropertyCreateContext	8
 #define X_SELinuxGetPropertyCreateContext	9
 #define X_SELinuxSetPropertyUseContext		10
@@ -150,12 +150,13 @@ typedef struct {
 #define SECCLASS_X_SELECTION		7
 #define SECCLASS_X_CURSOR		8
 #define SECCLASS_X_CLIENT		9
-#define SECCLASS_X_DEVICE		10
-#define SECCLASS_X_SERVER		11
-#define SECCLASS_X_EXTENSION		12
-#define SECCLASS_X_EVENT		13
-#define SECCLASS_X_FAKEEVENT		14
-#define SECCLASS_X_RESOURCE		15
+#define SECCLASS_X_POINTER		10
+#define SECCLASS_X_KEYBOARD		11
+#define SECCLASS_X_SERVER		12
+#define SECCLASS_X_EXTENSION		13
+#define SECCLASS_X_EVENT		14
+#define SECCLASS_X_FAKEEVENT		15
+#define SECCLASS_X_RESOURCE		16
 
 /* Mapping from DixAccess bits to Flask permissions */
 static struct security_class_mapping map[] = {
@@ -370,7 +371,37 @@ static struct security_class_mapping map[] = {
           "",			/* DixUseAccess */
           "manage",		/* DixManageAccess */
           NULL }},
-    { "x_device",
+    { "x_pointer",
+        { "read",		/* DixReadAccess */
+          "write",		/* DixWriteAccess */
+          "destroy",		/* DixDestroyAccess */
+          "create",		/* DixCreateAccess */
+          "getattr",		/* DixGetAttrAccess */
+          "setattr",		/* DixSetAttrAccess */
+          "list_property",	/* DixListPropAccess */
+          "get_property",	/* DixGetPropAccess */
+          "set_property",	/* DixSetPropAccess */
+          "getfocus",		/* DixGetFocusAccess */
+          "setfocus",		/* DixSetFocusAccess */
+          "",			/* DixListAccess */
+          "add",		/* DixAddAccess */
+          "remove",		/* DixRemoveAccess */
+          "",			/* DixHideAccess */
+          "",			/* DixShowAccess */
+          "",			/* DixBlendAccess */
+          "grab",		/* DixGrabAccess */
+          "freeze",		/* DixFreezeAccess */
+          "force_cursor",	/* DixForceAccess */
+          "",			/* DixInstallAccess */
+          "",			/* DixUninstallAccess */
+          "",			/* DixSendAccess */
+          "",			/* DixReceiveAccess */
+          "use",		/* DixUseAccess */
+          "manage",		/* DixManageAccess */
+          "",			/* DixDebugAccess */
+          "bell",		/* DixBellAccess */
+          NULL }},
+    { "x_keyboard",
         { "read",		/* DixReadAccess */
           "write",		/* DixWriteAccess */
           "destroy",		/* DixDestroyAccess */

Xext/xtest.c

@@ -184,6 +184,7 @@ ProcXTestFakeInput(ClientPtr client)
     int i;
     int base = 0;
     int flags = 0;
+    int need_ptr_update = 1;
 
     nev = (stuff->length << 2) - sizeof(xReq);
     if ((nev % sizeof(xEvent)) || !nev)
@@ -387,6 +388,8 @@ ProcXTestFakeInput(ClientPtr client)
                 client->errorValue = ev->u.u.detail;
                 return BadValue;
             }
+
+            need_ptr_update = 0;
             break;
         case MotionNotify:
             if (!dev->valuator)
@@ -451,7 +454,8 @@ ProcXTestFakeInput(ClientPtr client)
     for (i = 0; i < nevents; i++)
         mieqProcessDeviceEvent(dev, (InternalEvent*)(xtest_evlist+i)->event, NULL);
 
-    miPointerUpdateSprite(dev);
+    if (need_ptr_update)
+        miPointerUpdateSprite(dev);
     return client->noClientException;
 }
 

Xi/exevents.c

@@ -192,20 +192,16 @@ XIGetDevice(xEvent* xE)
  * This code is basically the old SwitchCoreKeyboard.
  */
 
-static void
+void
 CopyKeyClass(DeviceIntPtr device, DeviceIntPtr master)
 {
     KeyClassPtr mk = master->key;
-    KeyClassPtr dk = device->key;
-    int i;
 
     if (device == master)
         return;
 
     mk->sourceid = device->id;
 
-    for (i = 0; i < 8; i++)
-        mk->modifierKeyCount[i] = dk->modifierKeyCount[i];
 
     if (!XkbCopyDeviceKeymap(master, device))
         FatalError("Couldn't pivot keymap from device to core!\n");
@@ -444,6 +440,26 @@ DeepCopyKeyboardClasses(DeviceIntPtr from, DeviceIntPtr to)
         to->key      = NULL;
     }
 
+    /* If a SrvLedInfoPtr's flags are XkbSLI_IsDefault, the names and maps
+     * pointer point into the xkbInfo->desc struct.  XkbCopySrvLedInfo
+     * didn't update the pointers so we need to do it manually here.
+     */
+    if (to->kbdfeed)
+    {
+        KbdFeedbackPtr k;
+
+        for (k = to->kbdfeed; k; k = k->next)
+        {
+            if (!k->xkb_sli)
+                continue;
+            if (k->xkb_sli->flags & XkbSLI_IsDefault)
+            {
+                k->xkb_sli->names = to->key->xkbInfo->desc->names->indicators;
+                k->xkb_sli->maps = to->key->xkbInfo->desc->indicators->maps;
+            }
+        }
+    }
+
     /* We can't just copy over the focus class. When an app sets the focus,
      * it'll do so on the master device. Copying the SDs focus means losing
      * the focus.
@@ -805,7 +821,7 @@ UpdateDeviceState(DeviceIntPtr device, DeviceEvent* event)
         {
             /* XXX: Relative/Absolute mode */
             v->axisVal[i] = event->valuators.data[i];
-            v->axisVal[i] += event->valuators.data_frac[i];
+            v->axisVal[i] += (event->valuators.data_frac[i] * 1.0f / (1 << 16) / (1 << 16));
         }
     }
 
@@ -1031,16 +1047,19 @@ ProcessOtherEvent(InternalEvent *ev, DeviceIntPtr device)
             break;
     }
 
-#if 0
-    /* FIXME: I'm broken. Please fix me. Thanks */
-    if (DeviceEventCallback) {
+    if (DeviceEventCallback && !syncEvents.playingEvents) {
 	DeviceEventInfoRec eventinfo;
+	SpritePtr pSprite = device->spriteInfo->sprite;
 
-	eventinfo.events = (xEventPtr) xE;
-	eventinfo.count = count;
+	/* see comment in EnqueueEvents regarding the next three lines */
+	if (ev->any.type == ET_Motion)
+	    ev->device_event.root = WindowTable[pSprite->hotPhys.pScreen->myNum]->drawable.id;
+
+	eventinfo.device = device;
+	eventinfo.event = ev;
 	CallCallbacks(&DeviceEventCallback, (pointer) & eventinfo);
     }
-#endif
+
     grab = device->deviceGrab.grab;
 
     switch(event->type)

Xi/extinit.c

@@ -1123,7 +1123,6 @@ RestoreExtensionEvents(void)
 static void
 IResetProc(ExtensionEntry * unused)
 {
-
     ReplySwapVector[IReqCode] = ReplyNotSwappd;
     EventSwapVector[DeviceValuator] = NotImplemented;
     EventSwapVector[DeviceKeyPress] = NotImplemented;
@@ -1302,6 +1301,8 @@ XInputExtensionInit(void)
 
 	inputInfo.all_devices = &xi_all_devices;
 	inputInfo.all_master_devices = &xi_all_master_devices;
+
+	XIResetProperties();
     } else {
 	FatalError("IExtensionInit: AddExtensions failed\n");
     }

Xi/queryst.c

@@ -96,7 +96,7 @@ ProcXQueryDeviceState(ClientPtr client)
     rep.sequenceNumber = client->sequence;
 
     rc = dixLookupDevice(&dev, stuff->deviceid, client, DixReadAccess);
-    if (rc != Success)
+    if (rc != Success && rc != BadAccess)
 	return rc;
 
     v = dev->valuator;
@@ -130,8 +130,9 @@ ProcXQueryDeviceState(ClientPtr client)
 	tk->length = sizeof(xKeyState);
 	tk->num_keys = k->xkbInfo->desc->max_key_code -
                        k->xkbInfo->desc->min_key_code + 1;
-	for (i = 0; i < 32; i++)
-	    tk->keys[i] = k->down[i];
+	if (rc != BadAccess)
+	    for (i = 0; i < 32; i++)
+		tk->keys[i] = k->down[i];
 	buf += sizeof(xKeyState);
     }
 
@@ -140,19 +141,22 @@ ProcXQueryDeviceState(ClientPtr client)
 	tb->class = ButtonClass;
 	tb->length = sizeof(xButtonState);
 	tb->num_buttons = b->numButtons;
-	memcpy(tb->buttons, b->down, sizeof(b->down));
+	if (rc != BadAccess)
+	    memcpy(tb->buttons, b->down, sizeof(b->down));
 	buf += sizeof(xButtonState);
     }
 
     if (v != NULL) {
 	tv = (xValuatorState *) buf;
 	tv->class = ValuatorClass;
-	tv->length = sizeof(xValuatorState);
+	tv->length = sizeof(xValuatorState) + v->numAxes * 4;
 	tv->num_valuators = v->numAxes;
 	tv->mode = v->mode;
 	buf += sizeof(xValuatorState);
 	for (i = 0, values = v->axisVal; i < v->numAxes; i++) {
-	    *((int *)buf) = *values++;
+	    if (rc != BadAccess)
+		*((int *)buf) = *values;
+	    values++;
 	    if (client->swapped) {
 		swapl((int *)buf, n);	/* macro - braces needed */
 	    }

Xi/setmode.c

@@ -112,7 +112,17 @@ ProcXSetDeviceMode(ClientPtr client)
     if (rep.status == Success)
 	dev->valuator->mode = stuff->mode;
     else if (rep.status != AlreadyGrabbed)
+    {
+	switch(rep.status) {
+	    case BadMatch:
+	    case BadImplementation:
+	    case BadAlloc:
+		break;
+	    default:
+		rep.status = BadMode;
+	}
 	return rep.status;
+    }
 
     WriteReplyToClient(client, sizeof(xSetDeviceModeReply), &rep);
     return Success;

Xi/xiproperty.c

@@ -392,6 +392,15 @@ XIGetKnownProperty(char *name)
     return 0;
 }
 
+void
+XIResetProperties(void)
+{
+    int i;
+
+    for (i = 0; i < (sizeof(dev_properties)/sizeof(struct dev_properties)); i++)
+        dev_properties[i].type = None;
+}
+
 /**
  * Convert the given property's value(s) into @nelem_return integer values and
  * store them in @buf_return. If @nelem_return is larger than the number of
@@ -622,6 +631,8 @@ XIDeleteAllDeviceProperties (DeviceIntPtr device)
         XIDestroyDeviceProperty(prop);
     }
 
+    device->properties.properties = NULL;
+
     /* Now free all handlers */
     curr_handler = device->properties.handlers;
     while(curr_handler)
@@ -630,6 +641,8 @@ XIDeleteAllDeviceProperties (DeviceIntPtr device)
         xfree(curr_handler);
         curr_handler = next_handler;
     }
+
+    device->properties.handlers = NULL;
 }
 
 
@@ -643,6 +656,9 @@ XIDeleteDeviceProperty (DeviceIntPtr device, Atom property, Bool fromClient)
         if (prop->propertyName == property)
             break;
 
+    if (!prop)
+        return Success;
+
     if (fromClient && !prop->deletable)
         return BadAccess;
 

Xi/xiproperty.h

@@ -62,4 +62,7 @@ void SRepXIListProperties(ClientPtr client, int size,
                           xXIListPropertiesReply *rep);
 void SRepXIGetProperty(ClientPtr client, int size,
                        xXIGetPropertyReply *rep);
+
+void XIResetProperties(void);
+
 #endif /* XIPROPERTY_H */

Xi/xiquerydevice.c

@@ -45,7 +45,8 @@
 #include "xiquerydevice.h"
 
 static Bool ShouldSkipDevice(ClientPtr client, int deviceid, DeviceIntPtr d);
-static int ListDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info);
+static int
+ListDeviceInfo(ClientPtr client, DeviceIntPtr dev, xXIDeviceInfo* info);
 static int SizeDeviceInfo(DeviceIntPtr dev);
 static void SwapDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info);
 int
@@ -119,7 +120,7 @@ ProcXIQueryDevice(ClientPtr client)
     ptr = info;
     if (dev)
     {
-        len = ListDeviceInfo(dev, (xXIDeviceInfo*)info);
+        len = ListDeviceInfo(client, dev, (xXIDeviceInfo*)info);
         if (client->swapped)
             SwapDeviceInfo(dev, (xXIDeviceInfo*)info);
         info += len;
@@ -131,7 +132,7 @@ ProcXIQueryDevice(ClientPtr client)
         {
             if (!skip[i])
             {
-                len = ListDeviceInfo(dev, (xXIDeviceInfo*)info);
+                len = ListDeviceInfo(client, dev, (xXIDeviceInfo*)info);
                 if (client->swapped)
                     SwapDeviceInfo(dev, (xXIDeviceInfo*)info);
                 info += len;
@@ -143,7 +144,7 @@ ProcXIQueryDevice(ClientPtr client)
         {
             if (!skip[i])
             {
-                len = ListDeviceInfo(dev, (xXIDeviceInfo*)info);
+                len = ListDeviceInfo(client, dev, (xXIDeviceInfo*)info);
                 if (client->swapped)
                     SwapDeviceInfo(dev, (xXIDeviceInfo*)info);
                 info += len;
@@ -240,7 +241,7 @@ SizeDeviceClasses(DeviceIntPtr dev)
  * @return Number of bytes written into info.
  */
 int
-ListButtonInfo(DeviceIntPtr dev, xXIButtonInfo* info)
+ListButtonInfo(DeviceIntPtr dev, xXIButtonInfo* info, Bool reportState)
 {
     unsigned char *bits;
     int mask_len;
@@ -257,9 +258,11 @@ ListButtonInfo(DeviceIntPtr dev, xXIButtonInfo* info)
     bits = (unsigned char*)&info[1];
     memset(bits, 0, mask_len * 4);
 
-    for (i = 0; dev && dev->button && i < dev->button->numButtons; i++)
-        if (BitIsOn(dev->button->down, i))
-            SetBit(bits, i);
+    if (reportState)
+	for (i = 0; dev && dev->button && i < dev->button->numButtons; i++)
+	    if (BitIsOn(dev->button->down, i))
+		SetBit(bits, i);
+
     bits += mask_len * 4;
     memcpy(bits, dev->button->labels, dev->button->numButtons * sizeof(Atom));
 
@@ -327,7 +330,8 @@ SwapKeyInfo(DeviceIntPtr dev, xXIKeyInfo* info)
  * @return The number of bytes written into info.
  */
 int
-ListValuatorInfo(DeviceIntPtr dev, xXIValuatorInfo* info, int axisnumber)
+ListValuatorInfo(DeviceIntPtr dev, xXIValuatorInfo* info, int axisnumber,
+		 Bool reportState)
 {
     ValuatorClassPtr v = dev->valuator;
 
@@ -345,6 +349,9 @@ ListValuatorInfo(DeviceIntPtr dev, xXIValuatorInfo* info, int axisnumber)
     info->mode = v->mode; /* Server doesn't have per-axis mode yet */
     info->sourceid = v->sourceid;
 
+    if (!reportState)
+	info->value = info->min;
+
     return info->length * 4;
 }
 
@@ -389,7 +396,7 @@ int GetDeviceUse(DeviceIntPtr dev, uint16_t *attachment)
  * @return The number of bytes used.
  */
 static int
-ListDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
+ListDeviceInfo(ClientPtr client, DeviceIntPtr dev, xXIDeviceInfo* info)
 {
     char *any = (char*)&info[1];
     int len = 0, total_len = 0;
@@ -407,7 +414,8 @@ ListDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
     any += len;
     total_len += len;
 
-    return total_len + ListDeviceClasses(dev, any, &info->num_classes);
+    total_len += ListDeviceClasses(client, dev, any, &info->num_classes);
+    return total_len;
 }
 
 /**
@@ -416,16 +424,21 @@ ListDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
  * written.
  */
 int
-ListDeviceClasses(DeviceIntPtr dev, char *any, uint16_t *nclasses)
+ListDeviceClasses(ClientPtr client, DeviceIntPtr dev,
+		  char *any, uint16_t *nclasses)
 {
     int total_len = 0;
     int len;
     int i;
+    int rc;
+
+    /* Check if the current device state should be suppressed */
+    rc = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixReadAccess);
 
     if (dev->button)
     {
         (*nclasses)++;
-        len = ListButtonInfo(dev, (xXIButtonInfo*)any);
+        len = ListButtonInfo(dev, (xXIButtonInfo*)any, rc == Success);
         any += len;
         total_len += len;
     }
@@ -441,7 +454,7 @@ ListDeviceClasses(DeviceIntPtr dev, char *any, uint16_t *nclasses)
     for (i = 0; dev->valuator && i < dev->valuator->numAxes; i++)
     {
         (*nclasses)++;
-        len = ListValuatorInfo(dev, (xXIValuatorInfo*)any, i);
+        len = ListValuatorInfo(dev, (xXIValuatorInfo*)any, i, rc == Success);
         any += len;
         total_len += len;
     }

Xi/xiquerydevice.h

@@ -37,9 +37,11 @@ int SProcXIQueryDevice(ClientPtr client);
 int ProcXIQueryDevice(ClientPtr client);
 void SRepXIQueryDevice(ClientPtr client, int size, xXIQueryDeviceReply *rep);
 int SizeDeviceClasses(DeviceIntPtr dev);
-int ListDeviceClasses(DeviceIntPtr dev, char* any, uint16_t* nclasses);
+int ListDeviceClasses(ClientPtr client, DeviceIntPtr dev,
+		      char* any, uint16_t* nclasses);
 int GetDeviceUse(DeviceIntPtr dev, uint16_t *attachment);
-int ListButtonInfo(DeviceIntPtr dev, xXIButtonInfo* info);
+int ListButtonInfo(DeviceIntPtr dev, xXIButtonInfo* info, Bool reportState);
 int ListKeyInfo(DeviceIntPtr dev, xXIKeyInfo* info);
-int ListValuatorInfo(DeviceIntPtr dev, xXIValuatorInfo* info, int axisnumber);
+int ListValuatorInfo(DeviceIntPtr dev, xXIValuatorInfo* info,
+		     int axisnumber, Bool reportState);
 #endif /* QUERYDEV_H */

composite/compalloc.c

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *

composite/compext.c

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *

composite/compinit.c

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *
@@ -238,7 +232,6 @@ static CompAlternateVisual  altVisuals[] = {
     {	24,	PICT_r8g8b8 },
 #endif
     {	32,	PICT_a8r8g8b8 },
-    {	32,	PICT_b8g8r8a8 },
 };
 
 static const int NUM_COMP_ALTERNATE_VISUALS = sizeof(altVisuals) /
@@ -248,15 +241,9 @@ static Bool
 compAddAlternateVisual(ScreenPtr pScreen, CompScreenPtr cs,
 		       CompAlternateVisual *alt)
 {
-    VisualPtr	    visual, visuals;
-    int		    i;
-    int		    numVisuals;
-    XID		    *installedCmaps;
-    ColormapPtr	    installedCmap;
-    int		    numInstalledCmaps;
+    VisualPtr	    visual;
     DepthPtr	    depth;
     PictFormatPtr   pPictFormat;
-    VisualID	    *vid;
     unsigned long   alphaMask;
 
     /*
@@ -273,58 +260,16 @@ compAddAlternateVisual(ScreenPtr pScreen, CompScreenPtr cs,
 	return TRUE;
 
     pPictFormat = PictureMatchFormat (pScreen, alt->depth, alt->format);
-    if (!pPictFormat ||
-	pPictFormat->direct.red != pScreen->visuals[0].offsetRed)
+    if (!pPictFormat)
 	return FALSE;
 
-    vid = xalloc(sizeof(VisualID));
-    if (!vid)
-	return FALSE;
-
-    /* Find the installed colormaps */
-    installedCmaps = xalloc (pScreen->maxInstalledCmaps * sizeof (XID));
-    if (!installedCmaps) {
-	xfree(vid);
-	return FALSE;
-    }
-    numInstalledCmaps = pScreen->ListInstalledColormaps(pScreen, 
-	    installedCmaps);
-
-    /* realloc the visual array to fit the new one in place */
-    numVisuals = pScreen->numVisuals;
-    visuals = xrealloc(pScreen->visuals, (numVisuals + 1) * sizeof(VisualRec));
-    if (!visuals) {
-	xfree(vid);
-	xfree(installedCmaps);
-	return FALSE;
+    if (ResizeVisualArray(pScreen, 1, depth) == FALSE) {
+        return FALSE;
     }
 
-    /*
-     * Fix up any existing installed colormaps -- we'll assume that
-     * the only ones created so far have been installed.  If this
-     * isn't true, we'll have to walk the resource database looking
-     * for all colormaps.
-     */
-    for (i = 0; i < numInstalledCmaps; i++) {
-	int j, rc;
-
-	rc = dixLookupResourceByType((pointer *)&installedCmap,
-				     installedCmaps[i], RT_COLORMAP,
-				     serverClient, DixReadAccess);
-	if (rc != Success)
-	    continue;
-	j = installedCmap->pVisual - pScreen->visuals;
-	installedCmap->pVisual = &visuals[j];
-    }
-
-    xfree(installedCmaps);
-
-    pScreen->visuals = visuals;
-    visual = visuals + pScreen->numVisuals; /* the new one */
-    pScreen->numVisuals++;
+    visual = pScreen->visuals + (pScreen->numVisuals - 1); /* the new one */
 
     /* Initialize the visual */
-    visual->vid = FakeClientID (0);
     visual->bitsPerRGBValue = 8;
     if (PICT_FORMAT_TYPE(alt->format) == PICT_TYPE_COLOR) {
 	visual->class = PseudoColor;
@@ -357,10 +302,6 @@ compAddAlternateVisual(ScreenPtr pScreen, CompScreenPtr cs,
     /* remember the visual ID to detect auto-update windows */
     compRegisterAlternateVisuals(cs, &visual->vid, 1);
 
-    /* Fix up the depth */
-    *vid = visual->vid;
-    depth->numVids = 1;
-    depth->vids = vid;
     return TRUE;
 }
 

composite/compint.h

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *

composite/compoverlay.c

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *

composite/compwindow.c

@@ -2,29 +2,23 @@
  * Copyright © 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  *
  * Copyright © 2003 Keith Packard
  *

configure.ac

@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.6.99.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="(unreleased)"
+AC_INIT([xorg-server], 1.7.7, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2010-05-04"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([dist-bzip2 foreign])
 AM_MAINTAINER_MODE
@@ -85,12 +85,6 @@ dnl ISDN trace program named dtrace
 AC_ARG_WITH(dtrace, AS_HELP_STRING([--with-dtrace=PATH],
 	     [Enable dtrace probes (default: enabled if dtrace found)]),
 	     [WDTRACE=$withval], [WDTRACE=auto])
-dnl Darwin 9 has dtrace, but it doesn't support compilation into ELF...
-if test "x$WDTRACE" = xauto; then
-	case $host_os in
-		darwin*) WDTRACE="no" ;;
-	esac
-fi
 if test "x$WDTRACE" = "xyes" -o "x$WDTRACE" = "xauto" ; then
 	AC_PATH_PROG(DTRACE, [dtrace], [not_found], [$PATH:/usr/sbin])
 	if test "x$DTRACE" = "xnot_found" ; then
@@ -108,8 +102,20 @@ fi
 if test "x$WDTRACE" != "xno" ; then
   AC_DEFINE(XSERVER_DTRACE, 1, 
       [Define to 1 if the DTrace Xserver provider probes should be built in.])
+
+# Solaris/OpenSolaris require dtrace -G to build dtrace probe information into
+# object files, and require linking with those as relocatable objects, not .a
+# archives. MacOS X handles all this in the normal compiler toolchain, and on
+# some releases (like Tiger), will error out on dtrace -G.  For now, other
+# platforms with Dtrace ports are assumed to support -G (the FreeBSD and Linux
+# ports appear to, based on my web searches, but have not yet been tested).
+	case $host_os in
+		darwin*)	SPECIAL_DTRACE_OBJECTS=no ;;
+		*)		SPECIAL_DTRACE_OBJECTS=yes ;;
+	esac
 fi
 AM_CONDITIONAL(XSERVER_DTRACE, [test "x$WDTRACE" != "xno"])
+AM_CONDITIONAL(SPECIAL_DTRACE_OBJECTS, [test "x$SPECIAL_DTRACE_OBJECTS" = "xyes"])
 
 AC_HEADER_DIRENT
 AC_HEADER_STDC
@@ -504,9 +510,9 @@ AC_ARG_WITH(default-xkb-rules, AS_HELP_STRING([--with-default-xkb-rules=RULES],
                                 [ XKB_DFLT_RULES="$withval" ],
                                 [ XKB_DFLT_RULES="" ])
 AC_ARG_WITH(default-xkb-model, AS_HELP_STRING([--with-default-xkb-model=MODEL],
-                                   [Keyboard model (default: pc104)]),
+                                   [Keyboard model (default: pc105)]),
                                 [ XKB_DFLT_MODEL="$withval" ],
-                                [ XKB_DFLT_MODEL="pc104" ])
+                                [ XKB_DFLT_MODEL="pc105" ])
 AC_ARG_WITH(default-xkb-layout, AS_HELP_STRING([--with-default-xkb-layout=LAYOUT],
                                    [Keyboard layout (default: us)]),
                                 [ XKB_DFLT_LAYOUT="$withval" ],
@@ -554,6 +560,9 @@ AC_ARG_ENABLE(null-root-cursor, AS_HELP_STRING([--enable-null-root-cursor], [Use
 AC_ARG_ENABLE(visibility,     AC_HELP_STRING([--enable-visibility], [Enable symbol visibility (default: auto)]),
 				[SYMBOL_VISIBILITY=$enableval],
 				[SYMBOL_VISIBILITY=auto])
+AC_ARG_ENABLE(pc98,     	AC_HELP_STRING([--enable-pc98], [Enable PC98 support in Xorg (default: auto)]),
+				[SUPPORT_PC98=$enableval],
+				[SUPPORT_PC98=auto])
 
 dnl GLX build options
 AC_ARG_WITH(dri-driver-path,  AS_HELP_STRING([--with-dri-driver-path=PATH], [Path to DRI drivers (default: ${libdir}/dri)]),
@@ -604,7 +613,7 @@ dnl DDXes.
 AC_ARG_ENABLE(xorg,    	      AS_HELP_STRING([--enable-xorg], [Build Xorg server (default: auto)]), [XORG=$enableval], [XORG=auto])
 AC_ARG_ENABLE(dmx,    	      AS_HELP_STRING([--enable-dmx], [Build DMX server (default: auto)]), [DMX=$enableval], [DMX=auto])
 AC_ARG_ENABLE(xvfb,    	      AS_HELP_STRING([--enable-xvfb], [Build Xvfb server (default: yes)]), [XVFB=$enableval], [XVFB=yes])
-AC_ARG_ENABLE(xnest,   	      AS_HELP_STRING([--enable-xnest], [Build Xnest server (default: yes)]), [XNEST=$enableval], [XNEST=yes])
+AC_ARG_ENABLE(xnest,   	      AS_HELP_STRING([--enable-xnest], [Build Xnest server (default: auto)]), [XNEST=$enableval], [XNEST=auto])
 AC_ARG_ENABLE(xquartz,        AS_HELP_STRING([--enable-xquartz], [Build Xquartz server for OS-X (default: auto)]), [XQUARTZ=$enableval], [XQUARTZ=auto])
 AC_ARG_ENABLE(standalone-xpbproxy, AS_HELP_STRING([--enable-standalone-xpbproxy], [Build a standalone xpbproxy (in addition to the one integrated into Xquartz as a separate thread) (default: no)]), [STANDALONE_XPBPROXY=$enableval], [STANDALONE_XPBPROXY=no])
 AC_ARG_ENABLE(xwin,    	      AS_HELP_STRING([--enable-xwin], [Build XWin server (default: auto)]), [XWIN=$enableval], [XWIN=auto])
@@ -707,6 +716,7 @@ case $host_os in
 			XF86VIDMODE=no
 		fi
 		;;
+	*) XQUARTZ=no ;;
 esac
 
 dnl ---------------------------------------------------------------------------
@@ -738,6 +748,19 @@ dnl Core modules for most extensions, et al.
 REQUIRED_MODULES="[randrproto >= 1.2.99.3] [renderproto >= 0.11] [fixesproto >= 4.1] [damageproto >= 1.1] [xcmiscproto >= 1.2.0] [xextproto >= 7.0.99.3] [xproto >= 7.0.13] [xtrans >= 1.2.2] [bigreqsproto >= 1.1.0] fontsproto [inputproto >= 1.9.99.902] [kbproto >= 1.0.3]"
 REQUIRED_LIBS="xfont xau [pixman-1 >= 0.15.20]"
 
+dnl List of libraries that require a specific version
+LIBAPPLEWM="applewm >= 1.4"
+LIBDMX="dmx >= 1.0.99.1"
+LIBDRI="dri >= 7.1.0"
+LIBDRM="libdrm >= 2.3.0"
+LIBGL="gl >= 7.1.0"
+LIBXEXT="xext >= 1.0.99.4"
+LIBXI="xi >= 1.2.99.1"
+LIBXTST="xtst >= 1.0.99.2"
+LIBPCIACCESS="pciaccess >= 0.8.0"
+LIBGLIB="glib-2.0 >= 2.16"
+LIBSELINUX="libselinux >= 2.0.86"
+
 dnl HAVE_DBUS is true if we actually have the D-Bus library, whereas
 dnl CONFIG_DBUS_API is true if we want to enable the D-Bus config
 dnl API.
@@ -901,7 +924,7 @@ fi
 
 if test "x$GLX" = xyes; then
 	PKG_CHECK_MODULES([XLIB], [x11])
-	PKG_CHECK_MODULES([GL], $GLPROTO [gl >= 7.1.0])
+	PKG_CHECK_MODULES([GL], $GLPROTO $LIBGL)
 	AC_SUBST(XLIB_CFLAGS)
 	AC_DEFINE(GLXEXT, 1, [Build GLX extension])
 	GLX_LIBS='$(top_builddir)/glx/libglx.la'
@@ -928,7 +951,7 @@ AM_CONDITIONAL(DRI, test "x$DRI" = xyes)
 if test "x$DRI" = xyes; then
 	AC_DEFINE(XF86DRI, 1, [Build DRI extension])
 	PKG_CHECK_MODULES([DRIPROTO], [$DRIPROTO])
-	PKG_CHECK_MODULES([DRI], $GLPROTO [dri >= 7.1.0])
+	PKG_CHECK_MODULES([DRI], $GLPROTO $LIBDRI)
 	AC_SUBST(DRIPROTO_CFLAGS)
 fi
 
@@ -946,7 +969,7 @@ esac
 AM_CONDITIONAL(DRI2, test "x$DRI2" = xyes)
 
 if test "x$DRI" = xyes || test "x$DRI2" = xyes; then
-	PKG_CHECK_MODULES([LIBDRM], [libdrm >= 2.3.0])
+	PKG_CHECK_MODULES([LIBDRM], $LIBDRM)
 	AC_SUBST(LIBDRM_CFLAGS)
 	AC_SUBST(LIBDRM_LIBS)
 fi
@@ -990,16 +1013,11 @@ if test "x$XSELINUX" = xyes; then
 	if test "x$XACE" != xyes; then
 		AC_MSG_ERROR([cannot build SELinux extension without X-ACE])
 	fi
-	AC_CHECK_HEADERS([selinux/selinux.h selinux/avc.h], [], AC_MSG_ERROR([SELinux include files not found]))
-	AC_CHECK_LIB(selinux, avc_init, [], AC_MSG_ERROR([SELinux library not found])) 
 	AC_CHECK_HEADERS([libaudit.h], [], AC_MSG_ERROR([SELinux extension requires audit system headers]))
 	AC_CHECK_LIB(audit, audit_open, [], AC_MSG_ERROR([SELinux extension requires audit system library]))
-        AC_CHECK_DECL(avc_netlink_acquire_fd,
-                      [AC_DEFINE(HAVE_AVC_NETLINK_ACQUIRE_FD, 1, "Have avc_netlink_acquire_fd")],
-                      [],
-                      [#include <selinux/avc.h>])
+	PKG_CHECK_MODULES([SELINUX], $LIBSELINUX)
+	SELINUX_LIBS="$SELINUX_LIBS -laudit"
 	AC_DEFINE(XSELINUX, 1, [Build SELinux extension])
-	SELINUX_LIB="-lselinux -laudit"
 fi
 
