Update to xf86-input-synaptics 1.6.2

ok matthieu@, mpi@

8 files changed, 172 insertions, 217 deletions

diff --git a/driver/xf86-input-synaptics/ChangeLog b/driver/xf86-input-synaptics/ChangeLog
index 187be5247..1c01053bc 100644
--- a/driver/xf86-input-synaptics/ChangeLog
+++ b/driver/xf86-input-synaptics/ChangeLog
@@ -1,3 +1,133 @@
+commit d5ff9d8b0b186cf39695df84a10984eac559b746
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Tue Jun 12 13:46:34 2012 +1000
+
+    synaptics 1.6.2
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+
+commit c1aae820601a911432c64938f03eab62bafaab2f
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Fri May 18 09:38:50 2012 +1000
+
+    synaptics 1.6.1.901
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+
+commit 7ccca8e7d8fbf2ccb5a2dbbfbf06ff4dbd6b7149
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Thu May 17 12:10:04 2012 +1000
+
+    Don't allow for scroll distances of 0 (#49965)
+    
+    It'll either hang the server or blow up with divisions by 0, whichever one
+    comes first.
+    
+    X.Org Bug 49965 <http://bugs.freedesktop.org/show_bug.cgi?id=49965>
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+    (cherry picked from commit 6d47d334d8a876e7e094306c313246b87016b78a)
+
+commit f8d970e191e6df05a8f2c26afdeea3e27b941a62
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Thu May 17 11:02:02 2012 +1000
+
+    Reset hw->x/y to INT_MIN and skip HandleState until we have x/y events
+    
+    The driver assumes x/y is always valid but after coming from a resume we may
+    get a few events with either ABS_X or ABS_Y (not both). Thus we process with
+    hw->x == 0 and hw->y == somevalue, causing cursor jumps when calculating
+    deltas whenver the real hw->x comes in.
+    
+    Fix this by resetting hw->x/y to INT_MIN and skip state processing until
+    both axes are available.
+    
+    For clickpads, this means handling of data will be delayed until we get
+    at least one motion on each axis. Button presses won't be recognised either
+    until that happens. It requires some skill to not trigger motion on both
+    axes, even more to press a button without doing so.
+    
+    For non-clickpads, handling of motion events will be delayed likewise. If a
+    physical button is pressed immediately after resume we have to assume deltas
+    of x/y.
+    - If the next event is a new touch, it will have ABS_X/ABS_Y set anyway
+    - If the finger was already down, a button event is generated, and the
+      finger has generated ABS_X or ABS_Y only before the event, the next event
+      containing the missing data will cause a jump. The fix for this is more
+      invasive and this is quite a corner-case.
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+    (cherry picked from commit cd569377cda9b5a4ee00c0137db14f625c76c40f)
+
+commit 739175d198372a3226ce061b118d8fe5bbc8f6bf
+Author: Chase Douglas <chase.douglas@canonical.com>
+Date:   Wed May 16 07:49:25 2012 -0700
+
+    Reset open slots array on device disable
+    
+    The open slots array is used for clickpad cumulative delta computation.
+    If the array is not reset and becomes corrupted during the device
+    disable/enable cycle, the cumulative deltas may be wrong. This manifests
+    as jumpy cursor behavior on some clickpads after suspend/resume.
+    
+    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 0054b144f3daf00e46a35b2f165befb209df94fc)
+
+commit 67a02d676c96d5b3d4729290cd96af0201eb76bb
+Author: Chun Yang <Chuck.Yang@gmail.com>
+Date:   Tue May 15 14:51:42 2012 -0500
+
+    Fix coasting for negative ScrollDelta
+    
+    Fix the coasting direction for when VertScrollDelta or HorizScrollDelta is
+    negative.
+    
+    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=49966
+    
+    Regression introduced in 0de4445ff8e75aab208faf6383e76045934c6720
+    
+    Signed-off-by: Chun Yang <Chuck.Yang@gmail.com>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 53557a5cab1e253dc8f4393207954ae0fe76068f)
+
+commit 23e87b57bb874326c88a7ad7292bec51959fb876
+Author: Chase Douglas <chase.douglas@canonical.com>
+Date:   Mon May 14 10:20:01 2012 -0700
+
+    Ignore pre-existing touches
+    
+    If a touch is physically active when the device is enabled, then all
+    events for that touch must be ignored. In particular, we cannot close
+    the touch or we will decrement touch count counters below zero. If these
+    counters go below zero memory corruption can occur.
+    
+    Note that a device is disabled and enabled every time the user types on
+    the keyboard if synclient is used to disable the trackpad while typing.
+    This is a very common option.
+    
+    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 55fc42e7c9b4948cadd4f98ef7b6a3b12e268e3e)
+
+commit 23065a974e5dcdf0d6a436a0547bb7887d306a6f
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Fri May 11 12:27:39 2012 +1000
+
+    Avoid out-of-bounds access by running num_active_touches < 0 (#49439)
+    
+    If a touch is active during driver init, the slot will be set to
+    SLOTSTATE_CLOSE when it finishes. That could decrease num_active_touches to
+    less than 0, causing out-of-bounds access.
+    
+    X.Org Bug 49439 <http://bugs.freedesktop.org/show_bug.cgi?id=49439>
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+    (cherry picked from commit 77d766b1d535dff9a27c7db343ede85d9f44850b)
+
 commit e0f5688994baa85a8c658120681575cdd0ba2a58
 Author: Peter Hutterer <peter.hutterer@who-t.net>
 Date:   Fri May 11 10:30:21 2012 +1000
diff --git a/driver/xf86-input-synaptics/aclocal.m4 b/driver/xf86-input-synaptics/aclocal.m4
index b4657c6b0..b7fe8c334 100644
--- a/driver/xf86-input-synaptics/aclocal.m4
+++ b/driver/xf86-input-synaptics/aclocal.m4
@@ -11205,7 +11205,6 @@ XORG_TESTSET_CFLAG([[BASE_]PREFIX[FLAGS]], [-Wshadow])
 XORG_TESTSET_CFLAG([[BASE_]PREFIX[FLAGS]], [-Wcast-qual])
 XORG_TESTSET_CFLAG([[BASE_]PREFIX[FLAGS]], [-Wmissing-noreturn])
 XORG_TESTSET_CFLAG([[BASE_]PREFIX[FLAGS]], [-Wmissing-format-attribute])
-XORG_TESTSET_CFLAG([[BASE_]PREFIX[FLAGS]], [-Wredundant-decls])
 
