commit afb77415e1fb862c322754230f63bb70fd596943
Author: Matt Turner <mattst88@gmail.com>
Date:   Tue Aug 25 08:23:42 2020 -0700

    xserver 1.20.9
    
    Signed-off-by: Matt Turner <mattst88@gmail.com>

commit 705d7213935820d9f56563ee9e17aa9beb365c1e
Author: Matthieu Herrb <matthieu@herrb.eu>
Date:   Tue Aug 18 14:55:01 2020 +0200

    Fix XRecordRegisterClients() Integer underflow
    
    CVE-2020-14362 ZDI-CAN-11574
    
    This vulnerability was discovered by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
    (cherry picked from commit 24acad216aa0fc2ac451c67b2b86db057a032050)

commit 5b384e7678c5a155dd8752f018c8292153c1295e
Author: Matthieu Herrb <matthieu@herrb.eu>
Date:   Tue Aug 18 14:52:29 2020 +0200

    Fix XkbSelectEvents() integer underflow
    
    CVE-2020-14361 ZDI-CAN 11573
    
    This vulnerability was discovered by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
    (cherry picked from commit 90304b3c2018a6b8f4a79de86364d2af15cb9ad8)

commit eff3f6cdd398bfac040351e99e64baf3bf64fa2e
Author: Matthieu Herrb <matthieu@herrb.eu>
Date:   Tue Aug 18 14:49:04 2020 +0200

    Fix XIChangeHierarchy() integer underflow
    
    CVE-2020-14346 / ZDI-CAN-11429
    
    This vulnerability was discovered by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
    (cherry picked from commit 1e3392b07923987c6c9d09cf75b24f397b59bd5e)

commit 1d3a1092c30af660b1366fcd344af745590aa29f
Author: Matthieu Herrb <matthieu@herrb.eu>
Date:   Tue Aug 18 14:46:32 2020 +0200

    Correct bounds checking in XkbSetNames()
    
    CVE-2020-14345 / ZDI 11428
    
    This vulnerability was discovered by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
    (cherry picked from commit 11f22a3bf694d7061d552c99898d843bcdaf0cf1)

commit 249a12c54a9316b089bd22683c011519348496df
Author: Huacai Chen <chenhc@lemote.com>
Date:   Sun Jul 5 05:59:58 2020 -0400

    linux: Fix platform device probe for DT-based PCI
    
    On a DT-base PCI platform, the sysfs path of vga device is like this:
    /sys/devices/platform/bus@10000000/1a000000.pci/pci0000:00/0000:00:11.0/0000:04:00.0.
    
    Then the ID_PATH from udev is platform-1a000000.pci-pci-0000:04:00.0 and
    the BusID will be pci-0000:04:00.0, which causes Xorg start fail. This
    is because config_udev_odev_setup_attribs() use strstr() to search the
    first "pci-" in ID_PATH. To fix this, we implement a strrstr() function
    and use it to search the last "pci-" in ID_PATH, which can get a correct
    BusID.
    
    (backported from commit 9fbd3e43dd9e13700df96b508c3d97f77e2b9f7e)
    
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Huacai Chen <chenhc@lemote.com>

commit 5c96eb5f44e62a4cfe835023cde304eb5795b8fd
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Jun 19 14:23:56 2019 -0400

    linux: Fix platform device PCI detection for complex bus topologies
    
    Suppose you're in a Hyper-V guest and are trying to use PCI passthrough.
    The ID_PATH that udev will construct for that looks something like
    "acpi-VMBUS:00-pci-b8c8:00:00.0", and obviously looking for "pci-" in
    the first four characters of that is going to not work.
    
    Instead, strstr. I suppose it's possible you could have _multiple_ PCI
    buses in the path, in which case you'd want strrstr, if that were a
    thing.
    
    (backported from commit 9acff309434a8029bcce1b22530043459bb71791)
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Huacai Chen <chenhc@lemote.com>

commit 74b7427c41b4e4104af7abf70a996c086d3d7628
Author: Adam Jackson <ajax@redhat.com>
Date:   Tue Sep 18 14:37:51 2018 -0400

    linux: Make platform device probe less fragile
    
    At the point where xf86BusProbe runs we haven't yet taken our own VT,
    which means we can't perform drm "master" operations on the device. This
    is tragic, because we need master to fish the bus id string out of the
    kernel, which we can only do after drmSetInterfaceVersion, which for
    some reason stores that string on the device not the file handle and
    thus needs master access.
    
    Fortunately we know the format of the busid string, and it happens to
    almost be the same as the ID_PATH variable from udev. Use that instead
    and stop calling drmSetInterfaceVersion.
    
    (backported from commit 0816e8fca6194dfb4cc94c3a7fcb2c7f2a921386)
    
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Huacai Chen <chenhc@lemote.com>

commit 4979ac8f0be6fa2c4a1edd8a527f7d2134d8586a
Author: Matthieu Herrb <matthieu@herrb.eu>
Date:   Sat Jul 25 19:33:50 2020 +0200

    fix for ZDI-11426
    
    Avoid leaking un-initalized memory to clients by zeroing the
    whole pixmap on initial allocation.
    
