.gitignore

@@ -1 +1,36 @@
-SOURCES/xorg-server-1.20.11.tar.bz2
+xorg-server-1.9.1.tar.bz2
+/xorg-server-20101125.tar.xz
+/xorg-server-20101201.tar.xz
+/xorg-server-1.10.0.tar.bz2
+/xorg-server-20110418.tar.xz
+/xorg-server-20110510.tar.xz
+/xorg-server-20110818.tar.xz
+/xorg-server-1.11.0.tar.bz2
+/xorg-server-1.11.1.tar.bz2
+/xorg-server-20111109.tar.xz
+/xorg-server-20120103.tar.xz
+/xorg-server-20120124.tar.xz
+/xorg-server-20120215.tar.xz
+/xorg-server-1.12.0.tar.bz2
+/xorg-server-1.12.1.tar.bz2
+/xorg-server-1.12.2.tar.bz2
+/xorg-server-1.12.3.tar.bz2
+/xorg-server-20120717.tar.xz
+/xorg-server-20120726.tar.xz
+/xorg-server-20120808.tar.xz
+/xorg-server-20120822.tar.xz
+/xorg-server-1.13.0.tar.bz2
+/xorg-server-1.13.1.tar.bz2
+/xorg-server-20130109.tar.xz
+/xorg-server-20130215.tar.xz
+/xorg-server-1.14.0.tar.bz2
+/xorg-server-1.14.1.tar.bz2
+/xorg-server-1.14.1.901.tar.bz2
+/xorg-server-1.14.2.tar.bz2
+/xorg-server-1.14.3.tar.bz2
+/xorg-server-1.14.99.3.tar.bz2
+/xorg-server-1.14.99.901.tar.bz2
+/xorg-server-1.14.99.902.tar.bz2
+*.bz2
+*.xz
+/xorg-x11-server-1.15.0-1.fc21.src.rpm

.xorg-x11-server.metadata

@@ -1 +1 @@
-86ae4add5719e6026a569f5559d51e8707171d5d SOURCES/xorg-server-1.20.11.tar.bz2
+86ae4add5719e6026a569f5559d51e8707171d5d xorg-server-1.20.11.tar.bz2

0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch

@@ -0,0 +1,77 @@
+From a7bda3080d2b44eae668cdcec7a93095385b9652 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 28 Nov 2023 15:19:04 +1000
+Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons
+
+button->xkb_acts is supposed to be an array sufficiently large for all
+our buttons, not just a single XkbActions struct. Allocating
+insufficient memory here means when we memcpy() later in
+XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
+leading to the usual security ooopsiedaisies.
+
+CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd)
+---
+ Xi/exevents.c | 12 ++++++------
+ dix/devices.c | 10 ++++++++++
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index dcd4efb3bc..54ea11a938 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
+         }
+ 
+         if (from->button->xkb_acts) {
+-            if (!to->button->xkb_acts) {
+-                to->button->xkb_acts = calloc(1, sizeof(XkbAction));
+-                if (!to->button->xkb_acts)
+-                    FatalError("[Xi] not enough memory for xkb_acts.\n");
+-            }
++            size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
++            to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
++                                                   maxbuttons,
++                                                   sizeof(XkbAction));
++            memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
+             memcpy(to->button->xkb_acts, from->button->xkb_acts,
+-                   sizeof(XkbAction));
++                   from->button->numButtons * sizeof(XkbAction));
+         }
+         else {
+             free(to->button->xkb_acts);
+diff --git a/dix/devices.c b/dix/devices.c
+index 5bf956ead4..15e46a9a5f 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
+ 
+     if (master->button && master->button->numButtons != maxbuttons) {
+         int i;
++        int last_num_buttons = master->button->numButtons;
++
+         DeviceChangedEvent event = {
+             .header = ET_Internal,
+             .type = ET_DeviceChanged,
+@@ -2535,6 +2537,14 @@ RecalculateMasterButtons(DeviceIntPtr slave)
+         };
+ 
+         master->button->numButtons = maxbuttons;
++        if (last_num_buttons < maxbuttons) {
++            master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
++                                                       maxbuttons,
++                                                       sizeof(XkbAction));
++            memset(&master->button->xkb_acts[last_num_buttons],
++                   0,
++                   (maxbuttons - last_num_buttons) * sizeof(XkbAction));
++        }
+ 
+         memcpy(&event.buttons.names, master->button->labels, maxbuttons *
+                sizeof(Atom));
+-- 
+2.43.0
+

0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch

@@ -1,15 +1,16 @@
-From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001
+From 9ca7d3f61a88ae6cf47fdf139b6215d745db976b Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Wed, 25 Jan 2023 11:41:40 +1000
 Subject: [PATCH xserver] Xi: fix potential use-after-free in
  DeepCopyPointerClasses
 
-CVE-2023-0494, ZDI-CAN 19596
+CVE-2023-0494, ZDI-CAN-19596
 
 This vulnerability was discovered by:
 Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 0ba6d8c37071131a49790243cdac55392ecf71ec)
 ---
  Xi/exevents.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch

@@ -0,0 +1,80 @@
+From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 3 Oct 2023 11:53:05 +1000
+Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend
+
+The handling of appending/prepending properties was incorrect, with at
+least two bugs: the property length was set to the length of the new
+part only, i.e. appending or prepending N elements to a property with P
+existing elements always resulted in the property having N elements
+instead of N + P.
+
+Second, when pre-pending a value to a property, the offset for the old
+values was incorrect, leaving the new property with potentially
+uninitalized values and/or resulting in OOB memory writes.
+For example, prepending a 3 element value to a 5 element property would
+result in this 8 value array:
+  [N, N, N, ?, ?, P, P, P ] P, P
+                            ^OOB write
+
+The XI2 code is a copy/paste of the RandR code, so the bug exists in
+both.
+
+CVE-2023-5367, ZDI-CAN-22153
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ Xi/xiproperty.c    | 4 ++--
+ randr/rrproperty.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index 6ec419e870..563c4f31a5 100644
+--- a/Xi/xiproperty.c
++++ b/Xi/xiproperty.c
+@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
+                 XIDestroyDeviceProperty(prop);
+             return BadAlloc;
+         }
+-        new_value.size = len;
++        new_value.size = total_len;
+         new_value.type = type;
+         new_value.format = format;
+ 
+@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
+         case PropModePrepend:
+             new_data = new_value.data;
+             old_data = (void *) (((char *) new_value.data) +
+-                                  (prop_value->size * size_in_bytes));
++                                  (len * size_in_bytes));
+             break;
+         }
+         if (new_data)
+diff --git a/randr/rrproperty.c b/randr/rrproperty.c
+index c2fb9585c6..25469f57b2 100644
+--- a/randr/rrproperty.c
++++ b/randr/rrproperty.c
+@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
+                 RRDestroyOutputProperty(prop);
+             return BadAlloc;
+         }
+-        new_value.size = len;
++        new_value.size = total_len;
+         new_value.type = type;
+         new_value.format = format;
+ 
+@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
+         case PropModePrepend:
+             new_data = new_value.data;
+             old_data = (void *) (((char *) new_value.data) +
+-                                  (prop_value->size * size_in_bytes));
++                                  (len * size_in_bytes));
+             break;
+         }
+         if (new_data)
+-- 
+2.41.0
+

0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch

@@ -1,4 +1,4 @@
-From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001
+From b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 29 Nov 2022 12:55:45 +1000
 Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in

0001-composite-Fix-use-after-free-of-the-COW.patch

@@ -0,0 +1,42 @@
+From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Mar 2023 11:08:47 +0100
+Subject: [PATCH xserver] composite: Fix use-after-free of the COW
+
+ZDI-CAN-19866/CVE-2023-1393
+
+If a client explicitly destroys the compositor overlay window (aka COW),
+we would leave a dangling pointer to that window in the CompScreen
+structure, which will trigger a use-after-free later.
+
+Make sure to clear the CompScreen pointer to the COW when the latter gets
+destroyed explicitly by the client.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ composite/compwindow.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/composite/compwindow.c b/composite/compwindow.c
+index 4e2494b86..b30da589e 100644
+--- a/composite/compwindow.c
++++ b/composite/compwindow.c
+@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
+     ret = (*pScreen->DestroyWindow) (pWin);
+     cs->DestroyWindow = pScreen->DestroyWindow;
+     pScreen->DestroyWindow = compDestroyWindow;
++
++    /* Did we just destroy the overlay window? */
++    if (pWin == cs->pOverlayWin)
++        cs->pOverlayWin = NULL;
++
+ /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
+     return ret;
+ }
+-- 
+2.40.0
+

0001-configure.ac-search-for-the-fontrootdir-ourselves.patch

@@ -0,0 +1,72 @@
+From e67e988730346c63d2f0cdf2531ed36b0c7ad5a6 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 23 Nov 2022 14:50:29 +1000
+Subject: [PATCH xserver] configure.ac: search for the fontrootdir ourselves
+
+This replaces the use of font-utils' .m4 macro set with a copy of the
+only one we actually want: the bit for the fontrootpath.
+
+We don't need configure options for every single subfont directory, so
+let's hardcode those in the default font path. Like meson does upstream
+too.
+
+With this patch we no longer require the font-utils dependency.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ configure.ac | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 0909cc5b4d..2349320888 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -49,9 +49,6 @@ XORG_WITH_XSLTPROC
+ XORG_ENABLE_UNIT_TESTS
+ XORG_LD_WRAP([optional])
+ 
+-m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install font-util 1.1 or later before running autoconf/autogen])])
+-XORG_FONT_MACROS_VERSION(1.1)
+-
+ dnl this gets generated by autoheader, and thus contains all the defines.  we
+ dnl don't ever actually use it, internally.
+ AC_CONFIG_HEADERS(include/do-not-use-config.h)
+@@ -450,18 +447,27 @@ AC_MSG_RESULT([$FALLBACK_INPUT_DRIVER])
+ AC_DEFINE_UNQUOTED(FALLBACK_INPUT_DRIVER, ["$FALLBACK_INPUT_DRIVER"], [ Fallback input driver ])
+ 
+ dnl Determine font path
+-XORG_FONTROOTDIR
+-XORG_FONTSUBDIR(FONTMISCDIR, fontmiscdir, misc)
+-XORG_FONTSUBDIR(FONTOTFDIR, fontotfdir, OTF)
+-XORG_FONTSUBDIR(FONTTTFDIR, fontttfdir, TTF)
+-XORG_FONTSUBDIR(FONTTYPE1DIR, fonttype1dir, Type1)
+-XORG_FONTSUBDIR(FONT75DPIDIR, font75dpidir, 75dpi)
+-XORG_FONTSUBDIR(FONT100DPIDIR, font100dpidir, 100dpi)
++dnl This is a copy of XORG_FONTROOTDIR from font-utils so we can drop the dependency
++AC_MSG_CHECKING([for root directory for font files])
++AC_ARG_WITH(fontrootdir,
++	    AS_HELP_STRING([--with-fontrootdir=DIR],
++		   [Path to root directory for font files]),
++	    [FONTROOTDIR="$withval"])
++# if --with-fontrootdir not specified...
++if test "x${FONTROOTDIR}" = "x"; then
++	FONTROOTDIR=`$PKG_CONFIG --variable=fontrootdir fontutil`
++fi
++# ...and if pkg-config didn't find fontdir in fontutil.pc...
++if test "x${FONTROOTDIR}" = "x"; then
++	FONTROOTDIR="${datadir}/fonts/X11"
++fi
++AC_SUBST(FONTROOTDIR)
++AC_MSG_RESULT([${FONTROOTDIR}])
+ 
+ dnl Uses --with-default-font-path if set, otherwise uses standard
+ dnl subdirectories of FONTROOTDIR. Some distros set the default font path to
+ dnl "catalogue:/etc/X11/fontpath.d,built-ins"
+-DEFAULT_FONT_PATH="${FONTMISCDIR}/,${FONTTTFDIR}/,${FONTOTFDIR}/,${FONTTYPE1DIR}/,${FONT100DPIDIR}/,${FONT75DPIDIR}/"
++DEFAULT_FONT_PATH="${FONTROOTDIR}/misc,${FONTROOTDIR}/OTF,${FONTROOTDIR}/TTF,${FONTROOTDIR}/Type1,${FONTROOTDIR}/75dpi,${FONTROOTDIR}/100dpi"
+ case $host_os in
+     darwin*) DEFAULT_FONT_PATH="${DEFAULT_FONT_PATH},/Library/Fonts,/System/Library/Fonts" ;;
+ esac
+-- 
+2.38.1
+

