xserver 1.19.4

Signed-off-by: Adam Jackson <ajax@redhat.com>

Xext/panoramiXprocs.c

@@ -1050,7 +1050,7 @@ PanoramiXClearToBackground(ClientPtr client)
 int
 PanoramiXCopyArea(ClientPtr client)
 {
-    int j, result, srcx, srcy, dstx, dsty;
+    int j, result, srcx, srcy, dstx, dsty, width, height;
     PanoramiXRes *gc, *src, *dst;
     Bool srcIsRoot = FALSE;
     Bool dstIsRoot = FALSE;
@@ -1091,6 +1091,8 @@ PanoramiXCopyArea(ClientPtr client)
     srcy = stuff->srcY;
     dstx = stuff->dstX;
     dsty = stuff->dstY;
+    width = stuff->width;
+    height = stuff->height;
     if ((dst->type == XRT_PIXMAP) && (src->type == XRT_WINDOW)) {
         DrawablePtr drawables[MAXSCREENS];
         DrawablePtr pDst;
@@ -1105,13 +1107,12 @@ PanoramiXCopyArea(ClientPtr client)
                 return rc;
         }
 
-        pitch = PixmapBytePad(stuff->width, drawables[0]->depth);
+        pitch = PixmapBytePad(width, drawables[0]->depth);
-        if (!(data = calloc(stuff->height, pitch)))
+        if (!(data = calloc(height, pitch)))
             return BadAlloc;
 
-        XineramaGetImageData(drawables, srcx, srcy,
+        XineramaGetImageData(drawables, srcx, srcy, width, height, ZPixmap, ~0,
-                             stuff->width, stuff->height, ZPixmap, ~0, data,
+                             data, pitch, srcIsRoot);
-                             pitch, srcIsRoot);
 
         FOR_NSCREENS_BACKWARD(j) {
             stuff->gc = gc->info[j].id;
@@ -1123,14 +1124,63 @@ PanoramiXCopyArea(ClientPtr client)
             }
 
             (*pGC->ops->PutImage) (pDst, pGC, pDst->depth, dstx, dsty,
-                                   stuff->width, stuff->height,
+                                   width, height, 0, ZPixmap, data);
-                                   0, ZPixmap, data);
-
             if (dstShared)
                 break;
         }
-
         free(data);
+
+        if (pGC->graphicsExposures) {
+            RegionRec rgn;
+            int dx, dy;
+            BoxRec sourceBox;
+
+            dx = drawables[0]->x;
+            dy = drawables[0]->y;
+            if (srcIsRoot) {
+                dx += screenInfo.screens[0]->x;
+                dy += screenInfo.screens[0]->y;
+            }
+
+            sourceBox.x1 = min(srcx + dx, 0);
+            sourceBox.y1 = min(srcy + dy, 0);
+            sourceBox.x2 = max(sourceBox.x1 + width, 32767);
+            sourceBox.y2 = max(sourceBox.y1 + height, 32767);
+
+            RegionInit(&rgn, &sourceBox, 1);
+
+            /* subtract the (screen-space) clips of the source drawables */
+            FOR_NSCREENS(j) {
+                ScreenPtr screen = screenInfo.screens[j];
+                RegionPtr sd;
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    sd = NotClippedByChildren((WindowPtr)drawables[j]);
+                else
+                    sd = &((WindowPtr)drawables[j])->clipList;
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, -screen->x, -screen->y);
+
+                RegionSubtract(&rgn, &rgn, sd);
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, screen->x, screen->y);
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    RegionDestroy(sd);
+            }
+
+            /* -dx/-dy to get back to dest-relative, plus request offsets */
+            RegionTranslate(&rgn, -dx + dstx, -dy + dsty);
+
+            /* intersect with gc clip; just one screen is fine because pixmap */
+            RegionIntersect(&rgn, &rgn, pGC->pCompositeClip);
+
+            /* and expose */
+            SendGraphicsExpose(client, &rgn, dst->info[0].id, X_CopyArea, 0);
+            RegionUninit(&rgn);
+        }
     }
     else {
         DrawablePtr pDst = NULL, pSrc = NULL;

Xext/shm.c

@@ -1238,6 +1238,7 @@ ProcShmCreateSegment(ClientPtr client)
     };
 
     REQUEST_SIZE_MATCH(xShmCreateSegmentReq);
+    LEGAL_NEW_RESOURCE(stuff->shmseg, client);
     if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) {
         client->errorValue = stuff->readOnly;
         return BadValue;

Xi/exevents.c

@@ -1798,15 +1798,19 @@ ProcessDeviceEvent(InternalEvent *ev, DeviceIntPtr device)
         break;
     }
 
-    if (grab)
+    /* Don't deliver focus events (e.g. from KeymapNotify when running
-        DeliverGrabbedEvent((InternalEvent *) event, device,
+     * nested) to clients. */
-                            deactivateDeviceGrab);
+    if (event->source_type != EVENT_SOURCE_FOCUS) {
-    else if (device->focus && !IsPointerEvent(ev))
+        if (grab)
-        DeliverFocusedEvent(device, (InternalEvent *) event,
+            DeliverGrabbedEvent((InternalEvent *) event, device,
-                            GetSpriteWindow(device));
+                                deactivateDeviceGrab);
-    else
+        else if (device->focus && !IsPointerEvent(ev))
-        DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event,
+            DeliverFocusedEvent(device, (InternalEvent *) event,
-                            NullGrab, NullWindow, device);
+                                GetSpriteWindow(device));
+        else
+            DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event,
+                                NullGrab, NullWindow, device);
+    }
 
     if (deactivateDeviceGrab == TRUE) {
         (*device->deviceGrab.DeactivateGrab) (device);

Xi/sendexev.c

@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 {
     CARD32 *p;
     int i;
-    xEvent eventT;
+    xEvent eventT = { .u.u.type = 0 };
     xEvent *eventP;
     EventSwapPtr proc;
 
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
 
     eventP = (xEvent *) &stuff[1];
     for (i = 0; i < stuff->num_events; i++, eventP++) {
-        proc = EventSwapVector[eventP->u.u.type & 0177];
+        if (eventP->u.u.type == GenericEvent) {
-        if (proc == NotImplemented)     /* no swapping proc; invalid event type? */
+            client->errorValue = eventP->u.u.type;
             return BadValue;
+        }
+
+        proc = EventSwapVector[eventP->u.u.type & 0177];
+        /* no swapping proc; invalid event type? */
+        if (proc == NotImplemented) {
+            client->errorValue = eventP->u.u.type;
+            return BadValue;
+        }
         (*proc) (eventP, &eventT);
         *eventP = eventT;
     }
@@ -117,7 +125,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 int
 ProcXSendExtensionEvent(ClientPtr client)
 {
-    int ret;
+    int ret, i;
     DeviceIntPtr dev;
     xEvent *first;
     XEventClass *list;
@@ -141,10 +149,12 @@ ProcXSendExtensionEvent(ClientPtr client)
     /* The client's event type must be one defined by an extension. */
 
     first = ((xEvent *) &stuff[1]);
-    if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
+    for (i = 0; i < stuff->num_events; i++) {
-          (first->u.u.type < lastEvent))) {
+        if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
-        client->errorValue = first->u.u.type;
+            (first[i].u.u.type < lastEvent))) {
-        return BadValue;
+            client->errorValue = first[i].u.u.type;
+            return BadValue;
+        }
     }
 
     list = (XEventClass *) (first + stuff->num_events);

Xi/xibarriers.c

@@ -830,10 +830,13 @@ SProcXIBarrierReleasePointer(ClientPtr client)
     REQUEST(xXIBarrierReleasePointerReq);
     int i;
 
-    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
-
     swaps(&stuff->length);
+    REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+
     swapl(&stuff->num_barriers);
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
+
+    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {
         swaps(&info->deviceid);
         swapl(&info->barrier);
@@ -853,7 +856,7 @@ ProcXIBarrierReleasePointer(ClientPtr client)
     xXIBarrierReleasePointerInfo *info;
 
     REQUEST(xXIBarrierReleasePointerReq);
-    REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
 
     info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {

Xi/xichangehierarchy.c

@@ -194,7 +194,8 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int flags[MAXDEVICES])
     flags[XTestptr->id] |= XISlaveAttached;
     flags[XTestkeybd->id] |= XISlaveAttached;
 
-    XIBarrierNewMasterDevice(client, ptr->id);
+    for (int i = 0; i < currentMaxClients; i++)
+        XIBarrierNewMasterDevice(clients[i], ptr->id);
 
  unwind:
     free(name);
@@ -300,7 +301,8 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES])
         }
     }
 
-    XIBarrierRemoveMasterDevice(client, ptr->id);
+    for (int i = 0; i < currentMaxClients; i++)
+        XIBarrierRemoveMasterDevice(clients[i], ptr->id);
 
     /* disable the remove the devices, XTest devices must be done first
        else the sprites they rely on will be destroyed  */

Xi/xiwarppointer.c

@@ -186,6 +186,10 @@ ProcXIWarpPointer(ClientPtr client)
     pDev->last.valuators[1] = y;
     miPointerUpdateSprite(pDev);
 
+    if (*newScreen->CursorWarpedTo)
+        (*newScreen->CursorWarpedTo) (pDev, newScreen, client,
+                                      dest, pSprite, x, y);
+
     /* FIXME: XWarpPointer is supposed to generate an event. It doesn't do it
        here though. */
     return Success;

composite/compalloc.c

@@ -612,7 +612,7 @@ compAllocPixmap(WindowPtr pWin)
     else
         pWin->redirectDraw = RedirectDrawManual;
 
-    compSetPixmap(pWin, pPixmap);
+    compSetPixmap(pWin, pPixmap, bw);
     cw->oldx = COMP_ORIGIN_INVALID;
     cw->oldy = COMP_ORIGIN_INVALID;
     cw->damageRegistered = FALSE;
@@ -651,7 +651,7 @@ compSetParentPixmap(WindowPtr pWin)
     RegionCopy(&pWin->borderClip, &cw->borderClip);
     pParentPixmap = (*pScreen->GetWindowPixmap) (pWin->parent);
     pWin->redirectDraw = RedirectDrawNone;
-    compSetPixmap(pWin, pParentPixmap);
+    compSetPixmap(pWin, pParentPixmap, pWin->borderWidth);
 }
 
 /*
@@ -682,7 +682,7 @@ compReallocPixmap(WindowPtr pWin, int draw_x, int draw_y,
         if (!pNew)
             return FALSE;
         cw->pOldPixmap = pOld;
-        compSetPixmap(pWin, pNew);
+        compSetPixmap(pWin, pNew, bw);
     }
     else {
         pNew = pOld;

composite/compint.h

@@ -274,7 +274,7 @@ void
 #endif
 
 void
- compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap);
+ compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap, int bw);
 
 Bool
  compCheckRedirect(WindowPtr pWin);

composite/compwindow.c

@@ -89,6 +89,7 @@ compCheckTree(ScreenPtr pScreen)
 typedef struct _compPixmapVisit {
     WindowPtr pWindow;
     PixmapPtr pPixmap;
+    int bw;
 } CompPixmapVisitRec, *CompPixmapVisitPtr;
 
 static Bool
@@ -126,19 +127,20 @@ compSetPixmapVisitWindow(WindowPtr pWindow, void *data)
      */
     SetWinSize(pWindow);
     SetBorderSize(pWindow);
-    if (HasBorder(pWindow))
+    if (pVisit->bw)
         QueueWorkProc(compRepaintBorder, serverClient,
                       (void *) (intptr_t) pWindow->drawable.id);
     return WT_WALKCHILDREN;
 }
 
 void
-compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap)
+compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap, int bw)
 {
     CompPixmapVisitRec visitRec;
 
     visitRec.pWindow = pWindow;
     visitRec.pPixmap = pPixmap;
+    visitRec.bw = bw;
     TraverseTree(pWindow, compSetPixmapVisitWindow, (void *) &visitRec);
     compCheckTree(pWindow->drawable.pScreen);
 }
@@ -463,7 +465,8 @@ compReparentWindow(WindowPtr pWin, WindowPtr pPriorParent)
      * Reset pixmap pointers as appropriate
      */
     if (pWin->parent && pWin->redirectDraw == RedirectDrawNone)
-        compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent));
+        compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent),
+                      pWin->borderWidth);
     /*
      * Call down to next function
      */

configure.ac

@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.19.0, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+AC_INIT([xorg-server], 1.19.4, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2016-11-15"
+RELEASE_DATE="2017-10-04"
-RELEASE_NAME="Cioppino"
+RELEASE_NAME="French Onion Soup"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
@@ -134,7 +134,7 @@ AM_CONDITIONAL(SPECIAL_DTRACE_OBJECTS, [test "x$SPECIAL_DTRACE_OBJECTS" = "xyes"
 AC_HEADER_DIRENT
 AC_HEADER_STDC
 AC_CHECK_HEADERS([fcntl.h stdlib.h string.h unistd.h dlfcn.h stropts.h \
- fnmatch.h sys/mkdev.h sys/utsname.h])
+ fnmatch.h sys/mkdev.h sys/sysmacros.h sys/utsname.h])
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
@@ -221,9 +221,13 @@ AC_CHECK_FUNCS([backtrace ffs geteuid getuid issetugid getresuid \
 	mmap posix_fallocate seteuid shmctl64 strncasecmp vasprintf vsnprintf \
 	walkcontext setitimer poll epoll_create1])
 AC_CONFIG_LIBOBJ_DIR([os])
-AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup])
+AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup\
+	timingsafe_memcmp])
 AM_CONDITIONAL(POLL, [test "x$ac_cv_func_poll" = "xyes"])
 
+AC_CHECK_LIB([bsd], [arc4random_buf])
+AC_CHECK_FUNCS([arc4random_buf])
+
 AC_CHECK_DECLS([program_invocation_short_name], [], [], [[#include <errno.h>]])
 
 dnl Check for SO_PEERCRED #define
@@ -1844,7 +1848,7 @@ if test "x$XNEST" = xyes; then
 	if test "x$have_xnest" = xno; then
 		AC_MSG_ERROR([Xnest build explicitly requested, but required modules not found.])
 	fi
-	XNEST_LIBS="$FB_LIB $FIXES_LIB $MI_LIB $XEXT_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $RENDER_LIB $DAMAGE_LIB  $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $MAIN_LIB $DIX_LIB $OS_LIB"
+	XNEST_LIBS="$FB_LIB $FIXES_LIB $MI_LIB $XEXT_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $DAMAGE_LIB  $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_DAMAGE_LIB $RENDER_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $MAIN_LIB $DIX_LIB $OS_LIB"
 	XNEST_SYS_LIBS="$XNESTMODULES_LIBS $GLX_SYS_LIBS"
 	AC_SUBST([XNEST_LIBS])
 	AC_SUBST([XNEST_SYS_LIBS])
@@ -2330,7 +2334,7 @@ if test "x$DMX" = xyes; then
 	fi
 	DMX_INCLUDES="$XEXT_INC $RENDER_INC $RECORD_INC"
 	XDMX_CFLAGS="$DMXMODULES_CFLAGS"
-	XDMX_LIBS="$FB_LIB $MI_LIB $XEXT_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB $COMPOSITE_LIB $DAMAGE_LIB $MAIN_LIB $DIX_LIB $RANDR_LIB $CONFIG_LIB $OS_LIB $FIXES_LIB"
+	XDMX_LIBS="$FB_LIB $MI_LIB $XEXT_LIB $PRESENT_LIB $RANDR_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $DRI3_LIB $MIEXT_SYNC_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB $COMPOSITE_LIB $DAMAGE_LIB $MAIN_LIB $DIX_LIB $CONFIG_LIB $OS_LIB $FIXES_LIB"
 	XDMX_SYS_LIBS="$DMXMODULES_LIBS"
 	AC_SUBST([XDMX_CFLAGS])
 	AC_SUBST([XDMX_LIBS])
@@ -2643,6 +2647,7 @@ hw/xfree86/shadowfb/Makefile
 hw/xfree86/vbe/Makefile
 hw/xfree86/vgahw/Makefile
 hw/xfree86/x86emu/Makefile
+hw/xfree86/xkb/Makefile
 hw/xfree86/utils/Makefile
 hw/xfree86/utils/man/Makefile
 hw/xfree86/utils/cvt/Makefile

dix/Makefile.am

@@ -61,13 +61,13 @@ endif
 
 if SPECIAL_DTRACE_OBJECTS
 # Generate dtrace object code for probes in libdix
-dtrace-dix.o: $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS)
+dtrace-dix.o: $(top_srcdir)/dix/Xserver.d libdix.la
 	$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 
 noinst_PROGRAMS = dix.O
 
 dix_O_SOURCES =
-dix.O: dtrace-dix.o $(am_libdix_la_OBJECTS)
+dix.O: dtrace-dix.o libdix.la
 	$(AM_V_GEN)ld -r -o $@ $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 endif
 

dix/dispatch.c

@@ -266,6 +266,16 @@ mark_client_ready(ClientPtr client)
         xorg_list_append(&client->ready, &ready_clients);
 }
 
+/*
+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client)
+{
+    if (xorg_list_is_empty(&client->ready))
+        xorg_list_append(&client->ready, &saved_ready_clients);
+}
+
 /* Client has no requests queued and no data on network */
 void
 mark_client_not_ready(ClientPtr client)
@@ -3405,7 +3415,6 @@ CloseDownClient(ClientPtr client)
         if (grabState != GrabNone && grabClient == client) {
             UngrabServer(client);
         }
-        mark_client_not_ready(client);
         BITCLEAR(grabWaiters, client->index);
         DeleteClientFromAnySelections(client);
         ReleaseActiveGrabs(client);
@@ -3434,8 +3443,9 @@ CloseDownClient(ClientPtr client)
         if (ClientIsAsleep(client))
             ClientSignal(client);
         ProcessWorkQueueZombies();
-        output_pending_clear(client);
         CloseDownConnection(client);
+        output_pending_clear(client);
+        mark_client_not_ready(client);
 