 AM_CONDITIONAL(XCSECURITY, [test "x$XCSECURITY" = xyes])
@@ -1060,6 +1078,7 @@ MIEXT_DAMAGE_LIB='$(top_builddir)/miext/damage/libdamage.la'
 MIEXT_DAMAGE_INC='-I$(top_srcdir)/miext/damage'
 
 # XINPUT extension is integral part of the server
+AC_DEFINE(XINPUT, 1, [Support X Input extension])
 XI_LIB='$(top_builddir)/Xi/libXi.la'
 XI_INC='-I$(top_srcdir)/Xi'
 
@@ -1072,11 +1091,16 @@ AM_CONDITIONAL(INT10MODULE, test "x$INT10MODULE" = xyes)
 AC_DEFINE(SHAPE, 1, [Support SHAPE extension])
 
 AC_DEFINE_DIR(XKB_BASE_DIRECTORY, XKBPATH, [Path to XKB data])
-AC_DEFINE_DIR(XKB_BIN_DIRECTORY, bindir, [Path to XKB bin dir])
+AC_ARG_WITH(xkb-bin-directory,
+				AS_HELP_STRING([--with-xkb-bin-directory=DIR], [Directory containing xkbcomp program]),
+				[XKB_BIN_DIRECTORY="$withval"],
+				[XKB_BIN_DIRECTORY="$bindir"])
+
+AC_DEFINE_DIR(XKB_BIN_DIRECTORY, XKB_BIN_DIRECTORY, [Path to XKB bin dir])
 
 dnl Make sure XKM_OUTPUT_DIR is an absolute path
 XKBOUTPUT_FIRSTCHAR=`echo $XKBOUTPUT | cut -b 1`
-if [[ x$XKBOUTPUT_FIRSTCHAR != x/ ]] ; then
+if [[ x$XKBOUTPUT_FIRSTCHAR != x/ -a x$XKBOUTPUT_FIRSTCHAR != 'x$' ]] ; then
    XKBOUTPUT="$XKB_BASE_DIRECTORY/$XKBOUTPUT"
 fi
 
@@ -1193,7 +1217,7 @@ AM_CONDITIONAL(DEBUG, [test "x$DEBUGGING" = xyes])
 
 # If unittests aren't explicitly disabled, check for required support
 if test "x$UNITTESTS" != xno ; then
-       PKG_CHECK_MODULES([GLIB], [glib-2.0 >= 2.16],
+       PKG_CHECK_MODULES([GLIB], $LIBGLIB,
                          [HAVE_GLIB=yes], [HAVE_GLIB=no])
 
        # Check if linker supports -wrap, passed via compiler flags
@@ -1240,13 +1264,15 @@ AC_DEFINE(XSYNC, 1, [Support XSync extension])
 AC_DEFINE(XCMISC, 1, [Support XCMisc extension])
 AC_DEFINE(BIGREQS, 1, [Support BigRequests extension])
 
-if test "x$WDTRACE" != "xno" ; then
+if test "x$SPECIAL_DTRACE_OBJECTS" = "xyes" ; then
   DIX_LIB='$(top_builddir)/dix/dix.O'
   OS_LIB='$(top_builddir)/os/os.O'
 else
   DIX_LIB='$(top_builddir)/dix/libdix.la'
   OS_LIB='$(top_builddir)/os/libos.la'
 fi
+AC_SUBST([DIX_LIB])
+AC_SUBST([OS_LIB])
 
 MAIN_LIB='$(top_builddir)/dix/libmain.la'
 AC_SUBST([MAIN_LIB])
@@ -1360,7 +1386,7 @@ fi
 
 dnl Xnest DDX
 
-PKG_CHECK_MODULES(XNESTMODULES, [xfont xext x11 xau $XDMCP_MODULES], [have_xnest=yes], [have_xnest=no])
+PKG_CHECK_MODULES(XNESTMODULES, [xfont $LIBXEXT x11 xau $XDMCP_MODULES], [have_xnest=yes], [have_xnest=no])
 AC_MSG_CHECKING([whether to build Xnest DDX])
 if test "x$XNEST" = xauto; then
 	XNEST="$have_xnest"
@@ -1369,6 +1395,9 @@ AC_MSG_RESULT([$XNEST])
 AM_CONDITIONAL(XNEST, [test "x$XNEST" = xyes])
 
 if test "x$XNEST" = xyes; then
+	if test "x$have_xnest" = xno; then
+		AC_MSG_ERROR([Xnest build explicitly requested, but required modules not found.])
+	fi
 	XNEST_LIBS="$FB_LIB $FIXES_LIB $MI_LIB $XEXT_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $RENDER_LIB $DAMAGE_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $DIX_LIB $MAIN_LIB $OS_LIB $CONFIG_LIB"
 	XNEST_SYS_LIBS="$XNESTMODULES_LIBS $GLX_SYS_LIBS"
 	AC_SUBST([XNEST_LIBS])
@@ -1440,7 +1469,7 @@ if test "x$XORG" = xyes; then
 	AC_SUBST([symbol_visibility])
 	dnl ===================================================================
 
-	PKG_CHECK_MODULES([PCIACCESS], [pciaccess >= 0.8.0])
+	PKG_CHECK_MODULES([PCIACCESS], $LIBPCIACCESS)
 	SAVE_LIBS=$LIBS
 	SAVE_CFLAGS=$CFLAGS
 	CFLAGS=$PCIACCESS_CFLAGS
@@ -1451,7 +1480,7 @@ if test "x$XORG" = xyes; then
 	AC_CHECK_FUNCS([pci_device_vgaarb_init])
 	LIBS=$SAVE_LIBS
 	CFLAGS=$SAVE_CFLAGS
-	XORG_SYS_LIBS="$XORG_SYS_LIBS $PCIACCESS_LIBS $DLOPEN_LIBS $GLX_SYS_LIBS $SELINUX_LIB"
+	XORG_SYS_LIBS="$XORG_SYS_LIBS $PCIACCESS_LIBS $DLOPEN_LIBS $GLX_SYS_LIBS"
 	XORG_CFLAGS="$XORG_CFLAGS $PCIACCESS_CFLAGS"
 
 	case $host_os in
@@ -1500,6 +1529,7 @@ if test "x$XORG" = xyes; then
 	  solaris*)
 	  	XORG_OS="solaris"
 		XORG_OS_SUBDIR="solaris"
+		XORG_CFLAGS="$XORG_CFLAGS -DXF86PM"
 		# Use the same stubs as BSD for old functions, since we now
 		# use libpciaccess for PCI
 		xorg_bus_bsdpci="yes"
@@ -1532,7 +1562,6 @@ if test "x$XORG" = xyes; then
 			else
 				SOLARIS_INOUT_ARCH="ia32"
 			fi
-			XORG_CFLAGS="$XORG_CFLAGS -DXF86PM"
 			;;
 		  *)
 			AC_MSG_ERROR([Unsupported Solaris platform. Only SPARC & x86 \
@@ -1546,6 +1575,9 @@ if test "x$XORG" = xyes; then
 			XORG_CFLAGS="${XORG_CFLAGS} "'$(SOLARIS_ASM_CFLAGS)'
 		fi
 		AC_SUBST([SOLARIS_ASM_CFLAGS])
+		if test "x$SUPPORT_PC98" = xauto; then
+			SUPPORT_PC98="no"
+		fi
 		;;
 	  gnu*)
 	  	XORG_OS="gnu"
@@ -1567,8 +1599,19 @@ if test "x$XORG" = xyes; then
 	  sparc*)
 		xorg_bus_sparc="yes"
 		;;
+	  i*86)
+		if test "x$SUPPORT_PC98" = xauto; then
+			SUPPORT_PC98="yes"
+		fi
+		;;
 	esac
 
+	if test "x$SUPPORT_PC98" = xauto; then
+		SUPPORT_PC98="no"
+	fi
+	if test "x$SUPPORT_PC98" = xyes; then
+		AC_DEFINE(SUPPORT_PC98, 1, [Support PC98])
+	fi
 	if test "x$XORG_OS_PCI" = x ; then
 		XORG_OS_PCI=$XORG_OS
 	fi
@@ -1678,8 +1721,6 @@ if test "x$XWIN" = xauto; then
 		mingw*) XWIN="yes" ;;
 		*) XWIN="no" ;;
 	esac
-	XWIN_LIBS="$FB_LIB $MI_LIB $FIXES_LIB $XEXT_LIB $CONFIG_LIB $RANDR_LIB $RENDER_LIB $XTRAP_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $DAMAGE_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $MIEXT_LAYER_LIB $LAYER_LIB $XPSTUBS_LIB $SHADOW_LIB $OS_LIB"
-	AC_SUBST([XWIN_LIBS])
 fi
 AC_MSG_RESULT([$XWIN])
 
@@ -1692,8 +1733,14 @@ if test "x$XWIN" = xyes; then
 			XWIN_SERVER_NAME=XWin
 			PKG_CHECK_MODULES([XWINMODULES],[x11 xdmcp xau xfont])
 			AC_DEFINE(HAS_DEVWINDOWS,1,[Cygwin has /dev/windows for signaling new win32 messages])
-			AC_DEFINE(ROOTLESS,1,[Build Rootless code])
-			CFLAGS="$CFLAGS -DFD_SETSIZE=256 -DROOTLESS_WORKAROUND"
+
+			dnl if we have windowswmproto, build rootless extension for multwindowextwm mode
+			if test "x$WINDOWSWM" = xyes ; then
+			       AC_DEFINE(ROOTLESS,1,[Build Rootless code])
+			       CFLAGS="$CFLAGS -DROOTLESS_WORKAROUND"
+			fi
+
+			CFLAGS="$CFLAGS -DFD_SETSIZE=256"
 			;;
 		mingw*)
 			XWIN_SERVER_NAME=Xming
@@ -1703,7 +1750,9 @@ if test "x$XWIN" = xyes; then
 			XWIN_SYS_LIBS=-lwinsock2
 			;;
 	esac
+	XWIN_LIBS="$FB_LIB $MI_LIB $FIXES_LIB $XEXT_LIB $CONFIG_LIB $RANDR_LIB $RENDER_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $DAMAGE_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $OS_LIB"
 	XWIN_SYS_LIBS="$XWIN_SYS_LIBS $XWINMODULES_LIBS"
+	AC_SUBST(XWIN_LIBS)
 	AC_SUBST(XWIN_SERVER_NAME)
 	AC_SUBST(XWIN_SYS_LIBS)
 
@@ -1746,7 +1795,7 @@ if test "x$XQUARTZ" = xyes; then
 
 	CFLAGS="${CFLAGS} -DROOTLESS_WORKAROUND -DROOTLESS_SAFEALPHA -DNO_ALLOCA"
 
-	PKG_CHECK_MODULES(XPBPROXY, $APPLEWMPROTO [applewm >= 1.4] xfixes x11)
+	PKG_CHECK_MODULES(XPBPROXY, $APPLEWMPROTO $LIBAPPLEWM xfixes x11)
 
         if test "x$XQUARTZ_SPARKLE" = xyes ; then
                 AC_DEFINE(XQUARTZ_SPARKLE,1,[Support application updating through sparkle.])
@@ -1773,10 +1822,15 @@ AM_CONDITIONAL(XQUARTZ_SPARKLE, [test "x$XQUARTZ_SPARKLE" != "xno"])
 AM_CONDITIONAL(STANDALONE_XPBPROXY, [test "x$STANDALONE_XPBPROXY" = xyes])
 
 dnl DMX DDX
-
-PKG_CHECK_MODULES([DMXMODULES],
-    [xmuu xext x11 xrender xfixes xfont xi >= 1.2.99.1 $DMXPROTO xau $XDMCP_MODULES],
-    [have_dmx=yes], [have_dmx=no])
+PKG_CHECK_MODULES(
+	[DMXMODULES],
+	[xmuu $LIBXEXT x11 xrender xfixes xfont $LIBXI $DMXPROTO xau $XDMCP_MODULES],
+	[PKG_CHECK_MODULES(
+		[XDMXCONFIG_DEP],
+		[xaw7 xmu xt xpm x11],
+		[have_dmx=yes],
+		[have_dmx=no])],
+	[have_dmx=no])
 AC_MSG_CHECKING([whether to build Xdmx DDX])
 if test "x$DMX" = xauto; then
 	DMX="$have_dmx"
@@ -1795,7 +1849,7 @@ if test "x$DMX" = xyes; then
 	fi
 	DMX_INCLUDES="$XEXT_INC $RENDER_INC $RECORD_INC"
 	XDMX_CFLAGS="$DMXMODULES_CFLAGS"
-	XDMX_LIBS="$XEXT_LIB $FB_LIB $CONFIG_LIB $FIXES_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB"
+	XDMX_LIBS="$FB_LIB $MI_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB $XEXT_LIB $MAIN_LIB $DIX_LIB $CONFIG_LIB $OS_LIB $FIXES_LIB"
 	XDMX_SYS_LIBS="$DMXMODULES_LIBS"
 	AC_SUBST([XDMX_CFLAGS])
 	AC_SUBST([XDMX_LIBS])
@@ -1807,20 +1861,19 @@ dnl USB sources in DMX require <linux/input.h>
 dnl Linux sources in DMX require <linux/keyboard.h>
 	AC_CHECK_HEADER([linux/keyboard.h], DMX_BUILD_LNX="yes",
 			DMX_BUILD_LNX="no")
-	PKG_CHECK_MODULES([XDMXCONFIG_DEP], [xaw7 xmu xt xpm x11])
 	AC_SUBST(XDMXCONFIG_DEP_CFLAGS)
 	AC_SUBST(XDMXCONFIG_DEP_LIBS)
-	PKG_CHECK_MODULES([DMXEXAMPLES_DEP], [dmx xext x11])
+	PKG_CHECK_MODULES([DMXEXAMPLES_DEP], [$LIBDMX $LIBXEXT x11])
 	AC_SUBST(DMXEXAMPLES_DEP_LIBS)
-	PKG_CHECK_MODULES([DMXXMUEXAMPLES_DEP], [dmx xmu xext x11])
+	PKG_CHECK_MODULES([DMXXMUEXAMPLES_DEP], [$LIBDMX xmu $LIBXEXT x11])
 	AC_SUBST(DMXXMUEXAMPLES_DEP_LIBS)
-	PKG_CHECK_MODULES([DMXXIEXAMPLES_DEP], [dmx xi xext x11])
+	PKG_CHECK_MODULES([DMXXIEXAMPLES_DEP], [$LIBDMX $LIBXI $LIBXEXT x11])
 	AC_SUBST(DMXXIEXAMPLES_DEP_LIBS)
-	PKG_CHECK_MODULES([XTSTEXAMPLES_DEP], [xtst xext x11])
+	PKG_CHECK_MODULES([XTSTEXAMPLES_DEP], [$LIBXTST $LIBXEXT x11])
 	AC_SUBST(XTSTEXAMPLES_DEP_LIBS)
-	PKG_CHECK_MODULES([XRESEXAMPLES_DEP], [xres xext x11])
+	PKG_CHECK_MODULES([XRESEXAMPLES_DEP], [xres $LIBXEXT x11])
 	AC_SUBST(XRESEXAMPLES_DEP_LIBS)
-	PKG_CHECK_MODULES([X11EXAMPLES_DEP], [xext x11])
+	PKG_CHECK_MODULES([X11EXAMPLES_DEP], [$LIBXEXT x11])
 	AC_SUBST(X11EXAMPLES_DEP_LIBS)
 fi
 AM_CONDITIONAL([DMX_BUILD_LNX], [test "x$DMX_BUILD_LNX" = xyes])
@@ -1861,7 +1914,11 @@ if test "$KDRIVE" = yes; then
 
 
     PKG_CHECK_MODULES([TSLIB], [tslib-0.0], [HAVE_TSLIB="yes"], [HAVE_TSLIB="no"])
-    if test "x$HAVE_TSLIB" = xauto; then
+    if test "x$HAVE_TSLIB" = xno; then
+        AC_CHECK_LIB(ts, ts_open, [HAVE_TSLIB="yes"])
+    fi
+
+    if test "xTSLIB" = xauto; then
         TSLIB="$HAVE_TSLIB"
     fi
 
@@ -1885,12 +1942,12 @@ if test "$KDRIVE" = yes; then
        XSDL_INCS="`sdl-config --cflags` $XSERVER_CFLAGS"
     fi
 
-    XEPHYR_REQUIRED_LIBS="x11 xext xfont xau xdmcp"
+    XEPHYR_REQUIRED_LIBS="x11 $LIBXEXT xfont xau xdmcp"
     if test "x$XV" = xyes; then
         XEPHYR_REQUIRED_LIBS="$XEPHYR_REQUIRED_LIBS xv"
     fi
     if test "x$DRI" = xyes && test "x$GLX" = xyes; then
-        XEPHYR_REQUIRED_LIBS="$XEPHYR_REQUIRED_LIBS gl libdrm"
+        XEPHYR_REQUIRED_LIBS="$XEPHYR_REQUIRED_LIBS $LIBGL libdrm"
     fi
 
     PKG_CHECK_MODULES(XEPHYR, $XEPHYR_REQUIRED_LIBS, [xephyr="yes"], [xephyr="no"])
@@ -1960,9 +2017,9 @@ AC_TRY_COMPILE([
 
 AC_DEFINE_DIR(PROJECTROOT, prefix, [Overall prefix])
 
-BUILD_DATE="$(date +'%Y%m%d')"
+BUILD_DATE="`date +'%Y%m%d'`"
 AC_SUBST([BUILD_DATE])
-BUILD_TIME="$(date +'1%H%M%S')"
+BUILD_TIME="`date +'1%H%M%S'`"
 AC_SUBST([BUILD_TIME])
 
 DIX_CFLAGS="-DHAVE_DIX_CONFIG_H $XSERVER_CFLAGS"

dix/Makefile.am

@@ -54,17 +54,20 @@ Xserver-dtrace.h: $(srcdir)/Xserver.d
 	$(DTRACE) -C -h -o $@ -s $(srcdir)/Xserver.d \
 		|| cp Xserver-dtrace.h.in $@
 
+endif
+
+if SPECIAL_DTRACE_OBJECTS
 # Generate dtrace object code for probes in libdix
 dtrace-dix.o: $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS)
-	$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d .libs/*.o
+	$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 
 noinst_PROGRAMS = dix.O
 
 dix.O: dtrace-dix.o $(am_libdix_la_OBJECTS)
-	ld -r -o $@ .libs/*.o
+	ld -r -o $@ $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 endif
 
 dix.c:
 	touch $@
 
-CLEANFILES = dix.c
+CLEANFILES = dix.c Xserver-dtrace.h

dix/Xserver-dtrace.h.in

@@ -1,29 +1,23 @@
 /* Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
  *
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  */ 
 
 /*

dix/Xserver.d

@@ -1,36 +1,35 @@
 /* Copyright 2005-2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- * 
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  */
 
 /*
  * Xserver dtrace provider definition
  */
-
+#ifdef __APPLE__
+#define string char *
+#define pid_t uint32_t
+#define zoneid_t uint32_t
+#else
 #include <sys/types.h>
+#endif
 
 provider Xserver {
 	/* reqType, data, length, client id, request buffer */

dix/colormap.c

@@ -2690,3 +2690,70 @@ IsMapInstalled(Colormap map, WindowPtr pWin)
     xfree(pmaps);
     return (found);
 }
+
+struct colormap_lookup_data {
+    ScreenPtr pScreen;
+    VisualPtr visuals;
+};
+
+static void _colormap_find_resource(pointer value, XID id,
+				    pointer cdata)
+{
+    struct colormap_lookup_data *cmap_data = cdata;
+    VisualPtr visuals = cmap_data->visuals;
+    ScreenPtr pScreen = cmap_data->pScreen;
+    ColormapPtr cmap = value;
+    int j;
+
+    if (pScreen != cmap->pScreen)
+	return;
+
+    j = cmap->pVisual - pScreen->visuals;
+    cmap->pVisual = &visuals[j];
+}
+
+/* something has realloced the visuals, instead of breaking
+   ABI fix it up here - glx and compsite did this wrong */
+Bool
+ResizeVisualArray(ScreenPtr pScreen, int new_visual_count,
+		  DepthPtr depth)
+{
+    struct colormap_lookup_data cdata;
+    int numVisuals;
+    VisualPtr visuals;
+    XID *vids, vid;
+    int first_new_vid, first_new_visual, i;
+
+    first_new_vid = depth->numVids;
+    first_new_visual = pScreen->numVisuals;
+
+    vids = xrealloc(depth->vids, (depth->numVids + new_visual_count) * sizeof(XID));
+    if (!vids)
+        return FALSE;
+
+    /* its realloced now no going back if we fail the next one */
+    depth->vids = vids;
+
+    numVisuals = pScreen->numVisuals + new_visual_count;
+    visuals = xrealloc(pScreen->visuals, numVisuals * sizeof(VisualRec));
+    if (!visuals) {
+	return FALSE;
+    }
+
+    cdata.visuals = visuals;
+    cdata.pScreen = pScreen;
+    FindClientResourcesByType(serverClient, RT_COLORMAP, _colormap_find_resource, &cdata);
+
+    pScreen->visuals = visuals;
+
+    for (i = 0; i < new_visual_count; i++) {
+	vid = FakeClientID(0);
+	pScreen->visuals[first_new_visual + i].vid = vid;
+	vids[first_new_vid + i] = vid;
+    }
+
+    depth->numVids += new_visual_count;
+    pScreen->numVisuals += new_visual_count;
+
+    return TRUE;
+}

dix/cursor.c

@@ -86,6 +86,8 @@ FreeCursorBits(CursorBitsPtr bits)
 #ifdef ARGB_CURSOR
     xfree(bits->argb);
 #endif
+    dixFreePrivates(bits->devPrivates);
+    bits->devPrivates = NULL;
     if (bits->refcnt == 0)
     {
 	GlyphSharePtr *prev, this;
@@ -100,7 +102,6 @@ FreeCursorBits(CursorBitsPtr bits)
 	    CloseFont(this->font, (Font)0);
 	    xfree(this);
 	}
-	dixFreePrivates(bits->devPrivates);
 	xfree(bits);
     }
 }

dix/devices.c

@@ -539,7 +539,7 @@ CoreKeyboardProc(DeviceIntPtr pDev, int what)
 int
 CorePointerProc(DeviceIntPtr pDev, int what)
 {
-#define NBUTTONS 7
+#define NBUTTONS 10
 #define NAXES 2
     BYTE map[NBUTTONS + 1];
     int i = 0;
@@ -843,6 +843,9 @@ CloseDevice(DeviceIntPtr dev)
     if(dev->valuator && dev->valuator->accelScheme.AccelCleanupProc)
 	dev->valuator->accelScheme.AccelCleanupProc(dev);
 
+    while (dev->xkb_interest)
+	XkbRemoveResourceClient((DevicePtr)dev,dev->xkb_interest->resource);
+
     xfree(dev->name);
 
     classes = (ClassesPtr)&dev->key;
@@ -854,9 +857,6 @@ CloseDevice(DeviceIntPtr dev)
         FreeAllDeviceClasses(classes);
     }
 
-    while (dev->xkb_interest)
-	XkbRemoveResourceClient((DevicePtr)dev,dev->xkb_interest->resource);
-
     if (DevHasCursor(dev) && dev->spriteInfo->sprite) {
         xfree(dev->spriteInfo->sprite->spriteTrace);
         xfree(dev->spriteInfo->sprite);
@@ -877,6 +877,36 @@ CloseDevice(DeviceIntPtr dev)
     xfree(dev);
 }
 
+/**
+ * Shut down all devices of one list and free all resources.
+ */
+static
+void
+CloseDeviceList(DeviceIntPtr *listHead)
+{
+    /* Used to mark devices that we tried to free */
+    Bool freedIds[MAXDEVICES];
+    DeviceIntPtr dev;
+    int i;
+
+    if (listHead == NULL)
+        return;
+
+    for (i = 0; i < MAXDEVICES; i++)
+        freedIds[i] = FALSE;
+
+    dev = *listHead;
+    while (dev != NULL)
+    {
+        freedIds[dev->id] = TRUE;
+        DeleteInputDeviceRequest(dev);
+
+        dev = *listHead;
+        while (dev != NULL && freedIds[dev->id])
+            dev = dev->next;
+    }
+}
+
 /**
  * Shut down all devices, free all resources, etc.
  * Only useful if you're shutting down the server!
@@ -884,7 +914,7 @@ CloseDevice(DeviceIntPtr dev)
 void
 CloseDownDevices(void)
 {
-    DeviceIntPtr dev, next;
+    DeviceIntPtr dev;
 
     /* Float all SDs before closing them. Note that at this point resources
      * (e.g. cursors) have been freed already, so we can't just call
@@ -897,16 +927,11 @@ CloseDownDevices(void)
             dev->u.master = NULL;
     }
 
-    for (dev = inputInfo.devices; dev; dev = next)
-    {
-	next = dev->next;
-        DeleteInputDeviceRequest(dev);
-    }
-    for (dev = inputInfo.off_devices; dev; dev = next)
-    {
-	next = dev->next;
-        DeleteInputDeviceRequest(dev);
-    }
+    CloseDeviceList(&inputInfo.devices);
+    CloseDeviceList(&inputInfo.off_devices);
+
+    CloseDevice(inputInfo.pointer);
+    CloseDevice(inputInfo.keyboard);
 
     inputInfo.devices = NULL;
     inputInfo.off_devices = NULL;
@@ -1520,14 +1545,12 @@ int
 ProcGetModifierMapping(ClientPtr client)
 {
     xGetModifierMappingReply rep;
-    int ret, max_keys_per_mod = 0;
+    int max_keys_per_mod = 0;
     KeyCode *modkeymap = NULL;
     REQUEST_SIZE_MATCH(xReq);
 
-    ret = generate_modkeymap(client, PickKeyboard(client), &modkeymap,
-                             &max_keys_per_mod);
-    if (ret != Success)
-        return ret;
+    generate_modkeymap(client, PickKeyboard(client), &modkeymap,
+                       &max_keys_per_mod);
 
     memset(&rep, 0, sizeof(xGetModifierMappingReply));
     rep.type = X_Reply;
@@ -1933,7 +1956,7 @@ ProcChangeKeyboardControl (ClientPtr client)
     keyboard = PickKeyboard(client);
 
     for (pDev = inputInfo.devices; pDev; pDev = pDev->next) {
-        if ((pDev == keyboard || (!IsMaster(keyboard) && pDev->u.master == keyboard)) &&
+        if ((pDev == keyboard || (!IsMaster(pDev) && pDev->u.master == keyboard)) &&
             pDev->kbdfeed && pDev->kbdfeed->CtrlProc) {
             ret = XaceHook(XACE_DEVICE_ACCESS, client, pDev, DixManageAccess);
 	    if (ret != Success)
@@ -1942,7 +1965,7 @@ ProcChangeKeyboardControl (ClientPtr client)
     }
 
     for (pDev = inputInfo.devices; pDev; pDev = pDev->next) {
-        if ((pDev == keyboard || (!IsMaster(keyboard) && pDev->u.master == keyboard)) &&
+        if ((pDev == keyboard || (!IsMaster(pDev) && pDev->u.master == keyboard)) &&
             pDev->kbdfeed && pDev->kbdfeed->CtrlProc) {
             ret = DoChangeKeyboardControl(client, pDev, vlist, vmask);
             if (ret != Success)
@@ -1996,14 +2019,6 @@ ProcBell(ClientPtr client)
 	return BadValue;
     }
 
-    /* Seems like no keyboard actually has the BellProc set. Returning
-     * BadDevice (previous code) will make apps crash badly. The man pages
-     * doesn't say anything about a BadDevice being returned either.
-     * So just quietly do nothing and pretend everything has worked.
-     */
-    if (!keybd->kbdfeed->BellProc)
-        return Success;
-
     newpercent = (base * stuff->percent) / 100;
     if (stuff->percent < 0)
         newpercent = base + newpercent;
@@ -2221,12 +2236,15 @@ ProcQueryKeymap(ClientPtr client)
     rep.length = 2;
 
     rc = XaceHook(XACE_DEVICE_ACCESS, client, keybd, DixReadAccess);
-    if (rc != Success)
+    if (rc != Success && rc != BadAccess)
 	return rc;
 
     for (i = 0; i<32; i++)
 	rep.map[i] = down[i];
 
+    if (rc == BadAccess)
+	memset(rep.map, 0, 32);
+
     WriteReplyToClient(client, sizeof(xQueryKeymapReply), &rep);
 
    return Success;

dix/dispatch.c

@@ -78,29 +78,23 @@ Equipment Corporation.
  * Copyright 2005-2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- * 
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  */
 
 

dix/dixfonts.c

@@ -1046,7 +1046,7 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
 		    err = AllocError;
 		    break;
 		}
-		memset(reply + c->length, 0, length - c->length);
+		memset((char*)reply + c->length, 0, length - c->length);
 		c->reply = reply;
 		c->length = length;
 	    }

dix/eventconvert.c

@@ -119,6 +119,7 @@ EventToCore(InternalEvent *event, xEvent *core)
                 core->u.keyButtonPointer.rootX = e->root_x;
                 core->u.keyButtonPointer.rootY = e->root_y;
                 core->u.keyButtonPointer.state = e->corestate;
+                core->u.keyButtonPointer.root = e->root;
                 EventSetKeyRepeatFlag(core, (e->type == ET_KeyPress && e->key_repeat));
             }
             break;
@@ -352,17 +353,17 @@ getValuatorEvents(DeviceEvent *ev, deviceValuator *xv)
         xv->device_state = state;
         switch (xv->num_valuators) {
         case 6:
-            xv->valuator5 = ev->valuators.data[i + 5];
+            xv->valuator5 = ev->valuators.data[xv->first_valuator + 5];
         case 5:
-            xv->valuator4 = ev->valuators.data[i + 4];
+            xv->valuator4 = ev->valuators.data[xv->first_valuator + 4];
         case 4:
-            xv->valuator3 = ev->valuators.data[i + 3];
+            xv->valuator3 = ev->valuators.data[xv->first_valuator + 3];
         case 3:
-            xv->valuator2 = ev->valuators.data[i + 2];
+            xv->valuator2 = ev->valuators.data[xv->first_valuator + 2];
         case 2:
-            xv->valuator1 = ev->valuators.data[i + 1];
+            xv->valuator1 = ev->valuators.data[xv->first_valuator + 1];
         case 1:
-            xv->valuator0 = ev->valuators.data[i + 0];
+            xv->valuator0 = ev->valuators.data[xv->first_valuator + 0];
         }
 
         if (i + 6 < num_valuators)

dix/events.c

@@ -74,38 +74,28 @@ Equipment Corporation.
 