    This vulnerability was discovered by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit a6b2cbe91793ae4967cd21a7103d889248029553)

commit 2720b871575504349d9f4dffbc73539f1626bd78
Author: Aaron Ma <aaron.ma@canonical.com>
Date:   Thu Jul 30 11:02:39 2020 +0200

    xfree86: add drm modes on non-GTF panels
    
    EDID1.4 replaced GTF Bit with Continuous or Non-Continuous Frequency Display.
    
    Check the "Display Range Limits Descriptor" for GTF support.
    If panel doesn't support GTF, then add gtf modes.
    
    Otherwise X will only show the modes in "Detailed Timing Descriptor".
    
    V2: Coding style changes.
    V3: Coding style changes, remove unused variate.
    V4: remove unused variate.
    
    BugLink: https://gitlab.freedesktop.org/drm/intel/issues/313
    Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 6a79a737e2c0bc730ee693b4ea4a1530c108be4e)

commit 7da8e7babee16f7d518cd9ee2a71c950fe2c3c3f
Author: Roman Gilg <subdiff@gmail.com>
Date:   Fri Jul 24 12:21:37 2020 +0200

    present: Check valid region in window mode flips
    
    For Pixmap flips to have well defined outcomes the window must be contained by
    the valid region if such region was specified.
    
    The valid region is inserted as an argument to the check in window mode.
    Setting this argument is missing in screen mode as well but we ignore it for now
    and only add it to window mode.
    
    It seems there are none or only very few clients actually making use of valid
    regions at the moment. For simplicity we therefore just check if a valid region
    was set by the client and in this case do never flip, independently of the
    window being contained by the region or not.
    
    Signed-off-by: Roman Gilg <subdiff@gmail.com>
    (cherry picked from commit 591916ea9e7a77f68f436b4a541402d9deadfe64)

commit 4a65b6617ecc43b754885894f6575fb7dc4bb74d
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Thu Jul 23 19:14:28 2020 +0200

    xwayland: Handle NULL xwl_seat in xwl_seat_can_emulate_pointer_warp
    
    This can happen e.g. with weston's headless backend.
    
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit e33453f9111b21e4814d628e6ae00bc7b200f404)

commit 10cabe0b978677cfac4bfb405295a16ee8eedb34
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Tue Mar 17 12:58:12 2020 +0100

    xwayland: Propagate damage x1/y1 coordinates in xwl_present_flip
    
    This couldn't have worked correctly for non-0 x1/y1.
    
    Noticed by inspection.
    
    Reviewed-by: Simon Ser <contact@emersion.fr>
    (cherry picked from commits 9141196d3104ab37385c3e385deaa70c002dd184)
    (cherry picked fixup from commit 85a6fd11c723888ca093785a3df43066fdca9c33)

commit 3b51978b9ca8cdc71508f6db2411255ca6406c3a
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Tue Jul 21 18:34:28 2020 +0200

    doc: Update URLs in Xserver-DTrace.xml
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 0006aecba097b437f96a462075494d68bdad24c1)

commit 6cbd6a09b9037c6e6074127324978a51442ca375
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Tue Jun 2 11:23:46 2020 +0200

    xwayland: Use a fixed DPI value for core protocol
    
    The way Xwayland works (like all Wayland clients), it first queries the
    Wayland registry, set up all relevant protocols and then initializes its
    own structures.
    
    That means Xwayland will get the Wayland outputs from the Wayland
    compositor, compute the physical size of the combined outputs and set
    the corresponding Xwayland screen properties accordingly.
    
    Then it creates the X11 screen using fbScreenInit() but does so by using
    a default DPI value of 96. That value is used to set the physical size
    of the X11 screen, hence overriding the value computed from the actual
    physical size provided by the Wayland compositor.
    
    As a result, the DPI computed by tools such as xdpyinfo will always be
    96 regardless of the actual screen size and resolution.
    
    However, if the Wayland outputs get reconfigured, or new outputs added,
    or existing outputs removed, Xwayland will recompute and update the
    physical size of the screen, leading to an unexpected change of DPI.
    
    To avoid that discrepancy, use a fixed size DPI (defaults to 96, and can
    be set using the standard command lime option "-dpi") and compute a
    physical screen size to match that DPI setting.
    
    Note that only affects legacy core protocols, X11 clients can still get
    the actual physical output size as reported by the Wayland compositor
    using the RandR protocol, which also allows for the size to be 0 if the
    size is unknown or meaningless.
    
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Simon Ser <contact@emersion.fr>
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/731
    (cherry picked from commit b0413b6e99c6b5fbc04229ce64ddf1f41b08e63e)

commit d4e8c4622890b0cdcfe5f4b9c5608d15ce976901
Author: Simon Ser <contact@emersion.fr>
Date:   Tue Jul 21 18:28:01 2020 +0200

    xwayland: only use linux-dmabuf if format/modifier was advertised
    
    Previously, linux-dmabuf was used unconditionally if the buffer had a
    modifier. However creating a linux-dmabuf buffer with a format/modifier
    which hasn't been advertised will fail.
    