         /* If the client made it to the Running stage, nClients has
          * been incremented on its behalf, so we need to decrement it

dix/events.c

@@ -5366,6 +5366,12 @@ ProcSendEvent(ClientPtr client)
         client->errorValue = stuff->event.u.u.type;
         return BadValue;
     }
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
     if (stuff->event.u.u.type == ClientMessage &&
         stuff->event.u.u.detail != 8 &&
         stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) {

dix/getevents.c

@@ -1101,9 +1101,12 @@ GetKeyboardEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     }
 #endif
 
-    if (type == KeymapNotify) {
+    if (type == EnterNotify) {
         source_type = EVENT_SOURCE_FOCUS;
         type = KeyPress;
+    } else if (type == LeaveNotify) {
+        source_type = EVENT_SOURCE_FOCUS;
+        type = KeyRelease;
     }
 
     /* refuse events from disabled devices */

dix/pixmap.c

@@ -172,6 +172,14 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave)
     return spix;
 }
 
+static void
+PixmapDirtyDamageDestroy(DamagePtr damage, void *closure)
+{
+    PixmapDirtyUpdatePtr dirty = closure;
+
+    dirty->damage = NULL;
+}
+
 Bool
 PixmapStartDirtyTracking(PixmapPtr src,
                          PixmapPtr slave_dst,
@@ -195,10 +203,10 @@ PixmapStartDirtyTracking(PixmapPtr src,
     dirty_update->dst_x = dst_x;
     dirty_update->dst_y = dst_y;
     dirty_update->rotation = rotation;
-    dirty_update->damage = DamageCreate(NULL, NULL,
+    dirty_update->damage = DamageCreate(NULL, PixmapDirtyDamageDestroy,
                                         DamageReportNone,
                                         TRUE, src->drawable.pScreen,
-                                        src->drawable.pScreen);
+                                        dirty_update);
 
     if (rotation != RR_Rotate_0) {
         RRTransformCompute(x, y,
@@ -246,7 +254,8 @@ PixmapStopDirtyTracking(PixmapPtr src, PixmapPtr slave_dst)
 
     xorg_list_for_each_entry_safe(ent, safe, &screen->pixmap_dirty_list, ent) {
         if (ent->src == src && ent->slave_dst == slave_dst) {
-            DamageDestroy(ent->damage);
+            if (ent->damage)
+                DamageDestroy(ent->damage);
             xorg_list_del(&ent->ent);
             free(ent);
         }

dix/swapreq.c

@@ -292,6 +292,13 @@ SProcSendEvent(ClientPtr client)
     swapl(&stuff->destination);
     swapl(&stuff->eventMask);
 
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
+
     /* Swap event */
     proc = EventSwapVector[stuff->event.u.u.type & 0177];
     if (!proc || proc == NotImplemented)        /* no swapping proc; invalid event type? */

glamor/glamor.c

@@ -133,6 +133,9 @@ glamor_get_pixmap_texture(PixmapPtr pixmap)
 {
     glamor_pixmap_private *pixmap_priv = glamor_get_pixmap_private(pixmap);
 
+    if (!pixmap_priv)
+        return 0;
+
     if (pixmap_priv->type != GLAMOR_TEXTURE_ONLY)
         return 0;
 
@@ -470,7 +473,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate screen private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     glamor_set_screen_private(screen, glamor_priv);
@@ -480,7 +483,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate pixmap private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     if (!dixRegisterPrivateKey(&glamor_gc_private_key, PRIVATE_GC,
@@ -488,7 +491,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate gc private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     glamor_priv->saved_procs.close_screen = screen->CloseScreen;
@@ -731,6 +734,11 @@ glamor_init(ScreenPtr screen, unsigned int flags)
     return TRUE;
 
  fail:
+    /* Restore default CloseScreen and DestroyPixmap handlers */
+    screen->CloseScreen = glamor_priv->saved_procs.close_screen;
+    screen->DestroyPixmap = glamor_priv->saved_procs.destroy_pixmap;
+
+ free_glamor_private:
     free(glamor_priv);
     glamor_set_screen_private(screen, NULL);
     return FALSE;

glamor/glamor_copy.c

@@ -230,8 +230,8 @@ glamor_copy_cpu_fbo(DrawablePtr src,
             goto bail;
         }
 
-        src_pix->drawable.x = -dst->x;
+        src_pix->drawable.x = dst_xoff;
-        src_pix->drawable.y = -dst->y;
+        src_pix->drawable.y = dst_yoff;
 
         fbGetDrawable(&src_pix->drawable, src_bits, src_stride, src_bpp, src_xoff,
                       src_yoff);
@@ -344,6 +344,7 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
     glamor_program *prog;
     const glamor_facet *copy_facet;
     int n;
+    Bool ret = FALSE;
 
     glamor_make_current(glamor_priv);
 
@@ -410,9 +411,10 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
             goto bail_ctx;
 
         glamor_pixmap_loop(dst_priv, dst_box_index) {
-            glamor_set_destination_drawable(dst, dst_box_index, FALSE, FALSE,
+            if (!glamor_set_destination_drawable(dst, dst_box_index, FALSE, FALSE,
-                                            prog->matrix_uniform,
+                                                 prog->matrix_uniform,
-                                            &dst_off_x, &dst_off_y);
+                                                 &dst_off_x, &dst_off_y))
+                goto bail_ctx;
 
             glScissor(dst_off_x - args.dx,
                       dst_off_y - args.dy,
@@ -422,13 +424,14 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
             glamor_glDrawArrays_GL_QUADS(glamor_priv, nbox);
         }
     }
+
+    ret = TRUE;
+
+bail_ctx:
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-
-bail_ctx:
-    return FALSE;
 }
 
 /**

glamor/glamor_dash.c

@@ -32,6 +32,7 @@ static const char dash_vs_vars[] =
 
 static const char dash_vs_exec[] =
     "       dash_offset = primitive.z / dash_length;\n"
+    "       vec2 pos = vec2(0,0);\n"
     GLAMOR_POS(gl_Position, primitive.xy);
 
 static const char dash_fs_vars[] =
@@ -146,7 +147,7 @@ glamor_dash_setup(DrawablePtr drawable, GCPtr gc)
         goto bail;
 
     dash_pixmap = glamor_get_dash_pixmap(gc);
-    dash_priv = glamor_get_pixmap_private(pixmap);
+    dash_priv = glamor_get_pixmap_private(dash_pixmap);
 
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
         goto bail;

glamor/glamor_egl.c

@@ -769,6 +769,10 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
 
     glamor_egl->display = glamor_egl_get_display(EGL_PLATFORM_GBM_MESA,
                                                  glamor_egl->gbm);
+    if (!glamor_egl->display) {
+        xf86DrvMsg(scrn->scrnIndex, X_ERROR, "eglGetDisplay() failed\n");
+        goto error;
+    }
 #else
     glamor_egl->display = eglGetDisplay((EGLNativeDisplayType) (intptr_t) fd);
 #endif

glamor/glamor_egl.h

@@ -60,16 +60,12 @@
 static inline EGLDisplay
 glamor_egl_get_display(EGLint type, void *native)
 {
-    EGLDisplay dpy = NULL;
-
     /* In practise any EGL 1.5 implementation would support the EXT extension */
     if (epoxy_has_egl_extension(NULL, "EGL_EXT_platform_base")) {
         PFNEGLGETPLATFORMDISPLAYEXTPROC getPlatformDisplayEXT =
             (void *) eglGetProcAddress("eglGetPlatformDisplayEXT");
         if (getPlatformDisplayEXT)
-            dpy = getPlatformDisplayEXT(type, native, NULL);
+            return getPlatformDisplayEXT(type, native, NULL);
-        if (dpy)
-            return dpy;
     }
 
     /* Welp, everything is awful. */

glamor/glamor_fbo.c

@@ -156,6 +156,10 @@ glamor_create_fbo(glamor_screen_private *glamor_priv,
                   int w, int h, GLenum format, int flag)
 {
     GLint tex = _glamor_create_tex(glamor_priv, w, h, format);
+
+    if (!tex) /* Texture creation failed due to GL_OUT_OF_MEMORY */
+        return NULL;
+
     return glamor_create_fbo_from_tex(glamor_priv, w, h, format, tex, flag);
 }
 

glamor/glamor_glyphblt.c

@@ -49,6 +49,7 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
     glamor_program *prog;
     RegionPtr clip = gc->pCompositeClip;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -75,8 +76,9 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
         int off_x, off_y;
         char *vbo_offset;
 
-        glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                              prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         max_points = 500;
         num_points = 0;
@@ -138,11 +140,12 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-bail:
-    return FALSE;
 }
 
 void
@@ -174,6 +177,7 @@ glamor_push_pixels_gl(GCPtr gc, PixmapPtr bitmap,
     int num_points;
     INT16 *points = NULL;
     char *vbo_offset;
+    Bool ret = FALSE;
 
     if (w * h > MAXINT / (2 * sizeof(float)))
         goto bail;
@@ -221,17 +225,19 @@ glamor_push_pixels_gl(GCPtr gc, PixmapPtr bitmap,
     glamor_put_vbo_space(screen);
 
     glamor_pixmap_loop(pixmap_priv, box_index) {
-        glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
-                                        prog->matrix_uniform, NULL, NULL);
+                                             prog->matrix_uniform, NULL, NULL))
+            goto bail;
 
         glDrawArrays(GL_POINTS, 0, num_points);
     }
 
-    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+    ret = TRUE;
-    return TRUE;
 
 bail:
-    return FALSE;
+    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+
+    return ret;
 }
 
 void

glamor/glamor_largepixmap.c

@@ -1,4 +1,5 @@
 #include <stdlib.h>
+#include <stdint.h> /* For INT16_MAX */
 
 #include "glamor_priv.h"
 
@@ -722,11 +723,11 @@ glamor_compute_transform_clipped_regions(PixmapPtr pixmap,
         temp_box.x2 = MIN(temp_box.x2, pixmap->drawable.width);
         temp_box.y2 = MIN(temp_box.y2, pixmap->drawable.height);
     }
-    /* Now copy back the box32 to a box16 box. */
+    /* Now copy back the box32 to a box16 box, avoiding overflow. */
-    short_box.x1 = temp_box.x1;
+    short_box.x1 = MIN(temp_box.x1, INT16_MAX);
-    short_box.y1 = temp_box.y1;
+    short_box.y1 = MIN(temp_box.y1, INT16_MAX);
-    short_box.x2 = temp_box.x2;
+    short_box.x2 = MIN(temp_box.x2, INT16_MAX);
-    short_box.y2 = temp_box.y2;
+    short_box.y2 = MIN(temp_box.y2, INT16_MAX);
     RegionInitBoxes(temp_region, &short_box, 1);
     DEBUGF("copy to temp source region \n");
     DEBUGRegionPrint(temp_region);

glamor/glamor_lines.c

@@ -46,6 +46,7 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
     char *vbo_offset;
     int box_index;
     int add_last;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -103,8 +104,9 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -116,12 +118,13 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-bail:
-    return FALSE;
 }
 
 static Bool

glamor/glamor_points.c

@@ -47,6 +47,7 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
     GLshort *vbo_ppt;
     char *vbo_offset;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -90,8 +91,9 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -103,13 +105,13 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-
-bail:
-    return FALSE;
 }
 
 void

glamor/glamor_rects.c

@@ -52,6 +52,7 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
     GLshort *v;
     char *vbo_offset;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -115,8 +116,9 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, FALSE,
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, FALSE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -132,14 +134,15 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     if (glamor_priv->glsl_version >= 130)
         glVertexAttribDivisor(GLAMOR_VERTEX_POS, 0);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-bail:
-    return FALSE;
 }
 
 static void

glamor/glamor_render.c

@@ -992,7 +992,7 @@ glamor_composite_choose_shader(CARD8 op,
                 goto fail;
             }
         } else {
-            if (!glamor_render_format_is_supported(source->format)) {
+            if (source && !glamor_render_format_is_supported(source->format)) {
                 glamor_fallback("Unsupported source picture format.\n");
                 goto fail;
             }
@@ -1411,7 +1411,8 @@ glamor_composite_clipped_region(CARD8 op,
            x_source, y_source, x_mask, y_mask, x_dest, y_dest, width, height);
 
     /* Is the composite operation equivalent to a copy? */
-    if (!mask && !source->alphaMap && !dest->alphaMap
+    if (source &&
+        !mask && !source->alphaMap && !dest->alphaMap
         && source->pDrawable && !source->transform
         /* CopyArea is only defined with matching depths. */
         && dest->pDrawable->depth == source->pDrawable->depth
@@ -1494,6 +1495,10 @@ glamor_composite_clipped_region(CARD8 op,
             ca_state = CA_DUAL_BLEND;
         } else {
             if (op == PictOpOver) {
+                if (glamor_pixmap_is_memory(mask_pixmap)) {
+                    glamor_fallback("two pass not supported on memory pximaps\n");
+                    goto out;
+                }
                 ca_state = CA_TWO_PASS;
                 op = PictOpOutReverse;
             }

glamor/glamor_segs.c

@@ -46,6 +46,7 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
     char *vbo_offset;
     int box_index;
     int add_last;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -62,7 +63,7 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
                                    &glamor_facet_poly_segment);
 
     if (!prog)
-        goto bail_ctx;
+        goto bail;
 
     /* Set up the vertex buffers for the points */
 
@@ -95,8 +96,9 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -108,13 +110,13 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
+    ret = TRUE;
+
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-bail_ctx:
 bail:
-    return FALSE;
+    return ret;
 }
 
 static Bool

glamor/glamor_spans.c

@@ -56,6 +56,7 @@ glamor_fill_spans_gl(DrawablePtr drawable,
     char *vbo_offset;
     int c;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -123,8 +124,9 @@ glamor_fill_spans_gl(DrawablePtr drawable,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, FALSE, FALSE,
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, FALSE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -140,14 +142,15 @@ glamor_fill_spans_gl(DrawablePtr drawable,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     if (glamor_priv->glsl_version >= 130)
         glVertexAttribDivisor(GLAMOR_VERTEX_POS, 0);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    return ret;
-bail:
-    return FALSE;
 }
 
 static void

glamor/glamor_transform.c

@@ -33,7 +33,7 @@
  * clipping computations can be adjusted as appropriate
  */
 
-void
+Bool
 glamor_set_destination_drawable(DrawablePtr     drawable,
                                 int             box_index,
                                 Bool            do_drawable_translate,
@@ -53,6 +53,11 @@ glamor_set_destination_drawable(DrawablePtr     drawable,
     float scale_x = 2.0f / (float) w;
     float scale_y = 2.0f / (float) h;
     float center_adjust = 0.0f;
+    glamor_pixmap_fbo *pixmap_fbo;
+
+    pixmap_fbo = glamor_pixmap_fbo_at(pixmap_priv, box_index);
+    if (!pixmap_fbo)
+        return FALSE;
 
     glamor_get_drawable_deltas(drawable, pixmap, &off_x, &off_y);
 
@@ -94,8 +99,10 @@ glamor_set_destination_drawable(DrawablePtr     drawable,
                 scale_x, (off_x + center_adjust) * scale_x - 1.0f,
                 scale_y, (off_y + center_adjust) * scale_y - 1.0f);
 
-    glamor_set_destination_pixmap_fbo(glamor_priv, glamor_pixmap_fbo_at(pixmap_priv, box_index),
+    glamor_set_destination_pixmap_fbo(glamor_priv, pixmap_fbo,
                                       0, 0, w, h);
+
+    return TRUE;
 }
 
 /*

glamor/glamor_transform.h

@@ -23,7 +23,7 @@
 #ifndef _GLAMOR_TRANSFORM_H_
 #define _GLAMOR_TRANSFORM_H_
 
-void
+Bool
 glamor_set_destination_drawable(DrawablePtr     drawable,
                                 int             box_index,
                                 Bool            do_drawable_translate,

glamor/glamor_utils.h

@@ -723,8 +723,8 @@ glamor_is_large_pixmap(PixmapPtr pixmap)
 static inline void
 glamor_make_current(glamor_screen_private *glamor_priv)
 {
-    if (lastGLContext != &glamor_priv->ctx) {
+    if (lastGLContext != glamor_priv->ctx.ctx) {
-        lastGLContext = &glamor_priv->ctx;
+        lastGLContext = glamor_priv->ctx.ctx;
         glamor_priv->ctx.make_current(&glamor_priv->ctx);
     }
 }

glamor/glamor_xv.c

@@ -430,11 +430,14 @@ glamor_xv_put_image(glamor_port_private *port_priv,
                 glamor_destroy_pixmap(port_priv->src_pix[i]);
 
         port_priv->src_pix[0] =
-            glamor_create_pixmap(pScreen, width, height, 8, 0);
+            glamor_create_pixmap(pScreen, width, height, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix[1] =
-            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8, 0);
+            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix[2] =
-            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8, 0);
+            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix_w = width;
         port_priv->src_pix_h = height;
 

hw/dmx/dmxinit.c

@@ -532,63 +532,6 @@ dmxDisplayInit(DMXScreenInfo * dmxScreen)
     dmxGetPixmapFormats(dmxScreen);
 }
 
-/* If this doesn't compile, just add || defined(yoursystem) to the line
- * below.  This information is to help with bug reports and is not
- * critical. */
-#if !defined(_POSIX_SOURCE)
-static const char *
-dmxExecOS(void)
-{
-    return "";
-}
-#else
-#include <sys/utsname.h>
-static const char *
-dmxExecOS(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-    struct utsname u;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-        uname(&u);
-        snprintf(buffer, sizeof(buffer) - 1, "%s %s %s",
-                 u.sysname, u.release, u.version);
-    }
-    return buffer;
-}
-#endif
-
-static const char *
-dmxBuildCompiler(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-#if defined(__GNUC__) && defined(__GNUC_MINOR__) &&defined(__GNUC_PATCHLEVEL__)
-        snprintf(buffer, sizeof(buffer) - 1, "gcc %d.%d.%d",
-                 __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
-#endif
-    }
-    return buffer;
-}
-
-static const char *
-dmxExecHost(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-        XmuGetHostname(buffer, sizeof(buffer) - 1);
-    }
-    return buffer;
-}
-
 static void dmxAddExtensions(Bool glxSupported)
 {
     const ExtensionModule dmxExtensions[] = {
@@ -641,12 +584,6 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char *argv[])
         SetVendorRelease(VENDOR_RELEASE);
         SetVendorString(VENDOR_STRING);
 