0001-dix-Fix-use-after-free-in-input-device-shutdown.patch

@@ -0,0 +1,77 @@
+From 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas@radix.lt>
+Date: Sun, 19 Dec 2021 18:11:07 +0200
+Subject: [PATCH] dix: Fix use after free in input device shutdown
+
+This fixes access to freed heap memory via dev->master. E.g. when
+running BarrierNotify.ReceivesNotifyEvents/7 test from
+xorg-integration-tests:
+
+==24736==ERROR: AddressSanitizer: heap-use-after-free on address
+0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10
+READ of size 4 at 0x619000065020 thread T0
+    #0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722
+    #1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346
+    #2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525
+../../../Xi/xichangehierarchy.c:95
+    #4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204
+../../../hw/xfree86/common/xf86Xinput.c:1142
+    #6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
+    #7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
+    #8 0x55c450e837ef in dix_main ../../../dix/main.c:302
+    #9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+    #11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d)
+
+0x619000065020 is located 160 bytes inside of 912-byte region
+[0x619000064f80,0x619000065310)
+freed by thread T0 here:
+(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
+    #1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014
+    #2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186
+../../../hw/xfree86/common/xf86Xinput.c:1142
+    #4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
+    #5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
+    #6 0x55c450e837ef in dix_main ../../../dix/main.c:302
+    #7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+
+previously allocated by thread T0 here:
+(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
+    #1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259
+    #2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755
+    #3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152
+../../../Xi/xichangehierarchy.c:465
+    #5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390
+    #6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551
+    #7 0x55c450e834b7 in dix_main ../../../dix/main.c:272
+    #8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+
+The problem is caused by dev->master being not reset when disabling the
+device, which then causes dangling pointer when the master device itself
+is being deleted when exiting whole server.
+
+Note that RecalculateMasterButtons() requires dev->master to be still
+valid, so we can reset it only at the end of function.
+
+Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
+---
+ dix/devices.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index e62c34c55..5f9ce1678 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -520,6 +520,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+     }
+ 
+     RecalculateMasterButtons(dev);
++    dev->master = NULL;
+ 
+     return TRUE;
+ }
+-- 
+2.43.0
+

0001-dix-allocate-enough-space-for-logical-button-maps.patch

@@ -0,0 +1,51 @@
+From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 14 Dec 2023 11:29:49 +1000
+Subject: [PATCH 1/9] dix: allocate enough space for logical button maps
+
+Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
+each logical button currently down. Since buttons can be arbitrarily mapped
+to anything up to 255 make sure we have enough bits for the maximum mapping.
+
+CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/xiquerypointer.c | 3 +--
+ dix/enterleave.c    | 5 +++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
+index 5b77b1a44..2b05ac5f3 100644
+--- a/Xi/xiquerypointer.c
++++ b/Xi/xiquerypointer.c
+@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client)
+     if (pDev->button) {
+         int i;
+ 
+-        rep.buttons_len =
+-            bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
++        rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
+         rep.length += rep.buttons_len;
+         buttons = calloc(rep.buttons_len, 4);
+         if (!buttons)
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 867ec7436..ded8679d7 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
+ 
+     mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER);
+ 
+-    /* XI 2 event */
+-    btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
++    /* XI 2 event contains the logical button map - maps are CARD8
++     * so we need 256 bits for the possibly maximum mapping */
++    btlen = (mouse->button) ? bits_to_bytes(256) : 0;
+     btlen = bytes_to_int32(btlen);
+     len = sizeof(xXIFocusInEvent) + btlen * 4;
+ 
+-- 
+2.43.0
+

0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch

@@ -0,0 +1,153 @@
+From 454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Mon, 22 Jul 2019 13:51:06 -0400
+Subject: [PATCH] hw: Rename boolean config value field from bool to boolean
+
+"bool" conflicts with C++ (meh) and stdbool.h (ngh alright fine). This
+is a driver-visible change and will likely break the build for mach64,
+but it can be fixed by simply using xf86ReturnOptValBool like every
+other driver.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+---
+ hw/xfree86/common/xf86Opt.h    |  2 +-
+ hw/xfree86/common/xf86Option.c | 10 +++++-----
+ hw/xwin/winconfig.c            | 22 +++++++++++-----------
+ hw/xwin/winconfig.h            |  2 +-
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/hw/xfree86/common/xf86Opt.h b/hw/xfree86/common/xf86Opt.h
+index 3be2a0fc7..3046fbd41 100644
+--- a/hw/xfree86/common/xf86Opt.h
++++ b/hw/xfree86/common/xf86Opt.h
+@@ -41,7 +41,7 @@ typedef union {
+     unsigned long num;
+     const char *str;
+     double realnum;
+-    Bool bool;
++    Bool boolean;
+     OptFrequency freq;
+ } ValueUnion;
+ 
+diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c
+index 06973bca3..ca538cc57 100644
+--- a/hw/xfree86/common/xf86Option.c
++++ b/hw/xfree86/common/xf86Option.c
+@@ -213,7 +213,7 @@ LookupBoolOption(XF86OptionPtr optlist, const char *name, int deflt,
+     o.name = name;
+     o.type = OPTV_BOOLEAN;
+     if (ParseOptionValue(-1, optlist, &o, markUsed))
+-        deflt = o.value.bool;
++        deflt = o.value.boolean;
+     return deflt;
+ }
+ 
+@@ -474,7 +474,7 @@ xf86ShowUnusedOptions(int scrnIndex, XF86OptionPtr opt)
+ static Bool
+ GetBoolValue(OptionInfoPtr p, const char *s)
+ {
+-    return xf86getBoolValue(&p->value.bool, s);
++    return xf86getBoolValue(&p->value.boolean, s);
+ }
+ 
+ static Bool
+@@ -678,7 +678,7 @@ ParseOptionValue(int scrnIndex, XF86OptionPtr options, OptionInfoPtr p,
+             if (markUsed)
+                 xf86MarkOptionUsedByName(options, newn);
+             if (GetBoolValue(&opt, s)) {
+-                p->value.bool = !opt.value.bool;
++                p->value.boolean = !opt.value.boolean;
+                 p->found = TRUE;
+             }
+             else {
+@@ -869,7 +869,7 @@ xf86GetOptValBool(const OptionInfoRec * table, int token, Bool *value)
+ 
+     p = xf86TokenToOptinfo(table, token);
+     if (p && p->found) {
+-        *value = p->value.bool;
++        *value = p->value.boolean;
+         return TRUE;
+     }
+     else
+@@ -883,7 +883,7 @@ xf86ReturnOptValBool(const OptionInfoRec * table, int token, Bool def)
+ 
+     p = xf86TokenToOptinfo(table, token);
+     if (p && p->found) {
+-        return p->value.bool;
++        return p->value.boolean;
+     }
+     else
+         return def;
+diff --git a/hw/xwin/winconfig.c b/hw/xwin/winconfig.c
+index 31894d2fb..646d69006 100644
+--- a/hw/xwin/winconfig.c
++++ b/hw/xwin/winconfig.c
+@@ -623,7 +623,7 @@ winSetBoolOption(void *optlist, const char *name, int deflt)
+     o.name = name;
+     o.type = OPTV_BOOLEAN;
+     if (ParseOptionValue(-1, optlist, &o))
+-        deflt = o.value.bool;
++        deflt = o.value.boolean;
+     return deflt;
+ }
+ 
+@@ -918,7 +918,7 @@ ParseOptionValue(int scrnIndex, void *options, OptionInfoPtr p)
+         }
+         if ((s = winFindOptionValue(options, newn)) != NULL) {
+             if (GetBoolValue(&opt, s)) {
+-                p->value.bool = !opt.value.bool;
++                p->value.boolean = !opt.value.boolean;
+                 p->found = TRUE;
+             }
+             else {
+@@ -968,25 +968,25 @@ static Bool
+ GetBoolValue(OptionInfoPtr p, const char *s)
+ {
+     if (*s == 0) {
+-        p->value.bool = TRUE;
++        p->value.boolean = TRUE;
+     }
+     else {
+         if (winNameCompare(s, "1") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "on") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "true") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "yes") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "0") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "off") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "false") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "no") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+     }
+     return TRUE;
+ }
+diff --git a/hw/xwin/winconfig.h b/hw/xwin/winconfig.h
+index f079368c7..bd1f59650 100644
+--- a/hw/xwin/winconfig.h
++++ b/hw/xwin/winconfig.h
+@@ -199,7 +199,7 @@ typedef union {
+     unsigned long num;
+     char *str;
+     double realnum;
+-    Bool bool;
++    Bool boolean;
+     OptFrequency freq;
+ } ValueUnion;
+ 
+-- 
+2.43.0
+

0001-modesetting-Fix-msSharePixmapBacking-Segfault-Regres.patch

@@ -0,0 +1,49 @@
+From 88f0787f93f097a125a0aa156eb9a5628adfc2c2 Mon Sep 17 00:00:00 2001
+From: Alex Goins <agoins@nvidia.com>
+Date: Thu, 12 Dec 2019 20:18:53 -0600
+Subject: [PATCH xserver] modesetting: Fix msSharePixmapBacking Segfault
+ Regression
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit cb1b1e184 modified msSharePixmapBacking() to derive modesettingPtr from
+the 'screen' argument. Unfortunately, the name of the argument is misleading --
+the screen is the slave screen. If the master is modesetting,
+and the slave is not modesetting, it will segfault.
+
+To fix the problem, this change derives modesettingPtr from
+ppix->drawable.pScreen. This method is already used when calling
+ms->glamor.shareable_fd_from_pixmap() later in the function.
+
+To avoid future issues, this change also renames the 'screen' argument to
+'slave'.
+
+Signed-off-by: Alex Goins <agoins@nvidia.com>
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 456dff1bf890459840718339279dcb84d36531eb)
+---
+ hw/xfree86/drivers/modesetting/driver.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index ce8bac9f5..0817fa470 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -1454,10 +1454,11 @@ CreateScreenResources(ScreenPtr pScreen)
+ }
+ 
+ static Bool
+-msSharePixmapBacking(PixmapPtr ppix, ScreenPtr screen, void **handle)
++msSharePixmapBacking(PixmapPtr ppix, ScreenPtr slave, void **handle)
+ {
+ #ifdef GLAMOR_HAS_GBM
+-    modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(screen));
++    modesettingPtr ms =
++        modesettingPTR(xf86ScreenToScrn(ppix->drawable.pScreen));
+     int ret;
+     CARD16 stride;
+     CARD32 size;
+-- 
+2.34.1
+

0001-mustard-xfree86-Disable-the-PCI-probe-path.patch

@@ -0,0 +1,83 @@
+From b3afd9ccefe156ab2dee993118fcdba40341f66e Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Fri, 1 Oct 2021 11:47:21 -0400
+Subject: [PATCH xserver] mustard: xfree86: Disable the PCI probe path
+
+RHEL 9 does not support userspace modesetting drivers for Xorg. Ideally
+it would only support DRM drivers, but there are some fallback paths
+(efifb mainly) that still require fbdev support. Since the primary use
+of the PCI probe path is devices _without_ kernel support, we can safely
+disable it. And indeed we want to, because there are some devices
+(hyperv v1 e.g.) with both a platform and a PCI presentation, which the
+PCI probe code fails to handle such that the server fails to start.
+
+Thus: we #if 0 out the PCI probe in xf86CallDriverProbe.
+
+It might be nice if the platform code knew about fbdev devices, but it
+does not, and teaching it would be a large change for little benefit
+given we do intend to sunset the fbdev path as well. Since the fbdev
+path exists solely for cases where we have only the rudimentary firmare
+framebuffer, we should only use it if _no_ platform driver is available.
+
+Thus: we only call the legacy probe method if xf86ProbeIgnorePrimary.
+
+Having done this, we need to go back into fbdevhw and undo fc78bcca:
+
+    commit fc78bcca21e767697de6ad4d8e03b6728856f613 (merge-requests/38)
+    Author: Adam Jackson <ajax@redhat.com>
+    Date:   Wed Oct 10 14:09:11 2018 -0400
+
+    fbdevhw: Refuse to touch PCI devices on the fallback probe path
+
+Which was well intentioned, but given the above changes we know by the
+time we're trying to probe fbdev we really do want it, either because of
+the above fallback path or because xorg.conf asked for it. In either
+case we shouldn't spuriously fail just because it happens to be PCI.
+
+Thus: We if (0) out the code added in fc78bcca.
+
+Any one of the above might be questionable upstream, hence the mustard
+nature of this patch.
+---
+ hw/xfree86/common/xf86Bus.c  | 4 ++--
+ hw/xfree86/fbdevhw/fbdevhw.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/xfree86/common/xf86Bus.c b/hw/xfree86/common/xf86Bus.c
+index fd144dbe7a..844ce5a890 100644
+--- a/hw/xfree86/common/xf86Bus.c
++++ b/hw/xfree86/common/xf86Bus.c
+@@ -84,7 +84,7 @@ xf86CallDriverProbe(DriverPtr drv, Bool detect_only)
+     }
+ #endif
+ 
+-#ifdef XSERVER_LIBPCIACCESS
++#if 0
+     if (!foundScreen && (drv->PciProbe != NULL)) {
+         if (xf86DoConfigure && xf86DoConfigurePass1) {
+             assert(detect_only);
+@@ -96,7 +96,7 @@ xf86CallDriverProbe(DriverPtr drv, Bool detect_only)
+         }
+     }
+ #endif
+-    if (!foundScreen && (drv->Probe != NULL)) {
++    if (!foundScreen && xf86ProbeIgnorePrimary && (drv->Probe != NULL)) {
+         xf86Msg(X_WARNING, "Falling back to old probe method for %s\n",
+                 drv->driverName);
+         foundScreen = (*drv->Probe) (drv, (detect_only) ? PROBE_DETECT
+diff --git a/hw/xfree86/fbdevhw/fbdevhw.c b/hw/xfree86/fbdevhw/fbdevhw.c
+index 3d8b92e669..171038f46d 100644
+--- a/hw/xfree86/fbdevhw/fbdevhw.c
++++ b/hw/xfree86/fbdevhw/fbdevhw.c
+@@ -330,7 +330,7 @@ fbdev_open(int scrnIndex, const char *dev, char **namep)
+     }
+ 
+     /* only touch non-PCI devices on this path */
+-    {
++    if (0) {
+         char buf[PATH_MAX];
+         char *sysfs_path = NULL;
+         char *node = strrchr(dev, '/') + 1;
+-- 
+2.31.1
+