    Change xwl_glamor_gbm_get_wl_buffer_for_pixmap to use linux-dmabuf when
    the format/modifier has been advertised only.
    
    Signed-off-by: Simon Ser <contact@emersion.fr>
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1035
    Tested-by: Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    (cherry picked from commit c0e13cbf5a56e1fdd1e4ce58ebdefb6d2904e4b3)

commit c726ceacc1a39c56d2b054ac5f35798d0c3640d7
Author: Martin Weber <martin.weber@secunet.com>
Date:   Tue Jul 21 18:24:41 2020 +0200

    hw/xfree86: Avoid cursor use after free
    
    During a VT-Switch a raw pointer to the shared cursor object
    is saved which is then freed (in case of low refcount) by a call to
    xf86CursorSetCursor with argument pCurs = NullCursor.
    This leads to a dangling pointer which can follow in a use after free.
    
    This fix ensures that there is a shared handle saved for the VT-Switch cycle.
    
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    (cherry picked from commit 7ae221ad5774756766dc78a73d71f4163ac7b1c6)

commit 0679d4660579d0f399b5a9b8140d0c0d3483fa9f
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Tue Jul 21 18:14:51 2020 +0200

    Update URL's in man pages
    
    Mostly http->https conversions, but also replaces gitweb.fd.o
    with gitlab.fd.o, and xquartz.macosforge.org with xquartz.org.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit a5151f58cf98d1696d60a3577dc50851f159da8a)

commit 3059a2e62ae7ef665a537ee0fc2ec24beccf17ae
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Wed Jun 3 10:17:13 2020 +0200

    xwayland: Disable the MIT-SCREEN-SAVER extension when rootless
    
    Xwayland is just a Wayland client, no X11 screensaver should be
    expected to work reliably on Xwayland when running rootless because
    Xwayland cannot grab the input devices so it has no way to actually
    lock the screen managed by the Wayland compositor.
    
    Turn off the screensaver on Xwayland when running rootless by setting
    the screensaver timeout and interval and their default values to zero
    and disable the MIT-SCREEN-SAVER extension.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1051
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 5c20e4b834145f590c68dbc98e33c7d3d710001a)

commit 23c55ec32973e0a75d723e3f37769dd711c9c59c
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Wed Jul 22 18:20:14 2020 +0200

    xwayland: Hold a pixmap reference in struct xwl_present_event
    
    In the log of the commit below, I claimed this wasn't necessary on the
    1.20 branch, but this turned out to be wrong: It meant that
    event->buffer could already be destroyed in xwl_present_free_event,
    resulting in use-after-free and likely a crash.
    
    Fixes: 22c0808ac88f "xwayland: Free all remaining events in
                         xwl_present_cleanup"

commit 1179938c179a6e96170275e24adac3325539be65
Author: Alex Goins <agoins@nvidia.com>
Date:   Thu Jul 2 20:12:43 2020 -0500

    randr: Check rrPrivKey in RRHasScanoutPixmap()
    
    RRHasScanoutPixmap() is called from xf86CheckHWCursor(), regardless of whether
    or not RandR has been initialized.
    
    As mentioned in commit 4226c6d, it's possible that RandR has not been
    initialized if the server is configured with Xinerama and there is more than one
    X screen. Calling rrGetScrPriv when RandR isn't initialized causes an assertion
    failure that aborts the server:
    
          Xorg: ../include/privates.h:121: dixGetPrivateAddr: Assertion
          key->initialized' failed.
    
    Just as in commit 4226c6d, fix the problem by checking
    dixPrivateKeyRegistered(rrPrivKey) before calling rrGetScrPriv.
    
    Signed-off-by: Alex Goins <agoins@nvidia.com>
    Acked-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit 8eeff5d7880c6885ee6f206355599f13d739afa7)

commit 4912f693e8e3abbd090ee02b4bfe14703c3bad0f
Author: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
Date:   Fri May 15 18:33:11 2020 +0200

    modesetting: Fix front_bo leak at drmmode_xf86crtc_resize on XRandR rotation
    
    Since the introduction of "modesetting: Remove unnecessary fb addition from
    drmmode_xf86crtc_resize" the fb_id isn't initialited at
    drmmode_xf86crtc_resize.
    
    Rotate operation of XRandR uses rotate_bo. So in this case the fb_id
    associated to the front_bo is not initialized at drmmode_set_mode_major.
    So fd_id remains 0.
    
    As every call to drmmode_xf86crtc_resize allocates a new front_bo we should
    destroy unconditionally the old_front_bo if operation success. So we free
    the allocated GBM handles.
    