-        if (dmxGeneration == 1) {
-            dmxLog(dmxInfo, "DMX Build OS:       %s (%s)\n", OSNAME, OSVENDOR);
-            dmxLog(dmxInfo, "DMX Build Compiler: %s\n", dmxBuildCompiler());
-            dmxLog(dmxInfo, "DMX Execution OS:   %s\n", dmxExecOS());
-            dmxLog(dmxInfo, "DMX Execution Host: %s\n", dmxExecHost());
-        }
         dmxLog(dmxInfo, "MAXSCREENS:         %d\n", MAXSCREENS);
 
         for (i = 0; i < dmxNumScreens; i++) {

hw/dmx/dmxsync.c

@@ -182,7 +182,7 @@ dmxSync(DMXScreenInfo * dmxScreen, Bool now)
 
         /* Do sync or set time for later */
         if (now || !dmxScreen) {
-            if (!TimerForce(dmxSyncTimer))
+            if (dmxSyncTimer == NULL || !TimerForce(dmxSyncTimer))
                 dmxSyncCallback(NULL, 0, NULL);
             /* At this point, dmxSyncPending == 0 because
              * dmxSyncCallback must have been called. */

hw/dmx/input/usb-keyboard.c

@@ -289,7 +289,8 @@ kbdUSBCtrl(DevicePtr pDev, KeybdCtrl * ctrl)
             led = i;
         event.code = led;
         event.value = ! !(ctrl->leds & (1 << led));
-        write(priv->fd, &event, sizeof(event));
+        if (write(priv->fd, &event, sizeof(event)) != sizeof(event))
+            DebugF("Failed to set LEDs!\n");
     }
 }
 

hw/kdrive/ephyr/ephyr.c

@@ -725,8 +725,10 @@ ephyrCreateResources(ScreenPtr pScreen)
                            ephyrShadowUpdate, ephyrWindowLinear);
     else {
 #ifdef GLAMOR
-        if (ephyr_glamor)
+        if (ephyr_glamor) {
-            ephyr_glamor_create_screen_resources(pScreen);
+            if (!ephyr_glamor_create_screen_resources(pScreen))
+                return FALSE;
+        }
 #endif
         return ephyrSetInternalDamage(pScreen);
     }

hw/kdrive/ephyr/ephyrvideo.c

@@ -226,6 +226,11 @@ ephyrInitVideo(ScreenPtr pScreen)
         return FALSE;
     }
 
+    if (!hostx_has_extension(&xcb_xv_id)) {
+        EPHYR_LOG_ERROR("Host has no XVideo extension\n");
+        return FALSE;
+    }
+
     if (!xv_priv) {
         xv_priv = ephyrXVPrivNew();
     }

hw/kdrive/ephyr/hostx.c

@@ -927,7 +927,6 @@ hostx_screen_init(KdScreenInfo *screen,
 #ifdef GLAMOR
     if (ephyr_glamor) {
         *bytes_per_line = 0;
-        *bits_per_pixel = 0;
         ephyr_glamor_set_window_size(scrpriv->glamor,
                                      scrpriv->win_width, scrpriv->win_height);
         return NULL;
@@ -1559,6 +1558,8 @@ ephyr_glamor_create_screen_resources(ScreenPtr pScreen)
                                           pScreen->height,
                                           pScreen->rootDepth,
                                           GLAMOR_CREATE_NO_LARGE);
+    if (!screen_pixmap)
+        return FALSE;
 
     pScreen->SetScreenPixmap(screen_pixmap);
     if (pScreen->root && pScreen->SetWindowPixmap)
@@ -1566,6 +1567,9 @@ ephyr_glamor_create_screen_resources(ScreenPtr pScreen)
 
     /* Tell the GLX code what to GL texture to read from. */
     tex = glamor_get_pixmap_texture(screen_pixmap);
+    if (!tex)
+        return FALSE;
+
     ephyr_glamor_set_texture(scrpriv->glamor, tex);
 
     return TRUE;

hw/xfree86/Makefile.am

@@ -36,13 +36,13 @@ endif
 
 SUBDIRS = common ddc x86emu $(INT10_SUBDIR) os-support parser \
 	  ramdac $(VGAHW_SUBDIR) loader modes $(DRI_SUBDIR) \
-	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods \
+	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods xkb \
 	  fbdevhw shadowfb exa $(XF86UTILS_SUBDIR) doc man \
 	  $(GLAMOR_EGL_SUBDIR) drivers
 
 DIST_SUBDIRS = common ddc i2c x86emu int10 fbdevhw os-support \
                parser ramdac shadowfb vbe vgahw \
-               loader dixmods dri dri2 exa modes \
+               loader dixmods xkb dri dri2 exa modes \
 	       utils doc man glamor_egl drivers
 
 bin_PROGRAMS = Xorg
@@ -66,7 +66,7 @@ LOCAL_LIBS = \
             ddc/libddc.la \
             i2c/libi2c.la \
             $(XORG_LIBS) \
-            dixmods/libxorgxkb.la \
+            xkb/libxorgxkb.la \
             $(DRI_LIB) \
             $(DRI2_LIB) \
 	    $(DRI3_LIB) \
@@ -148,5 +148,5 @@ i2c/libi2c.la:
 dixmods/libdixmods.la:
 	$(AM_V_at)cd dixmods && $(MAKE) libdixmods.la
 
-dixmods/libxorgxkb.la:
+xkb/libxorgxkb.la:
-	$(AM_V_at)cd dixmods && $(MAKE) libxorgxkb.la
+	$(AM_V_at)cd xkb && $(MAKE) libxorgxkb.la

hw/xfree86/common/xf86AutoConfig.c

@@ -149,6 +149,15 @@ xf86AutoConfig(void)
     char buf[1024];
     ConfigStatus ret;
 
+    /* Make sure config rec is there */
+    if (xf86allocateConfig() != NULL) {
+        ret = CONFIG_OK;    /* OK so far */
+    }
+    else {
+        xf86Msg(X_ERROR, "Couldn't allocate Config record.\n");
+        return FALSE;
+    }
+
     listPossibleVideoDrivers(deviceList, 20);
 
     for (p = deviceList; *p; p++) {

hw/xfree86/common/xf86Init.c

@@ -309,6 +309,7 @@ InstallSignalHandlers(void)
     }
     else {
         OsSignal(SIGSEGV, SIG_DFL);
+        OsSignal(SIGABRT, SIG_DFL);
         OsSignal(SIGILL, SIG_DFL);
 #ifdef SIGEMT
         OsSignal(SIGEMT, SIG_DFL);

hw/xfree86/common/xf86Option.c

@@ -84,7 +84,7 @@ xf86CollectOptions(ScrnInfoPtr pScrn, XF86OptionPtr extraOpts)
         if (device && device->options) {
             tmp = xf86optionListDup(device->options);
             if (pScrn->options)
-                xf86optionListMerge(pScrn->options, tmp);
+                pScrn->options = xf86optionListMerge(pScrn->options, tmp);
             else
                 pScrn->options = tmp;
         }

hw/xfree86/common/xf86Xinput.c

@@ -84,6 +84,9 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 #ifdef HAVE_SYS_MKDEV_H
 #include <sys/mkdev.h>          /* for major() & minor() on Solaris */
 #endif

hw/xfree86/common/xf86pciBus.c

@@ -1303,7 +1303,7 @@ xf86MatchDriverFromFiles(uint16_t match_vendor, uint16_t match_chip,
     char *line = NULL;
     size_t len;
     ssize_t read;
-    char path_name[256], vendor_str[5], chip_str[5];
+    char path_name[512], vendor_str[5], chip_str[5];
     uint16_t vendor, chip;
     int i = 0, j;
 

hw/xfree86/dixmods/Makefile.am

@@ -1,4 +1,4 @@
-noinst_LTLIBRARIES = libdixmods.la libxorgxkb.la
+noinst_LTLIBRARIES = libdixmods.la
 
 if GLX
 GLXMODS = libglx.la
@@ -46,5 +46,3 @@ libshadow_la_SOURCES = shmodule.c
 
 libdixmods_la_SOURCES = $(top_srcdir)/mi/miinitext.c
 libdixmods_la_CFLAGS = $(AM_CFLAGS)
-
-libxorgxkb_la_SOURCES = xkbVT.c xkbPrivate.c xkbKillSrv.c

hw/xfree86/dri2/pci_ids/i965_pci_ids.h

@@ -109,6 +109,10 @@ CHIPSET(0x162A, bdw_gt3, "Intel(R) Iris Pro P6300 (Broadwell GT3e)")
 CHIPSET(0x162B, bdw_gt3, "Intel(R) Iris 6100 (Broadwell GT3)")
 CHIPSET(0x162D, bdw_gt3, "Intel(R) Broadwell GT3")
 CHIPSET(0x162E, bdw_gt3, "Intel(R) Broadwell GT3")
+CHIPSET(0x22B0, chv,     "Intel(R) HD Graphics (Cherrytrail)")
+CHIPSET(0x22B1, chv,     "Intel(R) HD Graphics XXX (Braswell)") /* Overridden in brw_get_renderer_string */
+CHIPSET(0x22B2, chv,     "Intel(R) HD Graphics (Cherryview)")
+CHIPSET(0x22B3, chv,     "Intel(R) HD Graphics (Cherryview)")
 CHIPSET(0x1902, skl_gt1, "Intel(R) HD Graphics 510 (Skylake GT1)")
 CHIPSET(0x1906, skl_gt1, "Intel(R) HD Graphics 510 (Skylake GT1)")
 CHIPSET(0x190A, skl_gt1, "Intel(R) Skylake GT1")
@@ -134,8 +138,13 @@ CHIPSET(0x1932, skl_gt4, "Intel(R) Iris Pro Graphics 580 (Skylake GT4e)")
 CHIPSET(0x193A, skl_gt4, "Intel(R) Iris Pro Graphics P580 (Skylake GT4e)")
 CHIPSET(0x193B, skl_gt4, "Intel(R) Iris Pro Graphics 580 (Skylake GT4e)")
 CHIPSET(0x193D, skl_gt4, "Intel(R) Iris Pro Graphics P580 (Skylake GT4e)")
-CHIPSET(0x5902, kbl_gt1, "Intel(R) Kabylake GT1")
+CHIPSET(0x0A84, bxt,     "Intel(R) HD Graphics (Broxton)")
-CHIPSET(0x5906, kbl_gt1, "Intel(R) Kabylake GT1")
+CHIPSET(0x1A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x1A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
+CHIPSET(0x5A84, bxt,     "Intel(R) HD Graphics 505 (Broxton)")
+CHIPSET(0x5A85, bxt_2x6, "Intel(R) HD Graphics 500 (Broxton 2x6)")
+CHIPSET(0x5902, kbl_gt1, "Intel(R) HD Graphics 610 (Kaby Lake GT1)")
+CHIPSET(0x5906, kbl_gt1, "Intel(R) HD Graphics 610 (Kaby Lake GT1)")
 CHIPSET(0x590A, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x5908, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x590B, kbl_gt1, "Intel(R) Kabylake GT1")
@@ -143,23 +152,39 @@ CHIPSET(0x590E, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x5913, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
 CHIPSET(0x5915, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
 CHIPSET(0x5917, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
-CHIPSET(0x5912, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x5912, kbl_gt2, "Intel(R) HD Graphics 630 (Kaby Lake GT2)")
-CHIPSET(0x5916, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x5916, kbl_gt2, "Intel(R) HD Graphics 620 (Kaby Lake GT2)")
-CHIPSET(0x591A, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x591A, kbl_gt2, "Intel(R) HD Graphics P630 (Kaby Lake GT2)")
-CHIPSET(0x591B, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x591B, kbl_gt2, "Intel(R) HD Graphics 630 (Kaby Lake GT2)")
-CHIPSET(0x591D, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x591D, kbl_gt2, "Intel(R) HD Graphics P630 (Kaby Lake GT2)")
-CHIPSET(0x591E, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x591E, kbl_gt2, "Intel(R) HD Graphics 615 (Kaby Lake GT2)")
 CHIPSET(0x5921, kbl_gt2, "Intel(R) Kabylake GT2F")
 CHIPSET(0x5923, kbl_gt3, "Intel(R) Kabylake GT3")
-CHIPSET(0x5926, kbl_gt3, "Intel(R) Kabylake GT3")
+CHIPSET(0x5926, kbl_gt3, "Intel(R) Iris Plus Graphics 640 (Kaby Lake GT3)")
-CHIPSET(0x5927, kbl_gt3, "Intel(R) Kabylake GT3")
+CHIPSET(0x5927, kbl_gt3, "Intel(R) Iris Plus Graphics 650 (Kaby Lake GT3)")
 CHIPSET(0x593B, kbl_gt4, "Intel(R) Kabylake GT4")
-CHIPSET(0x22B0, chv,     "Intel(R) HD Graphics (Cherrytrail)")
+CHIPSET(0x3184, glk,     "Intel(R) HD Graphics (Geminilake)")
-CHIPSET(0x22B1, chv,     "Intel(R) HD Graphics XXX (Braswell)") /* Overridden in brw_get_renderer_string */
+CHIPSET(0x3185, glk_2x6, "Intel(R) HD Graphics (Geminilake 2x6)")
-CHIPSET(0x22B2, chv,     "Intel(R) HD Graphics (Cherryview)")
+CHIPSET(0x3E90, cfl_gt1, "Intel(R) HD Graphics (Coffeelake 2x6 GT1)")
-CHIPSET(0x22B3, chv,     "Intel(R) HD Graphics (Cherryview)")
+CHIPSET(0x3E93, cfl_gt1, "Intel(R) HD Graphics (Coffeelake 2x6 GT1)")
-CHIPSET(0x0A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x3E91, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
-CHIPSET(0x1A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x3E92, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
-CHIPSET(0x1A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
+CHIPSET(0x3E96, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
-CHIPSET(0x5A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x3E9B, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
-CHIPSET(0x5A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
+CHIPSET(0x3E94, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3EA6, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA7, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA8, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA5, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x5A49, cnl_2x8, "Intel(R) HD Graphics (Cannonlake 2x8 GT0.5)")
+CHIPSET(0x5A4A, cnl_2x8, "Intel(R) HD Graphics (Cannonlake 2x8 GT0.5)")
+CHIPSET(0x5A41, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A42, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A44, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A59, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A5A, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A5C, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A50, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A51, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A52, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A54, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")

hw/xfree86/drivers/modesetting/dri2.c

@@ -695,19 +695,16 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
     ms_dri2_frame_event_ptr wait_info;
-    drmVBlank vbl;
     int ret;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     CARD64 current_msc, current_ust, request_msc;
     uint32_t seq;
+    uint64_t queued_msc;
 
     /* Drawable not visible, return immediately */
     if (!crtc)
         goto out_complete;
-    drmmode_crtc = crtc->driver_private;
 
     wait_info = calloc(1, sizeof(*wait_info));
     if (!wait_info)
@@ -747,13 +744,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 
         if (current_msc >= target_msc)
             target_msc = current_msc;
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, target_msc);
-        vbl.request.signal = (unsigned long)seq;
 
-        ret = drmWaitVBlank(ms->fd, &vbl);
+        ret = ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, target_msc, &queued_msc, seq);
         if (ret) {
             static int limit = 5;
             if (limit) {
@@ -766,7 +758,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
             goto out_free;
         }
 
-        wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+        wait_info->frame = queued_msc;
         DRI2BlockClient(client, draw);
         return TRUE;
     }
@@ -775,9 +767,6 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
      * If we get here, target_msc has already passed or we don't have one,
      * so we queue an event that will satisfy the divisor/remainder equation.
      */
-    vbl.request.type =
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
     /*
@@ -795,11 +784,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
     if (!seq)
         goto out_free;
 
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc);
+    if (!ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, request_msc, &queued_msc, seq)) {
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
         static int limit = 5;
         if (limit) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
@@ -811,7 +796,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
         goto out_free;
     }
 
-    wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+    wait_info->frame = queued_msc;
+
     DRI2BlockClient(client, draw);
 
     return TRUE;
@@ -839,20 +825,18 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmVBlank vbl;
     int ret, flip = 0;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     ms_dri2_frame_event_ptr frame_info = NULL;
     uint64_t current_msc, current_ust;
     uint64_t request_msc;
     uint32_t seq;
+    ms_queue_flag ms_flag = MS_QUEUE_ABSOLUTE;
+    uint64_t queued_msc;
 
     /* Drawable not displayed... just complete the swap */
     if (!crtc)
         goto blit_fallback;
-    drmmode_crtc = crtc->driver_private;
 
     frame_info = calloc(1, sizeof(*frame_info));
     if (!frame_info)
@@ -878,6 +862,8 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     ms_dri2_reference_buffer(back);
 
     ret = ms_get_crtc_ust_msc(crtc, &current_ust, &current_msc);
+    if (ret != Success)
+        goto blit_fallback;
 
     /* Flips need to be submitted one frame before */
     if (can_flip(scrn, draw, front, back)) {
@@ -892,22 +878,19 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (*target_msc > 0)
         *target_msc -= flip;
 
+    /* If non-pageflipping, but blitting/exchanging, we need to use
+     * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
+     * on.
+     */
+    if (flip == 0)
+        ms_flag |= MS_QUEUE_NEXT_ON_MISS;
+
     /*
      * If divisor is zero, or current_msc is smaller than target_msc
      * we just need to make sure target_msc passes before initiating
      * the swap.
      */
     if (divisor == 0 || current_msc < *target_msc) {
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-
-        /* If non-pageflipping, but blitting/exchanging, we need to use
-         * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
-         * on.
-         */
-        if (flip == 0)
-            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
         /* If target_msc already reached or passed, set it to
          * current_msc to ensure we return a reasonable value back
@@ -922,19 +905,14 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         if (!seq)
             goto blit_fallback;
 