 # These are currently disabled because they are noisy.  They will be enabled
 # in the future once the codebase is sufficiently modernized to silence
diff --git a/driver/xf86-input-synaptics/configure b/driver/xf86-input-synaptics/configure
index 6e40b1a83..b714ffc04 100755
--- a/driver/xf86-input-synaptics/configure
+++ b/driver/xf86-input-synaptics/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.62 for xf86-input-synaptics 1.6.1.
+# Generated by GNU Autoconf 2.62 for xf86-input-synaptics 1.6.2.
 #
 # Report bugs to <https://bugs.freedesktop.org/enter_bug.cgi?product=xorg>.
 #
@@ -616,8 +616,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='xf86-input-synaptics'
 PACKAGE_TARNAME='xf86-input-synaptics'
-PACKAGE_VERSION='1.6.1'
-PACKAGE_STRING='xf86-input-synaptics 1.6.1'
+PACKAGE_VERSION='1.6.2'
+PACKAGE_STRING='xf86-input-synaptics 1.6.2'
 PACKAGE_BUGREPORT='https://bugs.freedesktop.org/enter_bug.cgi?product=xorg'
 
 ac_unique_file="Makefile.am"
@@ -1409,7 +1409,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures xf86-input-synaptics 1.6.1 to adapt to many kinds of systems.
+\`configure' configures xf86-input-synaptics 1.6.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1480,7 +1480,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of xf86-input-synaptics 1.6.1:";;
+     short | recursive ) echo "Configuration of xf86-input-synaptics 1.6.2:";;
    esac
   cat <<\_ACEOF
 
@@ -1612,7 +1612,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-xf86-input-synaptics configure 1.6.1
+xf86-input-synaptics configure 1.6.2
 generated by GNU Autoconf 2.62
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1626,7 +1626,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by xf86-input-synaptics $as_me 1.6.1, which was
+It was created by xf86-input-synaptics $as_me 1.6.2, which was
 generated by GNU Autoconf 2.62.  Invocation command line was
 