    This avoids crashing xserver with a OOM in the RPI4 1Gb at 4k resolution
    after 3 series xrandr rotations from normal to left and vice versa reported at
    https://github.com/raspberrypi/firmware/issues/1345
    
    Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1024
    Fixes: 8774532121 "modesetting: Remove unnecessary fb addition from
           drmmode_xf86crtc_resize"
    (cherry picked from commit 73480f172aeced074dd9301ae4d97f7d2f3a9a45)

commit ccbcf083d5c676311aab77cc837a2539a7278a62
Author: Lyude Paul <lyude@redhat.com>
Date:   Tue Jul 14 18:32:39 2020 -0400

    xwayland: Store xwl_tablet_pad in its own private key
    
    When a slave device causes the master virtual pointer device to change
    device types, the device's private data pointer
    (device->public.devicePrivate) is also changed to match the type of the
    slave device. This can be a problem though, as tablet pad devices will
    set the device's private data pointer to their own xwl_tablet_pad
    struct. This can cause us to dereference the pointer as the wrong type,
    and result in a segfault:
    
    Thread 1 "Xwayland" received signal SIGSEGV, Segmentation fault.
    wl_proxy_marshal (proxy=0x51, opcode=opcode@entry=0) at src/wayland-client.c:792
    792             va_start(ap, opcode);
    (gdb) bt
    0  wl_proxy_marshal (proxy=0x51, opcode=opcode@entry=0) at
      src/wayland-client.c:792
    1  0x00005610b27b6c55 in wl_pointer_set_cursor (hotspot_y=0,
      hotspot_x=0, surface=0x0, serial=<optimized out>, wl_pointer=<optimized
      out>) at /usr/include/wayland-client-protocol.h:4610
    2  xwl_seat_set_cursor (xwl_seat=xwl_seat@entry=0x5610b46d5d10) at
      xwayland-cursor.c:137
    3  0x00005610b27b6ecd in xwl_set_cursor (device=<optimized out>,
      screen=<optimized out>, cursor=<optimized out>, x=<optimized out>,
      y=<optimized out>) at xwayland-cursor.c:249
    4  0x00005610b2800b46 in miPointerUpdateSprite (pDev=0x5610b4501a30) at
      mipointer.c:468
    5  miPointerUpdateSprite (pDev=0x5610b4501a30) at mipointer.c:410
    6  0x00005610b2800e56 in miPointerDisplayCursor (pCursor=0x5610b4b35740,
      pScreen=0x5610b3d54410, pDev=0x5610b4501a30) at mipointer.c:206
    7  miPointerDisplayCursor (pDev=0x5610b4501a30, pScreen=0x5610b3d54410,
      pCursor=0x5610b4b35740) at mipointer.c:194
    8  0x00005610b27ed62b in CursorDisplayCursor (pDev=<optimized out>,
      pScreen=0x5610b3d54410, pCursor=0x5610b4b35740) at cursor.c:168
    9  0x00005610b28773ee in AnimCurDisplayCursor (pDev=0x5610b4501a30,
      pScreen=0x5610b3d54410, pCursor=0x5610b4b35740) at animcur.c:197
    10 0x00005610b28eb4ca in ChangeToCursor (pDev=0x5610b4501a30,
      cursor=0x5610b4b35740) at events.c:938
    11 0x00005610b28ec99f in WindowHasNewCursor
      (pWin=pWin@entry=0x5610b4b2e0c0) at events.c:3362
    12 0x00005610b291102d in ChangeWindowAttributes (pWin=0x5610b4b2e0c0,
      vmask=<optimized out>, vlist=vlist@entry=0x5610b4c41dcc,
      client=client@entry=0x5610b4b2c900) at window.c:1561
    13 0x00005610b28db8e3 in ProcChangeWindowAttributes (client=0x5610b4b2c900)
      at dispatch.c:746
    14 0x00005610b28e1e5b in Dispatch () at dispatch.c:497
    15 0x00005610b28e5f34 in dix_main (argc=16, argv=0x7ffc7a601b68,
      envp=<optimized out>) at main.c:276
    16 0x00007f8828cde042 in __libc_start_main (main=0x5610b27ae930 <main>,
      argc=16, argv=0x7ffc7a601b68, init=<optimized out>, fini=<optimized
      out>, rtld_fini=<optimized out>, stack_end=0x7ffc7a601b58) at
      ../csu/libc-start.c:308
    17 0x00005610b27ae96e in _start () at cursor.c:1064
    
    Simple reproducer in gnome-shell: open up an Xwayland window, press some
    tablet buttons, lock and unlock the screen. Repeat if it doesn't crash
    the first time.
    
    So, let's fix this by registering our own device-specific private key
    for storing a backpointer to xwl_tablet_pad, so that all input devices
    have their private data pointers set to their respective xwl_seat.
    
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    (cherry picked from commit ba0e789b912671c724a21b3a30291247718bcf7d)

commit cc36135595fad70ce81697d7c98eb8a26cec9a72
Author: SimonP <simonp.git@gmail.com>
Date:   Tue Jun 9 13:26:48 2020 +0200

    xwayland: Initialise values in xwlVidModeGetGamma()
    
    ProcVidModeGetGamma() relies on GetGamma() to initialise values if it
    returns TRUE. Without this, we're sending uninitialised values to
    clients.
    