0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch

@@ -0,0 +1,105 @@
+From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Thu, 2 Feb 2023 12:26:27 -0500
+Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
+ destroyed windows
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This enables fixing a deadlock case on the client side, where the client
+ends up blocked waiting for a Present event that will never come because
+the window was destroyed. The new PresentWindowDestroyed flag allows the
+client to avoid blocking indefinitely.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
+---
+ present/present_event.c  |  5 +++--
+ present/present_priv.h   |  7 ++++++-
+ present/present_screen.c | 11 ++++++++++-
+ 3 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/present/present_event.c b/present/present_event.c
+index 435b26b70..849732dc8 100644
+--- a/present/present_event.c
++++ b/present/present_event.c
+@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
+ }
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
++                           int bw, WindowPtr sibling, CARD32 flags)
+ {
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
+@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
+             .off_y = 0,
+             .pixmap_width = w,
+             .pixmap_height = h,
+-            .pixmap_flags = 0
++            .pixmap_flags = flags
+         };
+         present_event_ptr event;
+ 
+diff --git a/present/present_priv.h b/present/present_priv.h
+index 6ebd009a2..4ad729864 100644
+--- a/present/present_priv.h
++++ b/present/present_priv.h
+@@ -43,6 +43,11 @@
+ #define DebugPresent(x)
+ #endif
+ 
++/* XXX this belongs in presentproto */
++#ifndef PresentWindowDestroyed
++#define PresentWindowDestroyed (1 << 0)
++#endif
++
+ extern int present_request;
+ 
+ extern DevPrivateKeyRec present_screen_private_key;
+@@ -307,7 +312,7 @@ void
+ present_free_events(WindowPtr window);
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
+ 
+ void
+ present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
+diff --git a/present/present_screen.c b/present/present_screen.c
+index 15684eda4..2c29aafd2 100644
+--- a/present/present_screen.c
++++ b/present/present_screen.c
+@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
++    present_send_config_notify(window,
++                               window->drawable.x,
++                               window->drawable.y,
++                               window->drawable.width,
++                               window->drawable.height,
++                               window->borderWidth,
++                               window->nextSib,
++                               PresentWindowDestroyed);
++
+     if (window_priv) {
+         present_clear_window_notifies(window);
+         present_free_events(window);
+@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
+     ScreenPtr screen = window->drawable.pScreen;
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+ 
+-    present_send_config_notify(window, x, y, w, h, bw, sibling);
++    present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
+ 
+     unwrap(screen_priv, screen, ConfigNotify);
+     if (screen->ConfigNotify)
+-- 
+2.40.0
+

0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch

@@ -0,0 +1,61 @@
+From 58e83c683950ac9e253ab05dd7a13a8368b70a3c Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 27 Nov 2023 16:27:49 +1000
+Subject: [PATCH xserver] randr: avoid integer truncation in length check of
+ ProcRRChange*Property
+
+Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty.
+See also xserver@8f454b79 where this same bug was fixed for the core
+protocol and XI.
+
+This fixes an OOB read and the resulting information disclosure.
+
+Length calculation for the request was clipped to a 32-bit integer. With
+the correct stuff->nUnits value the expected request size was
+truncated, passing the REQUEST_FIXED_SIZE check.
+
+The server then proceeded with reading at least stuff->num_items bytes
+(depending on stuff->format) from the request and stuffing whatever it
+finds into the property. In the process it would also allocate at least
+stuff->nUnits bytes, i.e. 4GB.
+
+CVE-2023-6478, ZDI-CAN-22561
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632)
+---
+ randr/rrproperty.c         | 2 +-
+ randr/rrproviderproperty.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/randr/rrproperty.c b/randr/rrproperty.c
+index 25469f57b2..c4fef8a1f6 100644
+--- a/randr/rrproperty.c
++++ b/randr/rrproperty.c
+@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client)
+     char format, mode;
+     unsigned long len;
+     int sizeInBytes;
+-    int totalSize;
++    uint64_t totalSize;
+     int err;
+ 
+     REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq);
+diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
+index b79c17f9bf..90c5a9a933 100644
+--- a/randr/rrproviderproperty.c
++++ b/randr/rrproviderproperty.c
+@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client)
+     char format, mode;
+     unsigned long len;
+     int sizeInBytes;
+-    int totalSize;
++    uint64_t totalSize;
+     int err;
+ 
+     REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq);
+-- 
+2.43.0
+

0001-xkb-Drop-check-for-XkbSetMapResizeTypes.patch

@@ -0,0 +1,118 @@
+From 36bcef5e5fd175e95ed4e0a014f6b1d8598b719d Mon Sep 17 00:00:00 2001
+From: Ray Strode <rstrode@redhat.com>
+Date: Mon, 4 Oct 2021 14:27:54 -0400
+Subject: [PATCH] xkb: Drop check for XkbSetMapResizeTypes
+
+Commit 446ff2d3177087b8173fa779fa5b77a2a128988b added checks to
+prevalidate the size of incoming SetMap requests.
+
+That commit checks for the XkbSetMapResizeTypes flag to be set before
+allowing key types data to be processed.
+
+key types data can be changed or even just sent wholesale unchanged
+without the number of key types changing, however. The check for
+XkbSetMapResizeTypes rejects those legitimate requests. In particular,
+XkbChangeMap never sets XkbSetMapResizeTypes and so always fails now
+any time XkbKeyTypesMask is in the changed mask.
+
+This commit drops the check for XkbSetMapResizeTypes in flags when
+prevalidating the request length.
+---
+ xkb/xkb.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 183d6ffa1..62dee9cb6 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2378,75 +2378,73 @@ SetVirtualModMap(XkbSrvInfoPtr xkbi,
+         }
+         changes->map.first_vmodmap_key = first;
+         changes->map.num_vmodmap_keys = (last - first) + 1;
+     }
+     return (char *) wire;
+ }
+ 
+ #define _add_check_len(new) \
+     if (len > UINT32_MAX - (new) || len > req_len - (new)) goto bad; \
+     else len += new
+ 
+ /**
+  * Check the length of the SetMap request
+  */
+ static int
+ _XkbSetMapCheckLength(xkbSetMapReq *req)
+ {
+     size_t len = sz_xkbSetMapReq, req_len = req->length << 2;
+     xkbKeyTypeWireDesc *keytype;
+     xkbSymMapWireDesc *symmap;
+     BOOL preserve;
+     int i, map_count, nSyms;
+ 
+     if (req_len < len)
+         goto bad;
+     /* types */
+     if (req->present & XkbKeyTypesMask) {
+         keytype = (xkbKeyTypeWireDesc *)(req + 1);
+         for (i = 0; i < req->nTypes; i++) {
+             _add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc));
+-            if (req->flags & XkbSetMapResizeTypes) {
+-                _add_check_len(keytype->nMapEntries
+-                               * sz_xkbKTSetMapEntryWireDesc);
+-                preserve = keytype->preserve;
+-                map_count = keytype->nMapEntries;
+-                if (preserve) {
+-                    _add_check_len(map_count * sz_xkbModsWireDesc);
+-                }
+-                keytype += 1;
+-                keytype = (xkbKeyTypeWireDesc *)
+-                          ((xkbKTSetMapEntryWireDesc *)keytype + map_count);
+-                if (preserve)
+-                    keytype = (xkbKeyTypeWireDesc *)
+-                              ((xkbModsWireDesc *)keytype + map_count);
++            _add_check_len(keytype->nMapEntries
++                           * sz_xkbKTSetMapEntryWireDesc);
++            preserve = keytype->preserve;
++            map_count = keytype->nMapEntries;
++            if (preserve) {
++                _add_check_len(map_count * sz_xkbModsWireDesc);
+             }
++            keytype += 1;
++            keytype = (xkbKeyTypeWireDesc *)
++                      ((xkbKTSetMapEntryWireDesc *)keytype + map_count);
++            if (preserve)
++                keytype = (xkbKeyTypeWireDesc *)
++                          ((xkbModsWireDesc *)keytype + map_count);
+         }
+     }
+     /* syms */
+     if (req->present & XkbKeySymsMask) {
+         symmap = (xkbSymMapWireDesc *)((char *)req + len);
+         for (i = 0; i < req->nKeySyms; i++) {
+             _add_check_len(sz_xkbSymMapWireDesc);
+             nSyms = symmap->nSyms;
+             _add_check_len(nSyms*sizeof(CARD32));
+             symmap += 1;
+             symmap = (xkbSymMapWireDesc *)((CARD32 *)symmap + nSyms);
+         }
+     }
+     /* actions */
+     if (req->present & XkbKeyActionsMask) {
+         _add_check_len(req->totalActs * sz_xkbActionWireDesc 
+                        + XkbPaddedSize(req->nKeyActs));
+     }
+     /* behaviours */
+     if (req->present & XkbKeyBehaviorsMask) {
+         _add_check_len(req->totalKeyBehaviors * sz_xkbBehaviorWireDesc);
+     }
+     /* vmods */
+     if (req->present & XkbVirtualModsMask) {
+         _add_check_len(XkbPaddedSize(Ones(req->virtualMods)));
+     }
+     /* explicit */
+     if (req->present & XkbExplicitComponentsMask) {
+         /* two bytes per non-zero explicit componen */
+         _add_check_len(XkbPaddedSize(req->totalKeyExplicit * sizeof(CARD16)));
+-- 
+2.32.0
+

0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch

@@ -1,4 +1,4 @@
-From c5ff57676698f19ed3a1402aef58a15552e32d27 Mon Sep 17 00:00:00 2001
+From cb260ba95d2bb1ae98b05e289d1b7947ac409230 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 29 Nov 2022 13:24:00 +1000
 Subject: [PATCH xserver 2/7] Xi: return an error from XI property changes if

0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch

@@ -0,0 +1,84 @@
+From ece23be888a93b741aa1209d1dbf64636109d6a5 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 18 Dec 2023 14:27:50 +1000
+Subject: [PATCH 2/9] dix: Allocate sufficient xEvents for our
+ DeviceStateNotify
+
+If a device has both a button class and a key class and numButtons is
+zero, we can get an OOB write due to event under-allocation.
+
+This function seems to assume a device has either keys or buttons, not
+both. It has two virtually identical code paths, both of which assume
+they're applying to the first event in the sequence.
+
+A device with both a key and button class triggered a logic bug - only
+one xEvent was allocated but the deviceStateNotify pointer was pushed on
+once per type. So effectively this logic code:
+
+   int count = 1;
+   if (button && nbuttons > 32) count++;
+   if (key && nbuttons > 0) count++;
+   if (key && nkeys > 32) count++; // this is basically always true
+   // count is at 2 for our keys + zero button device
+
+   ev = alloc(count * sizeof(xEvent));
+   FixDeviceStateNotify(ev);
+   if (button)
+     FixDeviceStateNotify(ev++);
+   if (key)
+     FixDeviceStateNotify(ev++);   // santa drops into the wrong chimney here
+
+If the device has more than 3 valuators, the OOB is pushed back - we're
+off by one so it will happen when the last deviceValuator event is
+written instead.
+
+Fix this by allocating the maximum number of events we may allocate.
+Note that the current behavior is not protocol-correct anyway, this
+patch fixes only the allocation issue.
+
+Note that this issue does not trigger if the device has at least one
+button. While the server does not prevent a button class with zero
+buttons, it is very unlikely.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/enterleave.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index ded8679d7..17964b00a 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -675,7 +675,8 @@ static void
+ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ {
+     int evcount = 1;
+-    deviceStateNotify *ev, *sev;
++    deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
++    deviceStateNotify *ev;
+     deviceKeyStateNotify *kev;
+     deviceButtonStateNotify *bev;
+ 
+@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+         }
+     }
+ 
+-    sev = ev = xallocarray(evcount, sizeof(xEvent));
++    ev = sev;
+     FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
+ 
+     if (b != NULL) {
+@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ 
+     DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
+                           DeviceStateNotifyMask, NullGrab);
+-    free(sev);
+ }
+ 
+ void
+-- 
+2.43.0
+