 ******************************************************************/
 
-/*****************************************************************
-
-Copyright 2003-2005 Sun Microsystems, Inc.
-
-All rights reserved.
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, and/or sell copies of the Software, and to permit persons
-to whom the Software is furnished to do so, provided that the above
-copyright notice(s) and this permission notice appear in all copies of
-the Software and that both the above copyright notice(s) and this
-permission notice appear in supporting documentation.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
-HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
-INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
-FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
-NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
-WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-Except as contained in this notice, the name of a copyright holder
-shall not be used in advertising or otherwise to promote the sale, use
-or other dealings in this Software without prior written authorization
-of the copyright holder.
-
-******************************************************************/
+/*
+ * Copyright © 2003-2005 Sun Microsystems, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
 
 /** @file events.c
  * This file handles event delivery and a big part of the server-side protocol
@@ -263,33 +253,7 @@ extern BOOL EventIsKeyRepeat(xEvent *event);
  */
 InputInfo inputInfo;
 
-/**
- * syncEvents is the global structure for queued events.
- *
- * Devices can be frozen through GrabModeSync pointer grabs. If this is the
- * case, events from these devices are added to "pending" instead of being
- * processed normally. When the device is unfrozen, events in "pending" are
- * replayed and processed as if they would come from the device directly.
- */
-static struct {
-    QdEventPtr		pending, /**<  list of queued events */
-                        *pendtail; /**< last event in list */
-    /** The device to replay events for. Only set in AllowEvents(), in which
-     * case it is set to the device specified in the request. */
-    DeviceIntPtr	replayDev;	/* kludgy rock to put flag for */
-
-    /**
-     * The window the events are supposed to be replayed on.
-     * This window may be set to the grab's window (but only when
-     * Replay{Pointer|Keyboard} is given in the XAllowEvents()
-     * request. */
-    WindowPtr		replayWin;	/*   ComputeFreezes            */
-    /**
-     * Flag to indicate whether we're in the process of
-     * replaying events. Only set in ComputeFreezes(). */
-    Bool		playingEvents;
-    TimeStamp		time;
-} syncEvents;
+EventSyncInfoRec syncEvents;
 
 /**
  * The root window the given device is currently on.
@@ -345,7 +309,9 @@ DevHasCursor(DeviceIntPtr pDev)
 Bool
 IsPointerDevice(DeviceIntPtr dev)
 {
-    return (dev->type == MASTER_POINTER) || (dev->valuator && dev->button);
+    return (dev->type == MASTER_POINTER) ||
+            (dev->valuator && dev->button) ||
+            (dev->valuator && !dev->key);
 }
 
 /*
@@ -772,7 +738,11 @@ CheckPhysLimits(
 	    new.y = pSprite->physLimits.y2 - 1;
     if (pSprite->hotShape)
 	ConfineToShape(pDev, pSprite->hotShape, &new.x, &new.y);
-    if ((pScreen != pSprite->hotPhys.pScreen) ||
+    if ((
+#ifdef PANORAMIX
+            noPanoramiXExtension &&
+#endif
+            (pScreen != pSprite->hotPhys.pScreen)) ||
 	(new.x != pSprite->hotPhys.x) || (new.y != pSprite->hotPhys.y))
     {
 #ifdef PANORAMIX
@@ -1139,11 +1109,10 @@ EnqueueEvent(InternalEvent *ev, DeviceIntPtr device)
         event->type == ET_KeyRelease)
 	AccessXCancelRepeatKey(device->key->xkbInfo, event->detail.key);
 
-#if 0
-        /* FIXME: I'm broken now. Please fix me. */
     if (DeviceEventCallback)
     {
 	DeviceEventInfoRec eventinfo;
+
 	/*  The RECORD spec says that the root window field of motion events
 	 *  must be valid.  At this point, it hasn't been filled in yet, so
 	 *  we do it here.  The long expression below is necessary to get
@@ -1153,14 +1122,14 @@ EnqueueEvent(InternalEvent *ev, DeviceIntPtr device)
 	 *  the data that GetCurrentRootWindow relies on hasn't been
 	 *  updated yet.
 	 */
-	if (xE->u.u.type == DeviceMotionNotify)
-	    XE_KBPTR.root =
-		WindowTable[pSprite->hotPhys.pScreen->myNum]->drawable.id;
-	eventinfo.events = xE;
-	eventinfo.count = nevents;
+	if (ev->any.type == ET_Motion)
+	    ev->device_event.root = WindowTable[pSprite->hotPhys.pScreen->myNum]->drawable.id;
+
+	eventinfo.event = ev;
+	eventinfo.device = device;
 	CallCallbacks(&DeviceEventCallback, (pointer)&eventinfo);
     }
-#endif
+
     if (event->type == ET_Motion)
     {
 #ifdef PANORAMIX
@@ -1423,11 +1392,6 @@ CheckGrabForSyncs(DeviceIntPtr thisDev, Bool thisMode, Bool otherMode)
 	    thisDev->deviceGrab.sync.other = NullGrab;
     }
 
-    /*
-        XXX: Direct slave grab won't freeze the paired master device.
-        The correct thing to do would be to freeze all SDs attached to the
-        paired master device.
-     */
     if (IsMaster(thisDev))
     {
         dev = GetPairedDevice(thisDev);
@@ -1671,7 +1635,7 @@ AllowSome(ClientPtr client,
     thisGrabbed = grabinfo->grab && SameClient(grabinfo->grab, client);
     thisSynced = FALSE;
     otherGrabbed = FALSE;
-    othersFrozen = TRUE;
+    othersFrozen = FALSE;
     grabTime = grabinfo->grabTime;
     for (dev = inputInfo.devices; dev; dev = dev->next)
     {
@@ -1687,11 +1651,9 @@ AllowSome(ClientPtr client,
 	    otherGrabbed = TRUE;
 	    if (grabinfo->sync.other == devgrabinfo->grab)
 		thisSynced = TRUE;
-	    if (devgrabinfo->sync.state < FROZEN)
-		othersFrozen = FALSE;
+	    if (devgrabinfo->sync.state >= FROZEN)
+		othersFrozen = TRUE;
 	}
-	else if (!devgrabinfo->sync.other || !SameClient(devgrabinfo->sync.other, client))
-	    othersFrozen = FALSE;
     }
     if (!((thisGrabbed && grabinfo->sync.state >= FROZEN) || thisSynced))
 	return;
@@ -2496,15 +2458,15 @@ DeliverDeviceEvents(WindowPtr pWin, InternalEvent *event, GrabPtr grab,
             if (mask & XI_MASK)
             {
                 rc = EventToXI(event, &xE, &count);
-                if (rc == Success &&
-                    XaceHook(XACE_SEND_ACCESS, NULL, dev, pWin, xE, count) == Success)
-                {
-                    filter = GetEventFilter(dev, xE);
-                    FixUpEventFromWindow(dev, xE, pWin, child, FALSE);
-                    deliveries = DeliverEventsToWindow(dev, pWin, xE, count,
-                                                       filter, grab);
-                    if (deliveries > 0)
-                        goto unwind;
+                if (rc == Success) {
+                    if (XaceHook(XACE_SEND_ACCESS, NULL, dev, pWin, xE, count) == Success) {
+                        filter = GetEventFilter(dev, xE);
+                        FixUpEventFromWindow(dev, xE, pWin, child, FALSE);
+                        deliveries = DeliverEventsToWindow(dev, pWin, xE, count,
+                                                           filter, grab);
+                        if (deliveries > 0)
+                            goto unwind;
+                    }
                 } else if (rc != BadMatch)
                     ErrorF("[dix] %s: XI conversion failed in DDE (%d, %d). Skipping delivery.\n",
                             dev->name, event->any.type, rc);
@@ -2514,15 +2476,15 @@ DeliverDeviceEvents(WindowPtr pWin, InternalEvent *event, GrabPtr grab,
             if ((mask & CORE_MASK) && IsMaster(dev) && dev->coreEvents)
             {
                 rc = EventToCore(event, &core);
-                if (rc == Success &&
-                    XaceHook(XACE_SEND_ACCESS, NULL, dev, pWin, &core, 1) == Success)
-                {
-                    filter = GetEventFilter(dev, &core);
-                    FixUpEventFromWindow(dev, &core, pWin, child, FALSE);
-                    deliveries = DeliverEventsToWindow(dev, pWin, &core, 1,
-                            filter, grab);
-                    if (deliveries > 0)
-                        goto unwind;
+                if (rc == Success) {
+                    if (XaceHook(XACE_SEND_ACCESS, NULL, dev, pWin, &core, 1) == Success) {
+                        filter = GetEventFilter(dev, &core);
+                        FixUpEventFromWindow(dev, &core, pWin, child, FALSE);
+                        deliveries = DeliverEventsToWindow(dev, pWin, &core, 1,
+                                                           filter, grab);
+                        if (deliveries > 0)
+                            goto unwind;
+                    }
                 } else if (rc != BadMatch)
                         ErrorF("[dix] %s: Core conversion failed in DDE (%d, %d).\n",
                                 dev->name, event->any.type, rc);
@@ -3478,7 +3440,6 @@ CheckPassiveGrabsOnWindow(
     {
 	DeviceIntPtr	gdev;
 	XkbSrvInfoPtr	xkbi = NULL;
-	Mask		mask = 0;
 
 	gdev= grab->modifierDevice;
         if (grab->grabtype == GRABTYPE_CORE)
@@ -3593,7 +3554,6 @@ CheckPassiveGrabsOnWindow(
                 }
                 xE = &core;
                 count = 1;
-                mask = grab->eventMask;
             } else if (match & XI2_MATCH)
             {
                 rc = EventToXI2((InternalEvent*)event, &xE);
@@ -3605,16 +3565,6 @@ CheckPassiveGrabsOnWindow(
                     continue;
                 }
                 count = 1;
-
-                /* FIXME: EventToXI2 returns NULL for enter events, so
-                 * dereferencing the event is bad. Internal event types are
-                 * aligned with core events, so the else clause is valid.
-                 * long-term we should use internal events for enter/focus
-                 * as well */
-                if (xE)
-                    mask = grab->xi2mask[device->id][((xGenericEvent*)xE)->evtype/8];
-                else if (event->type == XI_Enter || event->type == XI_FocusIn)
-                    mask = grab->xi2mask[device->id][event->type/8];
             } else
             {
                 rc = EventToXI((InternalEvent*)event, &xE, &count);
@@ -3625,7 +3575,6 @@ CheckPassiveGrabsOnWindow(
                                 "(%d, %d).\n", device->name, event->type, rc);
                     continue;
                 }
-                mask = grab->eventMask;
             }
 
 	    (*grabinfo->ActivateGrab)(device, grab, currentTime, TRUE);
@@ -3634,7 +3583,8 @@ CheckPassiveGrabsOnWindow(
             {
                 FixUpEventFromWindow(device, xE, grab->window, None, TRUE);
 
-                TryClientEvents(rClient(grab), device, xE, count, mask,
+                TryClientEvents(rClient(grab), device, xE, count,
+                                       GetEventFilter(device, xE),
                                        GetEventFilter(device, xE), grab);
             }
 
@@ -3802,13 +3752,13 @@ DeliverFocusedEvent(DeviceIntPtr keybd, InternalEvent *event, WindowPtr window)
     if (sendCore)
     {
         rc = EventToCore(event, &core);
-        if (rc == Success &&
-            XaceHook(XACE_SEND_ACCESS, NULL, keybd, focus, &core, 1) == Success)
-        {
-            FixUpEventFromWindow(keybd, &core, focus, None, FALSE);
-            deliveries = DeliverEventsToWindow(keybd, focus, &core, 1,
-                                               GetEventFilter(keybd, &core),
-                                               NullGrab);
+        if (rc == Success) {
+            if (XaceHook(XACE_SEND_ACCESS, NULL, keybd, focus, &core, 1) == Success) {
+                FixUpEventFromWindow(keybd, &core, focus, None, FALSE);
+                deliveries = DeliverEventsToWindow(keybd, focus, &core, 1,
+                                                   GetEventFilter(keybd, &core),
+                                                   NullGrab);
+            }
         } else if (rc != BadMatch)
             ErrorF("[dix] %s: core conversion failed DFE (%d, %d). Skipping delivery.\n",
                     keybd->name, event->any.type, rc);
@@ -3982,7 +3932,7 @@ DeliverGrabbedEvent(InternalEvent *event, DeviceIntPtr thisDev,
 		FreezeThaw(dev, TRUE);
 		if ((dev->deviceGrab.sync.state == FREEZE_BOTH_NEXT_EVENT) &&
 		    (CLIENT_BITS(grab->resource) ==
-		     CLIENT_BITS(dev->deviceGrab.sync.other->resource)))
+		     CLIENT_BITS(dev->deviceGrab.grab->resource)))
 		    dev->deviceGrab.sync.state = FROZEN_NO_EVENT;
 		else
                     dev->deviceGrab.sync.other = grab;
@@ -4414,10 +4364,12 @@ DeviceEnterLeaveEvent(
                         filter, grab);
     } else {
         if (!GetWindowXI2Mask(mouse, pWin, (xEvent*)event))
-            return;
+            goto out;
         DeliverEventsToWindow(mouse, pWin, (xEvent*)event, 1, filter,
                               NullGrab);
     }
+
+out:
     xfree(event);
 }
 
@@ -4970,7 +4922,7 @@ ProcQueryPointer(ClientPtr client)
     if (rc != Success)
 	return rc;
     rc = XaceHook(XACE_DEVICE_ACCESS, client, mouse, DixReadAccess);
-    if (rc != Success)
+    if (rc != Success && rc != BadAccess)
 	return rc;
 
     keyboard = GetPairedDevice(mouse);
@@ -5018,6 +4970,15 @@ ProcQueryPointer(ClientPtr client)
     }
 #endif
 
+    if (rc == BadAccess) {
+	rep.mask = 0;
+	rep.child = None;
+	rep.rootX = 0;
+	rep.rootY = 0;
+	rep.winX = 0;
+	rep.winY = 0;
+    }
+
     WriteReplyToClient(client, sizeof(xQueryPointerReply), &rep);
 
     return(Success);
@@ -5075,12 +5036,9 @@ InitEvents(void)
 void
 CloseDownEvents(void)
 {
-    int len;
-    EventListPtr list;
-
-    len = GetEventList(&list);
-    while(len--)
-        xfree(list[len].event);
+    FreeEventList(InputEventList, InputEventListLen);
+    InputEventListLen = 0;
+    InputEventList = NULL;
 }
 
 /**

dix/extension.c

@@ -83,8 +83,11 @@ AddExtension(char *name, int NumEvents, int NumErrors,
     if (!MainProc || !SwappedMainProc || !MinorOpcodeProc)
         return((ExtensionEntry *) NULL);
     if ((lastEvent + NumEvents > LAST_EVENT) || 
-	        (unsigned)(lastError + NumErrors > LAST_ERROR))
+	        (unsigned)(lastError + NumErrors > LAST_ERROR)) {
+        LogMessage(X_ERROR, "Not enabling extension %s: maximum number of "
+                   "events or errors exceeded.\n", name);
         return((ExtensionEntry *) NULL);
+    }
 
     ext = xalloc(sizeof(ExtensionEntry));
     if (!ext)

dix/getevents.c

@@ -177,7 +177,7 @@ set_valuators(DeviceIntPtr dev, DeviceEvent* event, int first_valuator,
     }
 
     memcpy(&event->valuators.data[first_valuator],
-           valuators, num_valuators * sizeof(uint32_t));
+           valuators, num_valuators * sizeof(int32_t));
 
 }
 
@@ -296,7 +296,7 @@ updateSlaveDeviceCoords(DeviceIntPtr master, DeviceIntPtr pDev)
                         &pDev->last.remainder[0], NULL, pDev->valuator->axes + 0, scr->width);
     if(pDev->valuator->numAxes > 1)
         pDev->last.valuators[1] = rescaleValuatorAxis(pDev->last.valuators[1], pDev->last.remainder[1],
-                        &pDev->last.remainder[0], NULL, pDev->valuator->axes + 1, scr->height);
+                        &pDev->last.remainder[1], NULL, pDev->valuator->axes + 1, scr->height);
 
     /* calculate the other axis as well based on info from the old
      * slave-device. If the old slave had less axes than this one,
@@ -578,12 +578,13 @@ GetMaximumEventsNum(void) {
 static void
 clipAxis(DeviceIntPtr pDev, int axisNum, int *val)
 {
-    AxisInfoPtr axis = pDev->valuator->axes + axisNum;
-    /* InitValuatoraAxisStruct ensures that (min < max). */
+    AxisInfoPtr axis;
 
     if (axisNum >= pDev->valuator->numAxes)
         return;
 
+    axis = pDev->valuator->axes + axisNum;
+
     /* If a value range is defined, clip. If not, do nothing */
     if (axis->max_value <= axis->min_value)
         return;
@@ -629,9 +630,12 @@ updateFromMaster(EventListPtr events, DeviceIntPtr dev, int type, int *num_event
     if (master && master->last.slave != dev)
     {
         CreateClassesChangedEvent(events, master, dev, type);
-        updateSlaveDeviceCoords(master, dev);
+        if (IsPointerDevice(master))
+        {
+            updateSlaveDeviceCoords(master, dev);
+            master->last.numValuators = dev->last.numValuators;
+        }
         master->last.slave = dev;
-        master->last.numValuators = dev->last.numValuators;
         (*num_events)++;
         events++;
     }
@@ -780,6 +784,19 @@ positionSprite(DeviceIntPtr dev, int *x, int *y, float x_frac, float y_frac,
         *screeny_frac = dev->last.remainder[1];
     }
 
+    /* Hit the left screen edge? */
+    if (*screenx <= 0 && *screenx_frac < 0.0f)
+    {
+        *screenx_frac = 0.0f;
+        x_frac = 0.0f;
+    }
+    if (*screeny <= 0 && *screeny_frac < 0.0f)
+    {
+        *screeny_frac = 0.0f;
+        y_frac = 0.0f;
+    }
+
+
     old_screenx = *screenx;
     old_screeny = *screeny;
     /* This takes care of crossing screens for us, as well as clipping

dix/main.c

@@ -159,9 +159,7 @@ int main(int argc, char *argv[], char *envp[])
 	ScreenSaverBlanking = defaultScreenSaverBlanking;
 	ScreenSaverAllowExposures = defaultScreenSaverAllowExposures;
 #ifdef DPMSExtension
-	DPMSStandbyTime = DEFAULT_SCREEN_SAVER_TIME;
-	DPMSSuspendTime = DEFAULT_SCREEN_SAVER_TIME;
-	DPMSOffTime = DEFAULT_SCREEN_SAVER_TIME;
+	DPMSStandbyTime = DPMSSuspendTime = DPMSOffTime = ScreenSaverTime;
 	DPMSEnabled = TRUE;
 	DPMSPowerLevel = 0;
 #endif

dix/resource.c

@@ -76,29 +76,23 @@ Equipment Corporation.
  * Copyright 2005-2006 Sun Microsystems, Inc.  All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, and/or sell copies of the Software, and to permit persons
- * to whom the Software is furnished to do so, provided that the above
- * copyright notice(s) and this permission notice appear in all copies of
- * the Software and that both the above copyright notice(s) and this
- * permission notice appear in supporting documentation.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
- * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- * 
- * Except as contained in this notice, the name of a copyright holder
- * shall not be used in advertising or otherwise to promote the sale, use
- * or other dealings in this Software without prior written authorization
- * of the copyright holder.
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  */
 
 /*	Routines to manage various kinds of resources:

dix/window.c

@@ -3233,8 +3233,13 @@ dixSaveScreens(ClientPtr client, int on, int mode)
 	}
     }
     screenIsSaved = what;
-    if (mode == ScreenSaverReset)
-       SetScreenSaverTimer();
+    if (mode == ScreenSaverReset) {
+	if (on == SCREEN_SAVER_FORCER) {
+	    UpdateCurrentTimeIf();
+	    lastDeviceEventTime = currentTime;
+	}
+	SetScreenSaverTimer();
+    }
     return Success;
 }
 

doc/Xserver.man.pre

@@ -100,12 +100,12 @@ specifies a file which contains a collection of authorization records used
 to authenticate access.  See also the \fIxdm\fP(1) and 
 \fIXsecurity\fP(__miscmansuffix__) manual pages.
 .TP 8
-.B \-bs
-disables backing store support on all screens.
-.TP 8
 .B \-br
 sets the default root window to solid black instead of the standard root weave
-pattern.
+pattern.   This is the default unless -retro or -wr is specified.
+.TP 8
+.B \-bs
+disables backing store support on all screens.
 .TP 8
 .B \-c
 turns off key-click.
@@ -117,17 +117,6 @@ sets key-click volume (allowable range: 0-100).
 sets the visual class for the root window of color screens.
 The class numbers are as specified in the X protocol.
 Not obeyed by all servers.
-.ig
-.TP 8
-.B \-config \fIfilename\fP
-reads more options from the given file.  Options in the file may be separated
-by newlines if desired.  If a '#' character appears on a line, all characters
-between it and the next newline are ignored, providing a simple commenting
-facility.  The \fB\-config\fP option itself may appear in the file.
-.BR NOTE :
-This option is disabled when the Xserver is run with an effective uid
-different from the user's real uid.
-..
 .TP 8
 .B \-core
 causes the server to generate a core dump on fatal errors.
@@ -184,6 +173,9 @@ sets the maximum big request to
 .I size
 MB.
 .TP 8
+.B \-nocursor
+disable the display of the pointer cursor.
+.TP 8
 .B \-nolisten \fItrans-type\fP
 disables a transport type.  For example, TCP/IP connections can be disabled
 with
@@ -584,11 +576,11 @@ Security: \fIXsecurity\fP(__miscmansuffix__), \fIxauth\fP(1), \fIXau\fP(1),
 Starting the server: \fIstartx\fP(1), \fIxdm\fP(1), \fIxinit\fP(1)
 .PP
 Controlling the server once started: \fIxset\fP(1), \fIxsetroot\fP(1),
-\fIxhost\fP(1)
+\fIxhost\fP(1), \fIxinput\fP(1), \fIxrandr\fP(1)
 .PP
 Server-specific man pages:
 \fIXorg\fP(1), \fIXdmx\fP(1), \fIXephyr\fP(1), \fIXnest\fP(1),
-\fIXvfb\fP(1), \fIXDarwin\fP(1), \fIXWin\fP(1).
+\fIXvfb\fP(1), \fIXquartz\fP(1), \fIXWin\fP(1).
 .PP
 Server internal documentation:
 .I "Definition of the Porting Layer for the X v11 Sample Server"

exa/exa.c

@@ -286,11 +286,10 @@ exaGetOffscreenPixmap (DrawablePtr pDrawable, int *xp, int *yp)
  * Returns TRUE if pixmap can be accessed offscreen.
  */
 Bool
-ExaDoPrepareAccess(DrawablePtr pDrawable, int index)
+ExaDoPrepareAccess(PixmapPtr pPixmap, int index)
 {
-    ScreenPtr pScreen = pDrawable->pScreen;
+    ScreenPtr pScreen = pPixmap->drawable.pScreen;
     ExaScreenPriv (pScreen);
-    PixmapPtr pPixmap = exaGetDrawablePixmap (pDrawable);
     ExaPixmapPriv(pPixmap);
     Bool offscreen;
     int i;
@@ -324,7 +323,7 @@ ExaDoPrepareAccess(DrawablePtr pDrawable, int index)
 
     offscreen = exaPixmapIsOffscreen(pPixmap);
 
-    if (offscreen)
+    if (offscreen && pExaPixmap->fb_ptr)
 	pPixmap->devPrivate.ptr = pExaPixmap->fb_ptr;
     else
 	pPixmap->devPrivate.ptr = pExaPixmap->sys_ptr;
@@ -333,20 +332,10 @@ ExaDoPrepareAccess(DrawablePtr pDrawable, int index)
     pExaScr->access[index].pixmap = pPixmap;
     pExaScr->access[index].count = 1;
 
-    if (!offscreen) {
-	/* Do we need to allocate our system buffer? */
-	if ((pExaScr->info->flags & EXA_HANDLES_PIXMAPS) && (pExaScr->info->flags & EXA_MIXED_PIXMAPS)) {
-	    if (!pExaPixmap->sys_ptr && !exaPixmapIsPinned(pPixmap)) {
-		pExaPixmap->sys_ptr = malloc(pExaPixmap->sys_pitch * pDrawable->height);
-		if (!pExaPixmap->sys_ptr)
-		    FatalError("EXA: malloc failed for size %d bytes\n", pExaPixmap->sys_pitch * pDrawable->height);
-		pPixmap->devPrivate.ptr = pExaPixmap->sys_ptr;
-	    }
-	}
+    if (!offscreen)
 	return FALSE;
-    }
 
-    exaWaitSync (pDrawable->pScreen);
+    exaWaitSync (pScreen);
 
     if (pExaScr->info->PrepareAccess == NULL)
 	return TRUE;
@@ -360,7 +349,8 @@ ExaDoPrepareAccess(DrawablePtr pDrawable, int index)
     }
 
     if (!(*pExaScr->info->PrepareAccess) (pPixmap, index)) {
-	if (pExaPixmap->score == EXA_PIXMAP_SCORE_PINNED)
+	if (pExaPixmap->score == EXA_PIXMAP_SCORE_PINNED &&
+	    !(pExaScr->info->flags & EXA_MIXED_PIXMAPS))
 	    FatalError("Driver failed PrepareAccess on a pinned pixmap.\n");
 	exaMoveOutPixmap (pPixmap);
 
@@ -370,31 +360,6 @@ ExaDoPrepareAccess(DrawablePtr pDrawable, int index)
     return TRUE;
 }
 
-void
-exaPrepareAccessReg(DrawablePtr pDrawable, int index, RegionPtr pReg)
-{
-    PixmapPtr pPixmap = exaGetDrawablePixmap (pDrawable);
-    ExaScreenPriv(pPixmap->drawable.pScreen);
-
-    if (pExaScr->do_migration) {
-	ExaMigrationRec pixmaps[1];
-
-	if (index == EXA_PREPARE_DEST || index == EXA_PREPARE_AUX_DEST) {
-	    pixmaps[0].as_dst = TRUE;
-	    pixmaps[0].as_src = FALSE;
-	} else {
-	    pixmaps[0].as_dst = FALSE;
-	    pixmaps[0].as_src = TRUE;
-	}
-	pixmaps[0].pPix = pPixmap;
-	pixmaps[0].pReg = pReg;
-
-	exaDoMigration(pixmaps, 1, FALSE);
-    }
-
-    ExaDoPrepareAccess(pDrawable, index);
-}
-
 /**
  * exaPrepareAccess() is EXA's wrapper for the driver's PrepareAccess() handler.
  *
@@ -404,7 +369,13 @@ exaPrepareAccessReg(DrawablePtr pDrawable, int index, RegionPtr pReg)
 void
 exaPrepareAccess(DrawablePtr pDrawable, int index)
 {
-    exaPrepareAccessReg(pDrawable, index, NULL);
+    PixmapPtr pPixmap = exaGetDrawablePixmap(pDrawable);
+    ExaScreenPriv(pDrawable->pScreen);
+
+    if (pExaScr->prepare_access_reg)
+	pExaScr->prepare_access_reg(pPixmap, index, NULL);
+    else
+	(void)ExaDoPrepareAccess(pPixmap, index);
 }
 
 /**
@@ -432,7 +403,6 @@ exaFinishAccess(DrawablePtr pDrawable, int index)
 	if (pExaScr->access[i].pixmap == pPixmap) {
 	    if (--pExaScr->access[i].count > 0)
 		return;
-	    index = i;
 	    break;
 	}
     }
@@ -442,25 +412,25 @@ exaFinishAccess(DrawablePtr pDrawable, int index)
 	EXA_FatalErrorDebug(("EXA bug: FinishAccess called without PrepareAccess for pixmap 0x%p.\n",
 			     pPixmap));
 
-    pExaScr->access[index].pixmap = NULL;
+    pExaScr->access[i].pixmap = NULL;
 
     /* We always hide the devPrivate.ptr. */
     pPixmap->devPrivate.ptr = NULL;
 
-    if (pExaScr->info->FinishAccess == NULL)
+    if (pExaScr->finish_access)
+	pExaScr->finish_access(pPixmap, index);
+
+    if (!pExaScr->info->FinishAccess || !exaPixmapIsOffscreen(pPixmap))
 	return;
 
-    if (!exaPixmapIsOffscreen (pPixmap))
-	return;
-
-    if (index >= EXA_PREPARE_AUX_DEST &&
+    if (i >= EXA_PREPARE_AUX_DEST &&
 	!(pExaScr->info->flags & EXA_SUPPORTS_PREPARE_AUX)) {
 	ErrorF("EXA bug: Trying to call driver FinishAccess hook with "
 	       "unsupported index EXA_PREPARE_AUX*\n");
 	return;
     }
 
-    (*pExaScr->info->FinishAccess) (pPixmap, index);
+    (*pExaScr->info->FinishAccess) (pPixmap, i);
 }
 
 /**
@@ -510,57 +480,6 @@ const GCFuncs exaGCFuncs = {
     exaCopyClip
 };
 
-/*
- * This wrapper exists to allow fbValidateGC to work.
- * Note that we no longer assume newly created pixmaps to be in normal ram.
- * This assumption is certainly not garuanteed with driver allocated pixmaps.
- */
-static PixmapPtr
-exaCreatePixmapWithPrepare(ScreenPtr pScreen, int w, int h, int depth,
-		unsigned usage_hint)
-{
-    PixmapPtr pPixmap;
-    ExaScreenPriv(pScreen);
-
-    /* This swaps between this function and the real upper layer function.
-     * Normally this would swap to the fb layer pointer, this is a very special case.
-     */
-    swap(pExaScr, pScreen, CreatePixmap);
-    pPixmap = pScreen->CreatePixmap(pScreen, w, h, depth, usage_hint);
-    swap(pExaScr, pScreen, CreatePixmap);
-
-    if (!pPixmap)
-	return NULL;
-
-    /* Note the usage of ExaDoPrepareAccess, this allowed because:
-     * The pixmap is new, so not offscreen in the classic exa case.
-     * For EXA_HANDLES_PIXMAPS the driver will handle whatever is needed.
-     * We want to signal that the pixmaps will be used as destination.
-     */
-    ExaDoPrepareAccess(&pPixmap->drawable, EXA_PREPARE_AUX_DEST);
-
-    return pPixmap;
-}
-
-static Bool
-exaDestroyPixmapWithFinish(PixmapPtr pPixmap)
-{
-    ScreenPtr pScreen = pPixmap->drawable.pScreen;
-    ExaScreenPriv(pScreen);
-    Bool ret;
-
-    exaFinishAccess(&pPixmap->drawable, EXA_PREPARE_AUX_DEST);
-
-    /* This swaps between this function and the real upper layer function.
-     * Normally this would swap to the fb layer pointer, this is a very special case.
-     */
-    swap(pExaScr, pScreen, DestroyPixmap);
-    ret = pScreen->DestroyPixmap(pPixmap);
-    swap(pExaScr, pScreen, DestroyPixmap);
-
-    return ret;
-}
-
 static void
 exaValidateGC(GCPtr pGC,
 		unsigned long changes,
@@ -572,20 +491,9 @@ exaValidateGC(GCPtr pGC,
 
     ScreenPtr pScreen = pDrawable->pScreen;
     ExaScreenPriv(pScreen);
-    CreatePixmapProcPtr old_ptr = NULL;
-    DestroyPixmapProcPtr old_ptr2 = NULL;
+    ExaGCPriv(pGC);
     PixmapPtr pTile = NULL;
-    EXA_GC_PROLOGUE(pGC);
-
-    /* save the "fb" pointer. */
-    old_ptr = pExaScr->SavedCreatePixmap;
-    /* create a new upper layer pointer. */
-    wrap(pExaScr, pScreen, CreatePixmap, exaCreatePixmapWithPrepare);
-
-    /* save the "fb" pointer. */
-    old_ptr2 = pExaScr->SavedDestroyPixmap;
-    /* create a new upper layer pointer. */
-    wrap(pExaScr, pScreen, DestroyPixmap, exaDestroyPixmapWithFinish);
+    Bool finish_current_tile = FALSE;
 
     /* Either of these conditions is enough to trigger access to a tile pixmap. */
     /* With pGC->tileIsPixel == 1, you run the risk of dereferencing an invalid tile pixmap pointer. */
@@ -599,8 +507,10 @@ exaValidateGC(GCPtr pGC,
 	 */
 	if (pTile && pTile->drawable.depth != pDrawable->depth && !(changes & GCTile)) {
 	    PixmapPtr pRotatedTile = fbGetRotatedPixmap(pGC);
-	    if (pRotatedTile->drawable.depth == pDrawable->depth)
+	    if (pRotatedTile && pRotatedTile->drawable.depth == pDrawable->depth)
 		pTile = pRotatedTile;
+	    else
+		finish_current_tile = TRUE; /* CreatePixmap will be called. */
 	}
     }
 
@@ -609,42 +519,39 @@ exaValidateGC(GCPtr pGC,
     if (pTile)
 	exaPrepareAccess(&pTile->drawable, EXA_PREPARE_SRC);
 
+    /* Calls to Create/DestroyPixmap have to be identified as special. */
+    pExaScr->fallback_counter++;
+    swap(pExaGC, pGC, funcs);
     (*pGC->funcs->ValidateGC)(pGC, changes, pDrawable);
+    swap(pExaGC, pGC, funcs);
+    pExaScr->fallback_counter--;
 
     if (pTile)
 	exaFinishAccess(&pTile->drawable, EXA_PREPARE_SRC);
+    if (finish_current_tile && pGC->tile.pixmap)
+	exaFinishAccess(&pGC->tile.pixmap->drawable, EXA_PREPARE_AUX_DEST);
     if (pGC->stipple)
-        exaFinishAccess(&pGC->stipple->drawable, EXA_PREPARE_MASK);
-
-    /* switch back to the normal upper layer. */
-    unwrap(pExaScr, pScreen, CreatePixmap);
-    /* restore copy of fb layer pointer. */
-    pExaScr->SavedCreatePixmap = old_ptr;
-
-    /* switch back to the normal upper layer. */
-    unwrap(pExaScr, pScreen, DestroyPixmap);
-    /* restore copy of fb layer pointer. */
-    pExaScr->SavedDestroyPixmap = old_ptr2;
-
-    EXA_GC_EPILOGUE(pGC);
+	exaFinishAccess(&pGC->stipple->drawable, EXA_PREPARE_MASK);
 }
 