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, *target_msc);
+        if (!ms_queue_vblank(crtc, ms_flag, *target_msc, &queued_msc, seq)) {
-        vbl.request.signal = (unsigned long)seq;
-
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (ret) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                        "divisor 0 get vblank counter failed: %s\n",
                        strerror(errno));
             goto blit_fallback;
         }
 
-        *target_msc = ms_kernel_msc_to_crtc_msc(crtc,
+        *target_msc = queued_msc + flip;
-                                                vbl.reply.sequence + flip);
         frame_info->frame = *target_msc;
 
         return TRUE;
@@ -945,11 +923,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
      * and we need to queue an event that will satisfy the divisor/remainder
      * equation.
      */
-    vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                        DRM_VBLANK_EVENT |
-                        drmmode_crtc->vblank_pipe);
-    if (flip == 0)
-        vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
@@ -966,7 +939,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (request_msc <= current_msc)
         request_msc += divisor;
 
-
     seq = ms_drm_queue_alloc(crtc, frame_info,
                              ms_dri2_frame_event_handler,
                              ms_dri2_frame_event_abort);
@@ -974,11 +946,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         goto blit_fallback;
 
     /* Account for 1 frame extra pageflip delay if flip > 0 */
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc) - flip;
+    if (!ms_queue_vblank(crtc, ms_flag, request_msc - flip, &queued_msc, seq)) {
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
         xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                    "final get vblank counter failed: %s\n",
                    strerror(errno));
@@ -986,7 +954,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     }
 
     /* Adjust returned value for 1 fame pageflip offset of flip > 0 */
-    *target_msc = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence + flip);
+    *target_msc = queued_msc + flip;
     frame_info->frame = *target_msc;
 
     return TRUE;

hw/xfree86/drivers/modesetting/driver.c

@@ -1202,6 +1202,11 @@ msEnableSharedPixmapFlipping(RRCrtcPtr crtc, PixmapPtr front, PixmapPtr back)
          * vblank events */
         if (syspath && strstr(syspath, "usb"))
             return FALSE;
+
+        /* EVDI uses USB transport but is platform device, not usb.
+         * Blacklist it explicitly */
+        if (syspath && strstr(syspath, "evdi"))
+            return FALSE;
     }
 #endif
 

hw/xfree86/drivers/modesetting/driver.h

@@ -119,6 +119,10 @@ typedef struct _modesettingRec {
     Bool dirty_enabled;
 
     uint32_t cursor_width, cursor_height;
+
+    Bool has_queue_sequence;
+    Bool tried_queue_sequence;
+
 } modesettingRec, *modesettingPtr;
 
 #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
@@ -129,6 +133,15 @@ uint32_t ms_drm_queue_alloc(xf86CrtcPtr crtc,
                             ms_drm_handler_proc handler,
                             ms_drm_abort_proc abort);
 
+typedef enum ms_queue_flag {
+    MS_QUEUE_ABSOLUTE = 0,
+    MS_QUEUE_RELATIVE = 1,
+    MS_QUEUE_NEXT_ON_MISS = 2
+} ms_queue_flag;
+
+Bool ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                     uint64_t msc, uint64_t *msc_queued, uint32_t seq);
+
 void ms_drm_abort(ScrnInfoPtr scrn,
                   Bool (*match)(void *data, void *match_data),
                   void *match_data);
@@ -140,8 +153,8 @@ xf86CrtcPtr ms_dri2_crtc_covering_drawable(DrawablePtr pDraw);
 
 int ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc);
 
-uint32_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
+uint64_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
-uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence);
+uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence);
 
 
 Bool ms_dri2_screen_init(ScreenPtr screen);

hw/xfree86/drivers/modesetting/drmmode_display.c

@@ -279,8 +279,6 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
 {
     drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
     msPixmapPrivPtr ppriv = msGetPixmapPriv(drmmode, ppix);
-
-    drmVBlank vbl;
     struct vblank_event_args *event_args;
 
     if (ppix == drmmode_crtc->prime_pixmap)
@@ -303,12 +301,7 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
                            drmmode_SharedPixmapVBlankEventHandler,
                            drmmode_SharedPixmapVBlankEventAbort);
 
-    vbl.request.type =
+    return ms_queue_vblank(crtc, MS_QUEUE_RELATIVE, 1, NULL, ppriv->flip_seq);
-        DRM_VBLANK_RELATIVE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-    vbl.request.sequence = 1;
-    vbl.request.signal = (unsigned long) ppriv->flip_seq;
-
-    return drmWaitVBlank(drmmode->fd, &vbl) >= 0;
 }
 
 Bool
@@ -1566,7 +1559,8 @@ drmmode_output_set_property(xf86OutputPtr output, Atom property,
                 value->size != 1)
                 return FALSE;
             memcpy(&atom, value->data, 4);
-            name = NameForAtom(atom);
+            if (!(name = NameForAtom(atom)))
+                return FALSE;
 
             /* search for matching name string, then set its value down */
             for (j = 0; j < p->mode_prop->count_enums; j++) {
@@ -2262,6 +2256,10 @@ drmmode_setup_colormap(ScreenPtr pScreen, ScrnInfoPtr pScrn)
 }
 
 #ifdef CONFIG_UDEV_KMS
+
+#define DRM_MODE_LINK_STATUS_GOOD       0
+#define DRM_MODE_LINK_STATUS_BAD        1
+
 static void
 drmmode_handle_uevents(int fd, void *closure)
 {
@@ -2281,6 +2279,52 @@ drmmode_handle_uevents(int fd, void *closure)
     if (!found)
         return;
 
+    /* Try to re-set the mode on all the connectors with a BAD link-state:
+     * This may happen if a link degrades and a new modeset is necessary, using
+     * different link-training parameters. If the kernel found that the current
+     * mode is not achievable anymore, it should have pruned the mode before
+     * sending the hotplug event. Try to re-set the currently-set mode to keep
+     * the display alive, this will fail if the mode has been pruned.
+     * In any case, we will send randr events for the Desktop Environment to
+     * deal with it, if it wants to.
+     */
+    for (i = 0; i < config->num_output; i++) {
+        xf86OutputPtr output = config->output[i];
+        drmmode_output_private_ptr drmmode_output = output->driver_private;
+        uint32_t con_id;
+        drmModeConnectorPtr koutput;
+
+        if (drmmode_output->mode_output == NULL)
+            continue;
+        con_id = drmmode_output->mode_output->connector_id;
+        /* Get an updated view of the properties for the current connector and
+         * look for the link-status property
+         */
+        koutput = drmModeGetConnectorCurrent(drmmode->fd, con_id);
+        for (j = 0; koutput && j < koutput->count_props; j++) {
+            drmModePropertyPtr props;
+            props = drmModeGetProperty(drmmode->fd, koutput->props[j]);
+            if (props && props->flags & DRM_MODE_PROP_ENUM &&
+                !strcmp(props->name, "link-status") &&
+                koutput->prop_values[j] == DRM_MODE_LINK_STATUS_BAD) {
+                xf86CrtcPtr crtc = output->crtc;
+                if (!crtc)
+                    continue;
+
+                /* the connector got a link failure, re-set the current mode */
+                drmmode_set_mode_major(crtc, &crtc->mode, crtc->rotation,
+                                       crtc->x, crtc->y);
+
+                xf86DrvMsg(scrn->scrnIndex, X_WARNING,
+                           "hotplug event: connector %u's link-state is BAD, "
+                           "tried resetting the current mode. You may be left"
+                           "with a black screen if this fails...\n", con_id);
+            }
+            drmModeFreeProperty(props);
+        }
+        drmModeFreeConnector(koutput);
+    }
+
     mode_res = drmModeGetResources(drmmode->fd);
     if (!mode_res)
         goto out;
@@ -2345,6 +2389,10 @@ out_free_res:
 out:
     RRGetInfo(xf86ScrnToScreen(scrn), TRUE);
 }
+
+#undef DRM_MODE_LINK_STATUS_BAD
+#undef DRM_MODE_LINK_STATUS_GOOD
+
 #endif
 
 void

hw/xfree86/drivers/modesetting/present.c

@@ -109,13 +109,7 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
                         uint64_t msc)
 {
     xf86CrtcPtr xf86_crtc = crtc->devPrivate;
-    ScreenPtr screen = crtc->pScreen;
-    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmmode_crtc_private_ptr drmmode_crtc = xf86_crtc->driver_private;
     struct ms_present_vblank_event *event;
-    drmVBlank vbl;
-    int ret;
     uint32_t seq;
 
     event = calloc(sizeof(struct ms_present_vblank_event), 1);
@@ -130,22 +124,9 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
         return BadAlloc;
     }
 
-    vbl.request.type =
+    if (!ms_queue_vblank(xf86_crtc, MS_QUEUE_ABSOLUTE, msc, NULL, seq))
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
+        return BadAlloc;
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(xf86_crtc, msc);
+
-    vbl.request.signal = seq;
-    for (;;) {
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (!ret)
-            break;
-        /* If we hit EBUSY, then try to flush events.  If we can't, then
-         * this is an error.
-         */
-        if (errno != EBUSY || ms_flush_drm_events(screen) < 0) {
-	    ms_drm_abort_seq(scrn, seq);
-            return BadAlloc;
-        }
-    }
     DebugPresent(("\t\tmq %lld seq %u msc %llu (hw msc %u)\n",
                  (long long) event_id, seq, (long long) msc,
                  vbl.request.sequence));

hw/xfree86/drivers/modesetting/vblank.c

@@ -173,7 +173,7 @@ ms_dri2_crtc_covering_drawable(DrawablePtr pDraw)
 
 static Bool
 ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
-                      uint32_t *msc, uint64_t *ust)
+                      uint64_t *msc, uint64_t *ust)
 {
     ScreenPtr screen = crtc->randr_crtc->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
@@ -198,13 +198,50 @@ ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
     }
 }
 
+Bool
+ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                uint64_t msc, uint64_t *msc_queued, uint32_t seq)
+{
+    ScreenPtr screen = crtc->randr_crtc->pScreen;
+    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
+    modesettingPtr ms = modesettingPTR(scrn);
+    drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+    drmVBlank vbl;
+    int ret;
+
+    for (;;) {
+        /* Queue an event at the specified sequence */
+        vbl.request.type = DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
+        if (flags & MS_QUEUE_RELATIVE)
+            vbl.request.type |= DRM_VBLANK_RELATIVE;
+        else
+            vbl.request.type |= DRM_VBLANK_ABSOLUTE;
+        if (flags & MS_QUEUE_NEXT_ON_MISS)
+            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
+
+        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, msc);
+        vbl.request.signal = seq;
+        ret = drmWaitVBlank(ms->fd, &vbl);
+        if (ret == 0) {
+            if (msc_queued)
+                *msc_queued = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+            return TRUE;
+        }
+        if (errno != EBUSY) {
+            ms_drm_abort_seq(scrn, msc);
+            return FALSE;
+        }
+        ms_flush_drm_events(screen);
+    }
+}
+
 /**
  * Convert a 32-bit kernel MSC sequence number to a 64-bit local sequence
  * number, adding in the vblank_offset and high 32 bits, and dealing
  * with 64-bit wrapping
  */
 uint64_t
-ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
+ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
     sequence += drmmode_crtc->vblank_offset;
@@ -218,7 +255,7 @@ ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
 int
 ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 {
-    uint32_t kernel_msc;
+    uint64_t kernel_msc;
 
     if (!ms_get_kernel_ust_msc(crtc, &kernel_msc, ust))
         return BadMatch;
@@ -230,13 +267,13 @@ ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 #define MAX_VBLANK_OFFSET       1000
 
 /**
- * Convert a 64-bit adjusted MSC value into a 32-bit kernel sequence number,
+ * Convert a 64-bit adjusted MSC value into a 64-bit kernel sequence number,
- * removing the high 32 bits and subtracting out the vblank_offset term.
+ * by subtracting out the vblank_offset term.
  *
  * This also updates the vblank_offset when it notices that the value should
  * change.
  */
-uint32_t
+uint64_t
 ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
@@ -257,7 +294,7 @@ ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
                 drmmode_crtc->vblank_offset = 0;
         }
     }
-    return (uint32_t) (expect - drmmode_crtc->vblank_offset);
+    return (expect - drmmode_crtc->vblank_offset);
 }
 
 /**
@@ -375,25 +412,31 @@ ms_drm_abort(ScrnInfoPtr scrn, Bool (*match)(void *data, void *match_data),
  * drm event queue and calls the handler for it.
  */
 static void
-ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
+ms_drm_sequence_handler(int fd, uint64_t frame, uint64_t ns, uint64_t user_data)
-               void *user_ptr)
 {
     struct ms_drm_queue *q, *tmp;
-    uint32_t user_data = (uint32_t) (intptr_t) user_ptr;
+    uint32_t seq = (uint32_t) user_data;
 
     xorg_list_for_each_entry_safe(q, tmp, &ms_drm_queue, list) {
-        if (q->seq == user_data) {
+        if (q->seq == seq) {
             uint64_t msc;
 
             msc = ms_kernel_msc_to_crtc_msc(q->crtc, frame);
             xorg_list_del(&q->list);
-            q->handler(msc, (uint64_t) sec * 1000000 + usec, q->data);
+            q->handler(msc, ns / 1000, q->data);
             free(q);
             break;
         }
     }
 }
 
+static void
+ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
+               void *user_ptr)
+{
+    ms_drm_sequence_handler(fd, frame, ((uint64_t) sec * 1000000 + usec) * 1000, (uint32_t) (uintptr_t) user_ptr);
+}
+
 Bool
 ms_vblank_screen_init(ScreenPtr screen)
 {
@@ -402,7 +445,7 @@ ms_vblank_screen_init(ScreenPtr screen)
     modesettingEntPtr ms_ent = ms_ent_priv(scrn);
     xorg_list_init(&ms_drm_queue);
 
-    ms->event_context.version = DRM_EVENT_CONTEXT_VERSION;
+    ms->event_context.version = 2;
     ms->event_context.vblank_handler = ms_drm_handler;
     ms->event_context.page_flip_handler = ms_drm_handler;
 

hw/xfree86/modes/xf86EdidModes.c

@@ -153,6 +153,11 @@ quirk_detailed_v_in_cm(int scrnIndex, xf86MonPtr DDC)
 static Bool
 quirk_detailed_use_maximum_size(int scrnIndex, xf86MonPtr DDC)
 {
+    /* ADA 1024x600 7" display */
+    if (memcmp(DDC->vendor.name, "ADA", 4) == 0 &&
+        DDC->vendor.prod_id == 4)
+        return TRUE;
+
     /* Bug #21324: Iiyama Vision Master 450 */
     if (memcmp(DDC->vendor.name, "IVM", 4) == 0 && DDC->vendor.prod_id == 6400)
         return TRUE;

hw/xfree86/modes/xf86RandR12.c

@@ -1174,8 +1174,7 @@ xf86RandR12CrtcSet(ScreenPtr pScreen,
     if ((transform != NULL) != crtc->transformPresent)
         changed = TRUE;
     else if (transform &&
-             memcmp(&transform->transform, &crtc->transform.transform,
+             !RRTransformEqual(transform, &crtc->transform))
-                    sizeof(transform->transform)) != 0)
         changed = TRUE;
 
     if (x != crtc->x || y != crtc->y)
@@ -1250,33 +1249,50 @@ xf86RandR12CrtcSet(ScreenPtr pScreen,
 }
 
 static void
-xf86RandR12CrtcComputeGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
+xf86RandR12CrtcComputeGamma(xf86CrtcPtr crtc, LOCO *palette,
+                            int palette_red_size, int palette_green_size,
+                            int palette_blue_size, CARD16 *gamma_red,
+                            CARD16 *gamma_green, CARD16 *gamma_blue,
+                            int gamma_size)
 {
-    XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
-    xf86CrtcPtr crtc = randr_crtc->devPrivate;
     int gamma_slots;
-    CARD16 value;
+    unsigned shift;
+    CARD32 value;
     int i, j;
 
-    gamma_slots = crtc->gamma_size / randrp->palette_red_size;
+    for (shift = 0; (gamma_size << shift) < (1 << 16); shift++);
-    for (i = 0; i < randrp->palette_red_size; i++) {
+
-        value = randr_crtc->gammaRed[randrp->palette[i].red];
+    gamma_slots = crtc->gamma_size / palette_red_size;
+    for (i = 0; i < palette_red_size; i++) {
+        value = palette[i].red;
+        if (gamma_red)
+            value = gamma_red[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_red[i * gamma_slots + j] = value;
     }
 
-    gamma_slots = crtc->gamma_size / randrp->palette_green_size;
+    gamma_slots = crtc->gamma_size / palette_green_size;
-    for (i = 0; i < randrp->palette_green_size; i++) {
+    for (i = 0; i < palette_green_size; i++) {
-        value = randr_crtc->gammaGreen[randrp->palette[i].green];
+        value = palette[i].green;
+        if (gamma_green)
+            value = gamma_green[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_green[i * gamma_slots + j] = value;
     }
 
-    gamma_slots = crtc->gamma_size / randrp->palette_blue_size;
+    gamma_slots = crtc->gamma_size / palette_blue_size;
-    for (i = 0; i < randrp->palette_blue_size; i++) {
+    for (i = 0; i < palette_blue_size; i++) {
-        value = randr_crtc->gammaBlue[randrp->palette[i].blue];
+        value = palette[i].blue;
+        if (gamma_blue)
+            value = gamma_blue[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_blue[i * gamma_slots + j] = value;
@@ -1284,10 +1300,8 @@ xf86RandR12CrtcComputeGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
 }
 
 static void
-xf86RandR12CrtcReloadGamma(RRCrtcPtr randr_crtc)
+xf86RandR12CrtcReloadGamma(xf86CrtcPtr crtc)
 {
-    xf86CrtcPtr crtc = randr_crtc->devPrivate;
-
     if (!crtc->scrn->vtSema || !crtc->funcs->gamma_set)
         return;
 