0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch

@@ -0,0 +1,99 @@
+From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 5 Oct 2023 12:19:45 +1000
+Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen
+ switch
+
+PointerWindows[] keeps a reference to the last window our sprite
+entered - changes are usually handled by CheckMotion().
+
+If we switch between screens via XWarpPointer our
+dev->spriteInfo->sprite->win is set to the new screen's root window.
+If there's another window at the cursor location CheckMotion() will
+trigger the right enter/leave events later. If there is not, it skips
+that process and we never trigger LeaveWindow() - PointerWindows[] for
+the device still refers to the previous window.
+
+If that window is destroyed we have a dangling reference that will
+eventually cause a use-after-free bug when checking the window hierarchy
+later.
+
+To trigger this, we require:
+- two protocol screens
+- XWarpPointer to the other screen's root window
+- XDestroyWindow before entering any other window
+
+This is a niche bug so we hack around it by making sure we reset the
+PointerWindows[] entry so we cannot have a dangling pointer. This
+doesn't handle Enter/Leave events correctly but the previous code didn't
+either.
+
+CVE-2023-5380, ZDI-CAN-21608
+
+This vulnerability was discovered by:
+Sri working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ dix/enterleave.h   |  2 --
+ include/eventstr.h |  3 +++
+ mi/mipointer.c     | 17 +++++++++++++++--
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/dix/enterleave.h b/dix/enterleave.h
+index 4b833d8a3b..e8af924c68 100644
+--- a/dix/enterleave.h
++++ b/dix/enterleave.h
+@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev,
+ 
+ extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
+ 
+-extern void LeaveWindow(DeviceIntPtr dev);
+-
+ extern void CoreFocusEvent(DeviceIntPtr kbd,
+                            int type, int mode, int detail, WindowPtr pWin);
+ 
+diff --git a/include/eventstr.h b/include/eventstr.h
+index bf3b95fe4a..2bae3b0767 100644
+--- a/include/eventstr.h
++++ b/include/eventstr.h
+@@ -296,4 +296,7 @@ union _InternalEvent {
+ #endif
+ };
+ 
++extern void
++LeaveWindow(DeviceIntPtr dev);
++
+ #endif
+diff --git a/mi/mipointer.c b/mi/mipointer.c
+index 75be1aeeb8..b12ae9be1d 100644
+--- a/mi/mipointer.c
++++ b/mi/mipointer.c
+@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
+ #ifdef PANORAMIX
+         && noPanoramiXExtension
+ #endif
+-        )
+-        UpdateSpriteForScreen(pDev, pScreen);
++        ) {
++            DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
++            /* Hack for CVE-2023-5380: if we're moving
++             * screens PointerWindows[] keeps referring to the
++             * old window. If that gets destroyed we have a UAF
++             * bug later. Only happens when jumping from a window
++             * to the root window on the other screen.
++             * Enter/Leave events are incorrect for that case but
++             * too niche to fix.
++             */
++            LeaveWindow(pDev);
++            if (master)
++                LeaveWindow(master);
++            UpdateSpriteForScreen(pDev, pScreen);
++    }
+ }
+ 
+ /**
+-- 
+2.41.0
+

0002-xfree86-Link-fb-statically.patch

@@ -0,0 +1,153 @@
+From c2eb1e2eac99ef0b8e6cf47ab0a94371cf47e939 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Tue, 23 Jul 2019 11:54:15 -0400
+Subject: [PATCH xserver 02/11] xfree86: Link fb statically
+
+There's no real benefit to leaving this loadable, virtually every driver
+is going to load it.
+
+Reviewed-by: Jon Turney <jon.turney@dronecode.org.uk>
+(cherry picked from commit c1703cdf3b0d6663fcac68598eefe324ae4e1e71)
+---
+ hw/xfree86/Makefile.am                     |  1 +
+ hw/xfree86/dixmods/Makefile.am             |  8 +-------
+ hw/xfree86/dixmods/meson.build             | 14 --------------
+ hw/xfree86/drivers/modesetting/meson.build |  1 -
+ hw/xfree86/loader/loadmod.c                |  1 +
+ hw/xfree86/meson.build                     |  1 +
+ hw/xfree86/sdksyms.sh                      |  6 +++---
+ test/Makefile.am                           |  1 +
+ 8 files changed, 8 insertions(+), 25 deletions(-)
+
+diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
+index 9aeaea1a6..1d494cd0f 100644
+--- a/hw/xfree86/Makefile.am
++++ b/hw/xfree86/Makefile.am
+@@ -75,6 +75,7 @@ LOCAL_LIBS = \
+             $(DRI2_LIB) \
+ 	    $(DRI3_LIB) \
+ 	    $(GLXVND_LIB) \
++	    $(top_builddir)/fb/libfb.la \
+ 	    $(top_builddir)/miext/sync/libsync.la \
+             $(top_builddir)/mi/libmi.la \
+             $(top_builddir)/os/libos.la \
+diff --git a/hw/xfree86/dixmods/Makefile.am b/hw/xfree86/dixmods/Makefile.am
+index 856659f98..a1f97056a 100644
+--- a/hw/xfree86/dixmods/Makefile.am
++++ b/hw/xfree86/dixmods/Makefile.am
+@@ -4,8 +4,7 @@ if GLX
+ GLXMODS = libglx.la
+ endif
+ 
+-module_LTLIBRARIES = libfb.la \
+-                     libwfb.la \
++module_LTLIBRARIES = libwfb.la \
+                      libshadow.la
+ 
+ extsmoduledir = $(moduledir)/extensions
+@@ -17,11 +16,6 @@ AM_CPPFLAGS = @XORG_INCS@ \
+            -I$(top_srcdir)/miext/shadow \
+            -I$(top_srcdir)/glx
+ 
+-libfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
+-libfb_la_LIBADD = $(top_builddir)/fb/libfb.la
+-libfb_la_SOURCES = fbmodule.c
+-libfb_la_CFLAGS = $(AM_CFLAGS)
+-
+ libwfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
+ libwfb_la_LIBADD = $(top_builddir)/fb/libwfb.la
+ libwfb_la_SOURCES = fbmodule.c
+diff --git a/hw/xfree86/dixmods/meson.build b/hw/xfree86/dixmods/meson.build
+index 0562b630f..e4ac02228 100644
+--- a/hw/xfree86/dixmods/meson.build
++++ b/hw/xfree86/dixmods/meson.build
+@@ -1,17 +1,3 @@
+-fb = shared_module(
+-    'fb',
+-    'fbmodule.c',
+-
+-    include_directories: [inc, xorg_inc],
+-    c_args: xorg_c_args,
+-    dependencies: common_dep,
+-    link_whole: libxserver_fb,
+-    link_with: e,
+-
+-    install: true,
+-    install_dir: module_dir,
+-)
+-
+ shared_module(
+     'wfb',
+     'fbmodule.c',
+diff --git a/hw/xfree86/drivers/modesetting/meson.build b/hw/xfree86/drivers/modesetting/meson.build
+index 5e13f1a53..02852a716 100644
+--- a/hw/xfree86/drivers/modesetting/meson.build
++++ b/hw/xfree86/drivers/modesetting/meson.build
+@@ -30,7 +30,6 @@ shared_module(
+ xorg_build_root = join_paths(meson.build_root(), 'hw', 'xfree86')
+ symbol_test_args = []
+ symbol_test_args += join_paths(xorg_build_root, 'libxorgserver.so')
+-symbol_test_args += join_paths(xorg_build_root, 'dixmods', 'libfb.so')
+ symbol_test_args += join_paths(xorg_build_root, 'dixmods', 'libshadow.so')
+ if gbm_dep.found()
+     symbol_test_args += join_paths(xorg_build_root, 'glamor_egl', 'libglamoregl.so')
+diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
+index a6356bd8f..f0983b2f8 100644
+--- a/hw/xfree86/loader/loadmod.c
++++ b/hw/xfree86/loader/loadmod.c
+@@ -621,6 +621,7 @@ DuplicateModule(ModuleDescPtr mod, ModuleDescPtr parent)
+ 
+ static const char *compiled_in_modules[] = {
+     "ddc",
++    "fb",
+     "i2c",
+     "ramdac",
+     "dbe",
+diff --git a/hw/xfree86/meson.build b/hw/xfree86/meson.build
+index cacf56d4c..c80964ea4 100644
+--- a/hw/xfree86/meson.build
++++ b/hw/xfree86/meson.build
+@@ -61,6 +61,7 @@ xorg_link = [
+     xorg_os_support,
+     xorg_parser,
+     xorg_ramdac,
++    libxserver_fb,
+     libxserver_xext_vidmode,
+     libxserver_main,
+     libxserver_config,
+diff --git a/hw/xfree86/sdksyms.sh b/hw/xfree86/sdksyms.sh
+index 7897aae22..2ebc4c019 100755
+--- a/hw/xfree86/sdksyms.sh
++++ b/hw/xfree86/sdksyms.sh
+@@ -21,13 +21,13 @@ cat > sdksyms.c << EOF
+ #include "picturestr.h"
+ 
+ 
+-/* fb/Makefile.am -- module */
+-/*
++/* fb/Makefile.am */
+ #include "fb.h"
+ #include "fbrop.h"
+ #include "fboverlay.h"
+-#include "wfbrename.h"
+ #include "fbpict.h"
++/* wfb is still a module
++#include "wfbrename.h"
+  */
+ 
+ 
+diff --git a/test/Makefile.am b/test/Makefile.am
+index 12ac327a3..ce07c3551 100644
+--- a/test/Makefile.am
++++ b/test/Makefile.am
+@@ -146,6 +146,7 @@ tests_LDADD += \
+             $(top_builddir)/hw/xfree86/i2c/libi2c.la \
+             $(top_builddir)/hw/xfree86/xkb/libxorgxkb.la \
+             $(top_builddir)/Xext/libXvidmode.la \
++            $(top_builddir)/fb/libfb.la \
+             $(XSERVER_LIBS) \
+             $(XORG_LIBS)
+ 
+-- 
+2.33.1
+

0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch

@@ -1,4 +1,4 @@
-From f9c435822c852659e3926502829f1b13ce6efc37 Mon Sep 17 00:00:00 2001
+From a16f2b9693d248b81703821fd22fba8b5ba83e1a Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 29 Nov 2022 13:26:57 +1000
 Subject: [PATCH xserver 3/7] Xi: avoid integer truncation in length check of