 /* Is exaPrepareAccessGC() needed? */
 static void
 exaDestroyGC(GCPtr pGC)
 {
-    EXA_GC_PROLOGUE (pGC);
+    ExaGCPriv(pGC);
+    swap(pExaGC, pGC, funcs);
     (*pGC->funcs->DestroyGC)(pGC);
-    EXA_GC_EPILOGUE (pGC);
+    swap(pExaGC, pGC, funcs);
 }
 
 static void
 exaChangeGC (GCPtr pGC,
 		unsigned long mask)
 {
-    EXA_GC_PROLOGUE (pGC);
+    ExaGCPriv(pGC);
+    swap(pExaGC, pGC, funcs);
     (*pGC->funcs->ChangeGC) (pGC, mask);
-    EXA_GC_EPILOGUE (pGC);
+    swap(pExaGC, pGC, funcs);
 }
 
 static void
@@ -652,9 +559,10 @@ exaCopyGC (GCPtr pGCSrc,
 	      unsigned long mask,
 	      GCPtr	 pGCDst)
 {
-    EXA_GC_PROLOGUE (pGCDst);
+    ExaGCPriv(pGCDst);
+    swap(pExaGC, pGCDst, funcs);
     (*pGCDst->funcs->CopyGC) (pGCSrc, mask, pGCDst);
-    EXA_GC_EPILOGUE (pGCDst);
+    swap(pExaGC, pGCDst, funcs);
 }
 
 static void
@@ -663,25 +571,28 @@ exaChangeClip (GCPtr pGC,
 		pointer pvalue,
 		int nrects)
 {
-    EXA_GC_PROLOGUE (pGC);
+    ExaGCPriv(pGC);
+    swap(pExaGC, pGC, funcs);
     (*pGC->funcs->ChangeClip) (pGC, type, pvalue, nrects);
-    EXA_GC_EPILOGUE (pGC);
+    swap(pExaGC, pGC, funcs);
 }
 
 static void
 exaCopyClip(GCPtr pGCDst, GCPtr pGCSrc)
 {
-    EXA_GC_PROLOGUE (pGCDst);
+    ExaGCPriv(pGCDst);
+    swap(pExaGC, pGCDst, funcs);
     (*pGCDst->funcs->CopyClip)(pGCDst, pGCSrc);
-    EXA_GC_EPILOGUE (pGCDst);
+    swap(pExaGC, pGCDst, funcs);
 }
 
 static void
 exaDestroyClip(GCPtr pGC)
 {
-    EXA_GC_PROLOGUE (pGC);
+    ExaGCPriv(pGC);
+    swap(pExaGC, pGC, funcs);
     (*pGC->funcs->DestroyClip)(pGC);
-    EXA_GC_EPILOGUE (pGC);
+    swap(pExaGC, pGC, funcs);
 }
 
 /**
@@ -712,18 +623,6 @@ exaChangeWindowAttributes(WindowPtr pWin, unsigned long mask)
     Bool ret;
     ScreenPtr pScreen = pWin->drawable.pScreen;
     ExaScreenPriv(pScreen);
-    CreatePixmapProcPtr old_ptr = NULL;
-    DestroyPixmapProcPtr old_ptr2 = NULL;
-
-    /* save the "fb" pointer. */
-    old_ptr = pExaScr->SavedCreatePixmap;
-    /* create a new upper layer pointer. */
-    wrap(pExaScr, pScreen, CreatePixmap, exaCreatePixmapWithPrepare);
-
-    /* save the "fb" pointer. */
-    old_ptr2 = pExaScr->SavedDestroyPixmap;
-    /* create a new upper layer pointer. */
-    wrap(pExaScr, pScreen, DestroyPixmap, exaDestroyPixmapWithFinish);
 
     if ((mask & CWBackPixmap) && pWin->backgroundState == BackgroundPixmap) 
 	exaPrepareAccess(&pWin->background.pixmap->drawable, EXA_PREPARE_SRC);
@@ -731,25 +630,17 @@ exaChangeWindowAttributes(WindowPtr pWin, unsigned long mask)
     if ((mask & CWBorderPixmap) && pWin->borderIsPixel == FALSE)
 	exaPrepareAccess(&pWin->border.pixmap->drawable, EXA_PREPARE_MASK);
 
+    pExaScr->fallback_counter++;
     swap(pExaScr, pScreen, ChangeWindowAttributes);
     ret = pScreen->ChangeWindowAttributes(pWin, mask);
     swap(pExaScr, pScreen, ChangeWindowAttributes);
+    pExaScr->fallback_counter--;
 
     if ((mask & CWBackPixmap) && pWin->backgroundState == BackgroundPixmap) 
 	exaFinishAccess(&pWin->background.pixmap->drawable, EXA_PREPARE_SRC);
     if ((mask & CWBorderPixmap) && pWin->borderIsPixel == FALSE)
 	exaFinishAccess(&pWin->border.pixmap->drawable, EXA_PREPARE_MASK);
 
-    /* switch back to the normal upper layer. */
-    unwrap(pExaScr, pScreen, CreatePixmap);
-    /* restore copy of fb layer pointer. */
-    pExaScr->SavedCreatePixmap = old_ptr;
-
-    /* switch back to the normal upper layer. */
-    unwrap(pExaScr, pScreen, DestroyPixmap);
-    /* restore copy of fb layer pointer. */
-    pExaScr->SavedDestroyPixmap = old_ptr2;
-
     return ret;
 }
 
@@ -1071,6 +962,8 @@ exaDriverInit (ScreenPtr		pScreen,
 		pExaScr->pixmap_is_offscreen = exaPixmapIsOffscreen_mixed;
 		pExaScr->do_move_in_pixmap = exaMoveInPixmap_mixed;
 		pExaScr->do_move_out_pixmap = NULL;
+		pExaScr->prepare_access_reg = exaPrepareAccessReg_mixed;
+		pExaScr->finish_access = exaFinishAccess_mixed;
 	    } else {
 		wrap(pExaScr, pScreen, CreatePixmap, exaCreatePixmap_driver);
 		wrap(pExaScr, pScreen, DestroyPixmap, exaDestroyPixmap_driver);
@@ -1079,6 +972,8 @@ exaDriverInit (ScreenPtr		pScreen,
 		pExaScr->pixmap_is_offscreen = exaPixmapIsOffscreen_driver;
 		pExaScr->do_move_in_pixmap = NULL;
 		pExaScr->do_move_out_pixmap = NULL;
+		pExaScr->prepare_access_reg = NULL;
+		pExaScr->finish_access = NULL;
 	    }
 	} else {
 	    wrap(pExaScr, pScreen, CreatePixmap, exaCreatePixmap_classic);
@@ -1088,6 +983,8 @@ exaDriverInit (ScreenPtr		pScreen,
 	    pExaScr->pixmap_is_offscreen = exaPixmapIsOffscreen_classic;
 	    pExaScr->do_move_in_pixmap = exaMoveInPixmap_classic;
 	    pExaScr->do_move_out_pixmap = exaMoveOutPixmap_classic;
+	    pExaScr->prepare_access_reg = exaPrepareAccessReg_classic;
+	    pExaScr->finish_access = NULL;
 	}
 	if (!(pExaScr->info->flags & EXA_HANDLES_PIXMAPS)) {
 	    LogMessage(X_INFO, "EXA(%d): Offscreen pixmap area of %lu bytes\n",

exa/exa_accel.c

@@ -51,7 +51,8 @@ exaFillSpans(DrawablePtr pDrawable, GCPtr pGC, int n,
     int		    partX1, partX2;
     int		    off_x, off_y;
 
-    if (pExaScr->swappedOut ||
+    if (pExaScr->fallback_counter ||
+	pExaScr->swappedOut ||
 	pGC->fillStyle != FillSolid ||
 	pExaPixmap->accel_blocked)
     {
@@ -153,7 +154,7 @@ exaDoPutImage (DrawablePtr pDrawable, GCPtr pGC, int depth, int x, int y,
     int bpp = pDrawable->bitsPerPixel;
     Bool ret = TRUE;
 
-    if (pExaPixmap->accel_blocked || !pExaScr->info->UploadToScreen)
+    if (pExaScr->fallback_counter || pExaPixmap->accel_blocked || !pExaScr->info->UploadToScreen)
 	return FALSE;
 
     /* Don't bother with under 8bpp, XYPixmaps. */
@@ -504,7 +505,7 @@ exaHWCopyNtoN (DrawablePtr    pSrcDrawable,
 	    (*pExaScr->info->DoneCopy) (pDstPixmap);
 	    exaMarkSync (pDstDrawable->pScreen);
 	/* UTS: mainly for SHM PutImage's secondary path. */
-	} else {
+	} else if (pSrcExaPixmap->sys_ptr) {
 	    int bpp = pSrcDrawable->bitsPerPixel;
 	    int src_stride = exaGetPixmapPitch(pSrcPixmap);
 	    CARD8 *src = NULL;
@@ -531,7 +532,8 @@ exaHWCopyNtoN (DrawablePtr    pSrcDrawable,
 
 		pbox++;
 	    }
-	}
+	} else
+	    goto fallback;
     } else
 	goto fallback;
 
@@ -568,7 +570,8 @@ exaCopyNtoN (DrawablePtr    pSrcDrawable,
 {
     ExaScreenPriv(pDstDrawable->pScreen);
 
-    if (pExaScr->fallback_flags & EXA_FALLBACK_COPYWINDOW)
+    if (pExaScr->fallback_counter ||
+	    (pExaScr->fallback_flags & EXA_FALLBACK_COPYWINDOW))
 	return;
 
     if (exaHWCopyNtoN(pSrcDrawable, pDstDrawable, pGC, pbox, nbox, dx, dy, reverse, upsidedown))
@@ -590,7 +593,7 @@ exaCopyArea(DrawablePtr pSrcDrawable, DrawablePtr pDstDrawable, GCPtr pGC,
 {
     ExaScreenPriv (pDstDrawable->pScreen);
 
-    if (pExaScr->swappedOut) {
+    if (pExaScr->fallback_counter || pExaScr->swappedOut) {
         return  ExaCheckCopyArea(pSrcDrawable, pDstDrawable, pGC,
                                  srcx, srcy, width, height, dstx, dsty);
     }
@@ -604,13 +607,14 @@ static void
 exaPolyPoint(DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
 	     DDXPointPtr ppt)
 {
+    ExaScreenPriv (pDrawable->pScreen);
     int i;
     xRectangle *prect;
 
     /* If we can't reuse the current GC as is, don't bother accelerating the
      * points.
      */
-    if (pGC->fillStyle != FillSolid) {
+    if (pExaScr->fallback_counter || pGC->fillStyle != FillSolid) {
 	ExaCheckPolyPoint(pDrawable, pGC, mode, npt, ppt);
 	return;
     }
@@ -639,10 +643,16 @@ static void
 exaPolylines(DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
 	     DDXPointPtr ppt)
 {
+    ExaScreenPriv (pDrawable->pScreen);
     xRectangle *prect;
     int x1, x2, y1, y2;
     int i;
 
+    if (pExaScr->fallback_counter) {
+	ExaCheckPolylines(pDrawable, pGC, mode, npt, ppt);
+	return;
+    }
+
     /* Don't try to do wide lines or non-solid fill style. */
     if (pGC->lineWidth != 0 || pGC->lineStyle != LineSolid ||
 	pGC->fillStyle != FillSolid) {
@@ -700,12 +710,13 @@ static void
 exaPolySegment (DrawablePtr pDrawable, GCPtr pGC, int nseg,
 		xSegment *pSeg)
 {
+    ExaScreenPriv (pDrawable->pScreen);
     xRectangle *prect;
     int i;
 
     /* Don't try to do wide lines or non-solid fill style. */
-    if (pGC->lineWidth != 0 || pGC->lineStyle != LineSolid ||
-	pGC->fillStyle != FillSolid)
+    if (pExaScr->fallback_counter || pGC->lineWidth != 0 ||
+	pGC->lineStyle != LineSolid || pGC->fillStyle != FillSolid)
     {
 	ExaCheckPolySegment(pDrawable, pGC, nseg, pSeg);
 	return;
@@ -782,7 +793,8 @@ exaPolyFillRect(DrawablePtr pDrawable,
 
     exaGetDrawableDeltas(pDrawable, pPixmap, &xoff, &yoff);
 
-    if (pExaScr->swappedOut || pExaPixmap->accel_blocked)
+    if (pExaScr->fallback_counter || pExaScr->swappedOut ||
+	    pExaPixmap->accel_blocked)
     {
 	goto fallback;
     }
@@ -956,12 +968,18 @@ exaCopyWindow(WindowPtr pWin, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
 			  -pPixmap->screen_x, -pPixmap->screen_y);
 #endif
 
+    if (pExaScr->fallback_counter) {
+	pExaScr->fallback_flags |= EXA_FALLBACK_COPYWINDOW;
+	goto fallback;
+    }
+
     pExaScr->fallback_flags |= EXA_ACCEL_COPYWINDOW;
     miCopyRegion (&pPixmap->drawable, &pPixmap->drawable,
 		  NULL,
 		  &rgnDst, dx, dy, exaCopyNtoN, 0, NULL);
     pExaScr->fallback_flags &= ~EXA_ACCEL_COPYWINDOW;
 
+fallback:
     REGION_UNINIT(pWin->drawable.pScreen, &rgnDst);
 
     if (pExaScr->fallback_flags & EXA_FALLBACK_COPYWINDOW) {
@@ -984,7 +1002,7 @@ exaFillRegionSolid (DrawablePtr	pDrawable, RegionPtr pRegion, Pixel pixel,
     exaGetDrawableDeltas(pDrawable, pPixmap, &xoff, &yoff);
     REGION_TRANSLATE(pScreen, pRegion, xoff, yoff);
 
-    if (pExaPixmap->accel_blocked)
+    if (pExaScr->fallback_counter || pExaPixmap->accel_blocked)
 	goto out;
 
     if (pExaScr->do_migration) {
@@ -1031,6 +1049,8 @@ exaFillRegionSolid (DrawablePtr	pDrawable, RegionPtr pRegion, Pixel pixel,
 		*(CARD16*)pExaPixmap->sys_ptr = pixel;
 		break;
 	    case 8:
+	    case 4:
+	    case 1:
 		*(CARD8*)pExaPixmap->sys_ptr = pixel;
 	    }
 
@@ -1080,7 +1100,8 @@ exaFillRegionTiled (DrawablePtr pDrawable, RegionPtr pRegion, PixmapPtr pTile,
     pPixmap = exaGetDrawablePixmap (pDrawable);
     pExaPixmap = ExaGetPixmapPriv (pPixmap);
 
-    if (pExaPixmap->accel_blocked || pTileExaPixmap->accel_blocked)
+    if (pExaScr->fallback_counter || pExaPixmap->accel_blocked ||
+	    pTileExaPixmap->accel_blocked)
 	return FALSE;
 
     if (pExaScr->do_migration) {
@@ -1238,7 +1259,7 @@ exaGetImage (DrawablePtr pDrawable, int x, int y, int w, int h,
     int xoff, yoff;
     Bool ok;
 
-    if (pExaScr->swappedOut)
+    if (pExaScr->fallback_counter || pExaScr->swappedOut)
 	goto fallback;
 
     exaGetDrawableDeltas (pDrawable, pPix, &xoff, &yoff);

exa/exa_classic.c

@@ -137,6 +137,10 @@ exaCreatePixmap_classic(ScreenPtr pScreen, int w, int h, int depth,
     exaSetAccelBlock(pExaScr, pExaPixmap,
                      w, h, bpp);
 
+    /* During a fallback we must prepare access. */
+    if (pExaScr->fallback_counter)
+	exaPrepareAccess(&pPixmap->drawable, EXA_PREPARE_AUX_DEST);
+
     return pPixmap;
 }
 
@@ -216,6 +220,10 @@ exaDestroyPixmap_classic (PixmapPtr pPixmap)
     {
 	ExaPixmapPriv (pPixmap);
 
+	/* During a fallback we must finish access, but we don't know the index. */
+	if (pExaScr->fallback_counter)
+	    exaFinishAccess(&pPixmap->drawable, -1);
+
 	if (pExaPixmap->area)
 	{
 	    DBG_PIXMAP(("-- 0x%p (0x%x) (%dx%d)\n",
@@ -248,9 +256,10 @@ exaPixmapIsOffscreen_classic(PixmapPtr pPixmap)
     Bool ret;
 
     if (pExaScr->info->PixmapIsOffscreen) {
+	void* old_ptr = pPixmap->devPrivate.ptr;
 	pPixmap->devPrivate.ptr = ExaGetPixmapAddress(pPixmap);
 	ret = pExaScr->info->PixmapIsOffscreen(pPixmap);
-	pPixmap->devPrivate.ptr = NULL;
+	pPixmap->devPrivate.ptr = old_ptr;
     } else
 	ret = (pExaPixmap->offscreen && pExaPixmap->fb_ptr);
 

exa/exa_driver.c

@@ -115,6 +115,10 @@ exaCreatePixmap_driver(ScreenPtr pScreen, int w, int h, int depth,
     exaSetAccelBlock(pExaScr, pExaPixmap,
                      w, h, bpp);
 
+    /* During a fallback we must prepare access. */
+    if (pExaScr->fallback_counter)
+	exaPrepareAccess(&pPixmap->drawable, EXA_PREPARE_AUX_DEST);
+
     return pPixmap;
 }
 
@@ -187,6 +191,10 @@ exaDestroyPixmap_driver (PixmapPtr pPixmap)
     {
 	ExaPixmapPriv (pPixmap);
 
+	/* During a fallback we must finish access, but we don't know the index. */
+	if (pExaScr->fallback_counter)
+	    exaFinishAccess(&pPixmap->drawable, -1);
+
 	if (pExaPixmap->driverPriv)
 	    pExaScr->info->DestroyPixmap(pScreen, pExaPixmap->driverPriv);
 	pExaPixmap->driverPriv = NULL;
@@ -204,11 +212,13 @@ exaPixmapIsOffscreen_driver(PixmapPtr pPixmap)
 {
     ScreenPtr pScreen = pPixmap->drawable.pScreen;
     ExaScreenPriv(pScreen);
+    pointer saved_ptr;
     Bool ret;
 
+    saved_ptr = pPixmap->devPrivate.ptr;
     pPixmap->devPrivate.ptr = ExaGetPixmapAddress(pPixmap);
     ret = pExaScr->info->PixmapIsOffscreen(pPixmap);
-    pPixmap->devPrivate.ptr = NULL;
+    pPixmap->devPrivate.ptr = saved_ptr;
 
     return ret;
 }

exa/exa_glyphs.c

@@ -701,7 +701,6 @@ exaGlyphs (CARD8 	 op,
 	   GlyphListPtr	 list,
 	   GlyphPtr	*glyphs)
 {
-    PicturePtr	pPicture;
     PixmapPtr   pMaskPixmap = 0;
     PicturePtr  pMask = NULL;
     ScreenPtr   pScreen = pDst->pDrawable->pScreen;
@@ -803,7 +802,6 @@ exaGlyphs (CARD8 	 op,
 	while (n--)
 	{
 	    glyph = *glyphs++;
-	    pPicture = GlyphPicture (glyph)[pScreen->myNum];
 
 	    if (glyph->info.width > 0 && glyph->info.height > 0)
 	    {

exa/exa_migration_classic.c

@@ -104,9 +104,8 @@ exaPixmapShouldBeInFB (PixmapPtr pPix)
 static void
 exaCopyDirty(ExaMigrationPtr migrate, RegionPtr pValidDst, RegionPtr pValidSrc,
 	     Bool (*transfer) (PixmapPtr pPix, int x, int y, int w, int h,
-			       char *sys, int sys_pitch), CARD8 *fallback_src,
-	     CARD8 *fallback_dst, int fallback_srcpitch, int fallback_dstpitch,
-	     int fallback_index, void (*sync) (ScreenPtr pScreen))
+			       char *sys, int sys_pitch), int fallback_index,
+	     void (*sync) (ScreenPtr pScreen))
 {
     PixmapPtr pPixmap = migrate->pPix;
     ExaPixmapPriv (pPixmap);
@@ -120,7 +119,7 @@ exaCopyDirty(ExaMigrationPtr migrate, RegionPtr pValidDst, RegionPtr pValidSrc,
     Bool need_sync = FALSE;
 
     /* Damaged bits are valid in current copy but invalid in other one */
-    if (exaPixmapIsOffscreen(pPixmap)) {
+    if (pExaPixmap->offscreen) {
 	REGION_UNION(pScreen, &pExaPixmap->validFB, &pExaPixmap->validFB,
 		     damage);
 	REGION_SUBTRACT(pScreen, &pExaPixmap->validSys, &pExaPixmap->validSys,
@@ -225,23 +224,24 @@ exaCopyDirty(ExaMigrationPtr migrate, RegionPtr pValidDst, RegionPtr pValidSrc,
 				    pExaPixmap->sys_pitch))
 	{
 	    if (!access_prepared) {
-		ExaDoPrepareAccess(&pPixmap->drawable, fallback_index);
+		ExaDoPrepareAccess(pPixmap, fallback_index);
 		access_prepared = TRUE;
 	    }
-	    exaMemcpyBox (pPixmap, pBox,
-			  fallback_src, fallback_srcpitch,
-			  fallback_dst, fallback_dstpitch);
+	    if (fallback_index == EXA_PREPARE_DEST) {
+		exaMemcpyBox (pPixmap, pBox,
+			      pExaPixmap->sys_ptr, pExaPixmap->sys_pitch,
+			      pPixmap->devPrivate.ptr, pPixmap->devKind);
+	    } else {
+		exaMemcpyBox (pPixmap, pBox,
+			      pPixmap->devPrivate.ptr, pPixmap->devKind,
+			      pExaPixmap->sys_ptr, pExaPixmap->sys_pitch);
+	    }
 	} else
 	    need_sync = TRUE;
 
 	pBox++;
     }
 
-    if (access_prepared)
-	exaFinishAccess(&pPixmap->drawable, fallback_index);
-    else if (need_sync && sync)
-	sync (pPixmap->drawable.pScreen);
-
     pExaPixmap->offscreen = save_offscreen;
     pPixmap->devKind = save_pitch;
 
@@ -256,6 +256,11 @@ exaCopyDirty(ExaMigrationPtr migrate, RegionPtr pValidDst, RegionPtr pValidSrc,
     REGION_UNION(pScreen, pValidDst, pValidDst, &CopyReg);
 
     REGION_UNINIT(pScreen, &CopyReg);
+
+    if (access_prepared)
+	exaFinishAccess(&pPixmap->drawable, fallback_index);
+    else if (need_sync && sync)
+	sync (pPixmap->drawable.pScreen);
 }
 
 /**
@@ -263,7 +268,7 @@ exaCopyDirty(ExaMigrationPtr migrate, RegionPtr pValidDst, RegionPtr pValidSrc,
  * the framebuffer  memory copy to the system memory copy.  Both areas must be
  * allocated.
  */
-static void
+void
 exaCopyDirtyToSys (ExaMigrationPtr migrate)
 {
     PixmapPtr pPixmap = migrate->pPix;
@@ -271,9 +276,8 @@ exaCopyDirtyToSys (ExaMigrationPtr migrate)
     ExaPixmapPriv (pPixmap);
 
     exaCopyDirty(migrate, &pExaPixmap->validSys, &pExaPixmap->validFB,
-		 pExaScr->info->DownloadFromScreen, pExaPixmap->fb_ptr,
-		 pExaPixmap->sys_ptr, pExaPixmap->fb_pitch,
-		 pExaPixmap->sys_pitch, EXA_PREPARE_SRC, exaWaitSync);
+		 pExaScr->info->DownloadFromScreen, EXA_PREPARE_SRC,
+		 exaWaitSync);
 }
 
 /**
@@ -281,7 +285,7 @@ exaCopyDirtyToSys (ExaMigrationPtr migrate)
  * the system memory copy to the framebuffer memory copy.  Both areas must be
  * allocated.
  */
-static void
+void
 exaCopyDirtyToFb (ExaMigrationPtr migrate)
 {
     PixmapPtr pPixmap = migrate->pPix;
@@ -289,9 +293,7 @@ exaCopyDirtyToFb (ExaMigrationPtr migrate)
     ExaPixmapPriv (pPixmap);
 
     exaCopyDirty(migrate, &pExaPixmap->validFB, &pExaPixmap->validSys,
-		 pExaScr->info->UploadToScreen, pExaPixmap->sys_ptr,
-		 pExaPixmap->fb_ptr, pExaPixmap->sys_pitch,
-		 pExaPixmap->fb_pitch, EXA_PREPARE_DEST, NULL);
+		 pExaScr->info->UploadToScreen, EXA_PREPARE_DEST, NULL);
 }
 
 /**
@@ -545,7 +547,7 @@ exaAssertNotDirty (PixmapPtr pPixmap)
     pExaPixmap->offscreen = TRUE;
     pPixmap->devKind = pExaPixmap->fb_pitch;
 
-    if (!ExaDoPrepareAccess(&pPixmap->drawable, EXA_PREPARE_SRC))
+    if (!ExaDoPrepareAccess(pPixmap, EXA_PREPARE_SRC))
 	goto skip;
 
     while (nbox--) {
@@ -718,3 +720,23 @@ exaDoMigration_classic (ExaMigrationPtr pixmaps, int npixmaps, Bool can_accel)
 	}
     }
 }
+
+void
+exaPrepareAccessReg_classic(PixmapPtr pPixmap, int index, RegionPtr pReg)
+{
+    ExaMigrationRec pixmaps[1];
+
+    if (index == EXA_PREPARE_DEST || index == EXA_PREPARE_AUX_DEST) {
+	pixmaps[0].as_dst = TRUE;
+	pixmaps[0].as_src = FALSE;
+    } else {
+	pixmaps[0].as_dst = FALSE;
+	pixmaps[0].as_src = TRUE;
+    }
+    pixmaps[0].pPix = pPixmap;
+    pixmaps[0].pReg = pReg;
+
+    exaDoMigration(pixmaps, 1, FALSE);
+
+    (void)ExaDoPrepareAccess(pPixmap, index);
+}

exa/exa_migration_mixed.c

@@ -31,55 +31,16 @@
 #include "exa_priv.h"
 #include "exa.h"
 
-static void
-exaUploadFallback(PixmapPtr pPixmap, CARD8 *src, int src_pitch)
-{
-    ExaPixmapPriv(pPixmap);
-    RegionPtr damage = DamageRegion (pExaPixmap->pDamage);
-    GCPtr pGC = GetScratchGC (pPixmap->drawable.depth,
-		pPixmap->drawable.pScreen);
-    int nbox, cpp = pPixmap->drawable.bitsPerPixel / 8;
-    DamagePtr backup = pExaPixmap->pDamage;
-    BoxPtr pbox;
-    CARD8 *src2;
-
-    /* We don't want damage optimisations. */
-    pExaPixmap->pDamage = NULL;
-    ValidateGC (&pPixmap->drawable, pGC);
-
-    pbox = REGION_RECTS(damage);
-    nbox = REGION_NUM_RECTS(damage);
-
-    while (nbox--) {
-	src2 = src + pbox->y1 * src_pitch + pbox->x1 * cpp;
-
-	ExaCheckPutImage(&pPixmap->drawable, pGC,
-	    pPixmap->drawable.depth, pbox->x1, pbox->y1,
-	    pbox->x2 - pbox->x1, pbox->y2 - pbox->y1, 0,
-	    ZPixmap, (char*) src2);
-
-	pbox++;
-    }
-
-    FreeScratchGC (pGC);
-    pExaPixmap->pDamage = backup;
-}
-
 void
 exaCreateDriverPixmap_mixed(PixmapPtr pPixmap)
 {
     ScreenPtr pScreen = pPixmap->drawable.pScreen;
     ExaScreenPriv(pScreen);
     ExaPixmapPriv(pPixmap);
-    RegionPtr damage = DamageRegion (pExaPixmap->pDamage);
-    void *sys_buffer = pExaPixmap->sys_ptr;
     int w = pPixmap->drawable.width, h = pPixmap->drawable.height;
     int depth = pPixmap->drawable.depth, bpp = pPixmap->drawable.bitsPerPixel;
     int usage_hint = pPixmap->usage_hint;
-    int sys_pitch = pExaPixmap->sys_pitch;
-    int paddedWidth = sys_pitch;
-    int nbox;
-    BoxPtr pbox;
+    int paddedWidth = pExaPixmap->sys_pitch;
 
     /* Already done. */
     if (pExaPixmap->driverPriv)
@@ -105,50 +66,8 @@ exaCreateDriverPixmap_mixed(PixmapPtr pPixmap)
     if (!pExaPixmap->driverPriv)
 	return;
 
-    pExaPixmap->offscreen = TRUE;
-    pExaPixmap->sys_ptr = pPixmap->devPrivate.ptr = NULL;
-    pExaPixmap->sys_pitch = pPixmap->devKind = 0;
-
-    pExaPixmap->score = EXA_PIXMAP_SCORE_PINNED;
     (*pScreen->ModifyPixmapHeader)(pPixmap, w, h, 0, 0,
 				paddedWidth, NULL);
-
-    /* scratch pixmaps */
-    if (!w || !h)
-	goto finish;
-
-    /* we do not malloc memory by default. */
-    if (!sys_buffer)
-	goto finish;
-
-    if (!pExaScr->info->UploadToScreen)
-	goto fallback;
-
-    pbox = REGION_RECTS(damage);
-    nbox = REGION_NUM_RECTS(damage);
-
-    while (nbox--) {
-	if (!pExaScr->info->UploadToScreen(pPixmap, pbox->x1, pbox->y1, pbox->x2 - pbox->x1,
-		pbox->y2 - pbox->y1, (char *) (sys_buffer) + pbox->y1 * sys_pitch + pbox->x1 * (bpp / 8), sys_pitch))
-	    goto fallback;
-
-	pbox++;
-    }
-
-    goto finish;
-
-fallback:
-    exaUploadFallback(pPixmap, sys_buffer, sys_pitch);
-
-finish:
-    free(sys_buffer);
-
-    /* We no longer need this. */
-    if (pExaPixmap->pDamage) {
-	DamageUnregister(&pPixmap->drawable, pExaPixmap->pDamage);
-	DamageDestroy(pExaPixmap->pDamage);
-	pExaPixmap->pDamage = NULL;
-    }
 }
 
 void
@@ -175,8 +94,16 @@ exaDoMigration_mixed(ExaMigrationPtr pixmaps, int npixmaps, Bool can_accel)
     for (i = 0; i < npixmaps; i++) {
 	PixmapPtr pPixmap = pixmaps[i].pPix;
 	ExaPixmapPriv(pPixmap);
+
 	if (!pExaPixmap->driverPriv)
 	    exaCreateDriverPixmap_mixed(pPixmap);
+
+	if (pExaPixmap->pDamage && exaPixmapIsOffscreen(pPixmap)) {
+	    pPixmap->devKind = pExaPixmap->fb_pitch;
+	    exaCopyDirtyToFb(pixmaps + i);
+	}
+
+	pExaPixmap->offscreen = exaPixmapIsOffscreen(pPixmap);
     }
 }
 
@@ -192,3 +119,92 @@ exaMoveInPixmap_mixed(PixmapPtr pPixmap)
 
     exaDoMigration(pixmaps, 1, TRUE);
 }
+
+/* With mixed pixmaps, if we fail to get direct access to the driver pixmap, we
+ * use the DownloadFromScreen hook to retrieve contents to a copy in system
+ * memory, perform software rendering on that and move back the results with the
+ * UploadToScreen hook (see exaFinishAccess_mixed).
+ */
+void
+exaPrepareAccessReg_mixed(PixmapPtr pPixmap, int index, RegionPtr pReg)
+{
+    if (!ExaDoPrepareAccess(pPixmap, index)) {
+	ExaPixmapPriv(pPixmap);
+	Bool is_offscreen = exaPixmapIsOffscreen(pPixmap);
+	ExaMigrationRec pixmaps[1];
+
+	/* Do we need to allocate our system buffer? */
+	if (!pExaPixmap->sys_ptr) {
+	    pExaPixmap->sys_ptr = malloc(pExaPixmap->sys_pitch *
+					 pPixmap->drawable.height);
+	    if (!pExaPixmap->sys_ptr)
+		FatalError("EXA: malloc failed for size %d bytes\n",
+			   pExaPixmap->sys_pitch * pPixmap->drawable.height);
+	}
+
+	if (index == EXA_PREPARE_DEST || index == EXA_PREPARE_AUX_DEST) {
+	    pixmaps[0].as_dst = TRUE;
+	    pixmaps[0].as_src = FALSE;
+	} else {
+	    pixmaps[0].as_dst = FALSE;
+	    pixmaps[0].as_src = TRUE;
+	}
+	pixmaps[0].pPix = pPixmap;
+	pixmaps[0].pReg = pReg;
+
+	if (!pExaPixmap->pDamage && (is_offscreen || !exaPixmapIsPinned(pPixmap))) {
+	    Bool as_dst = pixmaps[0].as_dst;
+
+	    /* Set up damage tracking */
+	    pExaPixmap->pDamage = DamageCreate(NULL, NULL, DamageReportNone,
+					       TRUE, pPixmap->drawable.pScreen,
+					       pPixmap);
+
+	    DamageRegister(&pPixmap->drawable, pExaPixmap->pDamage);
+	    /* This ensures that pending damage reflects the current operation. */
+	    /* This is used by exa to optimize migration. */
+	    DamageSetReportAfterOp(pExaPixmap->pDamage, TRUE);
+
+	    if (is_offscreen) {
+		exaPixmapDirty(pPixmap, 0, 0, pPixmap->drawable.width,
+			       pPixmap->drawable.height);
+
+		/* We don't know which region of the destination will be damaged,
+		 * have to assume all of it
+		 */
+		if (as_dst) {
+		    pixmaps[0].as_dst = FALSE;
+		    pixmaps[0].as_src = TRUE;
+		    pixmaps[0].pReg = NULL;
+		}
+		pPixmap->devKind = pExaPixmap->fb_pitch;
+		exaCopyDirtyToSys(pixmaps);
+	    }
+
+	    if (as_dst)
+		exaPixmapDirty(pPixmap, 0, 0, pPixmap->drawable.width,
+			       pPixmap->drawable.height);
+	} else if (is_offscreen) {
+	    pPixmap->devKind = pExaPixmap->fb_pitch;
+	    exaCopyDirtyToSys(pixmaps);
+	}
+
+	pPixmap->devPrivate.ptr = pExaPixmap->sys_ptr;
+	pPixmap->devKind = pExaPixmap->sys_pitch;
+	pExaPixmap->offscreen = FALSE;
+    }
+}
+
+/* Move back results of software rendering on system memory copy of mixed driver
+ * pixmap (see exaPrepareAccessReg_mixed).
+ */
+void exaFinishAccess_mixed(PixmapPtr pPixmap, int index)
+{
+    ExaPixmapPriv(pPixmap);
+
+    if (pExaPixmap->pDamage && exaPixmapIsOffscreen(pPixmap) &&
+	!pExaPixmap->offscreen) {
+	DamageRegionProcessPending(&pPixmap->drawable);
+	exaMoveInPixmap_mixed(pPixmap);
+    }
+}

exa/exa_mixed.c

@@ -32,8 +32,6 @@
 #include "exa.h"
 