    Fixes: xorg/xserver#1040
    (cherry picked from commit 6748a4094158d2bde1630b915a5318f9f22c8e0a)

commit 533cc6ca046a9e59503bd0763ab28f66284f7dc7
Author: Sjoerd Simons <sjoerd@collabora.com>
Date:   Fri Apr 10 16:34:06 2020 +0200

    xwayland: Fix crashes when there is no pointer
    
    When running with a weston session without a pointer device (thus with
    the wl_seat not having a pointer) xwayland pointer warping and pointer
    confining should simply be ignored to avoid crashes.
    
    Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
    (cherry picked from commit d35f68336b0a462dc660797d1779581f348af04e)

commit 3aa31823dbc3dd026ce08958ca5324d7af94a86a
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Tue May 5 15:40:43 2020 +0200

    xwayland: Clear private on device removal
    
    Xwayland uses the device private to point to the `xwl_seat`.
    
    Device may be removed at any time, including on suspend.
    
    On resume, if the DIX code ends up calling a function that requires the
    `xwl_seat` such as `xwl_set_cursor()` we may end up pointing at random
    data.
    
    Make sure the clear the device private data on removal so that we don't
    try to use it and crash later.
    
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    https://gitlab.freedesktop.org/xorg/xserver/issues/709
    (cherry picked from commit 4195e8035645007be313ade79032b8d561ceec6c)

commit 22c0808ac88f917541fe40ab30e85364adac82bc
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Fri Jun 19 18:10:18 2020 +0200

    xwayland: Free all remaining events in xwl_present_cleanup
    
    At the end of xwl_present_cleanup, these events aren't reachable
    anymore, so if we don't free them first, they're leaked.
    
    (cherry picked from commit 64565ea344fef0171497952ef75f019cb420fe3b)
    
    v2:
    * Simpler backport, no need to keep a reference to the pixmap on the
      1.20 branch.

commit 37779d7f4028e94c8383a937eab57a6ffb15c38b
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Fri Jun 19 18:14:35 2020 +0200

    xwayland: Always use xwl_present_free_event for freeing Present events
    
    Minor cleanup, and will make the next change simpler. No functional
    change intended.
    
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 1beffba699e2cc3f23039d2177c025bc127966de)

commit ba52e5eb0e3b30aa63a8b51e8899eca88d9e0a30
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Thu Jun 25 18:11:31 2020 +0200

    present/wnmd: Free flip_queue entries in present_wnmd_clear_window_flip
    
    When present_wnmd_clear_window_flip is done, present_destroy_window
    frees struct present_window_priv, and the events in the flip queue
    become unreachable. So if we don't free them first, they're leaked.
    
    Also drop the call to present_wnmd_set_abort_flip, which just sets a
    flag in struct present_window_priv and thus can't have any observable
    effect after present_destroy_window.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1042
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 1bdedc8dbb9d035b85444c2558a137470ff52113)

commit b3310ed5036b098509e40b3642c2265132445e6a
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Thu Jun 25 18:09:27 2020 +0200

    present/wnmd: Keep pixmap pointer in present_wnmd_clear_window_flip
    
    The comment was incorrect: Any reference held by the window (see
    present_wnmd_execute) is in addition to the one in struct present_vblank
    (see present_vblank_create). So if we don't drop the latter, the pixmap
    will be leaked.
    
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit bc9dd1c71c3722284ffaa7183f4119151b25a44f)

commit fc297c87d6755c11380a44e3510689cc76eb1ee1
Author: Simon Ser <contact@emersion.fr>
Date:   Mon May 4 18:20:17 2020 +0200

    xwayland: import DMA-BUFs with GBM_BO_USE_RENDERING only
    
    Drop GBM_BO_USE_SCANOUT from the GBM_BO_IMPORT_FD import, add
    GBM_BO_USE_RENDERING to the GBM_BO_IMPORT_FD_MODIFIER import.
    
    If the DMA-BUF cannot be scanned out, gbm_bo_import with
    GBM_BO_USE_SCANOUT will fail. However Xwayland doesn't need to scan-out
    the buffer and can work fine without scanout. Glamor only needs
    GBM_BO_USE_RENDERING.
    
    Signed-off-by: Simon Ser <contact@emersion.fr>
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    Reviewed-by: Daniel Stone <daniels@collabora.com>
    (cherry picked from commit 421ce458f1d295015c108eb32f9611e527649cf8)

commit 0430d13c1ed8ddbb1d5a57d7e507771f8079d9af
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Fri Apr 24 17:45:49 2020 +0200

    xwayland: Fix infinite loop at startup
    
    Mutter recently added headless tests, and when running those tests the
    Wayland compositor runs for a very short time.
    
    Xwayland is spawned by the Wayland compositor and upon startup will
    query the various Wayland protocol supported by the compositor.
    
    To do so, it will do a roundtrip to the Wayland server waiting for
    events it expects.
    
    If the Wayland compositor terminates before Xwayland has got the replies
    it expects, it will loop indefinitely calling `wl_display_roundtrip()`
    continuously.
    
