xserver: Branch 'server-1.7-nominations' - 4 commits

[Peter Hutterer]

 dix/devices.c   |   44 +++++++++++++++++++++++++++++++++-----------
 dix/getevents.c |    2 +-
 render/render.c |    4 ++--
 xkb/xkmread.c   |    6 ++++++
 4 files changed, 42 insertions(+), 14 deletions(-)

New commits:
commit 219a0d8fb54f179c7ac8d5953585849ab65a778b
Author: Oldřich Jedlička <oldium.pro at seznam.cz>
Date:   Sun Jan 17 17:59:03 2010 +0100

    Allow driver to call DeleteInputDeviceRequest during UnInit
    
    When the input driver (like xf86-input-wacom) removes it's devices
    during a call to UnInit, the CloseDownDevices() cannot handle it. The
    "next" variable can become a pointer to freed memory.
    
    The patch introduces order-independent device freeing mechanism by
    remembering the already freed device ids. The devices can reorder any
    time during freeing. No device will be double-freed - if the removing
    failed for any reason; some implementations of DeleteInputDeviceRequest
    don't free the devices already.
    
    Signed-off-by: Oldřich Jedlička <oldium.pro at seznam.cz>
    Reviewed-by: Simon Thum <simon.thum at gmx.de>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 08b22c7faf97217ea4d497eec6624fc3dd916d9b)

diff --git a/dix/devices.c b/dix/devices.c
index 245a95b..ef199b7 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -878,13 +878,43 @@ CloseDevice(DeviceIntPtr dev)
 }
 
 /**
+ * Shut down all devices of one list and free all resources.
+ */
+static
+void
+CloseDeviceList(DeviceIntPtr *listHead)
+{
+    /* Used to mark devices that we tried to free */
+    Bool freedIds[MAXDEVICES];
+    DeviceIntPtr dev;
+    int i;
+
+    if (listHead == NULL)
+        return;
+
+    for (i = 0; i < MAXDEVICES; i++)
+        freedIds[i] = FALSE;
+
+    dev = *listHead;
+    while (dev != NULL)
+    {
+        freedIds[dev->id] = TRUE;
+        DeleteInputDeviceRequest(dev);
+
+        dev = *listHead;
+        while (dev != NULL && freedIds[dev->id])
+            dev = dev->next;
+    }
+}
+
+/**
  * Shut down all devices, free all resources, etc.
  * Only useful if you're shutting down the server!
  */
 void
 CloseDownDevices(void)
 {
-    DeviceIntPtr dev, next;
+    DeviceIntPtr dev;
 
     /* Float all SDs before closing them. Note that at this point resources
      * (e.g. cursors) have been freed already, so we can't just call
@@ -897,16 +927,8 @@ CloseDownDevices(void)
             dev->u.master = NULL;
     }
 
-    for (dev = inputInfo.devices; dev; dev = next)
-    {
-	next = dev->next;
-        DeleteInputDeviceRequest(dev);
-    }
-    for (dev = inputInfo.off_devices; dev; dev = next)
-    {
-	next = dev->next;
-        DeleteInputDeviceRequest(dev);
-    }
+    CloseDeviceList(&inputInfo.devices);
+    CloseDeviceList(&inputInfo.off_devices);
 
     CloseDevice(inputInfo.pointer);
     CloseDevice(inputInfo.keyboard);
commit a6a4c20121301905399c4e1c23980993bcbf2152
Author: Horst Wente <horst.wente at acm.org>
Date:   Wed Dec 30 19:35:20 2009 +0100

    xkb: make ctrl+alt+keypad + / ctrl+alt+keypad - work again (#25743)
    
    Video mode switching via keypad keys did not work
    
    Signed-off-by: Horst Wente <horst.wente at acm.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit b91cec26de367f75388e620772747b08eee34294)

diff --git a/xkb/xkmread.c b/xkb/xkmread.c
index 6623d1b..3c2df03 100644
--- a/xkb/xkmread.c
+++ b/xkb/xkmread.c
@@ -531,7 +531,13 @@ XkbAction               *act;
             act->devval.v2_ndx = wire.actionData[5];
             act->devval.v2_what = wire.actionData[6];
             break;
+
         case XkbSA_XFree86Private:
+            /* copy the kind of action */
+            strncpy((char*)act->any.data, (char*)wire.actionData,
+                    XkbAnyActionDataSize);
+            break ;
+
         case XkbSA_Terminate:
             /* no args, kinda (note: untrue for xfree86). */
             break;
commit a5b558d065e24880ff14b3781f27d1a9ea6094ab
Author: Oldřich Jedlička <oldium.pro at seznam.cz>
Date:   Tue Jan 12 19:15:06 2010 +0100

    Fix typo in updateSlaveDeviceCoords
    
    The index [0] for the second valuator looks bogus; fix it.
    
    Signed-off-by: Oldřich Jedlička <oldium.pro at seznam.cz>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 993e78d6c433f65bd8a87890a6bb6da480b2cdc4)

diff --git a/dix/getevents.c b/dix/getevents.c
index 2df32e8..18c6302 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -296,7 +296,7 @@ updateSlaveDeviceCoords(DeviceIntPtr master, DeviceIntPtr pDev)
                         &pDev->last.remainder[0], NULL, pDev->valuator->axes + 0, scr->width);
     if(pDev->valuator->numAxes > 1)
         pDev->last.valuators[1] = rescaleValuatorAxis(pDev->last.valuators[1], pDev->last.remainder[1],
-                        &pDev->last.remainder[0], NULL, pDev->valuator->axes + 1, scr->height);
+                        &pDev->last.remainder[1], NULL, pDev->valuator->axes + 1, scr->height);
 
     /* calculate the other axis as well based on info from the old
      * slave-device. If the old slave had less axes than this one,
commit 5d34e78c81bfba3d14146ddfd8e714cdfd9a1692
Author: Robert Morell <rmorell at nvidia.com>
Date:   Thu Jan 21 12:38:47 2010 -0800

    Render: Fix request size verification
    
    RenderSetPictureClipRectangles and the Xinerama version of
    RenderChangePicture were using the wrong structure types for request
    size verification.
    
    Signed-off-by: Robert Morell <rmorell at nvidia.com>
    Reviewed-by: Aaron Plattner <aplattner at nvidia.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 8d6b1838330625b758ebc55bb0df1b425c5cefaf)

diff --git a/render/render.c b/render/render.c
index a32d797..10554ad 100644
--- a/render/render.c
+++ b/render/render.c
@@ -656,7 +656,7 @@ ProcRenderSetPictureClipRectangles (ClientPtr client)
     if (!pPicture->pDrawable)
         return BadDrawable;
 
-    nr = (client->req_len << 2) - sizeof(xRenderChangePictureReq);
+    nr = (client->req_len << 2) - sizeof(xRenderSetPictureClipRectanglesReq);
     if (nr & 4)
 	return BadLength;
     nr >>= 3;
@@ -2728,7 +2728,7 @@ PanoramiXRenderChangePicture (ClientPtr client)
     int		    result = Success, j;
     REQUEST(xRenderChangePictureReq);
 
-    REQUEST_AT_LEAST_SIZE(xChangeWindowAttributesReq);
+    REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
     
     VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess,
 		       RenderErrBase + BadPicture);