 /* This file holds the driver allocated pixmaps + better initial placement code.
- * A pinned pixmap implies one that is either driver based already or otherwise altered.
- * Proper care is taken to free the initially allocated buffer.
  */
 
 static _X_INLINE void*
@@ -46,9 +44,6 @@ ExaGetPixmapAddress(PixmapPtr p)
 
 /**
  * exaCreatePixmap() creates a new pixmap.
- *
- * Pixmaps are always marked as pinned, unless the pixmap can still be transfered to a
- * driver pixmaps.
  */
 PixmapPtr
 exaCreatePixmap_mixed(ScreenPtr pScreen, int w, int h, int depth,
@@ -57,7 +52,7 @@ exaCreatePixmap_mixed(ScreenPtr pScreen, int w, int h, int depth,
     PixmapPtr pPixmap;
     ExaPixmapPrivPtr	pExaPixmap;
     int bpp;
-    size_t paddedWidth, datasize;
+    size_t paddedWidth;
     ExaScreenPriv(pScreen);
 
     if (w > 32767 || h > 32767)
@@ -79,15 +74,12 @@ exaCreatePixmap_mixed(ScreenPtr pScreen, int w, int h, int depth,
     if (paddedWidth / 4 > 32767 || h > 32767)
         return NullPixmap;
 
-    datasize = h * paddedWidth;
-
     /* We will allocate the system pixmap later if needed. */
     pPixmap->devPrivate.ptr = NULL;
     pExaPixmap->sys_ptr = NULL;
     pExaPixmap->sys_pitch = paddedWidth;
 
     pExaPixmap->area = NULL;
-    pExaPixmap->offscreen = FALSE;
     pExaPixmap->fb_ptr = NULL;
     pExaPixmap->pDamage = NULL;
 
@@ -95,36 +87,19 @@ exaCreatePixmap_mixed(ScreenPtr pScreen, int w, int h, int depth,
     exaSetAccelBlock(pExaScr, pExaPixmap,
 	w, h, bpp);
 
-    /* Avoid freeing sys_ptr. */
-    pExaPixmap->score = EXA_PIXMAP_SCORE_PINNED;
-
     (*pScreen->ModifyPixmapHeader)(pPixmap, w, h, 0, 0,
 				    paddedWidth, NULL);
 
-    /* We want to be able to transfer the pixmap to driver memory later on. */
-    pExaPixmap->score = EXA_PIXMAP_SCORE_INIT;
-
     /* A scratch pixmap will become a driver pixmap right away. */
     if (!w || !h) {
 	exaCreateDriverPixmap_mixed(pPixmap);
-    } else {
-	/* Set up damage tracking */
-	pExaPixmap->pDamage = DamageCreate (NULL, NULL,
-					    DamageReportNone, TRUE,
-					    pScreen, pPixmap);
+	pExaPixmap->offscreen = exaPixmapIsOffscreen(pPixmap);
+    } else
+	pExaPixmap->offscreen = FALSE;
 
-	if (pExaPixmap->pDamage == NULL) {
-	    swap(pExaScr, pScreen, DestroyPixmap);
-	    pScreen->DestroyPixmap (pPixmap);
-	    swap(pExaScr, pScreen, DestroyPixmap);
-	    return NULL;
-	}
-
-	DamageRegister (&pPixmap->drawable, pExaPixmap->pDamage);
-	/* This ensures that pending damage reflects the current operation. */
-	/* This is used by exa to optimize migration. */
-	DamageSetReportAfterOp (pExaPixmap->pDamage, TRUE);
-    }
+    /* During a fallback we must prepare access. */
+    if (pExaScr->fallback_counter)
+	exaPrepareAccess(&pPixmap->drawable, EXA_PREPARE_AUX_DEST);
 
     return pPixmap;
 }
@@ -136,7 +111,7 @@ exaModifyPixmapHeader_mixed(PixmapPtr pPixmap, int width, int height, int depth,
     ScreenPtr pScreen = pPixmap->drawable.pScreen;
     ExaScreenPrivPtr pExaScr;
     ExaPixmapPrivPtr pExaPixmap;
-    Bool ret;
+    Bool ret, is_offscreen;
 
     if (!pPixmap)
         return FALSE;
@@ -144,26 +119,23 @@ exaModifyPixmapHeader_mixed(PixmapPtr pPixmap, int width, int height, int depth,
     pExaScr = ExaGetScreenPriv(pScreen);
     pExaPixmap = ExaGetPixmapPriv(pPixmap);
 
-    if (pExaPixmap) {
-	if (!exaPixmapIsPinned(pPixmap)) {
-	    free(pExaPixmap->sys_ptr);
-	    pExaPixmap->sys_ptr = pPixmap->devPrivate.ptr = NULL;
-	    pExaPixmap->sys_pitch = pPixmap->devKind = 0;
-
-	    /* We no longer need this. */
+    if (pPixData) {
+	if (pExaPixmap->driverPriv) {
 	    if (pExaPixmap->pDamage) {
 		DamageUnregister(&pPixmap->drawable, pExaPixmap->pDamage);
 		DamageDestroy(pExaPixmap->pDamage);
 		pExaPixmap->pDamage = NULL;
 	    }
+
+	    pExaScr->info->DestroyPixmap(pScreen, pExaPixmap->driverPriv);
+	    pExaPixmap->driverPriv = NULL;
 	}
 
-        if (pPixData)
-            pExaPixmap->sys_ptr = pPixData;
-
-        if (devKind > 0)
-            pExaPixmap->sys_pitch = devKind;
+	pExaPixmap->offscreen = FALSE;
+	pExaPixmap->score = EXA_PIXMAP_SCORE_PINNED;
+    }
 
+    if (pExaPixmap->driverPriv) {
         if (width > 0 && height > 0 && bitsPerPixel > 0) {
             exaSetFbPitch(pExaScr, pExaPixmap,
                           width, height, bitsPerPixel);
@@ -171,23 +143,21 @@ exaModifyPixmapHeader_mixed(PixmapPtr pPixmap, int width, int height, int depth,
             exaSetAccelBlock(pExaScr, pExaPixmap,
                              width, height, bitsPerPixel);
         }
+    }
 
-	/* Anything can happen, don't try to predict it all. */
-	pExaPixmap->score = EXA_PIXMAP_SCORE_PINNED;
+    is_offscreen = exaPixmapIsOffscreen(pPixmap);
+    if (is_offscreen) {
+	pPixmap->devPrivate.ptr = pExaPixmap->fb_ptr;
+	pPixmap->devKind = pExaPixmap->fb_pitch;
+    } else {
+	pPixmap->devPrivate.ptr = pExaPixmap->sys_ptr;
+	pPixmap->devKind = pExaPixmap->sys_pitch;
     }
 
     /* Only pass driver pixmaps to the driver. */
     if (pExaScr->info->ModifyPixmapHeader && pExaPixmap->driverPriv) {
 	ret = pExaScr->info->ModifyPixmapHeader(pPixmap, width, height, depth,
 						bitsPerPixel, devKind, pPixData);
-	/* For EXA_HANDLES_PIXMAPS, we set pPixData to NULL.
-	 * If pPixmap->devPrivate.ptr is non-NULL, then we've got a non-offscreen pixmap.
-	 * We need to store the pointer, because PrepareAccess won't be called.
-	 */
-	if (!pPixData && pPixmap->devPrivate.ptr && pPixmap->devKind) {
-	    pExaPixmap->sys_ptr = pPixmap->devPrivate.ptr;
-	    pExaPixmap->sys_pitch = pPixmap->devKind;
-	}
 	if (ret == TRUE)
 	    goto out;
     }
@@ -198,6 +168,13 @@ exaModifyPixmapHeader_mixed(PixmapPtr pPixmap, int width, int height, int depth,
     swap(pExaScr, pScreen, ModifyPixmapHeader);
 
 out:
+    if (is_offscreen) {
+	pExaPixmap->fb_ptr = pPixmap->devPrivate.ptr;
+	pExaPixmap->fb_pitch = pPixmap->devKind;
+    } else {
+	pExaPixmap->sys_ptr = pPixmap->devPrivate.ptr;
+	pExaPixmap->sys_pitch = pPixmap->devKind;
+    }
     /* Always NULL this, we don't want lingering pointers. */
     pPixmap->devPrivate.ptr = NULL;
 
@@ -215,12 +192,20 @@ exaDestroyPixmap_mixed(PixmapPtr pPixmap)
     {
 	ExaPixmapPriv (pPixmap);
 
+	/* During a fallback we must finish access, but we don't know the index. */
+	if (pExaScr->fallback_counter)
+	    exaFinishAccess(&pPixmap->drawable, -1);
+
 	if (pExaPixmap->driverPriv)
 	    pExaScr->info->DestroyPixmap(pScreen, pExaPixmap->driverPriv);
-	else if (pExaPixmap->sys_ptr && !exaPixmapIsPinned(pPixmap))
-	    free(pExaPixmap->sys_ptr);
 	pExaPixmap->driverPriv = NULL;
-	pExaPixmap->sys_ptr = NULL;
+
+	if (pExaPixmap->pDamage) {
+	    if (pExaPixmap->sys_ptr)
+		free(pExaPixmap->sys_ptr);
+	    pExaPixmap->sys_ptr = NULL;
+	    pExaPixmap->pDamage = NULL;
+	}
     }
 
     swap(pExaScr, pScreen, DestroyPixmap);

exa/exa_offscreen.c

@@ -169,7 +169,7 @@ exaOffscreenAlloc (ScreenPtr pScreen, int size, int align,
 {
     ExaOffscreenArea *area;
     ExaScreenPriv (pScreen);
-    int real_size = 0, free_total = 0, largest_avail = 0;
+    int real_size = 0, largest_avail = 0;
 #if DEBUG_OFFSCREEN
     static int number = 0;
     ErrorF("================= ============ allocating a new pixmap %d\n", ++number);
@@ -208,33 +208,10 @@ exaOffscreenAlloc (ScreenPtr pScreen, int size, int align,
 	if (real_size <= area->size)
 	    break;
 
-	free_total += area->size;
-
 	if (area->size > largest_avail)
 	    largest_avail = area->size;
     }
 
-    if (!area && free_total >= size) {
-	CARD32 now = GetTimeInMillis();
-
-	/* Don't defragment more than once per second, to avoid adding more
-	 * overhead than we're trying to prevent
-	 */
-	if (abs((INT32) (now - pExaScr->lastDefragment)) > 1000) {
-	    area = ExaOffscreenDefragment(pScreen);
-	    pExaScr->lastDefragment = now;
-
-	    if (area) {
-		/* adjust size to match alignment requirement */
-		real_size = size + (area->base_offset + area->size - size) % align;
-
-		/* does it fit? */
-		if (real_size > area->size)
-		    area = NULL;
-	    }
-	}
-    }
-
     if (!area)
     {
 	area = exaFindAreaToEvict(pExaScr, size, align);

exa/exa_priv.h

@@ -176,6 +176,8 @@ typedef struct {
     Bool (*pixmap_is_offscreen) (PixmapPtr pPixmap);
     void (*do_move_in_pixmap) (PixmapPtr pPixmap);
     void (*do_move_out_pixmap) (PixmapPtr pPixmap);
+    void (*prepare_access_reg)(PixmapPtr pPixmap, int index, RegionPtr pReg);
+    void (*finish_access)(PixmapPtr pPixmap, int index);
 
     Bool			 swappedOut;
     enum ExaMigrationHeuristic	 migration;
@@ -195,6 +197,7 @@ typedef struct {
 
     /* Holds information on fallbacks that cannot be relayed otherwise. */
     unsigned int fallback_flags;
+    unsigned int fallback_counter;
 
     ExaGlyphCacheRec             glyphCaches[EXA_NUM_GLYPH_CACHES];
 } ExaScreenPrivRec, *ExaScreenPrivPtr;
@@ -238,13 +241,21 @@ extern DevPrivateKey exaGCPrivateKey;
     real->mem = tmp; \
 }
 
-#define EXA_GC_PROLOGUE(_gc_) \
+#define EXA_PRE_FALLBACK(_screen_) \
+    ExaScreenPriv(_screen_); \
+    pExaScr->fallback_counter++;
+
+#define EXA_POST_FALLBACK(_screen_) \
+    pExaScr->fallback_counter--;
+
+#define EXA_PRE_FALLBACK_GC(_gc_) \
+    ExaScreenPriv(_gc_->pScreen); \
     ExaGCPriv(_gc_); \
-    swap(pExaGC, _gc_, funcs); \
+    pExaScr->fallback_counter++; \
     swap(pExaGC, _gc_, ops);
 
-#define EXA_GC_EPILOGUE(_gc_) \
-    swap(pExaGC, _gc_, funcs); \
+#define EXA_POST_FALLBACK_GC(_gc_) \
+    pExaScr->fallback_counter--; \
     swap(pExaGC, _gc_, ops);
 
 /** Align an offset to an arbitrary alignment */
@@ -511,10 +522,7 @@ ExaOffscreenFini (ScreenPtr pScreen);
 
 /* exa.c */
 Bool
-ExaDoPrepareAccess(DrawablePtr pDrawable, int index);
-
-void
-exaPrepareAccessReg(DrawablePtr pDrawable, int index, RegionPtr pReg);
+ExaDoPrepareAccess(PixmapPtr pPixmap, int index);
 
 void
 exaPrepareAccess(DrawablePtr pDrawable, int index);
@@ -609,6 +617,12 @@ exaDoMigration_mixed(ExaMigrationPtr pixmaps, int npixmaps, Bool can_accel);
 void
 exaMoveInPixmap_mixed(PixmapPtr pPixmap);
 
+void
+exaPrepareAccessReg_mixed(PixmapPtr pPixmap, int index, RegionPtr pReg);
+
+void
+exaFinishAccess_mixed(PixmapPtr pPixmap, int index);
+
 /* exa_render.c */
 Bool
 exaOpReadsDestination (CARD8 op);
@@ -664,6 +678,12 @@ exaGlyphs (CARD8	op,
 	  GlyphPtr	*glyphs);
 
 /* exa_migration_classic.c */
+void
+exaCopyDirtyToSys (ExaMigrationPtr migrate);
+
+void
+exaCopyDirtyToFb (ExaMigrationPtr migrate);
+
 void
 exaDoMigration_classic (ExaMigrationPtr pixmaps, int npixmaps, Bool can_accel);
 
@@ -676,4 +696,7 @@ exaMoveOutPixmap_classic (PixmapPtr pPixmap);
 void
 exaMoveInPixmap_classic (PixmapPtr pPixmap);
 
+void
+exaPrepareAccessReg_classic(PixmapPtr pPixmap, int index, RegionPtr pReg);
+
 #endif /* EXAPRIV_H */

exa/exa_render.c

@@ -185,41 +185,56 @@ exaGetRGBAFromPixel(CARD32	pixel,
 		    CARD16	*green,
 		    CARD16	*blue,
 		    CARD16	*alpha,
-		    PictFormatPtr pFormat)
+		    PictFormatPtr pFormat,
+		    PictFormatShort format)
 {
     int rbits, bbits, gbits, abits;
     int rshift, bshift, gshift, ashift;
 
-    if (!PICT_FORMAT_COLOR(pFormat->format) &&
-	PICT_FORMAT_TYPE(pFormat->format) != PICT_TYPE_A)
+    if (!PICT_FORMAT_COLOR(format) && PICT_FORMAT_TYPE(format) != PICT_TYPE_A)
 	return FALSE;
 
-    rbits = PICT_FORMAT_R(pFormat->format);
-    gbits = PICT_FORMAT_G(pFormat->format);
-    bbits = PICT_FORMAT_B(pFormat->format);
-    abits = PICT_FORMAT_A(pFormat->format);
+    rbits = PICT_FORMAT_R(format);
+    gbits = PICT_FORMAT_G(format);
+    bbits = PICT_FORMAT_B(format);
+    abits = PICT_FORMAT_A(format);
 
-    rshift = pFormat->direct.red;
-    gshift = pFormat->direct.green;
-    bshift = pFormat->direct.blue;
-    ashift = pFormat->direct.alpha;
+    if (pFormat) {
+	rshift = pFormat->direct.red;
+	gshift = pFormat->direct.green;
+	bshift = pFormat->direct.blue;
+	ashift = pFormat->direct.alpha;
+    } else if (format == PICT_a8r8g8b8) {
+	rshift = 16;
+	gshift = 8;
+	bshift = 0;
+	ashift = 24;
+    } else
+	FatalError("EXA bug: exaGetRGBAFromPixel() doesn't match "
+		   "createSourcePicture()\n");
 
-    *red = ((pixel >> rshift ) & ((1 << rbits) - 1)) << (16 - rbits);
-    while (rbits < 16) {
-	*red |= *red >> rbits;
-	rbits <<= 1;
-    }
+    if (rbits) {
+	*red = ((pixel >> rshift ) & ((1 << rbits) - 1)) << (16 - rbits);
+	while (rbits < 16) {
+	    *red |= *red >> rbits;
+	    rbits <<= 1;
+	}
 
-    *green = ((pixel >> gshift ) & ((1 << gbits) - 1)) << (16 - gbits);
-    while (gbits < 16) {
-	*green |= *green >> gbits;
-	gbits <<= 1;
-    }
+	*green = ((pixel >> gshift ) & ((1 << gbits) - 1)) << (16 - gbits);
+	while (gbits < 16) {
+	    *green |= *green >> gbits;
+	    gbits <<= 1;
+	}
 
-    *blue = ((pixel >> bshift ) & ((1 << bbits) - 1)) << (16 - bbits);
-    while (bbits < 16) {
-	*blue |= *blue >> bbits;
-	bbits <<= 1;
+	*blue = ((pixel >> bshift ) & ((1 << bbits) - 1)) << (16 - bbits);
+	while (bbits < 16) {
+	    *blue |= *blue >> bbits;
+	    bbits <<= 1;
+	}
+    } else {
+	*red = 0x0000;
+	*green = 0x0000;
+	*blue = 0x0000;
     }
 
     if (abits) {
@@ -266,6 +281,10 @@ exaTryDriverSolidFill(PicturePtr	pSrc,
 
     xDst += pDst->pDrawable->x;
     yDst += pDst->pDrawable->y;
+    if (pSrc->pDrawable) {
+	xSrc += pSrc->pDrawable->x;
+	ySrc += pSrc->pDrawable->y;
+    }
 
     if (!miComputeCompositeRegion (&region, pSrc, NULL, pDst,
 				   xSrc, ySrc, 0, 0, xDst, yDst,
@@ -277,16 +296,13 @@ exaTryDriverSolidFill(PicturePtr	pSrc,
     REGION_TRANSLATE(pScreen, &region, dst_off_x, dst_off_y);
 
     if (pSrc->pDrawable) {
-	xSrc += pSrc->pDrawable->x;
-	ySrc += pSrc->pDrawable->y;
-
 	pSrcPix = exaGetDrawablePixmap (pSrc->pDrawable);
 	pixel = exaGetPixmapFirstPixel (pSrcPix);
     } else
 	pixel = pSrc->pSourcePict->solidFill.color;
 
     if (!exaGetRGBAFromPixel(pixel, &red, &green, &blue, &alpha,
-			     pSrc->pFormat) ||
+			     pSrc->pFormat, pSrc->format) ||
 	!exaGetPixelFromRGBA(&pixel, red, green, blue, alpha,
 			     pDst->pFormat))
     {
@@ -340,7 +356,8 @@ exaTryDriverCompositeRects(CARD8	       op,
 			   ExaCompositeRectPtr rects)
 {
     ExaScreenPriv (pDst->pDrawable->pScreen);
-    int src_off_x, src_off_y, mask_off_x, mask_off_y, dst_off_x, dst_off_y;
+    int src_off_x = 0, src_off_y = 0, mask_off_x = 0, mask_off_y = 0;
+    int dst_off_x, dst_off_y;
     PixmapPtr pSrcPix = NULL, pMaskPix = NULL, pDstPix;
     ExaPixmapPrivPtr pSrcExaPix = NULL, pMaskExaPix = NULL, pDstExaPix;
 
@@ -656,7 +673,7 @@ exaTryDriverComposite(CARD8		op,
      */
     if (pDstExaPix->accel_blocked ||
 	(pSrcExaPix && pSrcExaPix->accel_blocked) ||
-	(pMask && (pMaskExaPix->accel_blocked)))
+	(pMaskExaPix && (pMaskExaPix->accel_blocked)))
     {
 	return -1;
     }

exa/exa_unaccel.c

@@ -74,26 +74,26 @@ void
 ExaCheckFillSpans (DrawablePtr pDrawable, GCPtr pGC, int nspans,
 		   DDXPointPtr ppt, int *pwidth, int fSorted)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
     exaPrepareAccessGC (pGC);
     pGC->ops->FillSpans (pDrawable, pGC, nspans, ppt, pwidth, fSorted);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
 ExaCheckSetSpans (DrawablePtr pDrawable, GCPtr pGC, char *psrc,
 		 DDXPointPtr ppt, int *pwidth, int nspans, int fSorted)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
     pGC->ops->SetSpans (pDrawable, pGC, psrc, ppt, pwidth, nspans, fSorted);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -101,19 +101,21 @@ ExaCheckPutImage (DrawablePtr pDrawable, GCPtr pGC, int depth,
 		 int x, int y, int w, int h, int leftPad, int format,
 		 char *bits)
 {
-    ExaPixmapPriv(exaGetDrawablePixmap(pDrawable));
+    PixmapPtr pPixmap = exaGetDrawablePixmap(pDrawable);
+    ExaPixmapPriv(pPixmap);
 
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
-    if (exaGCReadsDestination(pDrawable, pGC->planemask, pGC->fillStyle,
+    if (!pExaScr->prepare_access_reg || !pExaPixmap->pDamage ||
+	exaGCReadsDestination(pDrawable, pGC->planemask, pGC->fillStyle,
 			      pGC->alu, pGC->clientClipType))
 	exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
     else
-	exaPrepareAccessReg (pDrawable, EXA_PREPARE_DEST, pExaPixmap->pDamage ?
-			     DamagePendingRegion(pExaPixmap->pDamage) : NULL);
+	pExaScr->prepare_access_reg(pPixmap, EXA_PREPARE_DEST,
+				    DamagePendingRegion(pExaPixmap->pDamage));
     pGC->ops->PutImage (pDrawable, pGC, depth, x, y, w, h, leftPad, format, bits);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -121,7 +123,7 @@ ExaCheckCopyNtoN (DrawablePtr pSrc, DrawablePtr pDst,  GCPtr pGC,
 	     BoxPtr	pbox, int nbox, int dx, int dy, Bool	reverse, 
 	     Bool upsidedown, Pixel bitplane, void *closure)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("from %p to %p (%c,%c)\n", pSrc, pDst,
 		  exaDrawableLocation(pSrc), exaDrawableLocation(pDst)));
     exaPrepareAccess (pDst, EXA_PREPARE_DEST);
@@ -134,7 +136,7 @@ ExaCheckCopyNtoN (DrawablePtr pSrc, DrawablePtr pDst,  GCPtr pGC,
     }
     exaFinishAccess (pSrc, EXA_PREPARE_SRC);
     exaFinishAccess (pDst, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 RegionPtr
@@ -143,7 +145,7 @@ ExaCheckCopyArea (DrawablePtr pSrc, DrawablePtr pDst, GCPtr pGC,
 {
     RegionPtr ret;
 
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("from %p to %p (%c,%c)\n", pSrc, pDst,
 		  exaDrawableLocation(pSrc), exaDrawableLocation(pDst)));
     exaPrepareAccess (pDst, EXA_PREPARE_DEST);
@@ -151,7 +153,7 @@ ExaCheckCopyArea (DrawablePtr pSrc, DrawablePtr pDst, GCPtr pGC,
     ret = pGC->ops->CopyArea (pSrc, pDst, pGC, srcx, srcy, w, h, dstx, dsty);
     exaFinishAccess (pSrc, EXA_PREPARE_SRC);
     exaFinishAccess (pDst, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 
     return ret;
 }
@@ -163,7 +165,7 @@ ExaCheckCopyPlane (DrawablePtr pSrc, DrawablePtr pDst, GCPtr pGC,
 {
     RegionPtr ret;
 
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("from %p to %p (%c,%c)\n", pSrc, pDst,
 		  exaDrawableLocation(pSrc), exaDrawableLocation(pDst)));
     exaPrepareAccess (pDst, EXA_PREPARE_DEST);
@@ -172,7 +174,7 @@ ExaCheckCopyPlane (DrawablePtr pSrc, DrawablePtr pDst, GCPtr pGC,
 		       bitPlane);
     exaFinishAccess (pSrc, EXA_PREPARE_SRC);
     exaFinishAccess (pDst, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 
     return ret;
 }
@@ -181,19 +183,19 @@ void
 ExaCheckPolyPoint (DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
 		  DDXPointPtr pptInit)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
     pGC->ops->PolyPoint (pDrawable, pGC, mode, npt, pptInit);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
 ExaCheckPolylines (DrawablePtr pDrawable, GCPtr pGC,
 		  int mode, int npt, DDXPointPtr ppt)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c), width %d, mode %d, count %d\n",
 		  pDrawable, exaDrawableLocation(pDrawable),
 		  pGC->lineWidth, mode, npt));
@@ -203,14 +205,14 @@ ExaCheckPolylines (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->Polylines (pDrawable, pGC, mode, npt, ppt);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
 ExaCheckPolySegment (DrawablePtr pDrawable, GCPtr pGC,
 		    int nsegInit, xSegment *pSegInit)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c) width %d, count %d\n", pDrawable,
 		  exaDrawableLocation(pDrawable), pGC->lineWidth, nsegInit));
 
@@ -219,14 +221,14 @@ ExaCheckPolySegment (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->PolySegment (pDrawable, pGC, nsegInit, pSegInit);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
 ExaCheckPolyArc (DrawablePtr pDrawable, GCPtr pGC,
 		int narcs, xArc *pArcs)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
 
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
@@ -234,14 +236,14 @@ ExaCheckPolyArc (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->PolyArc (pDrawable, pGC, narcs, pArcs);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
 ExaCheckPolyFillRect (DrawablePtr pDrawable, GCPtr pGC,
 		     int nrect, xRectangle *prect)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
 
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
@@ -249,7 +251,7 @@ ExaCheckPolyFillRect (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->PolyFillRect (pDrawable, pGC, nrect, prect);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -257,7 +259,7 @@ ExaCheckImageGlyphBlt (DrawablePtr pDrawable, GCPtr pGC,
 		      int x, int y, unsigned int nglyph,
 		      CharInfoPtr *ppci, pointer pglyphBase)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c)\n", pDrawable,
 		  exaDrawableLocation(pDrawable)));
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
@@ -265,7 +267,7 @@ ExaCheckImageGlyphBlt (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->ImageGlyphBlt (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -273,7 +275,7 @@ ExaCheckPolyGlyphBlt (DrawablePtr pDrawable, GCPtr pGC,
 		     int x, int y, unsigned int nglyph,
 		     CharInfoPtr *ppci, pointer pglyphBase)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("to %p (%c), style %d alu %d\n", pDrawable,
 		  exaDrawableLocation(pDrawable), pGC->fillStyle, pGC->alu));
     exaPrepareAccess (pDrawable, EXA_PREPARE_DEST);
@@ -281,7 +283,7 @@ ExaCheckPolyGlyphBlt (DrawablePtr pDrawable, GCPtr pGC,
     pGC->ops->PolyGlyphBlt (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
     exaFinishAccessGC (pGC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -289,7 +291,7 @@ ExaCheckPushPixels (GCPtr pGC, PixmapPtr pBitmap,
 		   DrawablePtr pDrawable,
 		   int w, int h, int x, int y)
 {
-    EXA_GC_PROLOGUE(pGC);
+    EXA_PRE_FALLBACK_GC(pGC);
     EXA_FALLBACK(("from %p to %p (%c,%c)\n", pBitmap, pDrawable,
 		  exaDrawableLocation(&pBitmap->drawable),
 		  exaDrawableLocation(pDrawable)));
@@ -300,7 +302,7 @@ ExaCheckPushPixels (GCPtr pGC, PixmapPtr pBitmap,
     exaFinishAccessGC (pGC);
     exaFinishAccess (&pBitmap->drawable, EXA_PREPARE_SRC);
     exaFinishAccess (pDrawable, EXA_PREPARE_DEST);
-    EXA_GC_EPILOGUE(pGC);
+    EXA_POST_FALLBACK_GC(pGC);
 }
 
 void
@@ -308,7 +310,7 @@ ExaCheckCopyWindow(WindowPtr pWin, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
 {
     DrawablePtr pDrawable = &pWin->drawable;
     ScreenPtr pScreen = pDrawable->pScreen;
-    ExaScreenPriv(pScreen);
+    EXA_PRE_FALLBACK(pScreen);
     EXA_FALLBACK(("from %p\n", pWin));
 
     /* being both src and dest, src is safest. */
@@ -317,36 +319,42 @@ ExaCheckCopyWindow(WindowPtr pWin, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
     pScreen->CopyWindow (pWin, ptOldOrg, prgnSrc);
     swap(pExaScr, pScreen, CopyWindow);
     exaFinishAccess (pDrawable, EXA_PREPARE_SRC);
+    EXA_POST_FALLBACK(pScreen);
 }
 
 void
 ExaCheckGetImage(DrawablePtr pDrawable, int x, int y, int w, int h,
 		unsigned int format, unsigned long planeMask, char *d)
 {
-    BoxRec Box;
-    RegionRec Reg;
-    int xoff, yoff;
     ScreenPtr pScreen = pDrawable->pScreen;
     PixmapPtr pPix = exaGetDrawablePixmap (pDrawable);
-    ExaScreenPriv(pScreen);
-
+    EXA_PRE_FALLBACK(pScreen);
     EXA_FALLBACK(("from %p (%c)\n", pDrawable,
 		  exaDrawableLocation(pDrawable)));
 
-    exaGetDrawableDeltas(pDrawable, pPix, &xoff, &yoff);
+    if (pExaScr->prepare_access_reg) {
+	int xoff, yoff;
+	BoxRec Box;
+	RegionRec Reg;
 
-    Box.x1 = pDrawable->y + x + xoff;
-    Box.y1 = pDrawable->y + y + yoff;
-    Box.x2 = Box.x1 + w;
-    Box.y2 = Box.y1 + h;
+	exaGetDrawableDeltas(pDrawable, pPix, &xoff, &yoff);
 
-    REGION_INIT(pScreen, &Reg, &Box, 1);
+	Box.x1 = pDrawable->y + x + xoff;
+	Box.y1 = pDrawable->y + y + yoff;
+	Box.x2 = Box.x1 + w;
+	Box.y2 = Box.y1 + h;
+
+	REGION_INIT(pScreen, &Reg, &Box, 1);
+
+	pExaScr->prepare_access_reg(pPix, EXA_PREPARE_SRC, &Reg);
+    } else
+	exaPrepareAccess(pDrawable, EXA_PREPARE_SRC);
 
-    exaPrepareAccessReg (pDrawable, EXA_PREPARE_SRC, &Reg);
     swap(pExaScr, pScreen, GetImage);
     pScreen->GetImage (pDrawable, x, y, w, h, format, planeMask, d);
     swap(pExaScr, pScreen, GetImage);
     exaFinishAccess (pDrawable, EXA_PREPARE_SRC);
+    EXA_POST_FALLBACK(pScreen);
 }
 
 void
@@ -358,14 +366,15 @@ ExaCheckGetSpans (DrawablePtr pDrawable,
 		 char *pdstStart)
 {
     ScreenPtr pScreen = pDrawable->pScreen;
-    ExaScreenPriv(pScreen);
 
+    EXA_PRE_FALLBACK(pScreen);
     EXA_FALLBACK(("from %p (%c)\n", pDrawable, exaDrawableLocation(pDrawable)));
     exaPrepareAccess (pDrawable, EXA_PREPARE_SRC);
     swap(pExaScr, pScreen, GetSpans);
     pScreen->GetSpans (pDrawable, wMax, ppt, pwidth, nspans, pdstStart);
     swap(pExaScr, pScreen, GetSpans);
     exaFinishAccess (pDrawable, EXA_PREPARE_SRC);
+    EXA_POST_FALLBACK(pScreen);
 }
 
 void
@@ -386,9 +395,9 @@ ExaCheckComposite (CARD8      op,
 #ifdef RENDER
     PictureScreenPtr	ps = GetPictureScreen(pScreen);
 #endif /* RENDER */
-    ExaScreenPriv(pScreen);
     RegionRec region;
     int xoff, yoff;
+    EXA_PRE_FALLBACK(pScreen);
 