   $ $0 $@
@@ -2280,7 +2280,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='xf86-input-synaptics'
- VERSION='1.6.1'
+ VERSION='1.6.2'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -15773,203 +15773,6 @@ $as_echo "$supported" >&6; }
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-xorg_testset_save_CFLAGS="$CFLAGS"
-
-if test "x$xorg_testset_cc_unknown_warning_option" = "x" ; then
-	CFLAGS="$CFLAGS -Werror=unknown-warning-option"
-	{ $as_echo "$as_me:$LINENO: checking if $CC supports -Werror=unknown-warning-option" >&5
-$as_echo_n "checking if $CC supports -Werror=unknown-warning-option... " >&6; }
-if test "${xorg_cv_cc_flag_unknown_warning_option+set}" = set; then
-  $as_echo_n "(cached) " >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-int i;
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
-$as_echo "$ac_try_echo") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  xorg_cv_cc_flag_unknown_warning_option=yes
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	xorg_cv_cc_flag_unknown_warning_option=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:$LINENO: result: $xorg_cv_cc_flag_unknown_warning_option" >&5
-$as_echo "$xorg_cv_cc_flag_unknown_warning_option" >&6; }
-	xorg_testset_cc_unknown_warning_option=$xorg_cv_cc_flag_unknown_warning_option
-	CFLAGS="$xorg_testset_save_CFLAGS"
-fi
-
-if test "x$xorg_testset_cc_unused_command_line_argument" = "x" ; then
-	if test "x$xorg_testset_cc_unknown_warning_option" = "xyes" ; then
-		CFLAGS="$CFLAGS -Werror=unknown-warning-option"
-	fi
-	CFLAGS="$CFLAGS -Werror=unused-command-line-argument"
-	{ $as_echo "$as_me:$LINENO: checking if $CC supports -Werror=unused-command-line-argument" >&5
-$as_echo_n "checking if $CC supports -Werror=unused-command-line-argument... " >&6; }
-if test "${xorg_cv_cc_flag_unused_command_line_argument+set}" = set; then
-  $as_echo_n "(cached) " >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-int i;
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
-$as_echo "$ac_try_echo") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  xorg_cv_cc_flag_unused_command_line_argument=yes
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	xorg_cv_cc_flag_unused_command_line_argument=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:$LINENO: result: $xorg_cv_cc_flag_unused_command_line_argument" >&5
-$as_echo "$xorg_cv_cc_flag_unused_command_line_argument" >&6; }
-	xorg_testset_cc_unused_command_line_argument=$xorg_cv_cc_flag_unused_command_line_argument
-	CFLAGS="$xorg_testset_save_CFLAGS"
-fi
-
-found="no"
-
-	if test $found = "no" ; then
-		if test "x$xorg_testset_unknown_warning_option" = "xyes" ; then
-			CFLAGS="$CFLAGS -Werror=unknown-warning-option"
-		fi
-
-		if test "x$xorg_testset_unused_command_line_argument" = "xyes" ; then
-			CFLAGS="$CFLAGS -Werror=unused-command-line-argument"
-		fi
-
-		CFLAGS="$CFLAGS -Wredundant-decls"
-
-		{ $as_echo "$as_me:$LINENO: checking if $CC supports-Wredundant-decls" >&5
-$as_echo_n "checking if $CC supports-Wredundant-decls... " >&6; }
-		cacheid=xorg_cv_cc_flag__Wredundant_decls
-		if { as_var=$cacheid; eval "test \"\${$as_var+set}\" = set"; }; then
-  $as_echo_n "(cached) " >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-int i;
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
-$as_echo "$ac_try_echo") >&5
-  (eval "$ac_link") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest$ac_exeext && {
-	 test "$cross_compiling" = yes ||
-	 $as_test_x conftest$ac_exeext
-       }; then
-  eval $cacheid=yes
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	eval $cacheid=no
-fi
-
-rm -rf conftest.dSYM
-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
-      conftest$ac_exeext conftest.$ac_ext
-fi
-
-
-		CFLAGS="$xorg_testset_save_CFLAGS"
-
-		eval supported=\$$cacheid
-		{ $as_echo "$as_me:$LINENO: result: $supported" >&5
-$as_echo "$supported" >&6; }
-		if test "$supported" = "yes" ; then
-			BASE_CFLAGS="$BASE_CFLAGS -Wredundant-decls"
-			found="yes"
-		fi
-	fi
-
-
-
 # These are currently disabled because they are noisy.  They will be enabled
 # in the future once the codebase is sufficiently modernized to silence
 # them.  For now, I don't want them to drown out the other warnings.
@@ -23695,7 +23498,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by xf86-input-synaptics $as_me 1.6.1, which was
+This file was extended by xf86-input-synaptics $as_me 1.6.2, which was
 generated by GNU Autoconf 2.62.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -23748,7 +23551,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_version="\\
-xf86-input-synaptics config.status 1.6.1
+xf86-input-synaptics config.status 1.6.2
 configured by $0, generated by GNU Autoconf 2.62,
   with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
diff --git a/driver/xf86-input-synaptics/configure.ac b/driver/xf86-input-synaptics/configure.ac
index 916350145..26e2c321f 100644
--- a/driver/xf86-input-synaptics/configure.ac
+++ b/driver/xf86-input-synaptics/configure.ac
@@ -23,7 +23,7 @@
 # Initialize Autoconf
 AC_PREREQ([2.60])
 AC_INIT([xf86-input-synaptics],
-        [1.6.1],
+        [1.6.2],
         [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg],
         [xf86-input-synaptics])
 AC_CONFIG_SRCDIR([Makefile.am])
diff --git a/driver/xf86-input-synaptics/src/eventcomm.c b/driver/xf86-input-synaptics/src/eventcomm.c
index 89a8a3a7c..280ef9b73 100644
--- a/driver/xf86-input-synaptics/src/eventcomm.c
+++ b/driver/xf86-input-synaptics/src/eventcomm.c
@@ -564,8 +564,7 @@ EventProcessTouchEvent(InputInfoPtr pInfo, struct SynapticsHwState *hw,
         if (slot_index < 0)
             return;
 