0003-dix-fix-DeviceStateNotify-event-calculation.patch

@@ -0,0 +1,217 @@
+From 219c54b8a3337456ce5270ded6a67bcde53553d5 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 18 Dec 2023 12:26:20 +1000
+Subject: [PATCH 3/9] dix: fix DeviceStateNotify event calculation
+
+The previous code only made sense if one considers buttons and keys to
+be mutually exclusive on a device. That is not necessarily true, causing
+a number of issues.
+
+This function allocates and fills in the number of xEvents we need to
+send the device state down the wire.  This is split across multiple
+32-byte devices including one deviceStateNotify event and optional
+deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple)
+deviceValuator events.
+
+The previous behavior would instead compose a sequence
+of [state, buttonstate, state, keystate, valuator...]. This is not
+protocol correct, and on top of that made the code extremely convoluted.
+
+Fix this by streamlining: add both button and key into the deviceStateNotify
+and then append the key state and button state, followed by the
+valuators. Finally, the deviceValuator events contain up to 6 valuators
+per event but we only ever sent through 3 at a time. Let's double that
+troughput.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/enterleave.c | 121 ++++++++++++++++++++---------------------------
+ 1 file changed, 52 insertions(+), 69 deletions(-)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 17964b00a..7b7ba1098 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
+ 
+     ev->type = DeviceValuator;
+     ev->deviceid = dev->id;
+-    ev->num_valuators = nval < 3 ? nval : 3;
++    ev->num_valuators = nval < 6 ? nval : 6;
+     ev->first_valuator = first;
+     switch (ev->num_valuators) {
++    case 6:
++        ev->valuator2 = v->axisVal[first + 5];
++    case 5:
++        ev->valuator2 = v->axisVal[first + 4];
++    case 4:
++        ev->valuator2 = v->axisVal[first + 3];
+     case 3:
+         ev->valuator2 = v->axisVal[first + 2];
+     case 2:
+@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
+         ev->valuator0 = v->axisVal[first];
+         break;
+     }
+-    first += ev->num_valuators;
+ }
+ 
+ static void
+@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
+         ev->num_buttons = b->numButtons;
+         memcpy((char *) ev->buttons, (char *) b->down, 4);
+     }
+-    else if (k) {
++    if (k) {
+         ev->classes_reported |= (1 << KeyClass);
+         ev->num_keys = k->xkbInfo->desc->max_key_code -
+             k->xkbInfo->desc->min_key_code;
+@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
+     }
+ }
+ 
+-
++/**
++ * The device state notify event is split across multiple 32-byte events.
++ * The first one contains the first 32 button state bits, the first 32
++ * key state bits, and the first 3 valuator values.
++ *
++ * If a device has more than that, the server sends out:
++ * - one deviceButtonStateNotify for buttons 32 and above
++ * - one deviceKeyStateNotify for keys 32 and above
++ * - one deviceValuator event per 6 valuators above valuator 4
++ *
++ * All events but the last one have the deviceid binary ORed with MORE_EVENTS,
++ */
+ static void
+ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ {
++    /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify
++     * and one deviceValuator for each 6 valuators */
++    deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6];
+     int evcount = 1;
+-    deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
+-    deviceStateNotify *ev;
+-    deviceKeyStateNotify *kev;
+-    deviceButtonStateNotify *bev;
++    deviceStateNotify *ev = sev;
+ 
+     KeyClassPtr k;
+     ButtonClassPtr b;
+@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ 
+     if ((b = dev->button) != NULL) {
+         nbuttons = b->numButtons;
+-        if (nbuttons > 32)
++        if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */
+             evcount++;
+     }
+     if ((k = dev->key) != NULL) {
+         nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code;
+-        if (nkeys > 32)
++        if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */
+             evcount++;
+-        if (nbuttons > 0) {
+-            evcount++;
+-        }
+     }
+     if ((v = dev->valuator) != NULL) {
+         nval = v->numAxes;
+-
+-        if (nval > 3)
+-            evcount++;
+-        if (nval > 6) {
+-            if (!(k && b))
+-                evcount++;
+-            if (nval > 9)
+-                evcount += ((nval - 7) / 3);
+-        }
++        /* first three are encoded in deviceStateNotify, then
++         * it's 6 per deviceValuator event */
++        evcount += ((nval - 3) + 6)/6;
+     }
+ 
+-    ev = sev;
+-    FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
+-
+-    if (b != NULL) {
+-        FixDeviceStateNotify(dev, ev++, NULL, b, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nbuttons > 32) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            bev = (deviceButtonStateNotify *) ev++;
+-            bev->type = DeviceButtonStateNotify;
+-            bev->deviceid = dev->id;
+-            memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
+-                   DOWN_LENGTH - 4);
+-        }
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++    BUG_RETURN(evcount <= ARRAY_SIZE(sev));
++
++    FixDeviceStateNotify(dev, ev, k, b, v, first);
++
++    if (b != NULL && nbuttons > 32) {
++        deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev;
++        (ev - 1)->deviceid |= MORE_EVENTS;
++        bev->type = DeviceButtonStateNotify;
++        bev->deviceid = dev->id;
++        memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
++               DOWN_LENGTH - 4);
+     }
+ 
+-    if (k != NULL) {
+-        FixDeviceStateNotify(dev, ev++, k, NULL, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nkeys > 32) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            kev = (deviceKeyStateNotify *) ev++;
+-            kev->type = DeviceKeyStateNotify;
+-            kev->deviceid = dev->id;
+-            memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
+-        }
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++    if (k != NULL && nkeys > 32) {
++        deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev;
++        (ev - 1)->deviceid |= MORE_EVENTS;
++        kev->type = DeviceKeyStateNotify;
++        kev->deviceid = dev->id;
++        memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
+     }
+ 
++    first = 3;
++    nval -= 3;
+     while (nval > 0) {
+-        FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++        ev->deviceid |= MORE_EVENTS;
++        FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first);
++        first += 6;
++        nval -= 6;
+     }
+ 
+     DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
+-- 
+2.43.0
+

0004-Xi-disallow-passive-grabs-with-a-detail-255.patch

@@ -1,4 +1,4 @@
-From 0dab0b527ac5c4fe0272ea679522bd87238a733b Mon Sep 17 00:00:00 2001
+From be6bcbfa3f388ca0705db8baf10fa5c2d29b7d36 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 29 Nov 2022 13:55:32 +1000
 Subject: [PATCH xserver 4/7] Xi: disallow passive grabs with a detail > 255
@@ -27,14 +27,14 @@ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
 Acked-by: Olivier Fourdan <ofourdan@redhat.com>
 ---
- Xi/xipassivegrab.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
+ Xi/xipassivegrab.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
 
 diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
-index 65d5870f6f..89a591098a 100644
+index 2769fb7c94..c9ac2f8553 100644
 --- a/Xi/xipassivegrab.c
 +++ b/Xi/xipassivegrab.c
-@@ -133,6 +133,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+@@ -137,6 +137,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
          return BadValue;
      }
  
@@ -47,7 +47,24 @@ index 65d5870f6f..89a591098a 100644
      if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
                                 stuff->mask_len * 4) != Success)
          return BadValue;
-@@ -313,6 +319,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
+@@ -207,14 +213,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+                                 &param, XI2, &mask);
+             break;
+         case XIGrabtypeKeycode:
+-            /* XI2 allows 32-bit keycodes but thanks to XKB we can never
+-             * implement this. Just return an error for all keycodes that
+-             * cannot work anyway */
+-            if (stuff->detail > 255)
+-                status = XIAlreadyGrabbed;
+-            else
+-                status = GrabKey(client, dev, mod_dev, stuff->detail,
+-                                 &param, XI2, &mask);
++            status = GrabKey(client, dev, mod_dev, stuff->detail,
++                             &param, XI2, &mask);
+             break;
+         case XIGrabtypeEnter:
+         case XIGrabtypeFocusIn:
+@@ -334,6 +334,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
          return BadValue;
      }
  

0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch

@@ -0,0 +1,37 @@
+From df3c65706eb169d5938df0052059f3e0d5981b74 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 21 Dec 2023 13:48:10 +1000
+Subject: [PATCH 4/9] Xi: when creating a new ButtonClass, set the number of
+ buttons
+
+There's a racy sequence where a master device may copy the button class
+from the slave, without ever initializing numButtons. This leads to a
+device with zero buttons but a button class which is invalid.
+
+Let's copy the numButtons value from the source - by definition if we
+don't have a button class yet we do not have any other slave devices
+with more than this number of buttons anyway.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/exevents.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index 54ea11a93..e16171468 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
+                 to->button = calloc(1, sizeof(ButtonClassRec));
+                 if (!to->button)
+                     FatalError("[Xi] no memory for class shift.\n");
++                to->button->numButtons = from->button->numButtons;
+             }
+             else
+                 classes->button = NULL;
+-- 
+2.43.0
+

0004-loader-Move-LoaderSymbolFromModule-to-public-API.patch

@@ -0,0 +1,42 @@
+From e763a4fa114ba6c0abddf2b43a7297b8b9054855 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Tue, 8 Oct 2019 13:29:22 -0400
+Subject: [PATCH xserver 04/11] loader: Move LoaderSymbolFromModule() to public
+ API
+
+Bare LoaderSymbol() isn't really a great API, this is more of a direct
+map to dlsym like you want.
+
+Gitlab: https://gitlab.freedesktop.org/xorg/xserver/issues/692
+(cherry picked from commit 8760fab0a15805bdd12bb8f12bb1c665fde86cc2)
+---
+ hw/xfree86/common/xf86Module.h | 1 +
+ hw/xfree86/loader/loader.h     | 1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/common/xf86Module.h b/hw/xfree86/common/xf86Module.h
+index 00aa84ae2..fab8842c4 100644
+--- a/hw/xfree86/common/xf86Module.h
++++ b/hw/xfree86/common/xf86Module.h
+@@ -156,6 +156,7 @@ extern _X_EXPORT void *LoadSubModule(void *, const char *, const char **,
+ extern _X_EXPORT void UnloadSubModule(void *);
+ extern _X_EXPORT void UnloadModule(void *);
+ extern _X_EXPORT void *LoaderSymbol(const char *);
++extern _X_EXPORT void *LoaderSymbolFromModule(void *, const char *);
+ extern _X_EXPORT void LoaderErrorMsg(const char *, const char *, int, int);
+ extern _X_EXPORT Bool LoaderShouldIgnoreABI(void);
+ extern _X_EXPORT int LoaderGetABIVersion(const char *abiclass);
+diff --git a/hw/xfree86/loader/loader.h b/hw/xfree86/loader/loader.h
+index 5a2fe6c60..4e83730a2 100644
+--- a/hw/xfree86/loader/loader.h
++++ b/hw/xfree86/loader/loader.h
+@@ -72,6 +72,5 @@ extern unsigned long LoaderOptions;
+ 
+ /* Internal Functions */
+ void *LoaderOpen(const char *, int *);
+-void *LoaderSymbolFromModule(void *, const char *);
+ 
+ #endif                          /* _LOADER_H */
+-- 
+2.33.1
+

0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch

@@ -1,4 +1,4 @@
-From 94f6fe99d87cf6ba0adadd95c595158c345b7d29 Mon Sep 17 00:00:00 2001
+From 6b59bdddf30dde413c4e0391cf84f3b94d4b4e31 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 29 Nov 2022 14:53:07 +1000
 Subject: [PATCH xserver 5/7] Xext: free the screen saver resource when

0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch

@@ -0,0 +1,109 @@
+From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 4 Jan 2024 10:01:24 +1000
+Subject: [PATCH 5/9] Xi: flush hierarchy events after adding/removing master
+ devices
+
+The `XISendDeviceHierarchyEvent()` function allocates space to store up
+to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.
+
+If a device with a given ID was removed and a new device with the same
+ID added both in the same operation, the single device ID will lead to
+two info structures being written to `info`.
+
+Since this case can occur for every device ID at once, a total of two
+times `MAXDEVICES` info structures might be written to the allocation.
+
+To avoid it, once one add/remove master is processed, send out the
+device hierarchy event for the current state and continue. That event
+thus only ever has exactly one of either added/removed in it (and
+optionally slave attached/detached).
+
+CVE-2024-21885, ZDI-CAN-22744
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
+index d2d985848..72d00451e 100644
+--- a/Xi/xichangehierarchy.c
++++ b/Xi/xichangehierarchy.c
+@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client)
+     size_t len;			/* length of data remaining in request */
+     int rc = Success;
+     int flags[MAXDEVICES] = { 0 };
++    enum {
++        NO_CHANGE,
++        FLUSH,
++        CHANGED,
++    } changes = NO_CHANGE;
+ 
+     REQUEST(xXIChangeHierarchyReq);
+     REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq);
+@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = add_master(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = FLUSH;
+             break;
++        }
+         case XIRemoveMaster:
+         {
+             xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
+@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = remove_master(client, r, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = FLUSH;
+             break;
++        }
+         case XIDetachSlave:
+         {
+             xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
+@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = detach_slave(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = CHANGED;
+             break;
++        }
+         case XIAttachSlave:
+         {
+             xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
+@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = attach_slave(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
++            changes = CHANGED;
++            break;
+         }
++        default:
+             break;
+         }
+ 
++        if (changes == FLUSH) {
++            XISendDeviceHierarchyEvent(flags);
++            memset(flags, 0, sizeof(flags));
++            changes = NO_CHANGE;
++        }
++
+         len -= any->length * 4;
+         any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
+     }
+ 
+  unwind:
+-
+-    XISendDeviceHierarchyEvent(flags);
++    if (changes != NO_CHANGE)
++        XISendDeviceHierarchyEvent(flags);
+     return rc;
+ }
+-- 
+2.43.0
+

0005-loader-Make-LoaderSymbolFromModule-take-a-ModuleDesc.patch

@@ -0,0 +1,50 @@
+From b01ca791b9ba62e25e3533ba35f8e825f02f0f80 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Mon, 18 Nov 2019 16:43:50 -0500
+Subject: [PATCH xserver 05/11] loader: Make LoaderSymbolFromModule take a
+ ModuleDescPtr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The thing you get back from xf86LoadSubModule is a ModuleDescPtr, not a
+dlsym handle. We don't expose ModuleDescPtr to the drivers, so change
+LoaderSymbolFromModule to cast its void * argument to a ModuleDescPtr.
+
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit ab61c16ef07fde6eb7110c63c344c54eb2a2d117)
+---
+ hw/xfree86/loader/loader.c  | 3 ++-
+ hw/xfree86/loader/loadmod.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/hw/xfree86/loader/loader.c b/hw/xfree86/loader/loader.c
+index 503c47e3a..2580e93d9 100644
+--- a/hw/xfree86/loader/loader.c
++++ b/hw/xfree86/loader/loader.c
+@@ -135,7 +135,8 @@ LoaderSymbol(const char *name)
+ void *
+ LoaderSymbolFromModule(void *handle, const char *name)
+ {
+-    return dlsym(handle, name);
++    ModuleDescPtr mod = handle;
++    return dlsym(mod->handle, name);
+ }
+ 
+ void
+diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
+index a93a76aa9..81a3a1dd9 100644
+--- a/hw/xfree86/loader/loadmod.c
++++ b/hw/xfree86/loader/loadmod.c
+@@ -776,7 +776,7 @@ LoadModule(const char *module, void *options, const XF86ModReqInfo *modreq,
+             *errmaj = LDR_NOMEM;
+         goto LoadModule_fail;
+     }
+-    initdata = LoaderSymbolFromModule(ret->handle, p);
++    initdata = LoaderSymbolFromModule(ret, p);
+     if (initdata) {
+         ModuleSetupProc setup;
+         ModuleTearDownProc teardown;
+-- 
+2.33.1
+