     REGION_NULL(pScreen, &region);
 
@@ -401,23 +410,23 @@ ExaCheckComposite (CARD8      op,
     if (pMask && pMask->alphaMap && pMask->alphaMap->pDrawable)
 	exaPrepareAccess(pMask->alphaMap->pDrawable, EXA_PREPARE_AUX_MASK);
 
-    if (!exaOpReadsDestination(op)) {
+    if (!exaOpReadsDestination(op) && pExaScr->prepare_access_reg) {
+	PixmapPtr pDstPix;
+
 	if (!miComputeCompositeRegion (&region, pSrc, pMask, pDst,
 				       xSrc, ySrc, xMask, yMask, xDst, yDst,
 				       width, height))
 	    goto skip;
 
-	exaGetDrawableDeltas (pDst->pDrawable,
-			      exaGetDrawablePixmap(pDst->pDrawable),
-			      &xoff, &yoff);
-
+	pDstPix = exaGetDrawablePixmap(pDst->pDrawable);
+	exaGetDrawableDeltas (pDst->pDrawable, pDstPix, &xoff, &yoff);
 	REGION_TRANSLATE(pScreen, &region, xoff, yoff);
 
 	if (pDst->alphaMap && pDst->alphaMap->pDrawable)
-	    exaPrepareAccessReg(pDst->alphaMap->pDrawable, EXA_PREPARE_AUX_DEST,
-				&region);
+	    pExaScr->prepare_access_reg(exaGetDrawablePixmap(pDst->alphaMap->pDrawable),
+					EXA_PREPARE_AUX_DEST, &region);
 
-	exaPrepareAccessReg (pDst->pDrawable, EXA_PREPARE_DEST, &region);
+	pExaScr->prepare_access_reg(pDstPix, EXA_PREPARE_DEST, &region);
     } else {
 	if (pDst->alphaMap && pDst->alphaMap->pDrawable)
 	    exaPrepareAccess(pDst->alphaMap->pDrawable, EXA_PREPARE_AUX_DEST);
@@ -463,6 +472,7 @@ skip:
 	exaFinishAccess(pMask->alphaMap->pDrawable, EXA_PREPARE_AUX_MASK);
 
     REGION_UNINIT(pScreen, &region);
+    EXA_POST_FALLBACK(pScreen);
 }
 
 void
@@ -476,7 +486,7 @@ ExaCheckAddTraps (PicturePtr	pPicture,
 #ifdef RENDER
     PictureScreenPtr	ps = GetPictureScreen(pScreen);
 #endif /* RENDER */
-    ExaScreenPriv(pScreen);
+    EXA_PRE_FALLBACK(pScreen);
 
     EXA_FALLBACK(("to pict %p (%c)\n",
 		  exaDrawableLocation(pPicture->pDrawable)));
@@ -487,6 +497,7 @@ ExaCheckAddTraps (PicturePtr	pPicture,
     swap(pExaScr, ps, AddTraps);
 #endif /* RENDER */
     exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
+    EXA_POST_FALLBACK(pScreen);
 }
 
 /**
@@ -514,6 +525,8 @@ exaGetPixmapFirstPixel (PixmapPtr pPixmap)
 	    return pixel;
 	}
     case 8:
+    case 4:
+    case 1:
 	{
 	    CARD8 pixel;
 

fb/fb.h

@@ -700,38 +700,41 @@ typedef struct {
 #define __fbPixOffXPix(pPix)	(__fbPixDrawableX(pPix))
 #define __fbPixOffYPix(pPix)	(__fbPixDrawableY(pPix))
 
-#define fbGetDrawable(pDrawable, pointer, stride, bpp, xoff, yoff) { \
-    PixmapPtr   _pPix; \
-    if ((pDrawable)->type != DRAWABLE_PIXMAP) { \
-	_pPix = fbGetWindowPixmap(pDrawable); \
-	(xoff) = __fbPixOffXWin(_pPix); \
-	(yoff) = __fbPixOffYWin(_pPix); \
-    } else { \
-	_pPix = (PixmapPtr) (pDrawable); \
-	(xoff) = __fbPixOffXPix(_pPix); \
-	(yoff) = __fbPixOffYPix(_pPix); \
-    } \
-    fbPrepareAccess(pDrawable); \
-    (pointer) = (FbBits *) _pPix->devPrivate.ptr; \
-    (stride) = ((int) _pPix->devKind) / sizeof (FbBits); (void)(stride); \
-    (bpp) = _pPix->drawable.bitsPerPixel;  (void)(bpp); \
+#define fbGetDrawablePixmap(pDrawable, pixmap, xoff, yoff) {			\
+    if ((pDrawable)->type != DRAWABLE_PIXMAP) { 				\
+	(pixmap) = fbGetWindowPixmap(pDrawable);				\
+	(xoff) = __fbPixOffXWin(pixmap); 					\
+	(yoff) = __fbPixOffYWin(pixmap); 					\
+    } else { 									\
+	(pixmap) = (PixmapPtr) (pDrawable);					\
+	(xoff) = __fbPixOffXPix(pixmap); 					\
+	(yoff) = __fbPixOffYPix(pixmap); 					\
+    } 										\
+    fbPrepareAccess(pDrawable); 						\
 }
 
-#define fbGetStipDrawable(pDrawable, pointer, stride, bpp, xoff, yoff) { \
-    PixmapPtr   _pPix; \
-    if ((pDrawable)->type != DRAWABLE_PIXMAP) { \
-	_pPix = fbGetWindowPixmap(pDrawable); \
-	(xoff) = __fbPixOffXWin(_pPix); \
-	(yoff) = __fbPixOffYWin(_pPix); \
-    } else { \
-	_pPix = (PixmapPtr) (pDrawable); \
-	(xoff) = __fbPixOffXPix(_pPix); \
-	(yoff) = __fbPixOffYPix(_pPix); \
-    } \
-    fbPrepareAccess(pDrawable); \
-    (pointer) = (FbStip *) _pPix->devPrivate.ptr; \
-    (stride) = ((int) _pPix->devKind) / sizeof (FbStip); (void)(stride); \
-    (bpp) = _pPix->drawable.bitsPerPixel; (void)(bpp); \
+#define fbGetPixmapBitsData(pixmap, pointer, stride, bpp) {			\
+    (pointer) = (FbBits *) (pixmap)->devPrivate.ptr; 			       	\
+    (stride) = ((int) (pixmap)->devKind) / sizeof (FbBits); (void)(stride);	\
+    (bpp) = (pixmap)->drawable.bitsPerPixel;  (void)(bpp); 			\
+}
+
+#define fbGetPixmapStipData(pixmap, pointer, stride, bpp) {			\
+    (pointer) = (FbStip *) (pixmap)->devPrivate.ptr; 			       	\
+    (stride) = ((int) (pixmap)->devKind) / sizeof (FbStip); (void)(stride);	\
+    (bpp) = (pixmap)->drawable.bitsPerPixel;  (void)(bpp); 			\
+}
+
+#define fbGetDrawable(pDrawable, pointer, stride, bpp, xoff, yoff) { 		\
+    PixmapPtr   _pPix; 								\
+    fbGetDrawablePixmap(pDrawable, _pPix, xoff, yoff); 				\
+    fbGetPixmapBitsData(_pPix, pointer, stride, bpp);				\
+}
+
+#define fbGetStipDrawable(pDrawable, pointer, stride, bpp, xoff, yoff) { 	\
+    PixmapPtr   _pPix; 								\
+    fbGetDrawablePixmap(pDrawable, _pPix, xoff, yoff);				\
+    fbGetPixmapStipData(_pPix, pointer, stride, bpp);				\
 }
 
 /*
@@ -2079,9 +2082,16 @@ fbFillRegionSolid (DrawablePtr	pDrawable,
 		   FbBits	xor);
 
 extern _X_EXPORT pixman_image_t *
-image_from_pict (PicturePtr pict,
-		 Bool       has_clip,
-		 Bool	    is_src);
+image_from_pict (PicturePtr	pict,
+		 Bool		has_clip,
+		 Bool		is_src);
+
+extern _X_EXPORT pixman_image_t *
+image_from_pict_18 (PicturePtr	pict,
+		 Bool		has_clip,
+		 int		*xoff,
+		 int		*yoff);
+
 extern _X_EXPORT void free_pixman_pict (PicturePtr, pixman_image_t *);
 
 #endif /* _FB_H_ */

fb/fbbits.h

@@ -25,7 +25,7 @@
  * underlying datatypes instead of masks
  */
 
-#define isClipped(c,ul,lr)  ((((c) - (ul)) | ((lr) - (c))) & 0x80008000)
+#define isClipped(c,ul,lr)  (((c) | ((c) - (ul)) | ((lr) - (c))) & 0x80008000)
 
 #ifdef HAVE_DIX_CONFIG_H
 #include <dix-config.h>

fb/fbcmap.c

@@ -1,32 +1,25 @@
-/************************************************************
-Copyright 1987 by Sun Microsystems, Inc. Mountain View, CA.
-
-                    All Rights Reserved
-
-Permission  to  use,  copy,  modify,  and  distribute   this
-software  and  its documentation for any purpose and without
-fee is hereby granted, provided that the above copyright no-
-tice  appear  in all copies and that both that copyright no-
-tice and this permission notice appear in  supporting  docu-
-mentation,  and  that the names of Sun or X Consortium
-not be used in advertising or publicity pertaining to 
-distribution  of  the software  without specific prior 
-written permission. Sun and X Consortium make no 
-representations about the suitability of this software for 
-any purpose. It is provided "as is" without any express or 
-implied warranty.
-
-SUN DISCLAIMS ALL WARRANTIES WITH REGARD TO  THIS  SOFTWARE,
-INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FIT-
-NESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SUN BE  LI-
-ABLE  FOR  ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
-ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,  DATA  OR
-PROFITS,  WHETHER  IN  AN  ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION  WITH
-THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-********************************************************/
-
+/*
+ * Copyright © 1987 Sun Microsystems, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
 
 #ifdef HAVE_DIX_CONFIG_H
 #include <dix-config.h>

fb/fbcmap_mi.c

@@ -1,32 +1,25 @@
-/************************************************************
-Copyright 1987 by Sun Microsystems, Inc. Mountain View, CA.
-
-                    All Rights Reserved
-
-Permission  to  use,  copy,  modify,  and  distribute   this
-software  and  its documentation for any purpose and without
-fee is hereby granted, provided that the above copyright no-
-tice  appear  in all copies and that both that copyright no-
-tice and this permission notice appear in  supporting  docu-
-mentation,  and  that the names of Sun or X Consortium
-not be used in advertising or publicity pertaining to 
-distribution  of  the software  without specific prior 
-written permission. Sun and X Consortium make no 
-representations about the suitability of this software for 
-any purpose. It is provided "as is" without any express or 
-implied warranty.
-
-SUN DISCLAIMS ALL WARRANTIES WITH REGARD TO  THIS  SOFTWARE,
-INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FIT-
-NESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SUN BE  LI-
-ABLE  FOR  ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
-ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,  DATA  OR
-PROFITS,  WHETHER  IN  AN  ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION  WITH
-THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-********************************************************/
-
+/*
+ * Copyright © 1987 Sun Microsystems, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
 
 /**
  * This version of fbcmap.c is implemented in terms of mi functions.

fb/fbpict.c

@@ -158,19 +158,24 @@ fbComposite (CARD8      op,
 	     CARD16     height)
 {
     pixman_image_t *src, *mask, *dest;
+    int src_xoff, src_yoff;
+    int msk_xoff, msk_yoff;
+    int dst_xoff, dst_yoff;
     
-    miCompositeSourceValidate (pSrc, xSrc, ySrc, width, height);
+    miCompositeSourceValidate (pSrc, xSrc - xDst, ySrc - yDst, width, height);
     if (pMask)
-	miCompositeSourceValidate (pMask, xMask, yMask, width, height);
+	miCompositeSourceValidate (pMask, xMask - xDst, yMask - yDst, width, height);
     
-    src = image_from_pict (pSrc, TRUE, TRUE);
-    mask = image_from_pict (pMask, TRUE, TRUE);
-    dest = image_from_pict (pDst, TRUE, FALSE);
+    src = image_from_pict_18 (pSrc, FALSE, &src_xoff, &src_yoff);
+    mask = image_from_pict_18 (pMask, FALSE, &msk_xoff, &msk_yoff);
+    dest = image_from_pict_18 (pDst, TRUE, &dst_xoff, &dst_yoff);
 
     if (src && dest && !(pMask && !mask))
     {
 	pixman_image_composite (op, src, mask, dest,
-				xSrc, ySrc, xMask, yMask, xDst, yDst,
+				xSrc + src_xoff, ySrc + src_yoff,
+				xMask + msk_xoff, yMask + msk_yoff,
+				xDst + dst_xoff, yDst + dst_yoff,
 				width, height);
     }
 
@@ -268,80 +273,24 @@ create_conical_gradient_image (PictGradient *gradient)
 	gradient->nstops);
 }
 
-static DrawablePtr 
-copy_drawable (DrawablePtr pDraw)
-{
-    ScreenPtr pScreen = pDraw->pScreen;
-    PixmapPtr pPixmap;
-    GCPtr pGC;
-    int width, height;
-    ChangeGCVal gcv[2];
-    
-    width = pDraw->width;
-    height = pDraw->height;
-    
-    pPixmap = (*pScreen->CreatePixmap) (pScreen, width, height, pDraw->depth, 0);
-    
-    if (!pPixmap)
-	return NULL;
-    
-    pGC = GetScratchGC (pDraw->depth, pScreen);
-    
-    if (!pGC)
-    {
-	(*pScreen->DestroyPixmap) (pPixmap);
-	return NULL;
-    }
-    
-    /* First fill the pixmap with zeros */
-    gcv[0].val = 0x00000000;
-    gcv[1].val = IncludeInferiors;
-    dixChangeGC (NullClient, pGC, GCBackground | GCSubwindowMode, NULL, gcv);
-    ValidateGC ((DrawablePtr)pPixmap, pGC);
-    miClearDrawable ((DrawablePtr)pPixmap, pGC);
-    
-    /* Then copy the window there */
-    ValidateGC(&pPixmap->drawable, pGC);
-    (* pGC->ops->CopyArea) (pDraw, &pPixmap->drawable, pGC, 0, 0, width, height, 0, 0);
-    
-    FreeScratchGC (pGC);
-    
-    return &pPixmap->drawable;
-}
-
-static void
-destroy_drawable (pixman_image_t *image, void *data)
-{
-    DrawablePtr pDrawable = data;
-    ScreenPtr pScreen = pDrawable->pScreen;
-
-    pScreen->DestroyPixmap ((PixmapPtr)pDrawable);
-}
-
 static pixman_image_t *
 create_bits_picture (PicturePtr pict,
-		     Bool	has_clip,
-		     Bool       is_src)
+		     Bool       has_clip,
+		     int	*xoff,
+		     int	*yoff)
 {
+    PixmapPtr pixmap;
     FbBits *bits;
     FbStride stride;
-    int bpp, xoff, yoff;
+    int bpp;
     pixman_image_t *image;
-    DrawablePtr drawable;
-
-    if (is_src && pict->pDrawable->type == DRAWABLE_WINDOW)
-	drawable = copy_drawable (pict->pDrawable);
-    else
-	drawable = pict->pDrawable;
     
-    fbGetDrawable (drawable, bits, stride, bpp, xoff, yoff);
-
-    bits = (FbBits*)((CARD8*)bits +
-		     (drawable->y + yoff) * stride * sizeof(FbBits) +
-		     (drawable->x + xoff) * (bpp / 8));
+    fbGetDrawablePixmap (pict->pDrawable, pixmap, *xoff, *yoff);
+    fbGetPixmapBitsData(pixmap, bits, stride, bpp);
 
     image = pixman_image_create_bits (
-	pict->format, drawable->width, drawable->height,
+	pict->format,
+	pixmap->drawable.width, pixmap->drawable.height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
     
     
@@ -359,59 +308,60 @@ create_bits_picture (PicturePtr pict,
 #endif
 #endif
     
+    /* pCompositeClip is undefined for source pictures, so
+     * only set the clip region for pictures with drawables
+     */
     if (has_clip)
     {
-	if (is_src)
-	{
-	    if (pict->clientClipType != CT_NONE)
-	    {
-		pixman_image_set_has_client_clip (image, TRUE);
+	if (pict->clientClipType != CT_NONE)
+	    pixman_image_set_has_client_clip (image, TRUE);
 
-		pixman_region_translate (pict->clientClip,
-					 pict->clipOrigin.x,
-					 pict->clipOrigin.y);
-		
-		pixman_image_set_clip_region (image, pict->clientClip);
+	if (*xoff || *yoff)
+	    pixman_region_translate (pict->pCompositeClip, *xoff, *yoff);
 
-		pixman_region_translate (pict->clientClip,
-					 - pict->clipOrigin.x,
-					 - pict->clipOrigin.y);
-	    }
-	}
-	else
-	{
-	    pixman_region_translate (pict->pCompositeClip,
-				     - pict->pDrawable->x,
-				     - pict->pDrawable->y);
+	pixman_image_set_clip_region (image, pict->pCompositeClip);
 
-	    pixman_image_set_clip_region (image, pict->pCompositeClip);
-	    
-	    pixman_region_translate (pict->pCompositeClip,
-				     pict->pDrawable->x,
-				     pict->pDrawable->y);
-	}
+	if (*xoff || *yoff)
+	    pixman_region_translate (pict->pCompositeClip, -*xoff, -*yoff);
     }
     
     /* Indexed table */
     if (pict->pFormat->index.devPrivate)
 	pixman_image_set_indexed (image, pict->pFormat->index.devPrivate);
 
-    if (drawable != pict->pDrawable)
-	pixman_image_set_destroy_function (image, destroy_drawable, drawable);
-    
+    /* Add in drawable origin to position within the image */
+    *xoff += pict->pDrawable->x;
+    *yoff += pict->pDrawable->y;
+
     return image;
 }
 
 static void
-set_image_properties (pixman_image_t *image, PicturePtr pict)
+set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int *xoff, int *yoff)
 {
     pixman_repeat_t repeat;
     pixman_filter_t filter;
     
     if (pict->transform)
     {
-	pixman_image_set_transform (
-	    image, (pixman_transform_t *)pict->transform);
+	/* For source images, adjust the transform to account
+	 * for the drawable offset within the pixman image,
+	 * then set the offset to 0 as it will be used
+	 * to compute positions within the transformed image.
+	 */
+	if (!has_clip) {
+	    struct pixman_transform	adjusted;
+
+	    adjusted = *pict->transform;
+	    pixman_transform_translate(&adjusted,
+				       NULL,
+				       pixman_int_to_fixed(*xoff),
+				       pixman_int_to_fixed(*yoff));
+	    pixman_image_set_transform (image, &adjusted);
+	    *xoff = 0;
+	    *yoff = 0;
+	} else
+	    pixman_image_set_transform (image, pict->transform);
     }
     
     switch (pict->repeatType)
@@ -438,7 +388,8 @@ set_image_properties (pixman_image_t *image, PicturePtr pict)
     
     if (pict->alphaMap)
     {
-	pixman_image_t *alpha_map = image_from_pict (pict->alphaMap, TRUE, TRUE);
+	int alpha_xoff, alpha_yoff;
+	pixman_image_t *alpha_map = image_from_pict_18 (pict->alphaMap, FALSE, &alpha_xoff, &alpha_yoff);
 	
 	pixman_image_set_alpha_map (
 	    image, alpha_map, pict->alphaOrigin.x, pict->alphaOrigin.y);
@@ -470,10 +421,9 @@ set_image_properties (pixman_image_t *image, PicturePtr pict)
     pixman_image_set_source_clipping (image, TRUE);
 }
 
+
 pixman_image_t *
-image_from_pict (PicturePtr pict,
-		 Bool has_clip,
-		 Bool is_src)
+image_from_pict_18 (PicturePtr pict, Bool has_clip, int *xoff, int *yoff)
 {
     pixman_image_t *image = NULL;
 
@@ -482,7 +432,7 @@ image_from_pict (PicturePtr pict,
 
     if (pict->pDrawable)
     {
-	image = create_bits_picture (pict, has_clip, is_src);
+	image = create_bits_picture (pict, has_clip, xoff, yoff);
     }
     else if (pict->pSourcePict)
     {
@@ -503,14 +453,22 @@ image_from_pict (PicturePtr pict,
 	    else if (sp->type == SourcePictTypeConical)
 		image = create_conical_gradient_image (gradient);
 	}
+	*xoff = *yoff = 0;
     }
     
     if (image)
-	set_image_properties (image, pict);
+	set_image_properties (image, pict, has_clip, xoff, yoff);
     
     return image;
 }
 
+pixman_image_t *
+image_from_pict (PicturePtr pict, Bool has_clip, Bool is_src)
+{
+    int xoff = 0, yoff = 0;
+    return image_from_pict_18(pict, has_clip, &xoff, &yoff);
+}
+
 void
 free_pixman_pict (PicturePtr pict, pixman_image_t *image)
 {
@@ -540,3 +498,4 @@ fbPictureInit (ScreenPtr pScreen, PictFormatPtr formats, int nformats)
 
     return TRUE;
 }
+

fb/fbtrap.c

@@ -40,7 +40,8 @@ fbAddTraps (PicturePtr	pPicture,
 	    int		ntrap,
 	    xTrap	*traps)
 {
-    pixman_image_t *image = image_from_pict (pPicture, FALSE, FALSE);
+    int image_xoff, image_yoff;
+    pixman_image_t *image = image_from_pict_18 (pPicture, FALSE, &image_xoff, &image_yoff);
 
     if (!image)
 	return;
@@ -56,7 +57,8 @@ fbRasterizeTrapezoid (PicturePtr    pPicture,
 		      int	    x_off,
 		      int	    y_off)
 {
-    pixman_image_t *image = image_from_pict (pPicture, FALSE, FALSE);
+    int	mask_xoff, mask_yoff;
+    pixman_image_t *image = image_from_pict_18 (pPicture, FALSE, &mask_xoff, &mask_yoff);
 
     if (!image)
 	return;

fb/wfbrename.h

@@ -187,4 +187,5 @@
 #define fbZeroSegment wfbZeroSegment
 #define free_pixman_pict wfb_free_pixman_pict
 #define image_from_pict wfb_image_from_pict
+#define image_from_pict_18 wfb_image_from_pict_18
 #define composeFunctions wfbComposeFunctions

glx/glapi.c

@@ -114,10 +114,15 @@ warn(void)
    }
 }
 
+#if defined(__GNUC__) && (__GNUC__ > 2)
+#define possibly_unused __attribute((unused))
+#else
+#define possibly_unused
+#endif
 
 #define KEYWORD1 static
 #define KEYWORD1_ALT static
-#define KEYWORD2 GLAPIENTRY
+#define KEYWORD2 GLAPIENTRY possibly_unused
 #define NAME(func)  NoOp##func
 
 #define F NULL

glx/glxcmds.c

@@ -58,7 +58,7 @@ validGlxScreen(ClientPtr client, int screen, __GLXscreen **pGlxScreen, int *err)
     /*
     ** Check if screen exists.
     */
-    if (screen >= screenInfo.numScreens) {
+    if (screen < 0 || screen >= screenInfo.numScreens) {
 	client->errorValue = screen;
 	*err = BadValue;
 	return FALSE;
@@ -312,11 +312,14 @@ DoCreateContext(__GLXclientState *cl, GLXContextID gcId,
 
 int __glXDisp_CreateContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateContextReq *req = (xGLXCreateContextReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXCreateContextReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxVisual(cl->client, pGlxScreen, req->visual, &config, &err))
@@ -328,11 +331,14 @@ int __glXDisp_CreateContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateNewContextReq *req = (xGLXCreateNewContextReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXCreateNewContextReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxFBConfig(cl->client, pGlxScreen, req->fbconfig, &config, &err))
@@ -344,12 +350,15 @@ int __glXDisp_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateContextWithConfigSGIXReq *req = 
 	(xGLXCreateContextWithConfigSGIXReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXCreateContextWithConfigSGIXReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxFBConfig(cl->client, pGlxScreen, req->fbconfig, &config, &err))
@@ -360,10 +369,13 @@ int __glXDisp_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 }
 int __glXDisp_DestroyContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyContextReq *req = (xGLXDestroyContextReq *) pc;
     __GLXcontext *glxc;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyContextReq);
+
     if (!validGlxContext(cl->client, req->context, DixDestroyAccess,
 			 &glxc, &err))
 	    return err;
@@ -675,24 +687,33 @@ DoMakeCurrent(__GLXclientState *cl,
 
 int __glXDisp_MakeCurrent(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeCurrentReq *req = (xGLXMakeCurrentReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReq);
+
     return DoMakeCurrent( cl, req->drawable, req->drawable,
 			  req->context, req->oldContextTag );
 }
 
 int __glXDisp_MakeContextCurrent(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeContextCurrentReq *req = (xGLXMakeContextCurrentReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXMakeContextCurrentReq);
+
     return DoMakeCurrent( cl, req->drawable, req->readdrawable,
 			  req->context, req->oldContextTag );
 }
 
 int __glXDisp_MakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeCurrentReadSGIReq *req = (xGLXMakeCurrentReadSGIReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReadSGIReq);
+
     return DoMakeCurrent( cl, req->drawable, req->readable,
 			  req->context, req->oldContextTag );
 }
@@ -705,6 +726,8 @@ int __glXDisp_IsDirect(__GLXclientState *cl, GLbyte *pc)
     __GLXcontext *glxc;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXIsDirectReq);
+
     if (!validGlxContext(cl->client, req->context, DixReadAccess, &glxc, &err))
 	return err;
 
@@ -729,6 +752,8 @@ int __glXDisp_QueryVersion(__GLXclientState *cl, GLbyte *pc)
     xGLXQueryVersionReply reply;
     GLuint major, minor;
 
+    REQUEST_SIZE_MATCH(xGLXQueryVersionReq);
+
     major = req->majorVersion;
     minor = req->minorVersion;
     (void)major;
@@ -755,11 +780,15 @@ int __glXDisp_QueryVersion(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_WaitGL(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXWaitGLReq *req = (xGLXWaitGLReq *)pc;
-    GLXContextTag tag = req->contextTag;
+    GLXContextTag tag;
     __GLXcontext *glxc = NULL;
     int error;
 
+    REQUEST_SIZE_MATCH(xGLXWaitGLReq);
+
+    tag = req->contextTag;
     if (tag) {
 	glxc = __glXLookupContextByTag(cl, tag);
 	if (!glxc)
@@ -779,11 +808,15 @@ int __glXDisp_WaitGL(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_WaitX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXWaitXReq *req = (xGLXWaitXReq *)pc;
-    GLXContextTag tag = req->contextTag;
+    GLXContextTag tag;
     __GLXcontext *glxc = NULL;
     int error;
 
+    REQUEST_SIZE_MATCH(xGLXWaitXReq);
+
+    tag = req->contextTag;
     if (tag) {
 	glxc = __glXLookupContextByTag(cl, tag);
 	if (!glxc)
@@ -803,13 +836,19 @@ int __glXDisp_CopyContext(__GLXclientState *cl, GLbyte *pc)
 {
     ClientPtr client = cl->client;
     xGLXCopyContextReq *req = (xGLXCopyContextReq *) pc;
-    GLXContextID source = req->source;
-    GLXContextID dest = req->dest;
-    GLXContextTag tag = req->contextTag;
-    unsigned long mask = req->mask;
+    GLXContextID source;
+    GLXContextID dest;
+    GLXContextTag tag;
+    unsigned long mask;
     __GLXcontext *src, *dst;
     int error;
 
+    REQUEST_SIZE_MATCH(xGLXCopyContextReq);
+
+    source = req->source;
+    dest = req->dest;
+    tag = req->contextTag;
+    mask = req->mask;
     if (!validGlxContext(cl->client, source, DixReadAccess, &src, &error))
 	return error;
     if (!validGlxContext(cl->client, dest, DixWriteAccess, &dst, &error))
@@ -892,6 +931,8 @@ int __glXDisp_GetVisualConfigs(__GLXclientState *cl, GLbyte *pc)
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXGetVisualConfigsReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
 
@@ -1071,13 +1112,18 @@ DoGetFBConfigs(__GLXclientState *cl, unsigned screen)
 
 int __glXDisp_GetFBConfigs(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetFBConfigsReq *req = (xGLXGetFBConfigsReq *) pc;
+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsReq);
     return DoGetFBConfigs(cl, req->screen);
 }
 
 int __glXDisp_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
+    /* work around mesa bug, don't use REQUEST_SIZE_MATCH */
+    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
     return DoGetFBConfigs(cl, req->screen);
 }
 
@@ -1203,11 +1249,14 @@ determineTextureTarget(ClientPtr client, XID glxDrawableID,
 
 int __glXDisp_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPixmapReq *req = (xGLXCreateGLXPixmapReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxVisual(cl->client, pGlxScreen, req->visual, &config, &err))
@@ -1219,11 +1268,19 @@ int __glXDisp_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreatePixmapReq *req = (xGLXCreatePixmapReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreatePixmapReq);
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreatePixmapReq, req->numAttribs << 3);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxFBConfig(cl->client, pGlxScreen, req->fbconfig, &config, &err))
@@ -1242,12 +1299,15 @@ int __glXDisp_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_CreateGLXPixmapWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPixmapWithConfigSGIXReq *req = 
 	(xGLXCreateGLXPixmapWithConfigSGIXReq *) pc;
     __GLXconfig *config;
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapWithConfigSGIXReq);
+
     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxFBConfig(cl->client, pGlxScreen, req->fbconfig, &config, &err))
@@ -1274,15 +1334,23 @@ static int DoDestroyDrawable(__GLXclientState *cl, XID glxdrawable, int type)
 
 int __glXDisp_DestroyGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
+
     return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
 }
 
 int __glXDisp_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc;
 
+    /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set
+     * length to 3 instead of 2 */
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq);
+
     return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
 }
 
@@ -1311,10 +1379,18 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId,
 
 int __glXDisp_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreatePbufferReq	*req = (xGLXCreatePbufferReq *) pc;
     CARD32			*attrs;
     int				 width, height, i;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreatePbufferReq);
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreatePbufferReq, req->numAttribs << 3);
+
     attrs = (CARD32 *) (req + 1);
     width = 0;
     height = 0;
@@ -1340,23 +1416,32 @@ int __glXDisp_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq);
+
     return DoCreatePbuffer(cl->client, req->screen, req->fbconfig,
 			   req->width, req->height, req->pbuffer);
 }
 
 int __glXDisp_DestroyPbuffer(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyPbufferReq *req = (xGLXDestroyPbufferReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyPbufferReq);
+
     return DoDestroyDrawable(cl, req->pbuffer, GLX_DRAWABLE_PBUFFER);
 }
 
 int __glXDisp_DestroyGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyGLXPbufferSGIXReq *req = (xGLXDestroyGLXPbufferSGIXReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPbufferSGIXReq);
+
     return DoDestroyDrawable(cl, req->pbuffer, GLX_DRAWABLE_PBUFFER);
 }
 
@@ -1387,18 +1472,40 @@ DoChangeDrawableAttributes(ClientPtr client, XID glxdrawable,
 
 int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXChangeDrawableAttributesReq *req =
 	(xGLXChangeDrawableAttributesReq *) pc;
 
+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesReq);
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+#if 0
+    /* mesa sends an additional 8 bytes */
+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
+#else
+    if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
+	    return BadLength;
+#endif
+
     return DoChangeDrawableAttributes(cl->client, req->drawable,
 				      req->numAttribs, (CARD32 *) (req + 1));
 }
 
 int __glXDisp_ChangeDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXChangeDrawableAttributesSGIXReq *req =
 	(xGLXChangeDrawableAttributesSGIXReq *)pc;
 
+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesSGIXReq);
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesSGIXReq, req->numAttribs << 3);
+
     return DoChangeDrawableAttributes(cl->client, req->drawable,
 				      req->numAttribs, (CARD32 *) (req + 1));
 }
@@ -1412,6 +1519,13 @@ int __glXDisp_CreateWindow(__GLXclientState *cl, GLbyte *pc)
     DrawablePtr		 pDraw;
     int			 err;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreateWindowReq);
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreateWindowReq, req->numAttribs << 3);
+
     if (!validGlxScreen(client, req->screen, &pGlxScreen, &err))
 	return err;
     if (!validGlxFBConfig(client, pGlxScreen, req->fbconfig, &config, &err))
@@ -1432,8 +1546,12 @@ int __glXDisp_CreateWindow(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
 
+    /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
+
     return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW);
 }
 