-        if (hw->slot_state[slot_index] == SLOTSTATE_EMPTY ||
-            hw->slot_state[slot_index] == SLOTSTATE_OPEN_EMPTY)
+        if (hw->slot_state[slot_index] == SLOTSTATE_OPEN_EMPTY)
             hw->slot_state[slot_index] = SLOTSTATE_UPDATE;
         if (ev->code == ABS_MT_TRACKING_ID) {
             if (ev->value >= 0) {
@@ -580,7 +579,7 @@ EventProcessTouchEvent(InputInfoPtr pInfo, struct SynapticsHwState *hw,
                                 "Attempted to copy values from out-of-range "
                                 "slot, touch events may be incorrect.\n");
             }
-            else {
+            else if (hw->slot_state[slot_index] != SLOTSTATE_EMPTY) {
                 hw->slot_state[slot_index] = SLOTSTATE_CLOSE;
                 proto_data->num_touches--;
             }
diff --git a/driver/xf86-input-synaptics/src/properties.c b/driver/xf86-input-synaptics/src/properties.c
index 44ac3064a..3b3f1c549 100644
--- a/driver/xf86-input-synaptics/src/properties.c
+++ b/driver/xf86-input-synaptics/src/properties.c
@@ -519,6 +519,9 @@ SetProperty(DeviceIntPtr dev, Atom property, XIPropertyValuePtr prop,
             return BadMatch;
 
         dist = (INT32 *) prop->data;
+        if (dist[0] == 0 || dist[1] == 0)
+            return BadValue;
+
         if (para->scroll_dist_vert != dist[0]) {
             para->scroll_dist_vert = dist[0];
 #ifdef HAVE_SMOOTH_SCROLL
@@ -715,6 +718,9 @@ SetProperty(DeviceIntPtr dev, Atom property, XIPropertyValuePtr prop,
             return BadMatch;
 