0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch

@@ -1,4 +1,4 @@
-From a42635ee3c01f71a49052d83a372933504c9db04 Mon Sep 17 00:00:00 2001
+From 40f06ae1bd12f4416df59382324a0d31ab2ba704 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Wed, 30 Nov 2022 11:20:40 +1000
 Subject: [PATCH xserver 6/7] Xext: free the XvRTVideoNotify when turning off

0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch

@@ -0,0 +1,70 @@
+From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
+Date: Fri, 22 Dec 2023 18:28:31 +0100
+Subject: [PATCH 6/9] Xi: do not keep linked list pointer during recursion
+
+The `DisableDevice()` function is called whenever an enabled device
+is disabled and it moves the device from the `inputInfo.devices` linked
+list to the `inputInfo.off_devices` linked list.
+
+However, its link/unlink operation has an issue during the recursive
+call to `DisableDevice()` due to the `prev` pointer pointing to a
+removed device.
+
+This issue leads to a length mismatch between the total number of
+devices and the number of device in the list, leading to a heap
+overflow and, possibly, to local privilege escalation.
+
+Simplify the code that checked whether the device passed to
+`DisableDevice()` was in `inputInfo.devices` or not and find the
+previous device after the recursion.
+
+CVE-2024-21886, ZDI-CAN-22840
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/devices.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index dca98c8d1..389d28a23 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+ {
+     DeviceIntPtr *prev, other;
+     BOOL enabled;
++    BOOL dev_in_devices_list = FALSE;
+     int flags[MAXDEVICES] = { 0 };
+ 
+     if (!dev->enabled)
+         return TRUE;
+ 
+-    for (prev = &inputInfo.devices;
+-         *prev && (*prev != dev); prev = &(*prev)->next);
+-    if (*prev != dev)
++    for (other = inputInfo.devices; other; other = other->next) {
++        if (other == dev) {
++            dev_in_devices_list = TRUE;
++            break;
++        }
++    }
++
++    if (!dev_in_devices_list)
+         return FALSE;
+ 
+     TouchEndPhysicallyActiveTouches(dev);
+@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+     LeaveWindow(dev);
+     SetFocusOut(dev);
+ 
++    for (prev = &inputInfo.devices;
++         *prev && (*prev != dev); prev = &(*prev)->next);
++
+     *prev = dev->next;
+     dev->next = inputInfo.off_devices;
+     inputInfo.off_devices = dev;
+-- 
+2.43.0
+

0006-modesetting-Indirect-the-shadow-API-through-LoaderSy.patch

@@ -0,0 +1,144 @@
+From 13d3bc7a05eb7500c8987358c68c20a4bfe18079 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Tue, 8 Oct 2019 12:52:28 -0400
+Subject: [PATCH xserver 06/11] modesetting: Indirect the shadow API through
+ LoaderSymbol
+
+Prerequisite for building all of xserver with -z now.
+
+Gitlab: https://gitlab.freedesktop.org/xorg/xserver/issues/692
+(cherry picked from commit 45f35a0c6666c5f35df482948e0c8e91167429ef)
+---
+ hw/xfree86/drivers/modesetting/driver.c | 34 +++++++++++--------------
+ hw/xfree86/drivers/modesetting/driver.h | 12 ++++++++-
+ 2 files changed, 26 insertions(+), 20 deletions(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index ec4189a2c..a385e7ee2 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -50,7 +50,6 @@
+ #include "xf86Crtc.h"
+ #include "miscstruct.h"
+ #include "dixstruct.h"
+-#include "shadow.h"
+ #include "xf86xv.h"
+ #include <X11/extensions/Xv.h>
+ #include <xorg-config.h>
+@@ -60,7 +59,6 @@
+ #ifdef XSERVER_LIBPCIACCESS
+ #include <pciaccess.h>
+ #endif
+-
+ #include "driver.h"
+ 
+ static void AdjustFrame(ScrnInfoPtr pScrn, int x, int y);
+@@ -1084,9 +1082,16 @@ PreInit(ScrnInfoPtr pScrn, int flags)
+     }
+ 
+     if (ms->drmmode.shadow_enable) {
+-        if (!xf86LoadSubModule(pScrn, "shadow")) {
++        void *mod = xf86LoadSubModule(pScrn, "shadow");
++
++        if (!mod)
+             return FALSE;
+-        }
++
++        ms->shadow.Setup        = LoaderSymbolFromModule(mod, "shadowSetup");
++        ms->shadow.Add          = LoaderSymbolFromModule(mod, "shadowAdd");
++        ms->shadow.Remove       = LoaderSymbolFromModule(mod, "shadowRemove");
++        ms->shadow.Update32to24 = LoaderSymbolFromModule(mod, "shadowUpdate32to24");
++        ms->shadow.UpdatePacked = LoaderSymbolFromModule(mod, "shadowUpdatePacked");
+     }
+ 
+     return TRUE;
+@@ -1191,9 +1196,9 @@ msUpdatePacked(ScreenPtr pScreen, shadowBufPtr pBuf)
+     } while (0);
+ 
+     if (use_3224)
+-        shadowUpdate32to24(pScreen, pBuf);
++        ms->shadow.Update32to24(pScreen, pBuf);
+     else
+-        shadowUpdatePacked(pScreen, pBuf);
++        ms->shadow.UpdatePacked(pScreen, pBuf);
+ }
+ 
+ static Bool
+@@ -1380,8 +1385,8 @@ CreateScreenResources(ScreenPtr pScreen)
+         FatalError("Couldn't adjust screen pixmap\n");
+ 
+     if (ms->drmmode.shadow_enable) {
+-        if (!shadowAdd(pScreen, rootPixmap, msUpdatePacked, msShadowWindow,
+-                       0, 0))
++        if (!ms->shadow.Add(pScreen, rootPixmap, msUpdatePacked, msShadowWindow,
++                            0, 0))
+             return FALSE;
+     }
+ 
+@@ -1415,15 +1420,6 @@ CreateScreenResources(ScreenPtr pScreen)
+     return ret;
+ }
+ 
+-static Bool
+-msShadowInit(ScreenPtr pScreen)
+-{
+-    if (!shadowSetup(pScreen)) {
+-        return FALSE;
+-    }
+-    return TRUE;
+-}
+-
+ static Bool
+ msSharePixmapBacking(PixmapPtr ppix, ScreenPtr screen, void **handle)
+ {
+@@ -1643,7 +1639,7 @@ ScreenInit(ScreenPtr pScreen, int argc, char **argv)
+         return FALSE;
+     }
+ 
+-    if (ms->drmmode.shadow_enable && !msShadowInit(pScreen)) {
++    if (ms->drmmode.shadow_enable && !ms->shadow.Setup(pScreen)) {
+         xf86DrvMsg(pScrn->scrnIndex, X_ERROR, "shadow fb init failed\n");
+         return FALSE;
+     }
+@@ -1887,7 +1883,7 @@ CloseScreen(ScreenPtr pScreen)
+     }
+ 
+     if (ms->drmmode.shadow_enable) {
+-        shadowRemove(pScreen, pScreen->GetScreenPixmap(pScreen));
++        ms->shadow.Remove(pScreen, pScreen->GetScreenPixmap(pScreen));
+         free(ms->drmmode.shadow_fb);
+         ms->drmmode.shadow_fb = NULL;
+         free(ms->drmmode.shadow_fb2);
+diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
+index a99f37871..394a20fc1 100644
+--- a/hw/xfree86/drivers/modesetting/driver.h
++++ b/hw/xfree86/drivers/modesetting/driver.h
+@@ -33,7 +33,7 @@
+ #include <xf86Crtc.h>
+ #include <damage.h>
+ #include <X11/extensions/dpmsconst.h>
+-
++#include <shadow.h>
+ #ifdef GLAMOR_HAS_GBM
+ #define GLAMOR_FOR_XORG 1
+ #include "glamor.h"
+@@ -122,6 +122,16 @@ typedef struct _modesettingRec {
+ 
+     Bool kms_has_modifiers;
+ 
++    /* shadow API */
++    struct {
++        Bool (*Setup)(ScreenPtr);
++        Bool (*Add)(ScreenPtr, PixmapPtr, ShadowUpdateProc, ShadowWindowProc,
++                    int, void *);
++        void (*Remove)(ScreenPtr, PixmapPtr);
++        void (*Update32to24)(ScreenPtr, shadowBufPtr);
++        void (*UpdatePacked)(ScreenPtr, shadowBufPtr);
++    } shadow;
++
+ } modesettingRec, *modesettingPtr;
+ 
+ #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
+-- 
+2.33.1
+

0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch

@@ -0,0 +1,53 @@
+From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 5 Jan 2024 09:40:27 +1000
+Subject: [PATCH 7/9] dix: when disabling a master, float disabled slaved
+ devices too
+
+Disabling a master device floats all slave devices but we didn't do this
+to already-disabled slave devices. As a result those devices kept their
+reference to the master device resulting in access to already freed
+memory if the master device was removed before the corresponding slave
+device.
+
+And to match this behavior, also forcibly reset that pointer during
+CloseDownDevices().
+
+Related to CVE-2024-21886, ZDI-CAN-22840
+---
+ dix/devices.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index 389d28a23..84a6406d1 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+                 flags[other->id] |= XISlaveDetached;
+             }
+         }
++
++        for (other = inputInfo.off_devices; other; other = other->next) {
++            if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) {
++                AttachDevice(NULL, other, NULL);
++                flags[other->id] |= XISlaveDetached;
++            }
++        }
+     }
+     else {
+         for (other = inputInfo.devices; other; other = other->next) {
+@@ -1088,6 +1095,11 @@ CloseDownDevices(void)
+             dev->master = NULL;
+     }
+ 
++    for (dev = inputInfo.off_devices; dev; dev = dev->next) {
++        if (!IsMaster(dev) && !IsFloating(dev))
++            dev->master = NULL;
++    }
++
+     CloseDeviceList(&inputInfo.devices);
+     CloseDeviceList(&inputInfo.off_devices);
+ 
+-- 
+2.43.0
+