    To avoid that issue, add a new `xwl_screen_roundtrip()` that checks for
    the returned value from `wl_display_roundtrip()` and fails if it is
    negative.
    
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Roman Gilg <subdiff@gmail.com>
    Reviewed-by: Jonas Ådahl <jadahl@gmail.com>
    
    (cherry picked from commit 785e59060c00129e47da6c0877604a56d7e0e32f)

commit b8b10e29302d94832be8f0d8aa7aa1b54e42762c
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon Jun 24 21:46:26 2019 +0200

    modesetting: Disable pageflipping when using a swcursor
    
    The miPointerSpriteFunc swcursor code expects there to only be a single
    framebuffer and when the cursor moves it will undo the damage of the
    previous draw, potentially overwriting what ever is there in a new
    framebuffer installed after a flip.
    
    This leads to all kind of artifacts, so we need to disable pageflipping
    when a swcursor is used.
    
    The code for this has shamelessly been copied from the xf86-video-amdgpu
    code.
    
    Fixes: https://gitlab.freedesktop.org/xorg/xserver/issues/828
    
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    (cherry picked from commit 0aaac8d783e78c040a70a55ba8d67809abd7e625)
    Signed-off-by: Łukasz Spintzyk <lukasz.spintzyk@displaylink.com>

commit 271934db9f3b1297754b29855646e0a4ee01db59
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Tue Oct 30 18:43:51 2018 +0100

    dix: do not send focus event when grab actually does not change
    
    c67f2eac5651 ("dix: always send focus event on grab change") made dix
    always sent events when it's a NotifyGrab or NotifyUngrab, even if
    from == to, because 'from' can just come from a previous XSetInputFocus
    call.
    
    However, when an application calls XGrabKeyboard several times on
    the same window, we are now sending spurious FocusOut+FocusIn with
    NotifyGrab, even if the grab does not actually change. This makes screen
    readers for blind people spuriously emit activity events which disturb
    screen reading workflow when e.g. switching between menus.
    
    This commit avoids calling DoFocusEvents in that precise case, i.e. when
    oldWin is a previous grab and the new grab is the same window.
    
    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 364d64981549544213e2bca8de6ff8a5b2b5a69e)

commit f84ad082557f9cde6b8faa373eca6a0a89ba7d56
Author: Matt Turner <mattst88@gmail.com>
Date:   Sun Mar 29 13:02:03 2020 -0700

    xserver 1.20.8
    
    Signed-off-by: Matt Turner <mattst88@gmail.com>

commit 8837279869309317c110afb6f2f3c24484c77657
Author: Jon Turney <jon.turney@dronecode.org.uk>
Date:   Wed Apr 17 11:37:11 2019 +0100

    Fix old-style definition warning for xf86OSInputThreadInit()
    
    ../hw/xfree86/os-support/stub/stub_init.c: In function ‘xf86OSInputThreadInit’:
    ../hw/xfree86/os-support/stub/stub_init.c:29:1: warning: old-style function definition [-Wold-style-definition]
    
    (cherry picked from commit 7c266cafed14b38c039091651069ae9888c3a8ae)

commit 0c012f968b4e02a2bc892ce71f7bea9bd3f7fb22
Author: Jon Turney <jon.turney@dronecode.org.uk>
Date:   Wed Mar 13 14:57:14 2019 +0000

    Add xf86OSInputThreadInit to stub os-support as well
    
    stub os support also needs to provide xf86OSInputThreadInit, omitted in
    ea1527a8
    
    (cherry picked from commit c020769dbfb965740c8441d8242b738ef572a7c9)

commit b259485975078087fe6bde2b9e1eccf4ae14120c
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Tue Mar 17 11:45:22 2020 +0100

    xwayland: Delete all frame_callback_list nodes in xwl_unrealize_window
    
    We were only calling xwl_present_unrealize_window for the toplevel
    window, but the list can contain entries from child windows as well,
    in which case we were leaving dangling pointers to freed memory.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/1000
    Fixes: c5067feaeea1 "xwayland: Use single frame callback for Present
                         flips and normal updates"
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    Tested-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit 5e91587302e85fd6f0e8d5ffbe30182e18c6913f)

commit a033571644d277dc49a489f7ae32c4ad92856543
Author: Jonas Ådahl <jadahl@gmail.com>
Date:   Fri Sep 13 17:11:27 2019 +0200

    xwayland/glamor-gbm: Handle DRM_FORMAT_MOD_INVALID gracefully
    
    The compositor may send DRM_FORMAT_MOD_INVALID instead of a list of
    modifiers for various reasons. Handle this gracefully by ignoring it.
    
    Without this, if a compositor would send DRM_FORMAT_MOD_INVALID, it'd
    result in empty windows provided by Xwayland.
    