         circdist = *(float *) prop->data;
+        if (circdist == 0)
+            return BadValue;
+
         para->scroll_dist_circ = circdist;
     }
     else if (property == prop_circscroll_trigger) {
diff --git a/driver/xf86-input-synaptics/src/synaptics.c b/driver/xf86-input-synaptics/src/synaptics.c
index 30c411e34..5350dd822 100644
--- a/driver/xf86-input-synaptics/src/synaptics.c
+++ b/driver/xf86-input-synaptics/src/synaptics.c
@@ -1156,6 +1156,9 @@ SynapticsReset(SynapticsPrivate * priv)
     priv->lastButtons = 0;
     priv->prev_z = 0;
     priv->prevFingers = 0;
+#ifdef HAVE_MULTITOUCH
+    memset(priv->open_slots, 0, priv->num_slots * sizeof(int));
+#endif
 }
 
 static Bool
@@ -2743,7 +2746,7 @@ HandleScrolling(SynapticsPrivate * priv, struct SynapticsHwState *hw,
         double dtime = (hw->millis - priv->scroll.last_millis) / 1000.0;
         double ddy = para->coasting_friction * dtime;
 
-        priv->scroll.delta_y += priv->scroll.coast_speed_y * dtime * para->scroll_dist_vert;
+        priv->scroll.delta_y += priv->scroll.coast_speed_y * dtime * abs(para->scroll_dist_vert);
         delay = MIN(delay, POLL_MS);
         if (abs(priv->scroll.coast_speed_y) < ddy) {
             priv->scroll.coast_speed_y = 0;
@@ -2758,7 +2761,7 @@ HandleScrolling(SynapticsPrivate * priv, struct SynapticsHwState *hw,
     if (priv->scroll.coast_speed_x) {
         double dtime = (hw->millis - priv->scroll.last_millis) / 1000.0;
         double ddx = para->coasting_friction * dtime;
-        priv->scroll.delta_x += priv->scroll.coast_speed_x * dtime * para->scroll_dist_vert;
+        priv->scroll.delta_x += priv->scroll.coast_speed_x * dtime * abs(para->scroll_dist_horiz);
         delay = MIN(delay, POLL_MS);
         if (abs(priv->scroll.coast_speed_x) < ddx) {
             priv->scroll.coast_speed_x = 0;
@@ -3131,7 +3134,9 @@ UpdateTouchState(InputInfoPtr pInfo, struct SynapticsHwState *hw)
                     priv->open_slots[j] = priv->open_slots[j + 1];
             }
 
-            priv->num_active_touches--;
+            BUG_WARN(priv->num_active_touches == 0);
+            if (priv->num_active_touches > 0)
+                priv->num_active_touches--;
         }
     }
 
@@ -3276,6 +3281,19 @@ HandleState(InputInfoPtr pInfo, struct SynapticsHwState *hw, CARD32 now,
         return delay;
     }
 
+    /* We need both and x/y, the driver can't handle just one of the two
+     * yet. But since it's possible to hit a phys button on non-clickpads
+     * without ever getting motion data first, we must continue with 0/0 for
+     * that case. */
+    if (hw->x == INT_MIN || hw->y == INT_MAX) {
+        if (para->clickpad)
+            return delay;
+        else if (hw->left || hw->right || hw->middle) {
+            hw->x = (hw->x == INT_MIN) ? 0 : hw->x;
+            hw->y = (hw->y == INT_MIN) ? 0 : hw->y;
+        }
+    }
+
     /* If a physical button is pressed on a clickpad, use cumulative relative
      * touch movements for motion */
     if (para->clickpad && (hw->left || hw->right || hw->middle)) {
diff --git a/driver/xf86-input-synaptics/src/synproto.c b/driver/xf86-input-synaptics/src/synproto.c
index d6e8c658d..0c8a066ce 100644
--- a/driver/xf86-input-synaptics/src/synproto.c
+++ b/driver/xf86-input-synaptics/src/synproto.c
@@ -134,8 +134,8 @@ void
 SynapticsResetHwState(struct SynapticsHwState *hw)
 {
     hw->millis = 0;
-    hw->x = 0;
-    hw->y = 0;
+    hw->x = INT_MIN;
+    hw->y = INT_MIN;
     hw->z = 0;
     hw->cumulative_dx = 0;
     hw->cumulative_dy = 0;