0007-modesetting-Indirect-the-glamor-API-through-LoaderSy.patch

@@ -0,0 +1,332 @@
+From 94612044171975466f605d5f01769d1c2b9acc5d Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Tue, 8 Oct 2019 13:11:09 -0400
+Subject: [PATCH xserver 07/11] modesetting: Indirect the glamor API through
+ LoaderSymbol
+
+Prerequisite for building all of xserver with -z now.
+
+Gitlab: https://gitlab.freedesktop.org/xorg/xserver/issues/692
+(cherry picked from commit dd63f717fe8636315343f421f4f2ee299258f079)
+---
+ hw/xfree86/drivers/modesetting/dri2.c         | 10 ++--
+ hw/xfree86/drivers/modesetting/driver.c       | 49 ++++++++++++++-----
+ hw/xfree86/drivers/modesetting/driver.h       | 24 +++++++++
+ .../drivers/modesetting/drmmode_display.c     | 17 ++++---
+ hw/xfree86/drivers/modesetting/pageflip.c     |  4 +-
+ hw/xfree86/drivers/modesetting/present.c      |  4 +-
+ 6 files changed, 82 insertions(+), 26 deletions(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/dri2.c b/hw/xfree86/drivers/modesetting/dri2.c
+index d89904b53..724d9d34c 100644
+--- a/hw/xfree86/drivers/modesetting/dri2.c
++++ b/hw/xfree86/drivers/modesetting/dri2.c
+@@ -123,6 +123,7 @@ ms_dri2_create_buffer2(ScreenPtr screen, DrawablePtr drawable,
+                        unsigned int attachment, unsigned int format)
+ {
+     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
++    modesettingPtr ms = modesettingPTR(scrn);
+     DRI2Buffer2Ptr buffer;
+     PixmapPtr pixmap;
+     CARD32 size;
+@@ -200,7 +201,7 @@ ms_dri2_create_buffer2(ScreenPtr screen, DrawablePtr drawable,
+      */
+     buffer->flags = 0;
+ 
+-    buffer->name = glamor_name_from_pixmap(pixmap, &pitch, &size);
++    buffer->name = ms->glamor.name_from_pixmap(pixmap, &pitch, &size);
+     buffer->pitch = pitch;
+     if (buffer->name == -1) {
+         xf86DrvMsg(scrn->scrnIndex, X_ERROR,
+@@ -509,11 +510,12 @@ update_front(DrawablePtr draw, DRI2BufferPtr front)
+     ScreenPtr screen = draw->pScreen;
+     PixmapPtr pixmap = get_drawable_pixmap(draw);
+     ms_dri2_buffer_private_ptr priv = front->driverPrivate;
++    modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(screen));
+     CARD32 size;
+     CARD16 pitch;
+     int name;
+ 
+-    name = glamor_name_from_pixmap(pixmap, &pitch, &size);
++    name = ms->glamor.name_from_pixmap(pixmap, &pitch, &size);
+     if (name < 0)
+         return FALSE;
+ 
+@@ -617,7 +619,7 @@ ms_dri2_exchange_buffers(DrawablePtr draw, DRI2BufferPtr front,
+     *front_pix = *back_pix;
+     *back_pix = tmp_pix;
+ 
+-    glamor_egl_exchange_buffers(front_priv->pixmap, back_priv->pixmap);
++    ms->glamor.egl_exchange_buffers(front_priv->pixmap, back_priv->pixmap);
+ 
+     /* Post damage on the front buffer so that listeners, such
+      * as DisplayLink know take a copy and shove it over the USB.
+@@ -1036,7 +1038,7 @@ ms_dri2_screen_init(ScreenPtr screen)
+     DRI2InfoRec info;
+     const char *driver_names[2] = { NULL, NULL };
+ 
+-    if (!glamor_supports_pixmap_import_export(screen)) {
++    if (!ms->glamor.supports_pixmap_import_export(screen)) {
+         xf86DrvMsg(scrn->scrnIndex, X_WARNING,
+                    "DRI2: glamor lacks support for pixmap import/export\n");
+     }
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index a385e7ee2..4f4db67b7 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -615,7 +615,7 @@ redisplay_dirty(ScreenPtr screen, PixmapDirtyUpdatePtr dirty, int *timeout)
+          * the shared pixmap, but not all).
+          */
+         if (ms->drmmode.glamor)
+-            glamor_finish(screen);
++            ms->glamor.finish(screen);
+ #endif
+         /* Ensure the slave processes the damage immediately */
+         if (timeout)
+@@ -743,6 +743,26 @@ FreeRec(ScrnInfoPtr pScrn)
+ 
+ }
+ 
++static void
++bind_glamor_api(void *mod, modesettingPtr ms)
++{
++    ms->glamor.back_pixmap_from_fd = LoaderSymbolFromModule(mod, "glamor_back_pixmap_from_fd");
++    ms->glamor.block_handler = LoaderSymbolFromModule(mod, "glamor_block_handler");
++    ms->glamor.egl_create_textured_pixmap = LoaderSymbolFromModule(mod, "glamor_egl_create_textured_pixmap");
++    ms->glamor.egl_create_textured_pixmap_from_gbm_bo = LoaderSymbolFromModule(mod, "glamor_egl_create_textured_pixmap_from_gbm_bo");
++    ms->glamor.egl_exchange_buffers = LoaderSymbolFromModule(mod, "glamor_egl_exchange_buffers");
++    ms->glamor.egl_get_gbm_device = LoaderSymbolFromModule(mod, "glamor_egl_get_gbm_device");
++    ms->glamor.egl_init = LoaderSymbolFromModule(mod, "glamor_egl_init");
++    ms->glamor.finish = LoaderSymbolFromModule(mod, "glamor_finish");
++    ms->glamor.gbm_bo_from_pixmap = LoaderSymbolFromModule(mod, "glamor_gbm_bo_from_pixmap");
++    ms->glamor.init = LoaderSymbolFromModule(mod, "glamor_init");
++    ms->glamor.name_from_pixmap = LoaderSymbolFromModule(mod, "glamor_name_from_pixmap");
++    ms->glamor.set_drawable_modifiers_func = LoaderSymbolFromModule(mod, "glamor_set_drawable_modifiers_func");
++    ms->glamor.shareable_fd_from_pixmap = LoaderSymbolFromModule(mod, "glamor_shareable_fd_from_pixmap");
++    ms->glamor.supports_pixmap_import_export = LoaderSymbolFromModule(mod, "glamor_supports_pixmap_import_export");
++    ms->glamor.xv_init = LoaderSymbolFromModule(mod, "glamor_xv_init");
++}
++
+ static void
+ try_enable_glamor(ScrnInfoPtr pScrn)
+ {
+@@ -751,6 +771,7 @@ try_enable_glamor(ScrnInfoPtr pScrn)
+                                                        OPTION_ACCEL_METHOD);
+     Bool do_glamor = (!accel_method_str ||
+                       strcmp(accel_method_str, "glamor") == 0);
++    void *mod;
+ 
+     ms->drmmode.glamor = FALSE;
+ 
+@@ -765,8 +786,10 @@ try_enable_glamor(ScrnInfoPtr pScrn)
+         return;
+     }
+ 
+-    if (xf86LoadSubModule(pScrn, GLAMOR_EGL_MODULE_NAME)) {
+-        if (glamor_egl_init(pScrn, ms->fd)) {
++    mod = xf86LoadSubModule(pScrn, GLAMOR_EGL_MODULE_NAME);
++    if (mod) {
++        bind_glamor_api(mod, ms);
++        if (ms->glamor.egl_init(pScrn, ms->fd)) {
+             xf86DrvMsg(pScrn->scrnIndex, X_INFO, "glamor initialized\n");
+             ms->drmmode.glamor = TRUE;
+         } else {
+@@ -1424,11 +1447,12 @@ static Bool
+ msSharePixmapBacking(PixmapPtr ppix, ScreenPtr screen, void **handle)
+ {
+ #ifdef GLAMOR_HAS_GBM
++    modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(screen));
+     int ret;
+     CARD16 stride;
+     CARD32 size;
+-    ret = glamor_shareable_fd_from_pixmap(ppix->drawable.pScreen, ppix,
+-                                          &stride, &size);
++    ret = ms->glamor.shareable_fd_from_pixmap(ppix->drawable.pScreen, ppix,
++                                              &stride, &size);
+     if (ret == -1)
+         return FALSE;
+ 
+@@ -1453,11 +1477,12 @@ msSetSharedPixmapBacking(PixmapPtr ppix, void *fd_handle)
+            return drmmode_SetSlaveBO(ppix, &ms->drmmode, ihandle, 0, 0);
+ 
+     if (ms->drmmode.reverse_prime_offload_mode) {
+-        ret = glamor_back_pixmap_from_fd(ppix, ihandle,
+-                                         ppix->drawable.width,
+-                                         ppix->drawable.height,
+-                                         ppix->devKind, ppix->drawable.depth,
+-                                         ppix->drawable.bitsPerPixel);
++        ret = ms->glamor.back_pixmap_from_fd(ppix, ihandle,
++                                             ppix->drawable.width,
++                                             ppix->drawable.height,
++                                             ppix->devKind,
++                                             ppix->drawable.depth,
++                                             ppix->drawable.bitsPerPixel);
+     } else {
+         int size = ppix->devKind * ppix->drawable.height;
+         ret = drmmode_SetSlaveBO(ppix, &ms->drmmode, ihandle, ppix->devKind, size);
+@@ -1574,7 +1599,7 @@ ScreenInit(ScreenPtr pScreen, int argc, char **argv)
+ 
+ #ifdef GLAMOR_HAS_GBM
+     if (ms->drmmode.glamor)
+-        ms->drmmode.gbm = glamor_egl_get_gbm_device(pScreen);
++        ms->drmmode.gbm = ms->glamor.egl_get_gbm_device(pScreen);
+ #endif
+ 
+     /* HW dependent - FIXME */
+@@ -1718,7 +1743,7 @@ ScreenInit(ScreenPtr pScreen, int argc, char **argv)
+     if (ms->drmmode.glamor) {
+         XF86VideoAdaptorPtr     glamor_adaptor;
+ 
+-        glamor_adaptor = glamor_xv_init(pScreen, 16);
++        glamor_adaptor = ms->glamor.xv_init(pScreen, 16);
+         if (glamor_adaptor != NULL)
+             xf86XVScreenInit(pScreen, &glamor_adaptor, 1);
+         else
+diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
+index 394a20fc1..5e4d2509a 100644
+--- a/hw/xfree86/drivers/modesetting/driver.h
++++ b/hw/xfree86/drivers/modesetting/driver.h
+@@ -132,6 +132,30 @@ typedef struct _modesettingRec {
+         void (*UpdatePacked)(ScreenPtr, shadowBufPtr);
+     } shadow;
+ 
++    /* glamor API */
++    struct {
++        Bool (*back_pixmap_from_fd)(PixmapPtr, int, CARD16, CARD16, CARD16,
++                                    CARD8, CARD8);
++        void (*block_handler)(ScreenPtr);
++        Bool (*egl_create_textured_pixmap)(PixmapPtr, int, int);
++        Bool (*egl_create_textured_pixmap_from_gbm_bo)(PixmapPtr,
++                                                       struct gbm_bo *,
++                                                       Bool);
++        void (*egl_exchange_buffers)(PixmapPtr, PixmapPtr);
++        struct gbm_device *(*egl_get_gbm_device)(ScreenPtr);
++        Bool (*egl_init)(ScrnInfoPtr, int);
++        void (*finish)(ScreenPtr);
++        struct gbm_bo *(*gbm_bo_from_pixmap)(ScreenPtr, PixmapPtr);
++        Bool (*init)(ScreenPtr, unsigned int);
++        int (*name_from_pixmap)(PixmapPtr, CARD16 *, CARD32 *);
++        void (*set_drawable_modifiers_func)(ScreenPtr,
++                                            GetDrawableModifiersFuncPtr);
++        int (*shareable_fd_from_pixmap)(ScreenPtr, PixmapPtr, CARD16 *,
++                                        CARD32 *);
++        Bool (*supports_pixmap_import_export)(ScreenPtr);
++        XF86VideoAdaptorPtr (*xv_init)(ScreenPtr, int);
++    } glamor;
++
+ } modesettingRec, *modesettingPtr;
+ 
+ #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
+diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
+index 6f5f8caf6..28609db7c 100644
+--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
++++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
+@@ -770,7 +770,7 @@ drmmode_crtc_set_mode(xf86CrtcPtr crtc, Bool test_only)
+ #ifdef GLAMOR_HAS_GBM
+     /* Make sure any pending drawing will be visible in a new scanout buffer */
+     if (drmmode->glamor)
+-        glamor_finish(screen);
++        ms->glamor.finish(screen);
+ #endif
+ 
+     if (ms->atomic_modeset) {
+@@ -1385,6 +1385,7 @@ create_pixmap_for_fbcon(drmmode_ptr drmmode, ScrnInfoPtr pScrn, int fbcon_id)
+     PixmapPtr pixmap = drmmode->fbcon_pixmap;
+     drmModeFBPtr fbcon;
+     ScreenPtr pScreen = xf86ScrnToScreen(pScrn);
++    modesettingPtr ms = modesettingPTR(pScrn);
+     Bool ret;
+ 
+     if (pixmap)
+@@ -1405,7 +1406,8 @@ create_pixmap_for_fbcon(drmmode_ptr drmmode, ScrnInfoPtr pScrn, int fbcon_id)
+     if (!pixmap)
+         goto out_free_fb;
+ 
+-    ret = glamor_egl_create_textured_pixmap(pixmap, fbcon->handle, fbcon->pitch);
++    ret = ms->glamor.egl_create_textured_pixmap(pixmap, fbcon->handle,
++                                                fbcon->pitch);
+     if (!ret) {
+       FreePixmap(pixmap);
+       pixmap = NULL;
+@@ -1424,6 +1426,7 @@ drmmode_copy_fb(ScrnInfoPtr pScrn, drmmode_ptr drmmode)
+ #ifdef GLAMOR_HAS_GBM
+     xf86CrtcConfigPtr xf86_config = XF86_CRTC_CONFIG_PTR(pScrn);
+     ScreenPtr pScreen = xf86ScrnToScreen(pScrn);
++    modesettingPtr ms = modesettingPTR(pScrn);
+     PixmapPtr src, dst;
+     int fbcon_id = 0;
+     GCPtr gc;
+@@ -3108,12 +3111,13 @@ drmmode_set_pixmap_bo(drmmode_ptr drmmode, PixmapPtr pixmap, drmmode_bo *bo)
+ {
+ #ifdef GLAMOR_HAS_GBM
+     ScrnInfoPtr scrn = drmmode->scrn;
++    modesettingPtr ms = modesettingPTR(scrn);
+ 
+     if (!drmmode->glamor)
+         return TRUE;
+ 
+-    if (!glamor_egl_create_textured_pixmap_from_gbm_bo(pixmap, bo->gbm,
+-                                                       bo->used_modifiers)) {
++    if (!ms->glamor.egl_create_textured_pixmap_from_gbm_bo(pixmap, bo->gbm,
++                                                           bo->used_modifiers)) {
+         xf86DrvMsg(scrn->scrnIndex, X_ERROR, "Failed to create pixmap\n");
+         return FALSE;
+     }
+@@ -3436,13 +3440,14 @@ drmmode_init(ScrnInfoPtr pScrn, drmmode_ptr drmmode)
+ {
+ #ifdef GLAMOR_HAS_GBM
+     ScreenPtr pScreen = xf86ScrnToScreen(pScrn);
++    modesettingPtr ms = modesettingPTR(pScrn);
+ 
+     if (drmmode->glamor) {
+-        if (!glamor_init(pScreen, GLAMOR_USE_EGL_SCREEN)) {
++        if (!ms->glamor.init(pScreen, GLAMOR_USE_EGL_SCREEN)) {
+             return FALSE;
+         }
+ #ifdef GBM_BO_WITH_MODIFIERS
+-        glamor_set_drawable_modifiers_func(pScreen, get_drawable_modifiers);
++        ms->glamor.set_drawable_modifiers_func(pScreen, get_drawable_modifiers);
+ #endif
+     }
+ #endif
+diff --git a/hw/xfree86/drivers/modesetting/pageflip.c b/hw/xfree86/drivers/modesetting/pageflip.c
+index 1d54816e2..841fa917c 100644
+--- a/hw/xfree86/drivers/modesetting/pageflip.c
++++ b/hw/xfree86/drivers/modesetting/pageflip.c
+@@ -243,9 +243,9 @@ ms_do_pageflip(ScreenPtr screen,
+     uint32_t flags;
+     int i;
+     struct ms_flipdata *flipdata;
+-    glamor_block_handler(screen);
++    ms->glamor.block_handler(screen);
+ 
+-    new_front_bo.gbm = glamor_gbm_bo_from_pixmap(screen, new_front);
++    new_front_bo.gbm = ms->glamor.gbm_bo_from_pixmap(screen, new_front);
+     new_front_bo.dumb = NULL;
+ 
+     if (!new_front_bo.gbm) {
+diff --git a/hw/xfree86/drivers/modesetting/present.c b/hw/xfree86/drivers/modesetting/present.c
+index 186309a29..c700cf116 100644
+--- a/hw/xfree86/drivers/modesetting/present.c
++++ b/hw/xfree86/drivers/modesetting/present.c
+@@ -166,7 +166,7 @@ ms_present_flush(WindowPtr window)
+     modesettingPtr ms = modesettingPTR(scrn);
+ 
+     if (ms->drmmode.glamor)
+-        glamor_block_handler(screen);
++        ms->glamor.block_handler(screen);
+ #endif
+ }
+ 
+@@ -262,7 +262,7 @@ ms_present_check_unflip(RRCrtcPtr crtc,
+ 
+ #ifdef GBM_BO_WITH_MODIFIERS
+     /* Check if buffer format/modifier is supported by all active CRTCs */
+-    gbm = glamor_gbm_bo_from_pixmap(screen, pixmap);
++    gbm = ms->glamor.gbm_bo_from_pixmap(screen, pixmap);
+     if (gbm) {
+         uint32_t format;
+         uint64_t modifier;
+-- 
+2.33.1
+