    Signed-off-by: Jonas Ådahl <jadahl@gmail.com>
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    (cherry picked from commit edf964434eac10ffbe27cc883e3ab95505669aee)

commit 3c48bd50ad33f2a533ac76afa38d6e3906ebc28a
Author: Arthur Williams <taaparthur@gmail.com>
Date:   Sun Oct 6 18:55:35 2019 +0000

    dix: Check for NULL spriteInfo in GetPairedDevice
    
    There is a race when reseting the XServer that causes spriteInfo to be
    NULL in GetPairedDevice resulting a segfault and subsequent crash. The
    problem was noticed when opening a connection, creating master devices,
    destroying master devices and closing the connection during testing.
    
    Signed-off-by: Arthur Williams <taaparthur@gmail.com>
    
    
    (cherry picked from commit e693c9657f98c334e9921ca2f8ebf710497c0c6a)

commit 1610ef1d6b5ba99da9d1a639f3b65b2e61514a7d
Author: David Seifert <soap@gentoo.org>
Date:   Fri Jan 24 12:49:44 2020 +0100

    Fix building with `-fno-common`
    
    * GCC 10 will switch the default to `-fno-common`.
      https://gcc.gnu.org/PR85678
    
    Bug: https://bugs.gentoo.org/705880
    Signed-off-by: Matt Turner <mattst88@gmail.com>

commit 2a185dd22ddb5b0d7d2ef5948591028766bb9530
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Mon Mar 2 18:09:31 2020 +0100

    xwayland: Use frame callbacks for Present vblank events
    
    Instead of only the fallback timer.
    
    Fixes https://gitlab.freedesktop.org/xorg/xserver/issues/854
    
    v2:
    * Drop unused frame_callback member of struct xwl_present_window
      (Olivier Fourdan)
    
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit 9b31358c52e951883bf7c01c953a9da080542244)

commit 99a6d6b15e0757a4652a569a1b2070c76a00b567
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Wed Nov 27 18:04:06 2019 +0100

    xwayland: Use single frame callback for Present flips and normal updates
    
    Using a list of Present windows that need to be called back.
    
    This prepares for the following change, there should be no change in
    observed behaviour.
    
    v2:
    * Use xwl_window_create_frame_callback instead of making the
      frame_listener struct non-static (Olivier Fourdan)
    
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit c5067feaeea115761f0a72f37407c6e5e943d1a1)

commit 915cc107767624bd7914c962347bab9c2e21cdff
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Fri Dec 13 18:26:35 2019 +0100

    xwayland: Add xwl_window_create_frame_callback helper
    
    This will be used by the following changes. No functional change
    intended.
    
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit f80eea0529b2cfb805a9c7d4994a4235451131e3)

commit 94dad4f05133171805ee94095bbcd20ece754eba
Author: Dor Askayo <dor.askayo@gmail.com>
Date:   Wed Feb 19 17:22:11 2020 +0100

    xwayland: clear pixmaps after creation in rootless mode
    
    When a pixmap is created with a backing FBO, the FBO should be cleared
    to avoid rendering uninitialized memory. This could happen when the
    pixmap is rendered without being filled in its entirety.
    
    One example is when a top-level window without a background is
    resized. The pixmap would be reallocated to prepare for more pixels,
    but uninitialized memory would be rendered in the resize offset until
    the client sends a frame that fills these additional pixels.
    
    Another example is when a new top-level window is created without a
    background. Uninitialized memory would be rendered after the pixmap is
    allocated and before the client sends its first frame.
    
    This issue is only apparent in OpenGL implementations that don't zero
    the VRAM of allocated buffers by default, such as RadeonSI.
    
    Signed-off-by: Dor Askayo <dor.askayo@gmail.com>
    Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/636
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    (cherry picked from commit 0e9a0c203c2ae4eae12bdbb95428f398211c7bee)
    
    [ Michel Dänzer:
    * Squashed in commit ebf549db2d9341d99e0d0847b948dd798d98f7dc
    * Dropped code related to glamor_format, which only exists on master ]

commit 0238359bced17f9db0e266111897d154ab117d68
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Fri Feb 7 12:15:07 2020 +0100

    xwayland: Call glamor_block_handler from xwl_screen_post_damage
    
    In between the two phases introduced by the previous change. This makes
    sure all pending drawing to the new buffers is flushed before they're
    committed to the Wayland server.
    (cherry picked from commit a542224ea28e2e8ccaf5e0df85bf6c603e97599a)

commit a93bce6bfc6c610676a7fbc76639854c5553cb2c
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Fri Feb 7 12:06:39 2020 +0100

    xwayland: Split up xwl_screen_post_damage into two phases
    
    The first phase sets the new surface properties for all damaged
    windows, then the second phase commits all surface updates.
    
    This is preparatory for the next change, there should be no observable
    change in behaviour (other than the order of Wayland protocol
    requests).
    
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit f88d9b1f779835302e02e255fcd45989db7f488d)

commit 1ba5e528d52ed9d7d67eb45c5d3e04b6f5d22b05
Author: Maarten Lankhorst <dev@mblankhorst.nl>
Date:   Thu Apr 25 11:46:41 2019 +0200

    modesetting: Disable atomic support by default
    
    The atomic driver has issues with modesetting when stealing
    connectors from a different crtc, a black screen when doing rotation
    on a different crtc, and in general is just a mapping of the legacy
    helpers to atomic. This is already done in the kernel, so just
    fallback to legacy by default until this is fixed.
    