@@ -1309,7 +1323,14 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
         return FALSE;
 
     if (randrp->palette_size) {
-        xf86RandR12CrtcComputeGamma(pScreen, randr_crtc);
+        xf86RandR12CrtcComputeGamma(crtc, randrp->palette,
+                                    randrp->palette_red_size,
+                                    randrp->palette_green_size,
+                                    randrp->palette_blue_size,
+                                    randr_crtc->gammaRed,
+                                    randr_crtc->gammaGreen,
+                                    randr_crtc->gammaBlue,
+                                    randr_crtc->gammaSize);
     } else {
         memcpy(crtc->gamma_red, randr_crtc->gammaRed,
                crtc->gamma_size * sizeof(crtc->gamma_red[0]));
@@ -1319,7 +1340,7 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
                crtc->gamma_size * sizeof(crtc->gamma_blue[0]));
     }
 
-    xf86RandR12CrtcReloadGamma(randr_crtc);
+    xf86RandR12CrtcReloadGamma(crtc);
 
     return TRUE;
 }
@@ -1394,6 +1415,13 @@ xf86RandR12OutputInitGamma(xf86OutputPtr output)
      * different gamma
      */
     if (gamma_red != 1.0 || gamma_green != 1.0 || gamma_blue != 1.0) {
+        if (!output->crtc->randr_crtc) {
+            xf86DrvMsg(output->scrn->scrnIndex, X_WARNING,
+                       "Gamma correction for output %s not possible because "
+                       "RandR is disabled\n", output->name);
+            return TRUE;
+        }
+
         xf86DrvMsg(output->scrn->scrnIndex, X_INFO,
                    "Output %s wants gamma correction (%.1f, %.1f, %.1f)\n",
                    output->name, gamma_red, gamma_green, gamma_blue);
@@ -1415,6 +1443,9 @@ xf86RandR12InitGamma(ScrnInfoPtr pScrn, unsigned gammaSize) {
     for (c = 0; c < config->num_crtc; c++) {
         xf86CrtcPtr crtc = config->crtc[c];
 
+        if (!crtc->randr_crtc)
+            continue;
+
         if (!RRCrtcGammaSetSize(crtc->randr_crtc, gammaSize) ||
             !xf86RandR12CrtcInitGamma(crtc, 1.0f, 1.0f, 1.0f))
             return FALSE;
@@ -1876,7 +1907,6 @@ xf86RandR12LoadPalette(ScrnInfoPtr pScrn, int numColors, int *indices,
                        LOCO *colors, VisualPtr pVisual)
 {
     ScreenPtr pScreen = pScrn->pScreen;
-    XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
     xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
     int reds, greens, blues, index, palette_size;
     int c, i;
@@ -1891,36 +1921,51 @@ xf86RandR12LoadPalette(ScrnInfoPtr pScrn, int numColors, int *indices,
 
     palette_size = max(reds, max(greens, blues));
 
-    if (randrp->palette_size != palette_size) {
+    if (dixPrivateKeyRegistered(rrPrivKey)) {
-        randrp->palette = reallocarray(randrp->palette, palette_size,
+        XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
-                                       sizeof(colors[0]));
+
-        if (!randrp->palette) {
+        if (randrp->palette_size != palette_size) {
-            randrp->palette_size = 0;
+            randrp->palette = reallocarray(randrp->palette, palette_size,
-            return;
+                                           sizeof(colors[0]));
+            if (!randrp->palette) {
+                randrp->palette_size = 0;
+                return;
+            }
+
+            randrp->palette_size = palette_size;
         }
+        randrp->palette_red_size = reds;
+        randrp->palette_green_size = greens;
+        randrp->palette_blue_size = blues;
 
-        randrp->palette_size = palette_size;
+        for (i = 0; i < numColors; i++) {
-    }
+            index = indices[i];
-    randrp->palette_red_size = reds;
-    randrp->palette_green_size = greens;
-    randrp->palette_blue_size = blues;
 
-    for (i = 0; i < numColors; i++) {
+            if (index < reds)
-        index = indices[i];
+                randrp->palette[index].red = colors[index].red;
-
+            if (index < greens)
-        if (index < reds)
+                randrp->palette[index].green = colors[index].green;
-            randrp->palette[index].red = colors[index].red;
+            if (index < blues)
-        if (index < greens)
+                randrp->palette[index].blue = colors[index].blue;
-            randrp->palette[index].green = colors[index].green;
+        }
-        if (index < blues)
-            randrp->palette[index].blue = colors[index].blue;
     }
 
     for (c = 0; c < config->num_crtc; c++) {
-        RRCrtcPtr randr_crtc = config->crtc[c]->randr_crtc;
+        xf86CrtcPtr crtc = config->crtc[c];
+        RRCrtcPtr randr_crtc = crtc->randr_crtc;
 
-        xf86RandR12CrtcComputeGamma(pScreen, randr_crtc);
+        if (randr_crtc) {
-        xf86RandR12CrtcReloadGamma(randr_crtc);
+            xf86RandR12CrtcComputeGamma(crtc, colors, reds, greens, blues,
+                                        randr_crtc->gammaRed,
+                                        randr_crtc->gammaGreen,
+                                        randr_crtc->gammaBlue,
+                                        randr_crtc->gammaSize);
+        } else {
+            xf86RandR12CrtcComputeGamma(crtc, colors, reds, greens, blues,
+                                        NULL, NULL, NULL,
+                                        xf86GetGammaRampSize(pScreen));
+        }
+        xf86RandR12CrtcReloadGamma(crtc);
     }
 }
 
@@ -1973,7 +2018,7 @@ xf86RandR12EnterVT(ScrnInfoPtr pScrn)
 
     /* reload gamma */
     for (i = 0; i < rp->numCrtcs; i++)
-        xf86RandR12CrtcReloadGamma(rp->crtcs[i]);
+        xf86RandR12CrtcReloadGamma(rp->crtcs[i]->devPrivate);
 
     return RRGetInfo(pScreen, TRUE);    /* force a re-probe of outputs and notify clients about changes */
 }

hw/xfree86/os-support/linux/lnx_init.c

@@ -38,6 +38,9 @@
 #include "xf86_OSlib.h"
 
 #include <sys/stat.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 
 #ifndef K_OFF
 #define K_OFF 0x4

hw/xfree86/os-support/shared/posix_tty.c

@@ -394,6 +394,9 @@ xf86WaitForInput(int fd, int timeout)
     poll_fd.fd = fd;
     poll_fd.events = POLLIN;
 
+    /* convert microseconds to milliseconds */
+    timeout = (timeout + 999) / 1000;
+
     if (fd >= 0) {
         SYSCALL(r = xserver_poll(&poll_fd, 1, timeout));
     }

hw/xfree86/parser/read.c

@@ -56,6 +56,7 @@
 #include <xorg-config.h>
 #endif
 
+#include "xf86Config.h"
 #include "xf86Parser.h"
 #include "xf86tokens.h"
 #include "Configint.h"
@@ -91,7 +92,7 @@ xf86readConfigFile(void)
     int token;
     XF86ConfigPtr ptr = NULL;
 
-    if ((ptr = calloc(1, sizeof(XF86ConfigRec))) == NULL) {
+    if ((ptr = xf86allocateConfig()) == NULL) {
         return NULL;
     }
 
@@ -270,6 +271,19 @@ xf86itemNotSublist(GenericListPtr list_1, GenericListPtr list_2)
     return (!(last_1 == last_2));
 }
 
+/*
+ * Conditionally allocate config struct, but only allocate it
+ * if it's not already there.  In either event, return the pointer
+ * to the global config struct.
+ */
+XF86ConfigPtr xf86allocateConfig(void)
+{
+    if (!xf86configptr) {
+        xf86configptr = calloc(1, sizeof(XF86ConfigRec));
+    }
+    return xf86configptr;
+}
+
 void
 xf86freeConfig(XF86ConfigPtr p)
 {

hw/xfree86/parser/scan.c

@@ -1046,6 +1046,8 @@ xf86nameCompare(const char *s1, const char *s2)
             return 0;
         else
             return 1;
+    } else if (!s2 || *s2 == 0) {
+        return -1;
     }
 
     while (*s1 == '_' || *s1 == ' ' || *s1 == '\t')

hw/xfree86/parser/xf86Parser.h

@@ -449,6 +449,7 @@ extern char *xf86openConfigDirFiles(const char *path, const char *cmdline,
 extern void xf86setBuiltinConfig(const char *config[]);
 extern XF86ConfigPtr xf86readConfigFile(void);
 extern void xf86closeConfigFile(void);
+extern XF86ConfigPtr xf86allocateConfig(void);
 extern void xf86freeConfig(XF86ConfigPtr p);
 extern int xf86writeConfigFile(const char *, XF86ConfigPtr);
 extern _X_EXPORT XF86ConfDevicePtr xf86findDevice(const char *ident,

hw/xfree86/ramdac/xf86HWCurs.c

@@ -22,6 +22,9 @@
 
 #include "servermd.h"
 
+static void
+xf86RecolorCursor_locked(xf86CursorScreenPtr ScreenPriv, CursorPtr pCurs);
+
 static CARD32
 xf86ReverseBitOrder(CARD32 v)
 {
@@ -136,9 +139,14 @@ Bool
 xf86CheckHWCursor(ScreenPtr pScreen, CursorPtr cursor, xf86CursorInfoPtr infoPtr)
 {
     ScreenPtr pSlave;
+    Bool use_hw_cursor = TRUE;
 
-    if (!xf86ScreenCheckHWCursor(pScreen, cursor, infoPtr))
+    input_lock();
-        return FALSE;
+
+    if (!xf86ScreenCheckHWCursor(pScreen, cursor, infoPtr)) {
+        use_hw_cursor = FALSE;
+	goto unlock;
+    }
 
     /* ask each driver consuming a pixmap if it can support HW cursor */
     xorg_list_for_each_entry(pSlave, &pScreen->slave_list, slave_head) {
@@ -148,14 +156,22 @@ xf86CheckHWCursor(ScreenPtr pScreen, CursorPtr cursor, xf86CursorInfoPtr infoPtr
             continue;
 
         sPriv = dixLookupPrivate(&pSlave->devPrivates, xf86CursorScreenKey);
-        if (!sPriv) /* NULL if Option "SWCursor", possibly other conditions */
+        if (!sPriv) { /* NULL if Option "SWCursor", possibly other conditions */
-            return FALSE;
+            use_hw_cursor = FALSE;
+	    break;
+	}
 
         /* FALSE if HWCursor not supported by slave */
-        if (!xf86ScreenCheckHWCursor(pSlave, cursor, sPriv->CursorInfoPtr))
+        if (!xf86ScreenCheckHWCursor(pSlave, cursor, sPriv->CursorInfoPtr)) {
-            return FALSE;
+            use_hw_cursor = FALSE;
+	    break;
+	}
     }
-    return TRUE;
+
+unlock:
+    input_unlock();
+
+    return use_hw_cursor;
 }
 
 static Bool
@@ -204,7 +220,7 @@ xf86ScreenSetCursor(ScreenPtr pScreen, CursorPtr pCurs, int x, int y)
         if (!xf86DriverLoadCursorImage (infoPtr, bits))
             return FALSE;
 
-    xf86RecolorCursor(pScreen, pCurs, 1);
+    xf86RecolorCursor_locked (ScreenPriv, pCurs);
 
     (*infoPtr->SetCursorPosition) (infoPtr->pScrn, x, y);
 
@@ -258,6 +274,8 @@ xf86SetTransparentCursor(ScreenPtr pScreen)
                                                xf86CursorScreenKey);
     xf86CursorInfoPtr infoPtr = ScreenPriv->CursorInfoPtr;
 
+    input_lock();
+
     if (!ScreenPriv->transparentData)
         ScreenPriv->transparentData =
             (*infoPtr->RealizeCursor) (infoPtr, NullCursor);
@@ -270,6 +288,8 @@ xf86SetTransparentCursor(ScreenPtr pScreen)
                                    ScreenPriv->transparentData);
 
     (*infoPtr->ShowCursor) (infoPtr->pScrn);
+
+    input_unlock();
 }
 
 static void
@@ -312,12 +332,9 @@ xf86MoveCursor(ScreenPtr pScreen, int x, int y)
     input_unlock();
 }
 
-void
+static void
-xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
+xf86RecolorCursor_locked(xf86CursorScreenPtr ScreenPriv, CursorPtr pCurs)
 {
-    xf86CursorScreenPtr ScreenPriv =
-        (xf86CursorScreenPtr) dixLookupPrivate(&pScreen->devPrivates,
-                                               xf86CursorScreenKey);
     xf86CursorInfoPtr infoPtr = ScreenPriv->CursorInfoPtr;
 
     /* recoloring isn't applicable to ARGB cursors and drivers
@@ -357,6 +374,18 @@ xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
     }
 }
 
+void
+xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
+{
+    xf86CursorScreenPtr ScreenPriv =
+        (xf86CursorScreenPtr) dixLookupPrivate(&pScreen->devPrivates,
+                                               xf86CursorScreenKey);
+
+    input_lock();
+    xf86RecolorCursor_locked (ScreenPriv, pCurs);
+    input_unlock();
+}
+
 /* These functions assume that MaxWidth is a multiple of 32 */
 static unsigned char *
 RealizeCursorInterleave0(xf86CursorInfoPtr infoPtr, CursorPtr pCurs)

hw/xfree86/xkb/Makefile.am

@@ -0,0 +1,6 @@
+noinst_LTLIBRARIES = libxorgxkb.la
+
+AM_CFLAGS = @XORG_CFLAGS@ @DIX_CFLAGS@
+AM_CPPFLAGS = @XORG_INCS@
+
+libxorgxkb_la_SOURCES = xkbVT.c xkbPrivate.c xkbKillSrv.c

hw/xfree86/xkb/meson.build

@@ -0,0 +1,12 @@
+srcs_xorg_xkb = [
+    'xkbVT.c',
+    'xkbPrivate.c',
+    'xkbKillSrv.c',
+]
+
+xorg_xkb = static_library('xorg_xkb',
+    srcs_xorg_xkb,
+    include_directories: [inc, xorg_inc],
+    dependencies: common_dep,
+    c_args: xorg_c_args,
+)

hw/xfree86/xorg-wrapper.c

@@ -35,6 +35,9 @@
 #include <string.h>
 #include <sys/ioctl.h>
 #include <sys/stat.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 #include <sys/types.h>
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 #include <sys/consio.h>

hw/xquartz/quartz.c

@@ -178,6 +178,7 @@ QuartzInitOutput(int argc,
 {
     /* For XQuartz, we want to just use the default signal handler to work better with CrashTracer */
     signal(SIGSEGV, SIG_DFL);
+    signal(SIGABRT, SIG_DFL);
     signal(SIGILL, SIG_DFL);
 #ifdef SIGEMT
     signal(SIGEMT, SIG_DFL);

hw/xwayland/drm.xml

@@ -135,22 +135,6 @@
       <arg name="stride2" type="int"/>
     </request>
 
-    <!-- Create a wayland buffer for the prime fd.  Use for regular and planar
-         buffers.  Pass 0 for offset and stride for unused planes. -->
-    <request name="create_prime_buffer" since="2">
-      <arg name="id" type="new_id" interface="wl_buffer"/>
-      <arg name="name" type="fd"/>
-      <arg name="width" type="int"/>
-      <arg name="height" type="int"/>
-      <arg name="format" type="uint"/>
-      <arg name="offset0" type="int"/>
-      <arg name="stride0" type="int"/>
-      <arg name="offset1" type="int"/>
-      <arg name="stride1" type="int"/>
-      <arg name="offset2" type="int"/>
-      <arg name="stride2" type="int"/>
-    </request>
-
     <!-- Notification of the path of the drm device which is used by
          the server.  The client should use this device for creating
          local buffers.  Only buffers created from this device should
@@ -177,6 +161,25 @@
     <event name="capabilities">
       <arg name="value" type="uint"/>
     </event>
+
+    <!-- Version 2 additions -->
+
+    <!-- Create a wayland buffer for the prime fd.  Use for regular and planar
+         buffers.  Pass 0 for offset and stride for unused planes. -->
+    <request name="create_prime_buffer" since="2">
+      <arg name="id" type="new_id" interface="wl_buffer"/>
+      <arg name="name" type="fd"/>
+      <arg name="width" type="int"/>
+      <arg name="height" type="int"/>
+      <arg name="format" type="uint"/>
+      <arg name="offset0" type="int"/>
+      <arg name="stride0" type="int"/>
+      <arg name="offset1" type="int"/>
+      <arg name="stride1" type="int"/>
+      <arg name="offset2" type="int"/>
+      <arg name="stride2" type="int"/>
+    </request>
+
   </interface>
 
 </protocol>

hw/xwayland/xwayland-cursor.c

@@ -95,6 +95,15 @@ xwl_unrealize_cursor(DeviceIntPtr device, ScreenPtr screen, CursorPtr cursor)
     return xwl_shm_destroy_pixmap(pixmap);
 }
 
+static void
+clear_cursor_frame_callback(struct xwl_seat *xwl_seat)
+{
+   if (xwl_seat->cursor_frame_cb) {
+       wl_callback_destroy (xwl_seat->cursor_frame_cb);
+       xwl_seat->cursor_frame_cb = NULL;
+   }
+}
+
 static void
 frame_callback(void *data,
                struct wl_callback *callback,
@@ -102,8 +111,7 @@ frame_callback(void *data,
 {
     struct xwl_seat *xwl_seat = data;
 