@@ -1449,12 +1567,16 @@ int __glXDisp_SwapBuffers(__GLXclientState *cl, GLbyte *pc)
 {
     ClientPtr client = cl->client;
     xGLXSwapBuffersReq *req = (xGLXSwapBuffersReq *) pc;
-    GLXContextTag tag = req->contextTag;
-    XID drawId = req->drawable;
+    GLXContextTag tag;
+    XID drawId;
     __GLXcontext *glxc = NULL;
     __GLXdrawable *pGlxDraw;
     int error;
 
+    REQUEST_SIZE_MATCH(xGLXSwapBuffersReq);
+
+    tag = req->contextTag;
+    drawId = req->drawable;
     if (tag) {
 	glxc = __glXLookupContextByTag(cl, tag);
 	if (!glxc) {
@@ -1535,15 +1657,21 @@ DoQueryContext(__GLXclientState *cl, GLXContextID gcId)
 
 int __glXDisp_QueryContextInfoEXT(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryContextInfoEXTReq *req = (xGLXQueryContextInfoEXTReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXQueryContextInfoEXTReq);
+
     return DoQueryContext(cl, req->context);
 }
 
 int __glXDisp_QueryContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryContextReq *req = (xGLXQueryContextReq *) pc;
 
+    REQUEST_SIZE_MATCH(xGLXQueryContextReq);
+
     return DoQueryContext(cl, req->context);
 }
 
@@ -1556,11 +1684,21 @@ int __glXDisp_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
     GLXDrawable		 drawId;
     int			 buffer;
     int			 error;
+    CARD32		 num_attribs;
+
+    if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len)
+	return BadLength;
 
     pc += __GLX_VENDPRIV_HDR_SIZE;
 
     drawId = *((CARD32 *) (pc));
     buffer = *((INT32 *)  (pc + 4));
+    num_attribs = *((CARD32 *) (pc + 8));
+    if (num_attribs > (UINT32_MAX >> 3)) {
+	client->errorValue = num_attribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 12 + (num_attribs << 3));
 
     if (buffer != GLX_FRONT_LEFT_EXT)
 	return __glXError(GLXBadPixmap);
@@ -1591,6 +1729,8 @@ int __glXDisp_ReleaseTexImageEXT(__GLXclientState *cl, GLbyte *pc)
     int			 buffer;
     int			 error;
 
+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
+
     pc += __GLX_VENDPRIV_HDR_SIZE;
 
     drawId = *((CARD32 *) (pc));
@@ -1626,6 +1766,8 @@ int __glXDisp_CopySubBufferMESA(__GLXclientState *cl, GLbyte *pc)
     (void) client;
     (void) req;
 
+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 20);
+
     pc += __GLX_VENDPRIV_HDR_SIZE;
 
     drawId = *((CARD32 *) (pc));
@@ -1714,16 +1856,23 @@ DoGetDrawableAttributes(__GLXclientState *cl, XID drawId)
 
 int __glXDisp_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
 
+    /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */
+    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
+
     return DoGetDrawableAttributes(cl, req->drawable);
 }
 
 int __glXDisp_GetDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetDrawableAttributesSGIXReq *req =
 	(xGLXGetDrawableAttributesSGIXReq *)pc;
     
+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesSGIXReq);
+
     return DoGetDrawableAttributes(cl, req->drawable);
 }
 
@@ -1748,6 +1897,8 @@ int __glXDisp_Render(__GLXclientState *cl, GLbyte *pc)
     __GLXcontext *glxc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXRenderReq);
+
     req = (xGLXRenderReq *) pc;
     if (client->swapped) {
 	__GLX_SWAP_SHORT(&req->length);
@@ -1768,6 +1919,9 @@ int __glXDisp_Render(__GLXclientState *cl, GLbyte *pc)
 	__GLXdispatchRenderProcPtr proc;
 	int err;
 
+	if (left < sizeof(__GLXrenderHeader))
+	    return BadLength;
+
 	/*
 	** Verify that the header length and the overall length agree.
 	** Also, each command must be word aligned.
@@ -2278,10 +2432,12 @@ int __glXDisp_HyperpipeConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_VendorPrivate(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
     GLint vendorcode = req->vendorCode;
     __GLXdispatchVendorPrivProcPtr proc;
 
+    REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq);
 
     proc = (__GLXdispatchVendorPrivProcPtr)
       __glXGetProtocolDecodeFunction(& VendorPriv_dispatch_info,
@@ -2297,10 +2453,12 @@ int __glXDisp_VendorPrivate(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_VendorPrivateWithReply(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
     GLint vendorcode = req->vendorCode;
     __GLXdispatchVendorPrivProcPtr proc;
 
+    REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq);
 
     proc = (__GLXdispatchVendorPrivProcPtr)
       __glXGetProtocolDecodeFunction(& VendorPriv_dispatch_info,
@@ -2323,6 +2481,8 @@ int __glXDisp_QueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
     char *buf;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXQueryExtensionsStringReq);
+
     if (!validGlxScreen(client, req->screen, &pGlxScreen, &err))
 	return err;
 
@@ -2361,6 +2521,8 @@ int __glXDisp_QueryServerString(__GLXclientState *cl, GLbyte *pc)
     __GLXscreen *pGlxScreen;
     int err;
 
+    REQUEST_SIZE_MATCH(xGLXQueryServerStringReq);
+
     if (!validGlxScreen(client, req->screen, &pGlxScreen, &err))
 	return err;
 
@@ -2404,14 +2566,20 @@ int __glXDisp_QueryServerString(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDisp_ClientInfo(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXClientInfoReq *req = (xGLXClientInfoReq *) pc;
     const char *buf;
    
+    REQUEST_AT_LEAST_SIZE(xGLXClientInfoReq);
+
+    buf = (const char *)(req+1);
+    if (!memchr(buf, 0, (client->req_len << 2) - sizeof(xGLXClientInfoReq)))
+	return BadLength;
+
     cl->GLClientmajorVersion = req->major;
     cl->GLClientminorVersion = req->minor;
     if (cl->GLClientextensions)
 	xfree(cl->GLClientextensions);
-    buf = (const char *)(req+1);
     cl->GLClientextensions = xstrdup(buf);
 
     return Success;

glx/glxcmdsswap.c

@@ -61,9 +61,12 @@
 
 int __glXDispSwap_CreateContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateContextReq *req = (xGLXCreateContextReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCreateContextReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
     __GLX_SWAP_INT(&req->visual);
@@ -75,9 +78,12 @@ int __glXDispSwap_CreateContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateNewContextReq *req = (xGLXCreateNewContextReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCreateNewContextReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
     __GLX_SWAP_INT(&req->fbconfig);
@@ -90,10 +96,13 @@ int __glXDispSwap_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateContextWithConfigSGIXReq *req =
 	(xGLXCreateContextWithConfigSGIXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCreateContextWithConfigSGIXReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
     __GLX_SWAP_INT(&req->fbconfig);
@@ -106,9 +115,12 @@ int __glXDispSwap_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_DestroyContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyContextReq *req = (xGLXDestroyContextReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyContextReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
 
@@ -117,9 +129,12 @@ int __glXDispSwap_DestroyContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_MakeCurrent(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeCurrentReq *req = (xGLXMakeCurrentReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->drawable);
     __GLX_SWAP_INT(&req->context);
@@ -130,9 +145,12 @@ int __glXDispSwap_MakeCurrent(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_MakeContextCurrent(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeContextCurrentReq *req = (xGLXMakeContextCurrentReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXMakeContextCurrentReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->drawable);
     __GLX_SWAP_INT(&req->readdrawable);
@@ -144,9 +162,12 @@ int __glXDispSwap_MakeContextCurrent(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_MakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXMakeCurrentReadSGIReq *req = (xGLXMakeCurrentReadSGIReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReadSGIReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->drawable);
     __GLX_SWAP_INT(&req->readable);
@@ -158,9 +179,12 @@ int __glXDispSwap_MakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_IsDirect(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXIsDirectReq *req = (xGLXIsDirectReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXIsDirectReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
 
@@ -169,9 +193,12 @@ int __glXDispSwap_IsDirect(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_QueryVersion(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryVersionReq *req = (xGLXQueryVersionReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXQueryVersionReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->majorVersion);
     __GLX_SWAP_INT(&req->minorVersion);
@@ -181,9 +208,12 @@ int __glXDispSwap_QueryVersion(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_WaitGL(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXWaitGLReq *req = (xGLXWaitGLReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXWaitGLReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
 
@@ -192,9 +222,12 @@ int __glXDispSwap_WaitGL(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_WaitX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXWaitXReq *req = (xGLXWaitXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXWaitXReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
 
@@ -203,9 +236,12 @@ int __glXDispSwap_WaitX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CopyContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCopyContextReq *req = (xGLXCopyContextReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCopyContextReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->source);
     __GLX_SWAP_INT(&req->dest);
@@ -216,36 +252,48 @@ int __glXDispSwap_CopyContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_GetVisualConfigs(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetVisualConfigsReq *req = (xGLXGetVisualConfigsReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXGetVisualConfigsReq);
+
     __GLX_SWAP_INT(&req->screen);
     return __glXDisp_GetVisualConfigs(cl, pc);
 }
 
 int __glXDispSwap_GetFBConfigs(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetFBConfigsReq *req = (xGLXGetFBConfigsReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsReq);
+
     __GLX_SWAP_INT(&req->screen);
     return __glXDisp_GetFBConfigs(cl, pc);
 }
 
 int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
+
     __GLX_SWAP_INT(&req->screen);
     return __glXDisp_GetFBConfigsSGIX(cl, pc);
 }
 
 int __glXDispSwap_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPixmapReq *req = (xGLXCreateGLXPixmapReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->visual);
@@ -257,29 +305,41 @@ int __glXDispSwap_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreatePixmapReq *req = (xGLXCreatePixmapReq *) pc;
     CARD32 *attribs;
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreatePixmapReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->fbconfig);
     __GLX_SWAP_INT(&req->pixmap);
     __GLX_SWAP_INT(&req->glxpixmap);
     __GLX_SWAP_INT(&req->numAttribs);
+
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreatePixmapReq, req->numAttribs << 3);
     attribs = (CARD32*)(req + 1);
-    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
+    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
     return __glXDisp_CreatePixmap(cl, pc);
 }
 
 int __glXDispSwap_CreateGLXPixmapWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPixmapWithConfigSGIXReq *req = 
 	(xGLXCreateGLXPixmapWithConfigSGIXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapWithConfigSGIXReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->fbconfig);
@@ -291,9 +351,12 @@ int __glXDispSwap_CreateGLXPixmapWithConfigSGIX(__GLXclientState *cl, GLbyte *pc
 
 int __glXDispSwap_DestroyGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->glxpixmap);
 
@@ -302,9 +365,12 @@ int __glXDispSwap_DestroyGLXPixmap(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->glxpixmap);
 
@@ -313,9 +379,12 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_QueryContext(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryContextReq *req = (xGLXQueryContextReq *) pc;    
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXQueryContextReq);
+
     __GLX_SWAP_INT(&req->context);
 
     return __glXDisp_QueryContext(cl, pc);
@@ -323,26 +392,38 @@ int __glXDispSwap_QueryContext(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreatePbufferReq *req = (xGLXCreatePbufferReq *) pc;    
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
     CARD32 *attribs;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreatePbufferReq);
+
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->fbconfig);
     __GLX_SWAP_INT(&req->pbuffer);
     __GLX_SWAP_INT(&req->numAttribs);
+
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreatePbufferReq, req->numAttribs << 3);
     attribs = (CARD32*)(req + 1);
-    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
+    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
     return __glXDisp_CreatePbuffer(cl, pc);
 }
 
 int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc;    
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq);
+
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->fbconfig);
     __GLX_SWAP_INT(&req->pbuffer);
@@ -354,9 +435,12 @@ int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_DestroyPbuffer(__GLXclientState *cl, GLbyte *pc)
 {
-    xGLXDestroyPbufferReq *req = (xGLXDestroyPbufferReq *) req;
+    ClientPtr client = cl->client;
+    xGLXDestroyPbufferReq *req = (xGLXDestroyPbufferReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyPbufferReq);
+
     __GLX_SWAP_INT(&req->pbuffer);
 
     return __glXDisp_DestroyPbuffer(cl, pc);
@@ -364,9 +448,12 @@ int __glXDispSwap_DestroyPbuffer(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_DestroyGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 {
-    xGLXDestroyGLXPbufferSGIXReq *req = (xGLXDestroyGLXPbufferSGIXReq *) req;
+    ClientPtr client = cl->client;
+    xGLXDestroyGLXPbufferSGIXReq *req = (xGLXDestroyGLXPbufferSGIXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPbufferSGIXReq);
+
     __GLX_SWAP_INT(&req->pbuffer);
 
     return __glXDisp_DestroyGLXPbufferSGIX(cl, pc);
@@ -374,16 +461,27 @@ int __glXDispSwap_DestroyGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXChangeDrawableAttributesReq *req =
-	(xGLXChangeDrawableAttributesReq *) req;
+	(xGLXChangeDrawableAttributesReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
     CARD32 *attribs;
 
+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesReq);
+
     __GLX_SWAP_INT(&req->drawable);
     __GLX_SWAP_INT(&req->numAttribs);
+
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
+	return BadLength;
+
     attribs = (CARD32*)(req + 1);
-    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
+    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
     return __glXDisp_ChangeDrawableAttributes(cl, pc);
 }
@@ -391,43 +489,64 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 int __glXDispSwap_ChangeDrawableAttributesSGIX(__GLXclientState *cl,
 					       GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXChangeDrawableAttributesSGIXReq *req =
-	(xGLXChangeDrawableAttributesSGIXReq *) req;
+	(xGLXChangeDrawableAttributesSGIXReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
     CARD32 *attribs;
 
+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesSGIXReq);
+
     __GLX_SWAP_INT(&req->drawable);
     __GLX_SWAP_INT(&req->numAttribs);
+
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesSGIXReq, req->numAttribs << 3);
     attribs = (CARD32*)(req + 1);
-    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
+    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
     return __glXDisp_ChangeDrawableAttributesSGIX(cl, pc);
 }
 
 int __glXDispSwap_CreateWindow(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXCreateWindowReq *req = (xGLXCreateWindowReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
     CARD32 *attribs;
 
+    REQUEST_AT_LEAST_SIZE(xGLXCreateWindowReq);
+
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->fbconfig);
     __GLX_SWAP_INT(&req->window);
     __GLX_SWAP_INT(&req->glxwindow);
     __GLX_SWAP_INT(&req->numAttribs);
+
+    if (req->numAttribs > (UINT32_MAX >> 3)) {
+	client->errorValue = req->numAttribs;
+	return BadValue;
+    }
+    REQUEST_FIXED_SIZE(xGLXCreateWindowReq, req->numAttribs << 3);
     attribs = (CARD32*)(req + 1);
-    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
+    __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
     return __glXDisp_CreateWindow(cl, pc);
 }
 
 int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
+
     __GLX_SWAP_INT(&req->glxwindow);
 
     return __glXDisp_DestroyWindow(cl, pc);
@@ -435,9 +554,12 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_SwapBuffers(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXSwapBuffersReq *req = (xGLXSwapBuffersReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXSwapBuffersReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
     __GLX_SWAP_INT(&req->drawable);
@@ -447,9 +569,12 @@ int __glXDispSwap_SwapBuffers(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_UseXFont(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXUseXFontReq *req = (xGLXUseXFontReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXUseXFontReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
     __GLX_SWAP_INT(&req->font);
@@ -463,9 +588,12 @@ int __glXDispSwap_UseXFont(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_QueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryExtensionsStringReq *req = (xGLXQueryExtensionsStringReq *)pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXQueryExtensionsStringReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->screen);
 
@@ -474,9 +602,12 @@ int __glXDispSwap_QueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_QueryServerString(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryServerStringReq *req = (xGLXQueryServerStringReq *)pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXQueryServerStringReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->screen);
     __GLX_SWAP_INT(&req->name);
@@ -486,9 +617,12 @@ int __glXDispSwap_QueryServerString(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_ClientInfo(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXClientInfoReq *req = (xGLXClientInfoReq *)pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXClientInfoReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->major);
     __GLX_SWAP_INT(&req->minor);
@@ -499,9 +633,12 @@ int __glXDispSwap_ClientInfo(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_QueryContextInfoEXT(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXQueryContextInfoEXTReq *req = (xGLXQueryContextInfoEXTReq *) pc;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXQueryContextInfoEXTReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->context);
 
@@ -510,33 +647,41 @@ int __glXDispSwap_QueryContextInfoEXT(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
     GLXDrawable		 *drawId;
     int			 *buffer;
-    
+    CARD32		 *num_attribs;
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len)
+	return BadLength;
+
     pc += __GLX_VENDPRIV_HDR_SIZE;
 
     drawId = ((GLXDrawable *) (pc));
     buffer = ((int *)	      (pc + 4));
+    num_attribs = ((CARD32 *) (pc + 8));
     
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
     __GLX_SWAP_INT(drawId);
     __GLX_SWAP_INT(buffer);
+    __GLX_SWAP_INT(num_attribs);
 
     return __glXDisp_BindTexImageEXT(cl, (GLbyte *)pc);
 }
 
 int __glXDispSwap_ReleaseTexImageEXT(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
     GLXDrawable		 *drawId;
     int			 *buffer;
-    
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
+
     pc += __GLX_VENDPRIV_HDR_SIZE;
 
     drawId = ((GLXDrawable *) (pc));
@@ -552,12 +697,14 @@ int __glXDispSwap_ReleaseTexImageEXT(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_CopySubBufferMESA(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
     GLXDrawable		 *drawId;
     int			 *buffer;
-
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 20);
+
     (void) drawId;
     (void) buffer;
 
@@ -577,11 +724,13 @@ int __glXDispSwap_CopySubBufferMESA(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_GetDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXVendorPrivateWithReplyReq *req = (xGLXVendorPrivateWithReplyReq *)pc;
     CARD32 *data;
-    
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesSGIXReq);
+
     data = (CARD32 *) (req + 1);
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->contextTag);
@@ -592,10 +741,12 @@ int __glXDispSwap_GetDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
 
 int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 {
+    ClientPtr client = cl->client;
     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
-    
     __GLX_DECLARE_SWAP_VARIABLES;
 
+    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
+
     __GLX_SWAP_SHORT(&req->length);
     __GLX_SWAP_INT(&req->drawable);
 

glx/glxdri.c

@@ -863,12 +863,21 @@ static const char dri_driver_path[] = DRI_DRIVER_PATH;
 static Bool
 glxDRIEnterVT (int index, int flags)
 {
+    ScrnInfoPtr scrn = xf86Screens[index];
+    Bool	ret;
     __GLXDRIscreen *screen = (__GLXDRIscreen *) 
 	glxGetScreen(screenInfo.screens[index]);
 
     LogMessage(X_INFO, "AIGLX: Resuming AIGLX clients after VT switch\n");
 
-    if (!(*screen->enterVT) (index, flags))
+    scrn->EnterVT = screen->enterVT;
+
+    ret = scrn->EnterVT (index, flags);
+
+    screen->enterVT = scrn->EnterVT;
+    scrn->EnterVT = glxDRIEnterVT;
+
+    if (!ret)
 	return FALSE;
     
     glxResumeClients();
@@ -879,6 +888,7 @@ glxDRIEnterVT (int index, int flags)
 static void
 glxDRILeaveVT (int index, int flags)
 {
+    ScrnInfoPtr scrn = xf86Screens[index];
     __GLXDRIscreen *screen = (__GLXDRIscreen *)
 	glxGetScreen(screenInfo.screens[index]);
 
@@ -886,7 +896,10 @@ glxDRILeaveVT (int index, int flags)
 
     glxSuspendClients();
 
-    return (*screen->leaveVT) (index, flags);
+    scrn->LeaveVT = screen->leaveVT;
+    (*screen->leaveVT) (index, flags);
+    screen->leaveVT = scrn->LeaveVT;
+    scrn->LeaveVT = glxDRILeaveVT;
 }
 
 static void

glx/glxdri2.c

@@ -512,12 +512,21 @@ static const char dri_driver_path[] = DRI_DRIVER_PATH;
 static Bool
 glxDRIEnterVT (int index, int flags)
 {
+    ScrnInfoPtr scrn = xf86Screens[index];
+    Bool	ret;
     __GLXDRIscreen *screen = (__GLXDRIscreen *) 
 	glxGetScreen(screenInfo.screens[index]);
 
     LogMessage(X_INFO, "AIGLX: Resuming AIGLX clients after VT switch\n");
 
-    if (!(*screen->enterVT) (index, flags))
+    scrn->EnterVT = screen->enterVT;
+
+    ret = scrn->EnterVT (index, flags);
+
+    screen->enterVT = scrn->EnterVT;
+    scrn->EnterVT = glxDRIEnterVT;
+
+    if (!ret)
 	return FALSE;
     
     glxResumeClients();
@@ -528,6 +537,7 @@ glxDRIEnterVT (int index, int flags)
 static void
 glxDRILeaveVT (int index, int flags)
 {
+    ScrnInfoPtr scrn = xf86Screens[index];
     __GLXDRIscreen *screen = (__GLXDRIscreen *)
 	glxGetScreen(screenInfo.screens[index]);
 
@@ -535,7 +545,10 @@ glxDRILeaveVT (int index, int flags)
 
     glxSuspendClients();
 
-    return (*screen->leaveVT) (index, flags);
+    scrn->LeaveVT = screen->leaveVT;
+    (*screen->leaveVT) (index, flags);
+    screen->leaveVT = scrn->LeaveVT;
+    scrn->LeaveVT = glxDRILeaveVT;
 }
 
 static void

glx/glxscreens.c

@@ -250,12 +250,8 @@ GLint glxConvertToXVisualType(int visualType)
 static VisualPtr
 AddScreenVisuals(ScreenPtr pScreen, int count, int d)
 {
-    XID		*installedCmaps, *vids, vid;
-    int		 numInstalledCmaps, numVisuals, i, j;
-    VisualPtr	 visuals;
-    ColormapPtr	 installedCmap;
+    int		 i;
     DepthPtr	 depth;
-    int		 rc;
 
     depth = NULL;
     for (i = 0; i < pScreen->numDepths; i++) {
@@ -267,56 +263,8 @@ AddScreenVisuals(ScreenPtr pScreen, int count, int d)
     if (depth == NULL)
 	return NULL;
 
-    /* Find the installed colormaps */
-    installedCmaps = xalloc (pScreen->maxInstalledCmaps * sizeof (XID));
-    if (!installedCmaps)
-	return NULL;
-
-    numInstalledCmaps = pScreen->ListInstalledColormaps(pScreen, installedCmaps);
-
-    /* realloc the visual array to fit the new one in place */
-    numVisuals = pScreen->numVisuals;
-    visuals = xrealloc(pScreen->visuals, (numVisuals + count) * sizeof(VisualRec));
-    if (!visuals) {
-	xfree(installedCmaps);
-	return NULL;
-    }
-
-    vids = xrealloc(depth->vids, (depth->numVids + count) * sizeof(XID));
-    if (vids == NULL) {
-	xfree(installedCmaps);
-	xfree(visuals);
-	return NULL;
-    }
-
-    /*
-     * Fix up any existing installed colormaps -- we'll assume that
-     * the only ones created so far have been installed.  If this
-     * isn't true, we'll have to walk the resource database looking
-     * for all colormaps.
-     */
-    for (i = 0; i < numInstalledCmaps; i++) {
-	rc = dixLookupResourceByType((pointer *)&installedCmap,
-				     installedCmaps[i], RT_COLORMAP,
-				     serverClient, DixReadAccess);
-	if (rc != Success)
-	    continue;
-	j = installedCmap->pVisual - pScreen->visuals;
-	installedCmap->pVisual = &visuals[j];
-    }
-
-    xfree(installedCmaps);
-
-    for (i = 0; i < count; i++) {
-	vid = FakeClientID(0);
-	visuals[pScreen->numVisuals + i].vid = vid;
-	vids[depth->numVids + i] = vid;
-    }
-
-    pScreen->visuals = visuals;
-    pScreen->numVisuals += count;
-    depth->vids = vids;
-    depth->numVids += count;
+    if (ResizeVisualArray(pScreen, count, depth) == FALSE)
+        return NULL;
 
     /* Return a pointer to the first of the added visuals. */ 
     return pScreen->visuals + pScreen->numVisuals - count;

glx/unpack.h

@@ -47,7 +47,7 @@
 ** Fetch a double from potentially unaligned memory.
 */
 #ifdef __GLX_ALIGN64
-#define __GLX_MEM_COPY(dst,src,n)	if (src && dst) memcpy(dst,src,n)
+#define __GLX_MEM_COPY(dst,src,n)	if (src != NULL && dst != NULL) memcpy(dst,src,n)
 #define __GLX_GET_DOUBLE(dst,src)	__GLX_MEM_COPY(&dst,src,8)
 #else
 #define __GLX_GET_DOUBLE(dst,src)	(dst) = *((GLdouble*)(src))

glx/xfont.c

@@ -160,6 +160,8 @@ int __glXDisp_UseXFont(__GLXclientState *cl, GLbyte *pc)
     __GLXcontext *cx;
     int error;
 
+    REQUEST_SIZE_MATCH(xGLXUseXFontReq);
+
     req = (xGLXUseXFontReq *) pc;
     cx = __glXForceCurrent(cl, req->contextTag, &error);
     if (!cx) {

hw/dmx/Makefile.am

@@ -84,10 +84,7 @@ XDMX_LIBS = \
 	@XDMX_LIBS@ \
 	$(GLX_LIBS) \
         input/libdmxinput.a \
-        config/libdmxconfig.a \
-	$(MAIN_LIB) \
-	$(XSERVER_LIBS) \
-	$(top_builddir)/xfixes/libxfixes.la
+        config/libdmxconfig.a
 
 Xdmx_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
 Xdmx_DEPENDENCIES= $(XDMX_LIBS)

hw/dmx/dmx-config.h

@@ -72,17 +72,4 @@
 /* Enable the DMX extension */
 #define DMXEXT
 
-/* Disable the extensions that are not currently supported */
-#undef MULTIBUFFER
-#undef XV
-#undef DBE
-#undef XF86VIDMODE
-#undef XFreeXDGA
-#undef XF86DRI
-#undef SCREENSAVER
-#undef RANDR
-#undef XFIXES
-#undef DAMAGE
-#undef COMPOSITE
-
 #endif /* DMX_CONFIG_H */

hw/dmx/dmx.c

@@ -362,7 +362,8 @@ static int ProcDMXGetScreenAttributes(ClientPtr client)
     paddedLength            = pad_to_int32(length);
     rep.type                = X_Reply;
     rep.sequenceNumber      = client->sequence;
-    rep.length              = bytes_to_int32(paddedLength);
+    rep.length              = bytes_to_int32((sizeof(xDMXGetScreenAttributesReply) - sizeof(xGenericReply))
+                                             + paddedLength);
     rep.displayNameLength   = length;
 
     if (client->swapped) {

hw/dmx/dmxwindow.c

@@ -419,10 +419,9 @@ Bool dmxDestroyWindow(WindowPtr pWindow)
 	pWinPriv->windowDestroyed(pWindow);
 #endif
 
-#if 0
     if (pScreen->DestroyWindow)
 	ret = pScreen->DestroyWindow(pWindow);
-#endif
+
     DMX_WRAP(DestroyWindow, dmxDestroyWindow, dmxScreen, pScreen);
 
     return ret;

hw/dmx/glxProxy/glxcmds.c

@@ -1536,7 +1536,7 @@ int __glXGetVisualConfigs(__GLXclientState *cl, GLbyte *pc)
     int i, p;
 
     screen = req->screen;
-    if (screen > screenInfo.numScreens) {
+    if (screen >= screenInfo.numScreens) {
 	/* The client library must send a valid screen number. */
 	client->errorValue = screen;
 	return BadValue;
@@ -2685,7 +2685,7 @@ int __glXGetFBConfigs(__GLXclientState *cl, GLbyte *pc)
     int numFBConfigs, i, p;
     __GLXscreenInfo *pGlxScreen;
 
-    if (screen > screenInfo.numScreens) {
+    if (screen >= screenInfo.numScreens) {
 	/* The client library must send a valid screen number. */
 	client->errorValue = screen;
 	return BadValue;
@@ -3106,7 +3106,7 @@ int __glXCreatePbuffer(__GLXclientState *cl, GLbyte *pc)
    /*
     ** Look up screen and FBConfig.
     */
-    if (screen > screenInfo.numScreens) {
+    if (screen >= screenInfo.numScreens) {
         /* The client library must send a valid screen number. */
         client->errorValue = screen;
         return BadValue;

hw/dmx/glxProxy/glxcmdsswap.c

@@ -251,7 +251,7 @@ int __glXSwapGetVisualConfigs(__GLXclientState *cl, GLbyte *pc)
 
     __GLX_SWAP_INT(&req->screen);
     screen = req->screen;
-    if (screen > screenInfo.numScreens) {
+    if (screen >= screenInfo.numScreens) {
 	/* The client library must send a valid screen number. */
 	client->errorValue = screen;
 	return BadValue;

hw/dmx/input/dmxevents.c

@@ -183,7 +183,7 @@ static void enqueueMotion(DevicePtr pDev, int x, int y)
 
     GetEventList(&events);
     nevents = GetPointerEvents(events, p, MotionNotify, detail,
-                               POINTER_ABSOLUTE, 0, 2, valuators);
+                               POINTER_ABSOLUTE | POINTER_SCREEN, 0, 2, valuators);
     for (i = 0; i < nevents; i++)
        mieqEnqueue(p, (InternalEvent*)(events + i)->event);
     return;
@@ -688,7 +688,7 @@ void dmxEnqueue(DevicePtr pDev, int type, int detail, KeySym keySym,
         detail = dmxGetButtonMapping(dmxLocal, detail);
         GetEventList(&events);
         nevents = GetPointerEvents(events, p, type, detail,
-                                   POINTER_ABSOLUTE,
+                                   POINTER_ABSOLUTE | POINTER_SCREEN,
                                    0,   /* first_valuator = 0 */
                                    0,   /* num_valuators = 0 */
                                    valuators);
@@ -700,9 +700,9 @@ void dmxEnqueue(DevicePtr pDev, int type, int detail, KeySym keySym,
         GetEventList(&events);
         valuators[0] = e->xmotion.x;
         valuators[1] = e->xmotion.y;
-        valuators[2] = e->xmotion.state;
+        valuators[2] = e->xmotion.state; /* FIXME: WTF?? */
         nevents = GetPointerEvents(events, p, type, detail, 
-                                   POINTER_ABSOLUTE, 0, 3, valuators);
+                                   POINTER_ABSOLUTE | POINTER_SCREEN, 0, 3, valuators);
         for (i = 0; i < nevents; i++)
             mieqEnqueue(p, (InternalEvent*)(events + i)->event);
         return;

hw/dmx/input/dmxinputinit.c

@@ -474,9 +474,9 @@ static int dmxDeviceOnOff(DeviceIntPtr pDevice, int what)
                                               Relative);
                 for (i = 0; i < info.numRelAxes; i++)
                     InitValuatorAxisStruct(pDevice, i, axis_labels[i],
-                                           info.minval[0], info.maxval[0],
-                                           info.res[0],
-                                           info.minres[0], info.maxres[0]);
+                                           info.minval[i], info.maxval[i],
+                                           info.res[i],
+                                           info.minres[i], info.maxres[i]);
             } else if (info.numRelAxes) {
                 InitValuatorClassDeviceStruct(pDevice, info.numRelAxes,
                                               axis_labels,
@@ -484,20 +484,20 @@ static int dmxDeviceOnOff(DeviceIntPtr pDevice, int what)
                                               Relative);
                 for (i = 0; i < info.numRelAxes; i++)
                     InitValuatorAxisStruct(pDevice, i, axis_labels[i],
-                                           info.minval[0],
-                                           info.maxval[0], info.res[0],
-                                           info.minres[0], info.maxres[0]);
+                                           info.minval[i],
+                                           info.maxval[i], info.res[i],
+                                           info.minres[i], info.maxres[i]);
             } else if (info.numAbsAxes) {
                 InitValuatorClassDeviceStruct(pDevice, info.numAbsAxes,
                                               axis_labels,
                                               dmxPointerGetMotionBufferSize(),
                                               Absolute);
                 for (i = 0; i < info.numAbsAxes; i++)
-                    InitValuatorAxisStruct(pDevice, i+info.numRelAxes,
-                                           axis_labels[i + info.numRelAxes],
-                                           info.minval[i+1], info.maxval[i+1],
-                                           info.res[i+1], info.minres[i+1],
-                                           info.maxres[i+1]);
+                    InitValuatorAxisStruct(pDevice, i,
+                                           axis_labels[i],
+                                           info.minval[i], info.maxval[i],
+                                           info.res[i], info.minres[i],
+                                           info.maxres[i]);
             }
         }
         if (info.focusClass)       InitFocusClassDeviceStruct(pDevice);

hw/kdrive/ephyr/Xephyr.man.pre

@@ -46,6 +46,11 @@ sets the screen size.
 .BI -parent " id"
 uses exiting window
 .I id .
+If a 
+.BI -screen 
+argument follows a 
+.BI -parent
+argument, this screen is embedded into the given window.
 .TP 8
 .B -host-cursor
 set 'cursor acceleration':

hw/kdrive/ephyr/ephyr.c

@@ -1074,6 +1074,8 @@ MouseInit (KdPointerInfo *pi)
     ((EphyrPointerPrivate *)pi->driverPrivate)->enabled = FALSE;
     pi->nAxes = 3;
     pi->nButtons = 32;
+    if (pi->name)
+        xfree(pi->name);
     pi->name = strdup("Xephyr virtual mouse");
     ephyrMouse = pi;
     return Success;
@@ -1123,6 +1125,8 @@ EphyrKeyboardInit (KdKeyboardInfo *ki)
   }
   ki->minScanCode = ephyrKeySyms.minKeyCode;
   ki->maxScanCode = ephyrKeySyms.maxKeyCode;
+  if (ki->name)
+      xfree(ki->name);
   ki->name = strdup("Xephyr virtual keyboard");
   ephyrKbd = ki;
   return Success;

hw/kdrive/ephyr/ephyrdriext.c

@@ -470,7 +470,7 @@ EphyrDuplicateVisual (unsigned int a_screen,
     int i=0 ;
 