    Please backport to 1.20, as we don't want to enable it for everyone
    there. It breaks for existing users.
    
    The fixes to make the xserver more atomic have been pending on the
    mailing list for ages.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110375
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110030
    References: https://gitlab.freedesktop.org/xorg/xserver/merge_requests/36/commits
    Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    (cherry picked from commit f0d78b47ac49977a6007f5fe081f00c6eb19a12e)

commit d44bbb4710961651dcf10701bc562f1f01509010
Author: Eric Anholt <eric@anholt.net>
Date:   Mon Feb 10 10:22:34 2020 +0100

    glamor: Fix a compiler warning since the recent OOM fixes.
    
    Signed-off-by: Eric Anholt <eric@anholt.net>
    (cherry picked from commit 3b26b90cb787a14fa5f8bb2033eab8ab6562a9a5)

commit d2a6c8708ca4f27c8d9aade6db2c4e7f2d8c624f
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date:   Mon Feb 10 10:21:02 2020 +0100

    glamor: Fallback to system memory for RW PBO buffer allocation
    
    We currently support two modes of operation for RW PBO buffers: one
    that allocates a pack buffer with GL memory and one that uses system
    memory when the former is not supported.
    
    Since allocation with system memory is less likely to fail, add a
    fallback to system memory when GL memory failed instead of bailing
    out.
    
    Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
    (cherry picked from commit 8c4e8d9eff03cefc987f13c900b0a47403946127)

commit ca034c2f2cfff8e49b816b8ecbaa96215b796e36
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date:   Mon Feb 10 10:20:30 2020 +0100

    glamor: Propagate glamor_prepare_access failures in copy helpers
    
    glamor_prepare_access can fail for a few reasons, especially when
    failing to allocate a PBO buffer. Take this in account and bail in
    the copy helpers that call the helper when a failure happens.
    
    Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
    (cherry picked from commit de6b3fac1f26075ce915006c914c4a4755617715)

commit a7b165d994d74131778a5a9bcffec957f1d1cacb
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date:   Mon Feb 10 10:20:04 2020 +0100

    glamor: Error out on out-of-memory when allocating PBO for FBO access
    
    Packed buffer allocation (which happens at glBufferData time with the
    buffer bound) can fail when there is no GL memory left.
    
    Pick up the error when it happens, print a proper error message, do
    some cleanup and bail.
    
    Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
    (cherry picked from commit bc2e12239f86e5a4acd220744f42eb83ba55d328)

commit 428b5ce4da99a43bfa0c1933ec447f7feb3639a1
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date:   Mon Feb 10 10:19:18 2020 +0100

    glamor: Propagate FBO allocation failure for picture to texture upload
    
    When uploading a picture to a texture, glamor_upload_picture_to_texture
    calls glamor_pixmap_ensure_fbo to ensure that there is backing FBO.
    The FBO will be allocated if the picture's drawable pixmap does not have
    one already, which can fail when there is no GL memory left.
    
    glamor_upload_picture_to_texture checks that the call succeeded and will
    enter the failure path if it did not. However, unlike many other
    functions in glamor, this one has ret set to TRUE initially, so it needs
    to be set to FALSE when a failure happens.
    
    Otherwise, the error is not propagated and the failure path return TRUE.
    This leads to a fault when trying to access the FBO pointer later on.
    
    Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
    (cherry picked from commit c98c7709c67d8ed6b7455ec700a49b58c396ec2c)

commit 948afd768398955f043fef8e14d7d154cea25f85
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Feb 6 17:59:08 2020 +0100

    modesetting: remove unnecessary error message, fix zaphod leases
    
    I introduced this error with the MST hotplug code, but it can trigger
    on zaphod setups, and is perfectly fine. There is no support for
    MST/hotplug on zaphod setups currently, so we can just skip over
    the dynamic connector handling here. However we shouldn't skip
    over the lease handling so move it into the codepath.
    
    Fixes: 9257b1252da9 ("modesetting: add dynamic connector hotplug support (MST) (v3)")
    Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 1cfdd1a96580733df3625bcea3384ffee3dc92df)

commit 1c3e51dabadbf65e7fdedbebbdcd19a85fb03e34
Author: Michel Dänzer <mdaenzer@redhat.com>
Date:   Thu Feb 6 17:57:16 2020 +0100

    xfree86/modes: Bail from xf86RotateRedisplay if pScreen->root is NULL
    
    Avoids a crash in xf86RotatePrepare -> DamageRegister during
    CreateScreenResources if rotation or another transform is configured for
    any connected RandR output in xorg.conf. The generic rotation/transform
    code generally can't work without the root window currently.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/969
    Fixes: 094f42cdfe5d "xfree86/modes: Call xf86RotateRedisplay from
                         xf86CrtcRotate"
    Acked-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 6a5e47c57d16de8b6a6a2636f3cbad1aebec32e2)