-    wl_callback_destroy (xwl_seat->cursor_frame_cb);
+    clear_cursor_frame_callback(xwl_seat);
-    xwl_seat->cursor_frame_cb = NULL;
     if (xwl_seat->cursor_needs_update) {
         xwl_seat->cursor_needs_update = FALSE;
         xwl_seat_set_cursor(xwl_seat);
@@ -127,6 +135,8 @@ xwl_seat_set_cursor(struct xwl_seat *xwl_seat)
     if (!xwl_seat->x_cursor) {
         wl_pointer_set_cursor(xwl_seat->wl_pointer,
                               xwl_seat->pointer_enter_serial, NULL, 0, 0);
+        clear_cursor_frame_callback(xwl_seat);
+        xwl_seat->cursor_needs_update = FALSE;
         return;
     }
 

hw/xwayland/xwayland-cvt.c

@@ -296,6 +296,13 @@ xwayland_cvt(int HDisplay, int VDisplay, float VRefresh, Bool Reduced,
     if (Interlaced)
         modeinfo.modeFlags |= RR_Interlace;
 
+    /* FWXGA hack adapted from hw/xfree86/modes/xf86EdidModes.c, because you can't say 1366 */
+    if (HDisplay == 1366 && VDisplay == 768) {
+         modeinfo.width = 1366;
+         modeinfo.hSyncStart--;
+         modeinfo.hSyncEnd--;
+    }
+
     snprintf(name, sizeof name, "%dx%d",
              modeinfo.width, modeinfo.height);
     modeinfo.nameLength = strlen(name);

hw/xwayland/xwayland-glamor.c

@@ -38,6 +38,8 @@
 #include <dri3.h>
 #include "drm-client-protocol.h"
 
+static DevPrivateKeyRec xwl_auth_state_private_key;
+
 struct xwl_pixmap {
     struct wl_buffer *buffer;
     struct gbm_bo *bo;
@@ -429,17 +431,49 @@ glamor_egl_dri3_fd_name_from_tex(ScreenPtr screen,
 struct xwl_auth_state {
     int fd;
     ClientPtr client;
+    struct wl_callback *callback;
 };
 
+static void
+free_xwl_auth_state(ClientPtr pClient, struct xwl_auth_state *state)
+{
+    dixSetPrivate(&pClient->devPrivates, &xwl_auth_state_private_key, NULL);
+    if (state) {
+        wl_callback_destroy(state->callback);
+        free(state);
+    }
+}
+
+static void
+xwl_auth_state_client_callback(CallbackListPtr *pcbl, void *unused, void *data)
+{
+    NewClientInfoRec *clientinfo = (NewClientInfoRec *) data;
+    ClientPtr pClient = clientinfo->client;
+    struct xwl_auth_state *state;
+
+    switch (pClient->clientState) {
+    case ClientStateGone:
+    case ClientStateRetained:
+        state = dixLookupPrivate(&pClient->devPrivates, &xwl_auth_state_private_key);
+        free_xwl_auth_state(pClient, state);
+        break;
+    default:
+        break;
+    }
+}
+
 static void
 sync_callback(void *data, struct wl_callback *callback, uint32_t serial)
 {
     struct xwl_auth_state *state = data;
+    ClientPtr client = state->client;
 
-    dri3_send_open_reply(state->client, state->fd);
+    /* if the client is gone, the callback is cancelled so it's safe to
-    AttendClient(state->client);
+     * assume the client is still in ClientStateRunning at this point...
-    free(state);
+     */
-    wl_callback_destroy(callback);
+    dri3_send_open_reply(client, state->fd);
+    AttendClient(client);
+    free_xwl_auth_state(client, state);
 }
 
 static const struct wl_callback_listener sync_listener = {
@@ -454,7 +488,6 @@ xwl_dri3_open_client(ClientPtr client,
 {
     struct xwl_screen *xwl_screen = xwl_screen_get(screen);
     struct xwl_auth_state *state;
-    struct wl_callback *callback;
     drm_magic_t magic;
     int fd;
 
@@ -482,8 +515,9 @@ xwl_dri3_open_client(ClientPtr client,
     }
 
     wl_drm_authenticate(xwl_screen->drm, magic);
-    callback = wl_display_sync(xwl_screen->display);
+    state->callback = wl_display_sync(xwl_screen->display);
-    wl_callback_add_listener(callback, &sync_listener, state);
+    wl_callback_add_listener(state->callback, &sync_listener, state);
+    dixSetPrivate(&client->devPrivates, &xwl_auth_state_private_key, state);
 
     IgnoreClient(client);
 
@@ -565,6 +599,16 @@ xwl_glamor_init(struct xwl_screen *xwl_screen)
         return FALSE;
     }
 
+    if (!dixRegisterPrivateKey(&xwl_auth_state_private_key, PRIVATE_CLIENT, 0)) {
+        ErrorF("Failed to register private key\n");
+        return FALSE;
+    }
+
+    if (!AddCallback(&ClientStateCallback, xwl_auth_state_client_callback, NULL)) {
+        ErrorF("Failed to add client state callback\n");
+        return FALSE;
+    }
+
     xwl_screen->CreateScreenResources = screen->CreateScreenResources;
     screen->CreateScreenResources = xwl_glamor_create_screen_resources;
     screen->CreatePixmap = xwl_glamor_create_pixmap;

hw/xwayland/xwayland-input.c

@@ -318,6 +318,9 @@ pointer_handle_enter(void *data, struct wl_pointer *pointer,
     dx = xwl_seat->focus_window->window->drawable.x;
     dy = xwl_seat->focus_window->window->drawable.y;
 
+    /* We just entered a new xwindow, forget about the old last xwindow */
+    xwl_seat->last_xwindow = NullWindow;
+
     master = GetMaster(dev, POINTER_OR_FLOAT);
     (*pScreen->SetCursorPosition) (dev, pScreen, dx + sx, dy + sy, TRUE);
 
@@ -366,8 +369,14 @@ pointer_handle_leave(void *data, struct wl_pointer *pointer,
 
     xwl_seat->xwl_screen->serial = serial;
 
-    xwl_seat->focus_window = NULL;
+    /* The pointer has left a known xwindow, save it for a possible match
-    CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+     * in sprite_check_lost_focus()
+     */
+    if (xwl_seat->focus_window) {
+        xwl_seat->last_xwindow = xwl_seat->focus_window->window;
+        xwl_seat->focus_window = NULL;
+        CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+    }
 }
 
 static void
@@ -507,6 +516,9 @@ pointer_handle_frame(void *data, struct wl_pointer *wl_pointer)
 {
     struct xwl_seat *xwl_seat = data;
 
+    if (!xwl_seat->focus_window)
+        return;
+
     dispatch_pointer_motion_event(xwl_seat);
 }
 
@@ -557,6 +569,9 @@ relative_pointer_handle_relative_motion(void *data,
     xwl_seat->pending_pointer_event.dx_unaccel = wl_fixed_to_double(dx_unaccelf);
     xwl_seat->pending_pointer_event.dy_unaccel = wl_fixed_to_double(dy_unaccelf);
 
+    if (!xwl_seat->focus_window)
+        return;
+
     if (wl_proxy_get_version((struct wl_proxy *) xwl_seat->wl_pointer) < 5)
         dispatch_pointer_motion_event(xwl_seat);
 }
@@ -646,7 +661,7 @@ keyboard_handle_enter(void *data, struct wl_keyboard *keyboard,
 
     wl_array_copy(&xwl_seat->keys, keys);
     wl_array_for_each(k, &xwl_seat->keys)
-        QueueKeyboardEvents(xwl_seat->keyboard, KeymapNotify, *k + 8);
+        QueueKeyboardEvents(xwl_seat->keyboard, EnterNotify, *k + 8);
 }
 
 static void
@@ -658,12 +673,8 @@ keyboard_handle_leave(void *data, struct wl_keyboard *keyboard,
 
     xwl_seat->xwl_screen->serial = serial;
 
-    /* Unlike keymap_handle_enter above, this time we _do_ want to trigger
-     * full release, as we don't know how long we'll be out of focus for.
-     * Notify clients that the keys have been released, disable autorepeat,
-     * etc. */
     wl_array_for_each(k, &xwl_seat->keys)
-        QueueKeyboardEvents(xwl_seat->keyboard, KeyRelease, *k + 8);
+        QueueKeyboardEvents(xwl_seat->keyboard, LeaveNotify, *k + 8);
 
     xwl_seat->keyboard_focus = NULL;
 }
@@ -1022,8 +1033,6 @@ release_relative_pointer(struct xwl_seat *xwl_seat)
 static void
 init_keyboard(struct xwl_seat *xwl_seat)
 {
-    DeviceIntPtr master;
-
     xwl_seat->wl_keyboard = wl_seat_get_keyboard(xwl_seat->seat);
     wl_keyboard_add_listener(xwl_seat->wl_keyboard,
                              &keyboard_listener, xwl_seat);
@@ -1035,9 +1044,6 @@ init_keyboard(struct xwl_seat *xwl_seat)
     }
     EnableDevice(xwl_seat->keyboard, TRUE);
     xwl_seat->keyboard->key->xkbInfo->checkRepeat = keyboard_check_repeat;
-    master = GetMaster(xwl_seat->keyboard, MASTER_KEYBOARD);
-    if (master)
-        master->key->xkbInfo->checkRepeat = keyboard_check_repeat;
 }
 
 static void
@@ -1262,10 +1268,10 @@ sprite_check_lost_focus(SpritePtr sprite, WindowPtr window)
      */
     if (master->lastSlave == xwl_seat->pointer &&
         xwl_seat->focus_window == NULL &&
-        xwl_seat->last_xwindow == window)
+        xwl_seat->last_xwindow != NullWindow &&
+        IsParent(xwl_seat->last_xwindow, window))
         return TRUE;
 
-    xwl_seat->last_xwindow = window;
     return FALSE;
 }
 
@@ -1518,11 +1524,38 @@ xwl_seat_emulate_pointer_warp(struct xwl_seat *xwl_seat,
                                    x, y);
 }
 
+static Bool
+xwl_seat_maybe_lock_on_hidden_cursor(struct xwl_seat *xwl_seat)
+{
+    /* Some clients use hidden cursor+confineTo+relative motion
+     * to implement infinite panning (eg. 3D views), lock the
+     * pointer for so the relative pointer is used.
+     */
+    if (xwl_seat->x_cursor ||
+        !xwl_seat->cursor_confinement_window)
+        return FALSE;
+
+    if (!xwl_seat->focus_window)
+        return FALSE;
+
+    if (xwl_seat->confined_pointer)
+        xwl_seat_destroy_confined_pointer(xwl_seat);
+
+    xwl_seat_create_pointer_warp_emulator(xwl_seat);
+    xwl_pointer_warp_emulator_lock(xwl_seat->pointer_warp_emulator);
+    return TRUE;
+}
+
 void
 xwl_seat_cursor_visibility_changed(struct xwl_seat *xwl_seat)
 {
-    if (xwl_seat->pointer_warp_emulator && xwl_seat->x_cursor != NULL)
+    if (xwl_seat->pointer_warp_emulator && xwl_seat->x_cursor != NULL) {
         xwl_seat_destroy_pointer_warp_emulator(xwl_seat);
+    } else if (!xwl_seat->x_cursor && xwl_seat->cursor_confinement_window) {
+        /* If the cursor goes hidden as is confined, lock it for
+         * relative motion to work. */
+        xwl_seat_maybe_lock_on_hidden_cursor(xwl_seat);
+    }
 }
 
 void
@@ -1561,6 +1594,9 @@ xwl_seat_confine_pointer(struct xwl_seat *xwl_seat,
     if (xwl_seat->pointer_warp_emulator)
         return;
 
+    if (xwl_seat_maybe_lock_on_hidden_cursor(xwl_seat))
+        return;
+
     xwl_seat->confined_pointer =
         zwp_pointer_constraints_v1_confine_pointer(pointer_constraints,
                                                    xwl_window->surface,

hw/xwayland/xwayland-output.c

@@ -31,6 +31,12 @@
 #include <randrstr.h>
 
 #define DEFAULT_DPI 96
+#define ALL_ROTATIONS (RR_Rotate_0   | \
+                       RR_Rotate_90  | \
+                       RR_Rotate_180 | \
+                       RR_Rotate_270 | \
+                       RR_Reflect_X  | \
+                       RR_Reflect_Y)
 
 static Rotation
 wl_transform_to_xrandr(enum wl_output_transform transform)
@@ -102,14 +108,8 @@ output_handle_mode(void *data, struct wl_output *wl_output, uint32_t flags,
     if (!(flags & WL_OUTPUT_MODE_CURRENT))
         return;
 
-    if (xwl_output->rotation & (RR_Rotate_0 | RR_Rotate_180)) {
+    xwl_output->width = width;
-        xwl_output->width = width;
+    xwl_output->height = height;
-        xwl_output->height = height;
-    } else {
-        xwl_output->width = height;
-        xwl_output->height = width;
-    }
-
     xwl_output->refresh = refresh;
 }
 
@@ -117,11 +117,21 @@ static inline void
 output_get_new_size(struct xwl_output *xwl_output,
                     int *height, int *width)
 {
-    if (*width < xwl_output->x + xwl_output->width)
+    int output_width, output_height;
-        *width = xwl_output->x + xwl_output->width;
 
-    if (*height < xwl_output->y + xwl_output->height)
+    if (xwl_output->rotation & (RR_Rotate_0 | RR_Rotate_180)) {
-        *height = xwl_output->y + xwl_output->height;
+        output_width = xwl_output->width;
+        output_height = xwl_output->height;
+    } else {
+        output_width = xwl_output->height;
+        output_height = xwl_output->width;
+    }
+
+    if (*width < xwl_output->x + output_width)
+        *width = xwl_output->x + output_width;
+
+    if (*height < xwl_output->y + output_height)
+        *height = xwl_output->y + output_height;
 }
 
 /* Approximate some kind of mmpd (m.m. per dot) of the screen given the outputs
@@ -177,8 +187,11 @@ update_screen_size(struct xwl_output *xwl_output, int width, int height)
     SetRootClip(xwl_screen->screen, xwl_screen->root_clip_mode);
 
     if (xwl_screen->screen->root) {
+        BoxRec box = { 0, 0, width, height };
+
         xwl_screen->screen->root->drawable.width = width;
         xwl_screen->screen->root->drawable.height = height;
+        RegionReset(&xwl_screen->screen->root->winSize, &box);
         RRScreenSizeNotify(xwl_screen->screen);
     }
 
@@ -266,6 +279,7 @@ xwl_output_create(struct xwl_screen *xwl_screen, uint32_t id)
         ErrorF("Failed creating RandR CRTC\n");
         goto err;
     }
+    RRCrtcSetRotations (xwl_output->randr_crtc, ALL_ROTATIONS);
 
     xwl_output->randr_output = RROutputCreate(xwl_screen->screen, name,
                                               strlen(name), xwl_output);
@@ -317,7 +331,7 @@ xwl_output_remove(struct xwl_output *xwl_output)
 static Bool
 xwl_randr_get_info(ScreenPtr pScreen, Rotation * rotations)
 {
-    *rotations = 0;
+    *rotations = ALL_ROTATIONS;
 
     return TRUE;
 }

hw/xwayland/xwayland.c

@@ -175,11 +175,31 @@ xwl_cursor_warped_to(DeviceIntPtr device,
     struct xwl_screen *xwl_screen = xwl_screen_get(screen);
     struct xwl_seat *xwl_seat = device->public.devicePrivate;
     struct xwl_window *xwl_window;
+    WindowPtr focus;
 
     if (!xwl_seat)
         xwl_seat = xwl_screen_get_default_seat(xwl_screen);
 
     xwl_window = xwl_window_from_window(window);
+    if (!xwl_window && xwl_seat->focus_window) {
+        focus = xwl_seat->focus_window->window;
+
+        /* Warps on non wl_surface backed Windows are only allowed
+         * as long as the pointer stays within the focus window.
+         */
+        if (x >= focus->drawable.x &&
+            y >= focus->drawable.y &&
+            x < focus->drawable.x + focus->drawable.width &&
+            y < focus->drawable.y + focus->drawable.height) {
+            if (!window) {
+                DebugF("Warp relative to pointer, assuming pointer focus\n");
+                xwl_window = xwl_seat->focus_window;
+            } else if (window == screen->root) {
+                DebugF("Warp on root window, assuming pointer focus\n");
+                xwl_window = xwl_seat->focus_window;
+            }
+        }
+    }
     if (!xwl_window)
         return;
 
@@ -204,6 +224,15 @@ xwl_cursor_confined_to(DeviceIntPtr device,
     }
 
     xwl_window = xwl_window_from_window(window);
+    if (!xwl_window && xwl_seat->focus_window) {
+        /* Allow confining on InputOnly windows, but only if the geometry
+         * is the same than the focus window.
+         */
+        if (window->drawable.class == InputOnly) {
+            DebugF("Confine on InputOnly window, assuming pointer focus\n");
+            xwl_window = xwl_seat->focus_window;
+        }
+    }
     if (!xwl_window)
         return;
 
@@ -305,9 +334,11 @@ xwl_realize_window(WindowPtr window)
     screen->RealizeWindow = xwl_realize_window;
 
     if (xwl_screen->rootless && !window->parent) {
+        BoxRec box = { 0, 0, xwl_screen->width, xwl_screen->height };
+
+        RegionReset(&window->winSize, &box);
         RegionNull(&window->clipList);
         RegionNull(&window->borderClip);
-        RegionNull(&window->winSize);
     }
 
     if (xwl_screen->rootless) {
@@ -880,8 +911,9 @@ InitOutput(ScreenInfo * screen_info, int argc, char **argv)
     screen_info->bitmapBitOrder = BITMAP_BIT_ORDER;
     screen_info->numPixmapFormats = ARRAY_SIZE(depths);
 
-    LoadExtensionList(xwayland_extensions,
+    if (serverGeneration == 1)
-                      ARRAY_SIZE(xwayland_extensions), FALSE);
+        LoadExtensionList(xwayland_extensions,
+                          ARRAY_SIZE(xwayland_extensions), FALSE);
 