     EPHYR_LOG ("enter\n") ; 
-    if (a_screen > screenInfo.numScreens) {
+    if (a_screen >= screenInfo.numScreens) {
         EPHYR_LOG_ERROR ("bad screen number\n") ;
         goto out;
     }

hw/kdrive/ephyr/ephyrinit.c

@@ -148,6 +148,7 @@ processScreenArg (char *screen_size, char *parent_id)
 int
 ddxProcessArgument (int argc, char **argv, int i)
 {
+  static char* parent = NULL;
   EPHYR_DBG("mark argv[%d]='%s'", i, argv[i] );
 
   if (i == 1)
@@ -159,6 +160,18 @@ ddxProcessArgument (int argc, char **argv, int i)
     {
       if(i+1 < argc)
 	{
+	  int j;
+	  /* If parent is specified and a screen argument follows, don't do
+           * anything, let the -screen handling init the rest */
+	  for (j = i; j < argc; j++)
+	    {
+	      if (!strcmp(argv[j], "-screen"))
+		{
+		  parent = argv[i + 1];
+		  return 2;
+		}
+	    }
+
 	  processScreenArg ("100x100", argv[i+1]);
 	  return 2;
 	}
@@ -170,7 +183,8 @@ ddxProcessArgument (int argc, char **argv, int i)
     {
       if ((i+1) < argc)
 	{
-	  processScreenArg (argv[i+1], NULL);
+	  processScreenArg (argv[i+1], parent);
+	  parent = NULL;
 	  return 2;
 	}
 

hw/kdrive/fake/Makefile.am

@@ -18,10 +18,9 @@ Xfake_SOURCES = \
 
 Xfake_LDADD = 						\
 	libfake.la					\
-	@KDRIVE_LIBS@					\
-        @XSERVER_LIBS@
+	@KDRIVE_LIBS@
 
-Xfake_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-undefined=InitExtensions
+Xfake_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
 
 Xfake_DEPENDENCIES =	\
 	libfake.la					\

hw/kdrive/fake/kbd.c

@@ -28,142 +28,11 @@
 
 #define FAKE_WIDTH  2
 
-KeySym FakeKeymap[] = {
-/*      1     8 */	 XK_Escape, NoSymbol,
-/*      2     9 */	 XK_1,	XK_exclam,
-/*      3    10 */	 XK_2,	XK_at,
-/*      4    11 */	 XK_3,	XK_numbersign,
-/*      5    12 */	 XK_4,	XK_dollar,
-/*      6    13 */	 XK_5,	XK_percent,
-/*      7    14 */	 XK_6,	XK_asciicircum,
-/*      8    15 */	 XK_7,	XK_ampersand,
-/*      9    16 */	 XK_8,	XK_asterisk,
-/*     10    17 */	 XK_9,	XK_parenleft,
-/*     11    18 */	 XK_0,	XK_parenright,
-/*     12    19 */	 XK_minus,	XK_underscore,
-/*     13    20 */	 XK_equal,	XK_plus,
-/*     14    21 */	 XK_BackSpace,	NoSymbol,
-/*     15    22 */	 XK_Tab,	NoSymbol,
-/*     16    23 */	 XK_Q,	NoSymbol,
-/*     17    24 */	 XK_W,	NoSymbol,
-/*     18    25 */	 XK_E,	NoSymbol,
-/*     19    26 */	 XK_R,	NoSymbol,
-/*     20    27 */	 XK_T,	NoSymbol,
-/*     21    28 */	 XK_Y,	NoSymbol,
-/*     22    29 */	 XK_U,	NoSymbol,
-/*     23    30 */	 XK_I,	NoSymbol,
-/*     24    31 */	 XK_O,	NoSymbol,
-/*     25    32 */	 XK_P,	NoSymbol,
-/*     26    33 */	 XK_bracketleft,	XK_braceleft,
-/*     27    34 */	 XK_bracketright,	XK_braceright,
-/*     28    35 */	 XK_Return,	NoSymbol,
-/*     29    36 */	 XK_Control_L,	NoSymbol,
-/*     30    37 */	 XK_A,	NoSymbol,
-/*     31    38 */	 XK_S,	NoSymbol,
-/*     32    39 */	 XK_D,	NoSymbol,
-/*     33    40 */	 XK_F,	NoSymbol,
-/*     34    41 */	 XK_G,	NoSymbol,
-/*     35    42 */	 XK_H,	NoSymbol,
-/*     36    43 */	 XK_J,	NoSymbol,
-/*     37    44 */	 XK_K,	NoSymbol,
-/*     38    45 */	 XK_L,	NoSymbol,
-/*     39    46 */	 XK_semicolon,	XK_colon,
-/*     40    47 */	 XK_apostrophe,	XK_quotedbl,
-/*     41    48 */	 XK_grave,	XK_asciitilde,
-/*     42    49 */	 XK_Shift_L,	NoSymbol,
-/*     43    50 */	 XK_backslash,	XK_bar,
-/*     44    51 */	 XK_Z,	NoSymbol,
-/*     45    52 */	 XK_X,	NoSymbol,
-/*     46    53 */	 XK_C,	NoSymbol,
-/*     47    54 */	 XK_V,	NoSymbol,
-/*     48    55 */	 XK_B,	NoSymbol,
-/*     49    56 */	 XK_N,	NoSymbol,
-/*     50    57 */	 XK_M,	NoSymbol,
-/*     51    58 */	 XK_comma,	XK_less,
-/*     52    59 */	 XK_period,	XK_greater,
-/*     53    60 */	 XK_slash,	XK_question,
-/*     54    61 */	 XK_Shift_R,	NoSymbol,
-/*     55    62 */	 XK_KP_Multiply,	NoSymbol,
-/*     56    63 */	 XK_Alt_L,	XK_Meta_L,
-/*     57    64 */	 XK_space,	NoSymbol,
-/*     58    65 */	 XK_Caps_Lock,	NoSymbol,
-/*     59    66 */	 XK_F1,	NoSymbol,
-/*     60    67 */	 XK_F2,	NoSymbol,
-/*     61    68 */	 XK_F3,	NoSymbol,
-/*     62    69 */	 XK_F4,	NoSymbol,
-/*     63    70 */	 XK_F5,	NoSymbol,
-/*     64    71 */	 XK_F6,	NoSymbol,
-/*     65    72 */	 XK_F7,	NoSymbol,
-/*     66    73 */	 XK_F8,	NoSymbol,
-/*     67    74 */	 XK_F9,	NoSymbol,
-/*     68    75 */	 XK_F10,	NoSymbol,
-/*     69    76 */	 XK_Break,	XK_Pause,
-/*     70    77 */	 XK_Scroll_Lock,	NoSymbol,
-/*     71    78 */	 XK_KP_Home,	XK_KP_7,
-/*     72    79 */	 XK_KP_Up,	XK_KP_8,
-/*     73    80 */	 XK_KP_Page_Up,	XK_KP_9,
-/*     74    81 */	 XK_KP_Subtract,	NoSymbol,
-/*     75    82 */	 XK_KP_Left,	XK_KP_4,
-/*     76    83 */	 XK_KP_5,	NoSymbol,
-/*     77    84 */	 XK_KP_Right,	XK_KP_6,
-/*     78    85 */	 XK_KP_Add,	NoSymbol,
-/*     79    86 */	 XK_KP_End,	XK_KP_1,
-/*     80    87 */	 XK_KP_Down,	XK_KP_2,
-/*     81    88 */	 XK_KP_Page_Down,	XK_KP_3,
-/*     82    89 */	 XK_KP_Insert,	XK_KP_0,
-/*     83    90 */	 XK_KP_Delete,	XK_KP_Decimal,
-/*     84    91 */     NoSymbol,	NoSymbol,
-/*     85    92 */     NoSymbol,	NoSymbol,
-/*     86    93 */     NoSymbol,	NoSymbol,
-/*     87    94 */	 XK_F11,	NoSymbol,
-/*     88    95 */	 XK_F12,	NoSymbol,
-    
-/* These are remapped from the extended set (using ExtendMap) */
-    
-/*     89    96 */	 XK_Control_R,	NoSymbol,
-/*     90    97 */	 XK_KP_Enter,	NoSymbol,
-/*     91    98 */	 XK_KP_Divide,	NoSymbol,
-/*     92    99 */	 XK_Sys_Req,	XK_Print,
-/*     93   100 */	 XK_Alt_R,	XK_Meta_R,
-/*     94   101 */	 XK_Num_Lock,	NoSymbol,
-/*     95   102 */	 XK_Home,	NoSymbol,
-/*     96   103 */	 XK_Up,		NoSymbol,
-/*     97   104 */	 XK_Page_Up,	NoSymbol,
-/*     98   105 */	 XK_Left,	NoSymbol,
-/*     99   106 */	 XK_Right,	NoSymbol,
-/*    100   107 */	 XK_End,	NoSymbol,
-/*    101   108 */	 XK_Down,	NoSymbol,
-/*    102   109 */	 XK_Page_Down,	NoSymbol,
-/*    103   110 */	 XK_Insert,	NoSymbol,
-/*    104   111 */	 XK_Delete,	NoSymbol,
-/*    105   112 */	 XK_Super_L,	NoSymbol,
-/*    106   113 */	 XK_Super_R,	NoSymbol,
-/*    107   114 */	 XK_Menu,	NoSymbol,
-
-/*    108   115 */	 XK_Next,	NoSymbol,   /* right button on side */
-/*    109   116 */	 XK_Prior,	NoSymbol,   /* left button on side */
-/*    110   117 */	 XK_Up,		NoSymbol,   /* joypad */
-/*    111   118 */	 XK_Down,	NoSymbol,
-/*    112   119 */	 XK_Left,	NoSymbol,
-/*    113   120 */	 XK_Right,	NoSymbol,
-/*    114   121 */	 NoSymbol,	NoSymbol,   /* left near speaker */
-/*    115   122 */	 NoSymbol,	NoSymbol,   /* right near speaker */
-/*    116   123 */	 NoSymbol,	NoSymbol,   /* tiny button */
-};
-
 static Status
 FakeKeyboardInit (KdKeyboardInfo *ki)
 {
-    ki->keySyms.minKeyCode = 1;
-    ki->keySyms.maxKeyCode = (sizeof (FakeKeymap) / sizeof (FakeKeymap[0])) / FAKE_WIDTH;
-    ki->keySyms.mapWidth = FAKE_WIDTH;
-    if (ki->keySyms.map)
-        xfree(ki->keySyms.map);
-    ki->keySyms.map = (KeySym *)xalloc(sizeof(FakeKeymap));
-    if (!ki->keySyms.map)
-        return BadAlloc;
-    memcpy (ki->keySyms.map, FakeKeymap, sizeof (FakeKeymap));
-
+    ki->minScanCode = 8;
+    ki->maxScanCode = 255;
     return Success;
 }
 
@@ -182,8 +51,6 @@ FakeKeyboardDisable (KdKeyboardInfo *ki)
 static void
 FakeKeyboardFini (KdKeyboardInfo *ki)
 {
-    xfree(ki->keySyms.map);
-    ki->keySyms.map = NULL;
 }
 
 static void

hw/kdrive/linux/evdev.c

@@ -243,7 +243,9 @@ EvdevPtrEnable (KdPointerInfo *pi)
     if (fd < 0)
         return BadMatch;
 
-        
+    if (ioctl (fd, EVIOCGRAB, 1) < 0)
+        perror ("Grabbing evdev mouse device failed");
+
     if (ioctl (fd, EVIOCGBIT(0 /*EV*/, sizeof (ev)), ev) < 0)
     {
         perror ("EVIOCGBIT 0");
@@ -335,6 +337,10 @@ EvdevPtrDisable (KdPointerInfo *pi)
         return;
 
     KdUnregisterFd (pi, ke->fd, TRUE);
+
+    if (ioctl (ke->fd, EVIOCGRAB, 0) < 0)
+        perror ("Ungrabbing evdev mouse device failed");
+
     xfree (ke);
     pi->driverPrivate = 0;
 }
@@ -356,7 +362,7 @@ readMapping (KdKeyboardInfo *ki)
         return;
 
     ki->minScanCode = 0;
-    ki->maxScanCode = 193;
+    ki->maxScanCode = 247;
 }
 
 static void
@@ -425,6 +431,9 @@ EvdevKbdEnable (KdKeyboardInfo *ki)
     if (fd < 0)
         return BadMatch;
 
+    if (ioctl (fd, EVIOCGRAB, 1) < 0)
+        perror ("Grabbing evdev keyboard device failed");
+
     if (ioctl (fd, EVIOCGBIT(0 /*EV*/, sizeof (ev)), ev) < 0) {
         perror ("EVIOCGBIT 0");
         close (fd);
@@ -496,6 +505,10 @@ EvdevKbdDisable (KdKeyboardInfo *ki)
         return;
 
     KdUnregisterFd (ki, ke->fd, TRUE);
+
+    if (ioctl (ke->fd, EVIOCGRAB, 0) < 0)
+        perror ("Ungrabbing evdev keyboard device failed");
+
     xfree (ke);
     ki->driverPrivate = 0;
 }

hw/kdrive/linux/tslib.c

@@ -151,10 +151,6 @@ TslibDisable (KdPointerInfo *pi)
 static Status
 TslibInit (KdPointerInfo *pi)
 {
-    int		        fd = 0, i = 0;
-    DIR                 *inputdir = NULL;
-    struct dirent       *inputent = NULL;
-    struct tsdev        *tsDev = NULL;
     struct TslibPrivate *private = NULL;
 
     if (!pi || !pi->dixdev)

hw/kdrive/src/kinfo.c

@@ -166,6 +166,12 @@ KdFreeKeyboard(KdKeyboardInfo *ki)
         xfree(ki->name);
     if (ki->path)
         xfree(ki->path);
+    if (ki->xkbRules)
+        xfree(ki->xkbRules);
+    if (ki->xkbModel)
+        xfree(ki->xkbModel);
+    if (ki->xkbLayout)
+        xfree(ki->xkbLayout);
     ki->next = NULL;
     xfree(ki);
 }

hw/vfb/InitInput.c

@@ -43,6 +43,7 @@ from The Open Group.
 #include <X11/keysym.h>
 #include "xserver-properties.h"
 #include "exevents.h"
+#include "extinit.h"
 
 Bool
 LegalModifier(unsigned int key, DeviceIntPtr pDev)
@@ -136,9 +137,14 @@ void
 InitInput(int argc, char *argv[])
 {
     DeviceIntPtr p, k;
+    Atom xiclass;
     p = AddInputDevice(serverClient, vfbMouseProc, TRUE);
     k = AddInputDevice(serverClient, vfbKeybdProc, TRUE);
     RegisterPointerDevice(p);
+    xiclass = MakeAtom(XI_MOUSE, sizeof(XI_MOUSE) - 1, TRUE);
+    AssignTypeAndName(p, xiclass, "Xvfb mouse");
     RegisterKeyboardDevice(k);
+    xiclass = MakeAtom(XI_KEYBOARD, sizeof(XI_KEYBOARD) - 1, TRUE);
+    AssignTypeAndName(k, xiclass, "Xvfb keyboard");
     (void)mieqInit();
 }

hw/xfree86/Makefile.am

@@ -80,7 +80,7 @@ BUILT_SOURCES = xorg.conf.example
 DISTCLEANFILES += xorg.conf.example xorg.conf.example.pre
 EXTRA_DIST = xorgconf.cpp
 
-if XSERVER_DTRACE
+if SPECIAL_DTRACE_OBJECTS
 # Re-add dtrace object code that gets lost when building static libraries
 Xorg_LDADD += $(XSERVER_LIBS)
 endif
@@ -92,7 +92,8 @@ if SOLARIS_ASM_INLINE
 BUILT_SOURCES += os-support/solaris/solaris-@SOLARIS_INOUT_ARCH@.il
 
 os-support/solaris/solaris-@SOLARIS_INOUT_ARCH@.il:
-	cd os-support/solaris ; make solaris-@SOLARIS_INOUT_ARCH@.il
+	cd os-support/solaris ; \
+	 $(MAKE) $(AM_MAKEFLAGS) solaris-@SOLARIS_INOUT_ARCH@.il
 endif
 
 # do not use $(mkdir_p) if you want automake 1.7 to work

hw/xfree86/common/compiler.h

@@ -55,6 +55,20 @@
 # define DO_PROTOTYPES
 #endif
 
+/* Map Sun compiler platform defines to gcc-style used in the code */
+#if defined(__amd64) && !defined(__amd64__)
+# define __amd64__
+#endif
+#if defined(__i386) && !defined(__i386__)
+# define __i386__
+#endif
+#if defined(__sparc) && !defined(__sparc__)
+# define __sparc__
+#endif
+#if defined(__sparcv9) && !defined(__sparc64__)
+# define __sparc64__
+#endif
+
 #ifndef _X_EXPORT
 # include <X11/Xfuncproto.h>
 #endif
@@ -1211,6 +1225,8 @@ extern _X_EXPORT void (*xf86WriteMmio32)(int, void *, unsigned long);
 extern _X_EXPORT void (*xf86WriteMmioNB8)(int, void *, unsigned long);
 extern _X_EXPORT void (*xf86WriteMmioNB16)(int, void *, unsigned long);
 extern _X_EXPORT void (*xf86WriteMmioNB32)(int, void *, unsigned long);
+extern _X_EXPORT void xf86SlowBCopyFromBus(unsigned char *, unsigned char *, int);
+extern _X_EXPORT void xf86SlowBCopyToBus(unsigned char *, unsigned char *, int);
 
 /* Some macros to hide the system dependencies for MMIO accesses */
 /* Changed to kill noise generated by gcc's -Wcast-align */
@@ -1342,4 +1358,18 @@ extern _X_EXPORT void (*xf86WriteMmioNB32)(int, void *, unsigned long);
 #  define MMIO_MOVE32(base, offset, val) MMIO_OUT32(base, offset, val)
 
 # endif /* __alpha__ */
+
+/*
+ * With Intel, the version in os-support/misc/SlowBcopy.s is used.
+ * This avoids port I/O during the copy (which causes problems with
+ * some hardware).
+ */
+# ifdef __alpha__
+#  define slowbcopy_tobus(src,dst,count) xf86SlowBCopyToBus(src,dst,count)
+#  define slowbcopy_frombus(src,dst,count) xf86SlowBCopyFromBus(src,dst,count)
+# else /* __alpha__ */
+#  define slowbcopy_tobus(src,dst,count) xf86SlowBcopy(src,dst,count)
+#  define slowbcopy_frombus(src,dst,count) xf86SlowBcopy(src,dst,count)
+# endif /* __alpha__ */
+
 #endif /* _COMPILER_H */

hw/xfree86/common/xf86Config.c

@@ -71,13 +71,6 @@ extern DeviceAssocRec mouse_assoc;
 #include "picture.h"
 #endif
 
-#if (defined(__i386__)) && \
-    (defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || \
-     defined(__NetBSD__) || defined(linux) || \
-     (defined(SVR4) && !defined(sun)) || defined(__GNU__))
-#define SUPPORT_PC98
-#endif
-
 /*
  * These paths define the way the config file search is done.  The escape
  * sequences are documented in parser/scan.c.
@@ -249,7 +242,9 @@ xf86ModulelistFromConfig(pointer **optlist)
 {
     int count = 0, i = 0;
     char **modulearray;
-    char *ignore[] = { "GLcore", "speedo", "bitmap", "drm", NULL };
+    char *ignore[] = { "GLcore", "speedo", "bitmap", "drm",
+		       "freetype", "type1",
+		       NULL };
     pointer *optarray;
     XF86LoadPtr modp;
     Bool found;
@@ -776,11 +771,10 @@ static OptionInfoRec FlagOptions[] = {
 	{0}, FALSE },
 };
 
-#ifdef __i386__
+#ifdef SUPPORT_PC98
 static Bool
 detectPC98(void)
 {
-#ifdef SUPPORT_PC98
     unsigned char buf[2];
 
     if (xf86ReadBIOS(0xf8000, 0xe80, buf, 2) != 2)
@@ -789,11 +783,8 @@ detectPC98(void)
 	return TRUE;
     else
 	return FALSE;
-#else
-    return FALSE;
-#endif
 }
-#endif /* __i386__ */
+#endif
 
 static Bool
 configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
@@ -1052,7 +1043,7 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
 	xf86Info.pixmap24 = Pix24DontCare;
 	xf86Info.pix24From = X_DEFAULT;
     }
-#ifdef __i386__
+#ifdef SUPPORT_PC98
     if (xf86GetOptValBool(FlagOptions, FLAG_PC98, &value)) {
 	xf86Info.pc98 = value;
 	if (value) {
@@ -1456,7 +1447,7 @@ checkCoreInputDevices(serverLayoutPtr servlayoutp, Bool implicitLayout)
 #ifdef CONFIG_HAL
 	xf86Msg(X_INFO, "The server relies on HAL to provide the list of "
 	                "input devices.\n\tIf no devices become available, "
-	                "reconfigure HAL or disable AllowEmptyInput.\n");
+	                "reconfigure HAL or disable AutoAddDevices.\n");
 #else
 	xf86Msg(X_INFO, "HAL is disabled and no input devices were configured.\n"
 			"\tTry disabling AllowEmptyInput.\n");

hw/xfree86/common/xf86DGA.c

@@ -120,8 +120,22 @@ DGAInit(
 
     DGAScreenKey = &DGAScreenKeyIndex;
 
-    if(!(pScreenPriv = (DGAScreenPtr)xalloc(sizeof(DGAScreenRec))))
-	return FALSE;
+    pScreenPriv = DGA_GET_SCREEN_PRIV(pScreen);
+
+    if (!pScreenPriv)
+    {
+	if(!(pScreenPriv = (DGAScreenPtr)xalloc(sizeof(DGAScreenRec))))
+	    return FALSE;
+	dixSetPrivate(&pScreen->devPrivates, DGAScreenKey, pScreenPriv);
+	pScreenPriv->CloseScreen = pScreen->CloseScreen;
+	pScreen->CloseScreen = DGACloseScreen;
+	pScreenPriv->DestroyColormap = pScreen->DestroyColormap;
+	pScreen->DestroyColormap = DGADestroyColormap;
+	pScreenPriv->InstallColormap = pScreen->InstallColormap;
+	pScreen->InstallColormap = DGAInstallColormap;
+	pScreenPriv->UninstallColormap = pScreen->UninstallColormap;
+	pScreen->UninstallColormap = DGAUninstallColormap;
+    }
 
     pScreenPriv->pScrn = pScrn;
     pScreenPriv->numModes = num;
@@ -146,17 +160,6 @@ DGAInit(
 	    modes[i].flags &= ~DGA_PIXMAP_AVAILABLE;
 #endif
 
-    dixSetPrivate(&pScreen->devPrivates, DGAScreenKey, pScreenPriv);
-    pScreenPriv->CloseScreen = pScreen->CloseScreen;
-    pScreen->CloseScreen = DGACloseScreen;
-    pScreenPriv->DestroyColormap = pScreen->DestroyColormap;
-    pScreen->DestroyColormap = DGADestroyColormap;
-    pScreenPriv->InstallColormap = pScreen->InstallColormap;
-    pScreen->InstallColormap = DGAInstallColormap;
-    pScreenPriv->UninstallColormap = pScreen->UninstallColormap;
-    pScreen->UninstallColormap = DGAUninstallColormap;
-
-
     return TRUE;
 }
 
@@ -1085,13 +1088,15 @@ DGAProcessPointerEvent (ScreenPtr pScreen, DGAEvent *event, DeviceIntPtr mouse)
     ButtonClassPtr  butc = mouse->button;
     DGAScreenPtr    pScreenPriv = DGA_GET_SCREEN_PRIV(pScreen);
     DeviceEvent     ev;
+    DeviceIntPtr    master = GetMaster(mouse, MASTER_KEYBOARD);
 
     memset(&ev, 0, sizeof(ev));
     ev.header = ET_Internal;
     ev.length = sizeof(ev);
     ev.type = event->subtype;
     ev.corestate  = butc->state;
-    ev.corestate |= XkbStateFieldFromRec(&GetPairedDevice(mouse)->key->xkbInfo->state);
+    if (master && master->key)
+        ev.corestate |= XkbStateFieldFromRec(&master->key->xkbInfo->state);
 
     UpdateDeviceState(mouse, &ev);
 

hw/xfree86/common/xf86Events.c

@@ -202,8 +202,16 @@ xf86ProcessActionEvent(ActionEvent action, void *arg)
 	    vtno--;
 #endif
 #if defined(sun)
-	    if (vtno == xf86Info.vtno)
+	    if (vtno == xf86Info.vtno) {
 		break;
+	    } else {
+		struct vt_stat state;
+		if (ioctl(xf86Info.consoleFd, VT_GETSTATE, &state) < 0)
+			break;
+
+		if ((state.v_state & (1 << vtno)) == 0)
+			break;
+	    }
 
 	    xf86Info.vtRequestsPending = TRUE;
 	    xf86Info.vtPendingNum = vtno;
@@ -263,13 +271,14 @@ xf86Wakeup(pointer blockData, int err, pointer pReadmask)
 		    (FD_ISSET(pInfo->fd, &devicesWithInput) != 0)) {
 		    int sigstate = xf86BlockSIGIO();
 
-		    pInfo->read_input(pInfo);
-		    xf86UnblockSIGIO(sigstate);
 		    /*
 		     * Remove the descriptior from the set because more than one
 		     * device may share the same file descriptor.
 		     */
 		    FD_CLR(pInfo->fd, &devicesWithInput);
+
+		    pInfo->read_input(pInfo);
+		    xf86UnblockSIGIO(sigstate);
 		}
 		pInfo = pInfo->next;
 	    }

hw/xfree86/common/xf86Globals.c

@@ -124,7 +124,7 @@ xf86InfoRec xf86Info = {
     .miscModInDevAllowNonLocal  = FALSE,
     .pixmap24                   = Pix24DontCare,
     .pix24From                  = X_DEFAULT,
-#ifdef __i386__
+#ifdef SUPPORT_PC98
     .pc98                       = FALSE,
 #endif
     .pmFlag                     = TRUE,

hw/xfree86/common/xf86Helper.c

@@ -1446,6 +1446,13 @@ xf86MatchDevice(const char *drivername, GDevPtr **sectlist)
 
     if (xf86DoConfigure && xf86DoConfigurePass1) return 1;
 
+    /*
+     * This can happen when running Xorg -showopts and a module like ati
+     * or vmware tries to load its submodules when xf86ConfigLayout is empty
+     */
+    if (!xf86ConfigLayout.screens)
+	return 0;
+
     /*
      * This is a very important function that matches the device sections
      * as they show up in the config file with the drivers that the server
@@ -2140,7 +2147,7 @@ xf86GetAllowMouseOpenFail(void)
 Bool
 xf86IsPc98(void)
 {
-#ifdef __i386__
+#if SUPPORT_PC98
     return xf86Info.pc98;
 #else
     return FALSE;

hw/xfree86/common/xf86Init.c

@@ -1142,8 +1142,10 @@ OsVendorInit(void)
   signal(SIGCHLD, SIG_DFL);	/* Need to wait for child processes */
 #endif
 
-  if (!beenHere)
+  if (!beenHere) {
+    umask(022);
     xf86LogInit();
+  }
 
         /* Set stderr to non-blocking. */
 #ifndef O_NONBLOCK
@@ -1243,7 +1245,9 @@ AbortDDX(void)
 	       * we might not have been wrapped yet. Therefore enable
 	       * screen explicitely.
 	       */
+	      xf86VGAarbiterLock(xf86Screens[i]);
 	      (xf86Screens[i]->LeaveVT)(i, 0);
+	      xf86VGAarbiterUnlock(xf86Screens[i]);
 	  }
   }
 

hw/xfree86/common/xf86Mode.c

@@ -249,6 +249,15 @@ xf86ShowClockRanges(ScrnInfoPtr scrp, ClockRangePtr clockRanges)
     }
 }
 
+static Bool
+modeInClockRange(ClockRangePtr cp, DisplayModePtr p)
+{
+    return ((p->Clock >= cp->minClock) &&
+	    (p->Clock <= cp->maxClock) &&
+	    (cp->interlaceAllowed || !(p->Flags & V_INTERLACE)) &&
+	    (cp->doubleScanAllowed ||
+	     ((p->VScan <= 1) && !(p->Flags & V_DBLSCAN))));
+}
 
 /*
  * xf86FindClockRangeForMode()    [... like the name says ...]
@@ -259,12 +268,7 @@ xf86FindClockRangeForMode(ClockRangePtr clockRanges, DisplayModePtr p)
     ClockRangePtr cp;
 
     for (cp = clockRanges; ; cp = cp->next)
-	if (!cp ||
-	    ((p->Clock >= cp->minClock) &&
-	     (p->Clock <= cp->maxClock) &&
-	     (cp->interlaceAllowed || !(p->Flags & V_INTERLACE)) &&
-	     (cp->doubleScanAllowed ||
-	      ((p->VScan <= 1) && !(p->Flags & V_DBLSCAN)))))
+	if (!cp || modeInClockRange(cp, p))
 	    return cp;
 }
 
@@ -979,11 +983,7 @@ xf86CheckModeForDriver(ScrnInfoPtr scrp, DisplayModePtr mode, int flags)
     if (scrp->progClock) {
 	/* Check clock is in range */
 	for (cp = scrp->clockRanges; cp != NULL; cp = cp->next) {
-	    if ((cp->minClock <= mode->Clock) &&
-		(cp->maxClock >= mode->Clock) &&
-		(cp->interlaceAllowed || !(mode->Flags & V_INTERLACE)) &&
-		(cp->doubleScanAllowed ||
-		 ((!(mode->Flags & V_DBLSCAN)) && (mode->VScan <= 1))))
+	    if (modeInClockRange(cp, mode))
 	        break;
 	}
 	if (cp == NULL) {
@@ -999,12 +999,7 @@ xf86CheckModeForDriver(ScrnInfoPtr scrp, DisplayModePtr mode, int flags)
 	 status = MODE_CLOCK_RANGE;
 	/* Check clock is in range */
 	for (cp = scrp->clockRanges; cp != NULL; cp = cp->next) {
-	    if ((cp->minClock <= mode->Clock) &&
-		(cp->maxClock >= mode->Clock) &&
-		(cp->interlaceAllowed || !(mode->Flags & V_INTERLACE)) &&
-		(cp->doubleScanAllowed ||
-		 ((!(mode->Flags & V_DBLSCAN)) && (mode->VScan <= 1)))) {
-
+	    if (modeInClockRange(cp, mode)) {
 		/*
 	 	 * Clock is in range, so if it is not a programmable clock,
 		 * find a matching clock.

hw/xfree86/common/xf86Privstr.h

@@ -91,7 +91,7 @@ typedef struct {
 						   input device events */
     Pix24Flags		pixmap24;
     MessageType		pix24From;
-#ifdef __i386__
+#ifdef SUPPORT_PC98
     Bool		pc98;
 #endif
     Bool		pmFlag;

hw/xfree86/common/xf86RandR.c

@@ -163,7 +163,7 @@ xf86RandRSetMode (ScreenPtr	    pScreen,
     WindowPtr		pRoot = WindowTable[pScreen->myNum];
     Bool		ret = TRUE;
 
-    if (pRoot)
+    if (pRoot && scrp->vtSema)
 	(*scrp->EnableDisableFBAccess) (pScreen->myNum, FALSE);
     if (useVirtual)
     {
@@ -229,7 +229,7 @@ xf86RandRSetMode (ScreenPtr	    pScreen,
      */
     xf86SetViewport (pScreen, pScreen->width, pScreen->height);
     xf86SetViewport (pScreen, 0, 0);
-    if (pRoot)
+    if (pRoot && scrp->vtSema)
 	(*scrp->EnableDisableFBAccess) (pScreen->myNum, TRUE);
     return ret;
 }