     /* Cast away warning from missing printf annotation for
      * wl_log_func_t.  Wayland 1.5 will have the annotation, so we can

include/dix-config.h.in

@@ -125,6 +125,9 @@
 /* Build a standalone xpbproxy */
 #undef STANDALONE_XPBPROXY
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+#undef HAVE_LIBBSD
+
 /* Define to 1 if you have the `m' library (-lm). */
 #undef HAVE_LIBM
 
@@ -161,6 +164,9 @@
 /* Define to 1 if you have the <rpcsvc/dbm.h> header file. */
 #undef HAVE_RPCSVC_DBM_H
 
+/* Define to 1 if you have the `arc4random_buf' function. */
+#undef HAVE_ARC4RANDOM_BUF
+
 /* Define to use libc SHA1 functions */
 #undef HAVE_SHA1_IN_LIBC
 
@@ -238,6 +244,9 @@
 /* Define to 1 if you have the <sys/utsname.h> header file. */
 #undef HAVE_SYS_UTSNAME_H
 
+/* Define to 1 if you have the `timingsafe_memcmp' function. */
+#undef HAVE_TIMINGSAFE_MEMCMP
+
 /* Define to 1 if you have the <tslib.h> header file. */
 #undef HAVE_TSLIB_H
 

include/dixstruct.h

@@ -143,6 +143,12 @@ extern void SmartScheduleStopTimer(void);
 /* Client has requests queued or data on the network */
 void mark_client_ready(ClientPtr client);
 
+/*
+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client);
+
 /* Client has no requests queued and no data on network */
 void mark_client_not_ready(ClientPtr client);
 

include/input.h

@@ -722,6 +722,7 @@ extern _X_HIDDEN void input_constrain_cursor(DeviceIntPtr pDev, ScreenPtr screen
 extern _X_EXPORT void input_lock(void);
 extern _X_EXPORT void input_unlock(void);
 extern _X_EXPORT void input_force_unlock(void);
+extern _X_EXPORT int in_input_thread(void);
 
 extern void InputThreadPreInit(void);
 extern void InputThreadInit(void);

include/os.h

@@ -590,6 +590,11 @@ extern _X_EXPORT char *
 strndup(const char *str, size_t n);
 #endif
 
+#ifndef HAVE_TIMINGSAFE_MEMCMP
+extern _X_EXPORT int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len);
+#endif
+
 /* Logging. */
 typedef enum _LogParameter {
     XLOG_FLUSH,

include/xorg-config.h.in

@@ -124,6 +124,9 @@
 /* Define to 1 if you have the <sys/mkdev.h> header file. */
 #undef HAVE_SYS_MKDEV_H
 
+/* Define to 1 if you have the <sys/sysmacros.h> header file. */
+#undef HAVE_SYS_SYSMACROS_H
+
 /* Path to text files containing PCI IDs */
 #undef PCI_TXT_IDS_PATH
 

miext/damage/damage.c

@@ -34,6 +34,7 @@
 #include    <X11/fonts/fontstruct.h>
 #include    <X11/fonts/libxfont2.h>
 #include    "mi.h"
+#include    "mipict.h"
 #include    "regionstr.h"
 #include    "globals.h"
 #include    "gcstruct.h"
@@ -282,8 +283,10 @@ damageRegionAppend(DrawablePtr pDrawable, RegionPtr pRegion, Bool clip,
 }
 
 static void
-damageRegionProcessPending(DamagePtr pDamage)
+damageRegionProcessPending(DrawablePtr pDrawable)
 {
+    drawableDamage(pDrawable);
+
     for (; pDamage != NULL; pDamage = pDamage->pNext) {
         if (pDamage->reportAfter) {
             /* It's possible that there is only interest in postRendering reporting. */
@@ -358,7 +361,6 @@ damageCreateGC(GCPtr pGC)
 
 #define DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable) \
     damageGCPriv(pGC);  \
-    drawableDamage(pDrawable); \
     const GCFuncs *oldFuncs = pGC->funcs; \
     unwrap(pGCPriv, pGC, funcs);  \
     unwrap(pGCPriv, pGC, ops); \
@@ -456,7 +458,7 @@ damageDestroyClip(GCPtr pGC)
 #define BOX_NOT_EMPTY(box) \
     (((box.x2 - box.x1) > 0) && ((box.y2 - box.y1) > 0))
 
-#define checkGCDamage(d,g)	(d && \
+#define checkGCDamage(d,g)	(getDrawableDamage(d) && \
 				 (!g->pCompositeClip ||\
 				  RegionNotEmpty(g->pCompositeClip)))
 
@@ -468,7 +470,8 @@ damageDestroyClip(GCPtr pGC)
     if(box.y2 > extents->y2) box.y2 = extents->y2; \
     }
 
-#define checkPictureDamage(d, p) (d && RegionNotEmpty(p->pCompositeClip))
+#define checkPictureDamage(p)	(getDrawableDamage(p->pDrawable) && \
+				 RegionNotEmpty(p->pCompositeClip))
 
 static void
 damageComposite(CARD8 op,
@@ -485,9 +488,8 @@ damageComposite(CARD8 op,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pDst->pDrawable);
 
-    if (checkPictureDamage(pDamage, pDst)) {
+    if (checkPictureDamage(pDst)) {
         BoxRec box;
 
         box.x1 = xDst + pDst->pDrawable->x;
@@ -498,13 +500,22 @@ damageComposite(CARD8 op,
         if (BOX_NOT_EMPTY(box))
             damageDamageBox(pDst->pDrawable, &box, pDst->subWindowMode);
     }
+    /*
+     * Validating a source picture bound to a window may trigger other
+     * composite operations. Do it before unwrapping to make sure damage
+     * is reported correctly.
+     */
+    if (pSrc->pDrawable && WindowDrawable(pSrc->pDrawable->type))
+        miCompositeSourceValidate(pSrc);
+    if (pMask && pMask->pDrawable && WindowDrawable(pMask->pDrawable->type))
+        miCompositeSourceValidate(pMask);
     unwrap(pScrPriv, ps, Composite);
     (*ps->Composite) (op,
                       pSrc,
                       pMask,
                       pDst,
                       xSrc, ySrc, xMask, yMask, xDst, yDst, width, height);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst->pDrawable);
     wrap(pScrPriv, ps, Composite, damageComposite);
 }
 
@@ -520,9 +531,8 @@ damageGlyphs(CARD8 op,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pDst->pDrawable);
 
-    if (checkPictureDamage(pDamage, pDst)) {
+    if (checkPictureDamage(pDst)) {
         int nlistTmp = nlist;
         GlyphListPtr listTmp = list;
         GlyphPtr *glyphsTmp = glyphs;
@@ -567,7 +577,7 @@ damageGlyphs(CARD8 op,
     }
     unwrap(pScrPriv, ps, Glyphs);
     (*ps->Glyphs) (op, pSrc, pDst, maskFormat, xSrc, ySrc, nlist, list, glyphs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst->pDrawable);
     wrap(pScrPriv, ps, Glyphs, damageGlyphs);
 }
 
@@ -579,9 +589,8 @@ damageAddTraps(PicturePtr pPicture,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pPicture->pDrawable);
 
-    if (checkPictureDamage(pDamage, pPicture)) {
+    if (checkPictureDamage(pPicture)) {
         BoxRec box;
         int i;
         int x, y;
@@ -616,7 +625,7 @@ damageAddTraps(PicturePtr pPicture,
     }
     unwrap(pScrPriv, ps, AddTraps);
     (*ps->AddTraps) (pPicture, x_off, y_off, ntrap, traps);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pPicture->pDrawable);
     wrap(pScrPriv, ps, AddTraps, damageAddTraps);
 }
 
@@ -628,7 +637,7 @@ damageFillSpans(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         int nptTmp = npt;
         DDXPointPtr pptTmp = ppt;
         int *pwidthTmp = pwidth;
@@ -664,7 +673,7 @@ damageFillSpans(DrawablePtr pDrawable,
 
     (*pGC->ops->FillSpans) (pDrawable, pGC, npt, ppt, pwidth, fSorted);
 
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -676,7 +685,7 @@ damageSetSpans(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         DDXPointPtr pptTmp = ppt;
         int *pwidthTmp = pwidth;
         int nptTmp = npt;
@@ -710,7 +719,7 @@ damageSetSpans(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->SetSpans) (pDrawable, pGC, pcharsrc, ppt, pwidth, npt, fSorted);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -722,7 +731,7 @@ damagePutImage(DrawablePtr pDrawable,
                int y, int w, int h, int leftPad, int format, char *pImage)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
 
         box.x1 = x + pDrawable->x;
@@ -736,7 +745,7 @@ damagePutImage(DrawablePtr pDrawable,
     }
     (*pGC->ops->PutImage) (pDrawable, pGC, depth, x, y, w, h,
                            leftPad, format, pImage);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -750,7 +759,7 @@ damageCopyArea(DrawablePtr pSrc,
 
     DAMAGE_GC_OP_PROLOGUE(pGC, pDst);
 
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDst, pGC)) {
         BoxRec box;
 
         box.x1 = dstx + pDst->x;
@@ -765,7 +774,7 @@ damageCopyArea(DrawablePtr pSrc,
 
     ret = (*pGC->ops->CopyArea) (pSrc, pDst,
                                  pGC, srcx, srcy, width, height, dstx, dsty);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDst);
     return ret;
 }
@@ -783,7 +792,7 @@ damageCopyPlane(DrawablePtr pSrc,
 
     DAMAGE_GC_OP_PROLOGUE(pGC, pDst);
 
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDst, pGC)) {
         BoxRec box;
 
         box.x1 = dstx + pDst->x;
@@ -799,7 +808,7 @@ damageCopyPlane(DrawablePtr pSrc,
     ret = (*pGC->ops->CopyPlane) (pSrc, pDst,
                                   pGC, srcx, srcy, width, height, dstx, dsty,
                                   bitPlane);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDst);
     return ret;
 }
@@ -810,7 +819,7 @@ damagePolyPoint(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int nptTmp = npt;
         xPoint *pptTmp = ppt;
@@ -840,7 +849,7 @@ damagePolyPoint(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyPoint) (pDrawable, pGC, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -850,7 +859,7 @@ damagePolylines(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         int nptTmp = npt;
         DDXPointPtr pptTmp = ppt;
         BoxRec box;
@@ -913,7 +922,7 @@ damagePolylines(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->Polylines) (pDrawable, pGC, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -922,7 +931,7 @@ damagePolySegment(DrawablePtr pDrawable, GCPtr pGC, int nSeg, xSegment * pSeg)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nSeg && checkGCDamage(pDamage, pGC)) {
+    if (nSeg && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int extra = pGC->lineWidth;
         int nsegTmp = nSeg;
@@ -992,7 +1001,7 @@ damagePolySegment(DrawablePtr pDrawable, GCPtr pGC, int nSeg, xSegment * pSeg)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolySegment) (pDrawable, pGC, nSeg, pSeg);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1002,7 +1011,7 @@ damagePolyRectangle(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nRects && checkGCDamage(pDamage, pGC)) {
+    if (nRects && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int offset1, offset2, offset3;
         int nRectsTmp = nRects;
@@ -1051,7 +1060,7 @@ damagePolyRectangle(DrawablePtr pDrawable,
         }
     }
     (*pGC->ops->PolyRectangle) (pDrawable, pGC, nRects, pRects);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1060,7 +1069,7 @@ damagePolyArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nArcs && checkGCDamage(pDamage, pGC)) {
+    if (nArcs && checkGCDamage(pDrawable, pGC)) {
         int extra = pGC->lineWidth >> 1;
         BoxRec box;
         int nArcsTmp = nArcs;
@@ -1098,7 +1107,7 @@ damagePolyArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyArc) (pDrawable, pGC, nArcs, pArcs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1108,7 +1117,7 @@ damageFillPolygon(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt > 2 && checkGCDamage(pDamage, pGC)) {
+    if (npt > 2 && checkGCDamage(pDrawable, pGC)) {
         DDXPointPtr pptTmp = ppt;
         int nptTmp = npt;
         BoxRec box;
@@ -1157,7 +1166,7 @@ damageFillPolygon(DrawablePtr pDrawable,
     }
 
     (*pGC->ops->FillPolygon) (pDrawable, pGC, shape, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1166,7 +1175,7 @@ damagePolyFillRect(DrawablePtr pDrawable,
                    GCPtr pGC, int nRects, xRectangle *pRects)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (nRects && checkGCDamage(pDamage, pGC)) {
+    if (nRects && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         xRectangle *pRectsTmp = pRects;
         int nRectsTmp = nRects;
@@ -1193,7 +1202,7 @@ damagePolyFillRect(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyFillRect) (pDrawable, pGC, nRects, pRects);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1202,7 +1211,7 @@ damagePolyFillArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nArcs && checkGCDamage(pDamage, pGC)) {
+    if (nArcs && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int nArcsTmp = nArcs;
         xArc *pArcsTmp = pArcs;
@@ -1229,7 +1238,7 @@ damagePolyFillArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyFillArc) (pDrawable, pGC, nArcs, pArcs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1278,9 +1287,12 @@ damageDamageChars(DrawablePtr pDrawable,
 #define TT_IMAGE16 3
 
 static void
-damageText(DrawablePtr pDrawable, GCPtr pGC, int x, int y, unsigned long count,
+damageText(DrawablePtr pDrawable,
-           char *chars, FontEncoding fontEncoding, DamagePtr pDamage,
+           GCPtr pGC,
-           Bool textType)
+           int x,
+           int y,
+           unsigned long count,
+           char *chars, FontEncoding fontEncoding, Bool textType)
 {
     CharInfoPtr *charinfo;
     unsigned long i;
@@ -1289,7 +1301,7 @@ damageText(DrawablePtr pDrawable, GCPtr pGC, int x, int y, unsigned long count,
 
     imageblt = (textType == TT_IMAGE8) || (textType == TT_IMAGE16);
 
-    if (!pDamage)
+    if (!checkGCDamage(pDrawable, pGC))
         return;
 
     charinfo = xallocarray(count, sizeof(CharInfoPtr));
@@ -1314,9 +1326,9 @@ damagePolyText8(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, chars, Linear8Bit,
-               pDamage, TT_POLY8);
+               TT_POLY8);
     x = (*pGC->ops->PolyText8) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
     return x;
 }
@@ -1328,9 +1340,9 @@ damagePolyText16(DrawablePtr pDrawable,
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, (char *) chars,
                FONTLASTROW(pGC->font) == 0 ? Linear16Bit : TwoD16Bit,
-               pDamage, TT_POLY16);
+               TT_POLY16);
     x = (*pGC->ops->PolyText16) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
     return x;
 }
@@ -1341,9 +1353,9 @@ damageImageText8(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, chars, Linear8Bit,
-               pDamage, TT_IMAGE8);
+               TT_IMAGE8);
     (*pGC->ops->ImageText8) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1354,9 +1366,9 @@ damageImageText16(DrawablePtr pDrawable,
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, (char *) chars,
                FONTLASTROW(pGC->font) == 0 ? Linear16Bit : TwoD16Bit,
-               pDamage, TT_IMAGE16);
+               TT_IMAGE16);
     (*pGC->ops->ImageText16) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1371,7 +1383,7 @@ damageImageGlyphBlt(DrawablePtr pDrawable,
     damageDamageChars(pDrawable, pGC->font, x + pDrawable->x, y + pDrawable->y,
                       nglyph, ppci, TRUE, pGC->subWindowMode);
     (*pGC->ops->ImageGlyphBlt) (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1386,7 +1398,7 @@ damagePolyGlyphBlt(DrawablePtr pDrawable,
     damageDamageChars(pDrawable, pGC->font, x + pDrawable->x, y + pDrawable->y,
                       nglyph, ppci, FALSE, pGC->subWindowMode);
     (*pGC->ops->PolyGlyphBlt) (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1396,7 +1408,7 @@ damagePushPixels(GCPtr pGC,
                  DrawablePtr pDrawable, int dx, int dy, int xOrg, int yOrg)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
 
         box.x1 = xOrg;
@@ -1415,7 +1427,7 @@ damagePushPixels(GCPtr pGC,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PushPixels) (pGC, pBitMap, pDrawable, dx, dy, xOrg, yOrg);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1480,7 +1492,6 @@ damageCopyWindow(WindowPtr pWindow, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
     ScreenPtr pScreen = pWindow->drawable.pScreen;
 
     damageScrPriv(pScreen);
-    drawableDamage(&pWindow->drawable);
 
     if (getWindowDamage(pWindow)) {
         int dx = pWindow->drawable.x - ptOldOrg.x;
@@ -1496,7 +1507,7 @@ damageCopyWindow(WindowPtr pWindow, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
     }
     unwrap(pScrPriv, pScreen, CopyWindow);
     (*pScreen->CopyWindow) (pWindow, ptOldOrg, prgnSrc);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(&pWindow->drawable);
     wrap(pScrPriv, pScreen, CopyWindow, damageCopyWindow);
 }
 
@@ -1870,22 +1881,20 @@ DamageRegionAppend(DrawablePtr pDrawable, RegionPtr pRegion)
 void
 DamageRegionProcessPending(DrawablePtr pDrawable)
 {
-    drawableDamage(pDrawable);
+    damageRegionProcessPending(pDrawable);
-    damageRegionProcessPending(pDamage);
 }
 
 /* This call is very odd, i'm leaving it intact for API sake, but please don't use it. */
 void
 DamageDamageRegion(DrawablePtr pDrawable, RegionPtr pRegion)
 {
-    drawableDamage(pDrawable);
     damageRegionAppend(pDrawable, pRegion, FALSE, -1);
 
     /* Go back and report this damage for DamagePtrs with reportAfter set, since
      * this call isn't part of an in-progress drawing op in the call chain and
      * the DDX probably just wants to know about it right away.
      */
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
 }
 
 void

os/Makefile.am

@@ -58,12 +58,12 @@ EXTRA_DIST = $(SECURERPC_SRCS) $(XDMCP_SRCS)
 
 if SPECIAL_DTRACE_OBJECTS
 # Generate dtrace object code for probes in libos & libdix
-dtrace.o: $(top_srcdir)/dix/Xserver.d $(am_libos_la_OBJECTS)
+dtrace.o: $(top_srcdir)/dix/Xserver.d libos.la
 	$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d .libs/*.o ../dix/.libs/*.o
 
 noinst_PROGRAMS = os.O
 
 os_O_SOURCES =
-os.O: dtrace.o $(am_libos_la_OBJECTS)
+os.O: dtrace.o libos.la
 	$(AM_V_GEN)ld -r -o $@ dtrace.o .libs/*.o
 endif

os/WaitFor.c

@@ -143,7 +143,7 @@ check_timers(void)
 {
     OsTimerPtr timer;
 
-    while ((timer = first_timer()) != NULL) {
+    if ((timer = first_timer()) != NULL) {
         CARD32 now = GetTimeInMillis();
         int timeout = timer->expires - now;
 
@@ -157,6 +157,8 @@ check_timers(void)
             /* time has rewound.  reset the timers. */
             CheckAllTimers();
         }
+
+        return 0;
     }
     return -1;
 }

os/auth.c

@@ -45,6 +45,9 @@ from The Open Group.
 #ifdef WIN32
 #include    <X11/Xw32defs.h>
 #endif
+#ifdef HAVE_LIBBSD
+#include   <bsd/stdlib.h>       /* for arc4random_buf() */
+#endif
 
 struct protocol {
     unsigned short name_length;
@@ -52,7 +55,6 @@ struct protocol {
     AuthAddCFunc Add;           /* new authorization data */
     AuthCheckFunc Check;        /* verify client authorization data */
     AuthRstCFunc Reset;         /* delete all authorization data entries */
-    AuthToIDFunc ToID;          /* convert cookie to ID */
     AuthFromIDFunc FromID;      /* convert ID to cookie */
     AuthRemCFunc Remove;        /* remove a specific cookie */
 #ifdef XCSECURITY
@@ -63,7 +65,7 @@ struct protocol {
 static struct protocol protocols[] = {
     {(unsigned short) 18, "MIT-MAGIC-COOKIE-1",
      MitAddCookie, MitCheckCookie, MitResetCookie,
-     MitToID, MitFromID, MitRemoveCookie,
+     MitFromID, MitRemoveCookie,
 #ifdef XCSECURITY
      MitGenerateCookie
 #endif
@@ -71,7 +73,7 @@ static struct protocol protocols[] = {
 #ifdef HASXDMAUTH
     {(unsigned short) 19, "XDM-AUTHORIZATION-1",
      XdmAddCookie, XdmCheckCookie, XdmResetCookie,
-     XdmToID, XdmFromID, XdmRemoveCookie,
+     XdmFromID, XdmRemoveCookie,
 #ifdef XCSECURITY
      NULL
 #endif
@@ -80,7 +82,7 @@ static struct protocol protocols[] = {
 #ifdef SECURE_RPC
     {(unsigned short) 9, "SUN-DES-1",
      SecureRPCAdd, SecureRPCCheck, SecureRPCReset,
-     SecureRPCToID, SecureRPCFromID, SecureRPCRemove,
+     SecureRPCFromID, SecureRPCRemove,
 #ifdef XCSECURITY
      NULL
 #endif
@@ -303,11 +305,15 @@ GenerateAuthorization(unsigned name_length,
 void
 GenerateRandomData(int len, char *buf)
 {
+#ifdef HAVE_ARC4RANDOM_BUF
+    arc4random_buf(buf, len);
+#else
     int fd;
 
     fd = open("/dev/urandom", O_RDONLY);
     read(fd, buf, len);
     close(fd);
+#endif
 }
 
 #endif                          /* XCSECURITY */

os/busfault.c

@@ -98,15 +98,16 @@ static void
 busfault_sigaction(int sig, siginfo_t *info, void *param)
 {
     void                *fault = info->si_addr;
-    struct busfault     *busfault = NULL;
+    struct busfault     *iter, *busfault = NULL;
     void                *new_addr;
 
     /* Locate the faulting address in our list of shared segments
      */
-    xorg_list_for_each_entry(busfault, &busfaults, list) {
+    xorg_list_for_each_entry(iter, &busfaults, list) {
-        if ((char *) busfault->addr <= (char *) fault && (char *) fault < (char *) busfault->addr + busfault->size) {
+	if ((char *) iter->addr <= (char *) fault && (char *) fault < (char *) iter->addr + iter->size) {
-            break;
+	    busfault = iter;
-        }
+	    break;
+	}
     }
     if (!busfault)
         goto panic;
@@ -132,7 +133,7 @@ panic:
     if (previous_busfault_sigaction)
         (*previous_busfault_sigaction)(sig, info, param);
     else
-        FatalError("bus error");
+        FatalError("bus error\n");
 }
 
 Bool

os/connection.c

@@ -1067,6 +1067,10 @@ AttendClient(ClientPtr client)
     set_poll_client(client);
     if (listen_to_client(client))
         mark_client_ready(client);
+    else {
+        /* grab active, mark ready when grab goes away */
+        mark_client_saved_ready(client);
+    }
 }
 
 /* make client impervious to grabs; assume only executing client calls this */

os/inputthread.c

@@ -90,6 +90,13 @@ static pthread_mutex_t input_mutex;
 static Bool input_mutex_initialized;
 #endif
 
+int
+in_input_thread(void)
+{
+    return inputThreadInfo &&
+           pthread_equal(pthread_self(), inputThreadInfo->thread);
+}
+
 void
 input_lock(void)
 {
@@ -529,6 +536,7 @@ void input_force_unlock(void) {}
 void InputThreadPreInit(void) {}
 void InputThreadInit(void) {}
 void InputThreadFini(void) {}
+int in_input_thread(void) { return 0; }
 
 int InputThreadRegisterDev(int fd,
                            NotifyFdProcPtr readInputProc,

os/io.c

@@ -633,6 +633,28 @@ SetCriticalOutputPending(void)
     CriticalOutputPending = TRUE;
 }
 
+/*****************
+ * AbortClient:
+ *    When a write error occurs to a client, close
+ *    the connection and clean things up. Mark
+ *    the client as 'ready' so that the server will
+ *    try to read from it again, notice that the fd is
+ *    closed and clean up from there.
+ *****************/
+
+static void
+AbortClient(ClientPtr client)
+{
+    OsCommPtr oc = client->osPrivate;
+
+    if (oc->trans_conn) {
+        _XSERVTransDisconnect(oc->trans_conn);
+        _XSERVTransClose(oc->trans_conn);
+        oc->trans_conn = NULL;
+        mark_client_ready(client);
+    }
+}
+
 /*****************
  * WriteToClient
  *    Copies buf into ClientPtr.buf if it fits (with padding), else
@@ -652,6 +674,9 @@ WriteToClient(ClientPtr who, int count, const void *__buf)
     int padBytes;
     const char *buf = __buf;
 
+    BUG_RETURN_VAL_MSG(in_input_thread(), 0,
+                       "******** %s called from input thread *********\n", __func__);
+
 #ifdef DEBUG_COMMUNICATION
     Bool multicount = FALSE;
 #endif
@@ -705,11 +730,7 @@ WriteToClient(ClientPtr who, int count, const void *__buf)
             FreeOutputs = oco->next;
         }
         else if (!(oco = AllocateOutputBuffer())) {
-            if (oc->trans_conn) {
+            AbortClient(who);
-                _XSERVTransDisconnect(oc->trans_conn);
-                _XSERVTransClose(oc->trans_conn);
-                oc->trans_conn = NULL;
-            }
             MarkClientException(who);
             return -1;
         }
@@ -890,9 +911,7 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
                     obuf = realloc(oco->buf, notWritten + BUFSIZE);
                 }
                 if (!obuf) {
-                    _XSERVTransDisconnect(oc->trans_conn);
+                    AbortClient(who);
-                    _XSERVTransClose(oc->trans_conn);
-                    oc->trans_conn = NULL;
                     MarkClientException(who);
                     oco->count = 0;
                     return -1;
@@ -919,11 +938,7 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
         }
 #endif
         else {
-            if (oc->trans_conn) {
+            AbortClient(who);
-                _XSERVTransDisconnect(oc->trans_conn);
-                _XSERVTransClose(oc->trans_conn);
-                oc->trans_conn = NULL;
-            }
             MarkClientException(who);
             oco->count = 0;
             return -1;

os/mitauth.c

@@ -76,7 +76,7 @@ MitCheckCookie(unsigned short data_length,
 
     for (auth = mit_auth; auth; auth = auth->next) {
         if (data_length == auth->len &&
-            memcmp(data, auth->data, (int) data_length) == 0)
+            timingsafe_memcmp(data, auth->data, (int) data_length) == 0)
             return auth->id;
     }
     *reason = "Invalid MIT-MAGIC-COOKIE-1 key";
@@ -97,19 +97,6 @@ MitResetCookie(void)
     return 0;
 }
 
-XID
-MitToID(unsigned short data_length, char *data)
-{
-    struct auth *auth;
-
-    for (auth = mit_auth; auth; auth = auth->next) {
-        if (data_length == auth->len &&
-            memcmp(data, auth->data, data_length) == 0)
-            return auth->id;
-    }
-    return (XID) -1;
-}
-
 int
 MitFromID(XID id, unsigned short *data_lenp, char **datap)
 {

os/osdep.h

@@ -113,9 +113,6 @@ typedef int (*AuthRemCFunc) (AuthRemCArgs);
 #define AuthRstCArgs void
 typedef int (*AuthRstCFunc) (AuthRstCArgs);
 
-#define AuthToIDArgs unsigned short data_length, char *data
-typedef XID (*AuthToIDFunc) (AuthToIDArgs);
-
 typedef void (*OsCloseFunc) (ClientPtr);
 
 typedef int (*OsFlushFunc) (ClientPtr who, struct _osComm * oc, char *extraBuf,
@@ -185,7 +182,6 @@ extern void GenerateRandomData(int len, char *buf);
 /* in mitauth.c */
 extern XID MitCheckCookie(AuthCheckArgs);
 extern XID MitGenerateCookie(AuthGenCArgs);
-extern XID MitToID(AuthToIDArgs);
 extern int MitAddCookie(AuthAddCArgs);
 extern int MitFromID(AuthFromIDArgs);
 extern int MitRemoveCookie(AuthRemCArgs);
@@ -194,7 +190,6 @@ extern int MitResetCookie(AuthRstCArgs);
 /* in xdmauth.c */
 #ifdef HASXDMAUTH
 extern XID XdmCheckCookie(AuthCheckArgs);
-extern XID XdmToID(AuthToIDArgs);
 extern int XdmAddCookie(AuthAddCArgs);
 extern int XdmFromID(AuthFromIDArgs);
 extern int XdmRemoveCookie(AuthRemCArgs);
@@ -205,7 +200,6 @@ extern int XdmResetCookie(AuthRstCArgs);
 #ifdef SECURE_RPC
 extern void SecureRPCInit(AuthInitArgs);
 extern XID SecureRPCCheck(AuthCheckArgs);
-extern XID SecureRPCToID(AuthToIDArgs);
 extern int SecureRPCAdd(AuthAddCArgs);
 extern int SecureRPCFromID(AuthFromIDArgs);
 extern int SecureRPCRemove(AuthRemCArgs);

os/osinit.c

@@ -173,6 +173,7 @@ OsInit(void)
         int i;
 
         int siglist[] = { SIGSEGV, SIGQUIT, SIGILL, SIGFPE, SIGBUS,
+            SIGABRT,
             SIGSYS,
             SIGXCPU,
             SIGXFSZ,

os/rpcauth.c

@@ -175,12 +175,6 @@ SecureRPCReset(void)
     return 1;
 }
 
-_X_HIDDEN XID
-SecureRPCToID(unsigned short data_length, char *data)
-{
-    return rpc_id;
-}
-
 _X_HIDDEN int
 SecureRPCFromID(XID id, unsigned short *data_lenp, char **datap)
 {

os/timingsafe_memcmp.c

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2014 Google Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <limits.h>
+#include <string.h>
+#include <X11/Xfuncproto.h>
+#include <dix-config.h>
+#include "os.h"
+
+int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len)
+{
+        const unsigned char *p1 = b1, *p2 = b2;
+        size_t i;
+        int res = 0, done = 0;
+
+        for (i = 0; i < len; i++) {
+                /* lt is -1 if p1[i] < p2[i]; else 0. */
+                int lt = (p1[i] - p2[i]) >> CHAR_BIT;
+
+                /* gt is -1 if p1[i] > p2[i]; else 0. */
+                int gt = (p2[i] - p1[i]) >> CHAR_BIT;
+
+                /* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
+                int cmp = lt - gt;
+
+                /* set res = cmp if !done. */
+                res |= cmp & ~done;
+
+                /* set done if p1[i] != p2[i]. */
+                done |= lt | gt;
+        }
+
+        return (res);
+}

os/utils.c

@@ -318,7 +318,7 @@ LockServer(void)
     }
     if (lfd < 0)
         FatalError("Could not create lock file in %s\n", tmp);
-    snprintf(pid_str, sizeof(pid_str), "%10ld\n", (long) getpid());
+    snprintf(pid_str, sizeof(pid_str), "%10lu\n", (unsigned long) getpid());
     if (write(lfd, pid_str, 11) != 11)
         FatalError("Could not write pid to lock file in %s\n", tmp);
     (void) fchmod(lfd, 0444);
@@ -1351,6 +1351,12 @@ OsAbort(void)
 {
 #ifndef __APPLE__
     OsBlockSignals();
+#endif
+#if !defined(WIN32) || defined(__CYGWIN__)
+    /* abort() raises SIGABRT, so we have to stop handling that to prevent
+     * recursion
+     */
+    OsSignal(SIGABRT, SIG_DFL);
 #endif
     abort();
 }

os/xdmauth.c

@@ -411,33 +411,6 @@ XdmResetCookie(void)
     return 1;
 }
 
-XID
-XdmToID(unsigned short cookie_length, char *cookie)
-{
-    XdmAuthorizationPtr auth;
-    XdmClientAuthPtr client;
-    unsigned char *plain;
-
-    plain = malloc(cookie_length);
-    if (!plain)
-        return (XID) -1;
-    for (auth = xdmAuth; auth; auth = auth->next) {
-        XdmcpUnwrap((unsigned char *) cookie, (unsigned char *) &auth->key,
-                    plain, cookie_length);
-        if ((client =
-             XdmAuthorizationValidate(plain, cookie_length, &auth->rho, NULL,
-                                      NULL)) != NULL) {
-            free(client);
-            free(cookie);
-            free(plain);
-            return auth->id;
-        }
-    }
-    free(cookie);
-    free(plain);
-    return (XID) -1;
-}
-
 int
 XdmFromID(XID id, unsigned short *data_lenp, char **datap)
 {

present/present.c

@@ -117,6 +117,18 @@ present_flip_pending_pixmap(ScreenPtr screen)
     return screen_priv->flip_pending->pixmap;
 }
 
+static Bool
+present_check_output_slaves_active(ScreenPtr pScreen)
+{
+    ScreenPtr pSlave;
+
+    xorg_list_for_each_entry(pSlave, &pScreen->slave_list, slave_head) {
+        if (RRHasScanoutPixmap(pSlave))
+            return TRUE;
+    }
+    return FALSE;
+}
+
 static Bool
 present_check_flip(RRCrtcPtr    crtc,
                    WindowPtr    window,
@@ -145,7 +157,7 @@ present_check_flip(RRCrtcPtr    crtc,
         return FALSE;
 
     /* Fail to flip if we have slave outputs */
-    if (screen->output_slaves)
+    if (screen->output_slaves && present_check_output_slaves_active(screen))
         return FALSE;
 
     /* Make sure the window hasn't been redirected with Composite */
@@ -531,12 +543,13 @@ present_event_notify(uint64_t event_id, uint64_t ust, uint64_t msc)
             present_execute(vblank, ust, msc);
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {
-            present_flip_notify(vblank, ust, msc);
+            if (vblank->queued)
+                present_execute(vblank, ust, msc);
+            else
+                present_flip_notify(vblank, ust, msc);
             return;
         }
     }
@@ -992,8 +1005,6 @@ present_abort_vblank(ScreenPtr screen, RRCrtcPtr crtc, uint64_t event_id, uint64
             vblank->queued = FALSE;
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {

randr/rrcrtc.c

@@ -686,8 +686,14 @@ rrCheckPixmapBounding(ScreenPtr pScreen,
     }
 
     newsize = RegionExtents(&total_region);
-    new_width = newsize->x2 - newsize->x1;
+    new_width = newsize->x2;
-    new_height = newsize->y2 - newsize->y1;
+    new_height = newsize->y2;
+
+    if (new_width < screen_pixmap->drawable.width)
+        new_width = screen_pixmap->drawable.width;
+
+    if (new_height < screen_pixmap->drawable.height)
+        new_height = screen_pixmap->drawable.height;
 
     if (new_width == screen_pixmap->drawable.width &&
         new_height == screen_pixmap->drawable.height) {
@@ -837,9 +843,8 @@ RRCrtcGetTransform(RRCrtcPtr crtc)
 Bool
 RRCrtcPendingTransform(RRCrtcPtr crtc)
 {
-    return memcmp(&crtc->client_current_transform.transform,
+    return !RRTransformEqual(&crtc->client_current_transform,
-                  &crtc->client_pending_transform.transform,
+                             &crtc->client_pending_transform);
-                  sizeof(PictTransform)) != 0;
 }
 
 /*

randr/rrprovider.c

@@ -338,6 +338,9 @@ ProcRRSetProviderOutputSource(ClientPtr client)
     pScreen = provider->pScreen;
     pScrPriv = rrGetScrPriv(pScreen);
 
+    if (!pScreen->isGPU)
+        return BadValue;
+
     pScrPriv->rrProviderSetOutputSource(pScreen, provider, source_provider);
 
     RRInitPrimeSyncProps(pScreen);