0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch

@@ -1,4 +1,4 @@
-From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001
+From 9c70f90b24ba5de5eeb8a854c25f72a38d497fb7 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Mon, 5 Dec 2022 15:55:54 +1000
 Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after

0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch

@@ -0,0 +1,60 @@
+From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 6 Dec 2023 12:09:41 +0100
+Subject: [PATCH 8/9] glx: Call XACE hooks on the GLX buffer
+
+The XSELINUX code will label resources at creation by checking the
+access mode. When the access mode is DixCreateAccess, it will call the
+function to label the new resource SELinuxLabelResource().
+
+However, GLX buffers do not go through the XACE hooks when created,
+hence leaving the resource actually unlabeled.
+
+When, later, the client tries to create another resource using that
+drawable (like a GC for example), the XSELINUX code would try to use
+the security ID of that object which has never been labeled, get a NULL
+pointer and crash when checking whether the requested permissions are
+granted for subject security ID.
+
+To avoid the issue, make sure to call the XACE hooks when creating the
+GLX buffers.
+
+Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.
+
+CVE-2024-0408
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ glx/glxcmds.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/glx/glxcmds.c b/glx/glxcmds.c
+index fc26a2e34..1e46d0c72 100644
+--- a/glx/glxcmds.c
++++ b/glx/glxcmds.c
+@@ -48,6 +48,7 @@
+ #include "indirect_util.h"
+ #include "protocol-versions.h"
+ #include "glxvndabi.h"
++#include "xace.h"
+ 
+ static char GLXServerVendorName[] = "SGI";
+ 
+@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId,
+     if (!pPixmap)
+         return BadAlloc;
+ 
++    err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP,
++                   pPixmap, RT_NONE, NULL, DixCreateAccess);
++    if (err != Success) {
++        (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap);
++        return err;
++    }
++
+     /* Assign the pixmap the same id as the pbuffer and add it as a
+      * resource so it and the DRI2 drawable will be reclaimed when the
+      * pbuffer is destroyed. */
+-- 
+2.43.0
+

0008-modesetting-Add-glamor_finish-convenience-macro.patch

@@ -0,0 +1,58 @@
+From 7f1bedcf27cfd09162544ff1b18c21c8e5695a9d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Fri, 22 Nov 2019 18:05:04 +0100
+Subject: [PATCH xserver 08/11] modesetting: Add glamor_finish() convenience
+ macro
+
+This will simplify backporting the following fix to the 1.20 branch.
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+(cherry picked from commit 06ef320e9bc1f1098df9cd5581f072528f28128e)
+---
+ hw/xfree86/drivers/modesetting/driver.c          | 2 +-
+ hw/xfree86/drivers/modesetting/driver.h          | 2 ++
+ hw/xfree86/drivers/modesetting/drmmode_display.c | 2 +-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index 4f4db67b7..afba8538a 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -615,7 +615,7 @@ redisplay_dirty(ScreenPtr screen, PixmapDirtyUpdatePtr dirty, int *timeout)
+          * the shared pixmap, but not all).
+          */
+         if (ms->drmmode.glamor)
+-            ms->glamor.finish(screen);
++            glamor_finish(screen);
+ #endif
+         /* Ensure the slave processes the damage immediately */
+         if (timeout)
+diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
+index 5e4d2509a..c6e7cd0c8 100644
+--- a/hw/xfree86/drivers/modesetting/driver.h
++++ b/hw/xfree86/drivers/modesetting/driver.h
+@@ -158,6 +158,8 @@ typedef struct _modesettingRec {
+ 
+ } modesettingRec, *modesettingPtr;
+ 
++#define glamor_finish(screen) ms->glamor.finish(screen)
++
+ #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
+ modesettingEntPtr ms_ent_priv(ScrnInfoPtr scrn);
+ 
+diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
+index 28609db7c..6516fac5f 100644
+--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
++++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
+@@ -770,7 +770,7 @@ drmmode_crtc_set_mode(xf86CrtcPtr crtc, Bool test_only)
+ #ifdef GLAMOR_HAS_GBM
+     /* Make sure any pending drawing will be visible in a new scanout buffer */
+     if (drmmode->glamor)
+-        ms->glamor.finish(screen);
++        glamor_finish(screen);
+ #endif
+ 
+     if (ms->atomic_modeset) {
+-- 
+2.33.1
+

0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch

@@ -0,0 +1,56 @@
+From 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 6 Dec 2023 11:51:56 +0100
+Subject: [PATCH 9/9] ephyr,xwayland: Use the proper private key for cursor
+
+The cursor in DIX is actually split in two parts, the cursor itself and
+the cursor bits, each with their own devPrivates.
+
+The cursor itself includes the cursor bits, meaning that the cursor bits
+devPrivates in within structure of the cursor.
+
+Both Xephyr and Xwayland were using the private key for the cursor bits
+to store the data for the cursor, and when using XSELINUX which comes
+with its own special devPrivates, the data stored in that cursor bits'
+devPrivates would interfere with the XSELINUX devPrivates data and the
+SELINUX security ID would point to some other unrelated data, causing a
+crash in the XSELINUX code when trying to (re)use the security ID.
+
+CVE-2024-0409
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ hw/kdrive/ephyr/ephyrcursor.c | 2 +-
+ hw/xwayland/xwayland-cursor.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/kdrive/ephyr/ephyrcursor.c b/hw/kdrive/ephyr/ephyrcursor.c
+index f991899c5..3f192d034 100644
+--- a/hw/kdrive/ephyr/ephyrcursor.c
++++ b/hw/kdrive/ephyr/ephyrcursor.c
+@@ -246,7 +246,7 @@ miPointerSpriteFuncRec EphyrPointerSpriteFuncs = {
+ Bool
+ ephyrCursorInit(ScreenPtr screen)
+ {
+-    if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR_BITS,
++    if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR,
+                                sizeof(ephyrCursorRec)))
+         return FALSE;
+ 
+diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c
+index e3c1aaa50..bd94b0cfb 100644
+--- a/hw/xwayland/xwayland-cursor.c
++++ b/hw/xwayland/xwayland-cursor.c
+@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = {
+ Bool
+ xwl_screen_init_cursor(struct xwl_screen *xwl_screen)
+ {
+-    if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0))
++    if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0))
+         return FALSE;
+ 
+     return miPointerInitialize(xwl_screen->screen,
+-- 
+2.43.0
+

0009-modesetting-Use-EGL_MESA_query_driver-to-select-DRI-.patch

@@ -0,0 +1,63 @@
+From ae40c508fbd88869157412a1b159c0d71eb1e708 Mon Sep 17 00:00:00 2001
+From: Kenneth Graunke <kenneth@whitecape.org>
+Date: Thu, 21 Nov 2019 23:03:50 -0800
+Subject: [PATCH xserver 09/11] modesetting: Use EGL_MESA_query_driver to
+ select DRI driver if possible
+
+New now ask Glamor to use EGL_MESA_query_driver to obtain the DRI driver
+name; if successful, we use that as the DRI driver name.  Following the
+existing dri2.c logic, we also use the same name for the VDPAU driver,
+except for i965 (and now iris), where we switch to the "va_gl" fallback.
+
+This allows us to bypass the PCI ID lists in xserver and centralize the
+driver selection mechanism inside Mesa.  The hope is that we no longer
+have to update these lists for any future hardware.
+
+(cherry picked from commit 8d4be7f6c4f7c673d7ec1a6bfdef944907a3916e)
+---
+ hw/xfree86/drivers/modesetting/dri2.c   | 3 ++-
+ hw/xfree86/drivers/modesetting/driver.c | 1 +
+ hw/xfree86/drivers/modesetting/driver.h | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/dri2.c b/hw/xfree86/drivers/modesetting/dri2.c
+index 724d9d34c..255c72cac 100644
+--- a/hw/xfree86/drivers/modesetting/dri2.c
++++ b/hw/xfree86/drivers/modesetting/dri2.c
+@@ -1076,7 +1076,8 @@ ms_dri2_screen_init(ScreenPtr screen)
+     info.CopyRegion2 = ms_dri2_copy_region2;
+ 
+     /* Ask Glamor to obtain the DRI driver name via EGL_MESA_query_driver. */
+-    driver_names[0] = glamor_egl_get_driver_name(screen);
++    if (ms->glamor.egl_get_driver_name)
++        driver_names[0] = ms->glamor.egl_get_driver_name(screen);
+ 
+     if (driver_names[0]) {
+         /* There is no VDPAU driver for Intel, fallback to the generic
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index afba8538a..08cf6a1b4 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -761,6 +761,7 @@ bind_glamor_api(void *mod, modesettingPtr ms)
+     ms->glamor.shareable_fd_from_pixmap = LoaderSymbolFromModule(mod, "glamor_shareable_fd_from_pixmap");
+     ms->glamor.supports_pixmap_import_export = LoaderSymbolFromModule(mod, "glamor_supports_pixmap_import_export");
+     ms->glamor.xv_init = LoaderSymbolFromModule(mod, "glamor_xv_init");
++    ms->glamor.egl_get_driver_name = LoaderSymbolFromModule(mod, "glamor_egl_get_driver_name");
+ }
+ 
+ static void
+diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
+index c6e7cd0c8..328a97de1 100644
+--- a/hw/xfree86/drivers/modesetting/driver.h
++++ b/hw/xfree86/drivers/modesetting/driver.h
+@@ -154,6 +154,7 @@ typedef struct _modesettingRec {
+                                         CARD32 *);
+         Bool (*supports_pixmap_import_export)(ScreenPtr);
+         XF86VideoAdaptorPtr (*xv_init)(ScreenPtr, int);
++        const char *(*egl_get_driver_name)(ScreenPtr);
+     } glamor;
+ 
+ } modesettingRec, *modesettingPtr;
+-- 
+2.33.1
+

0010-modesetting-Fix-build-with-glamor-disabled.patch

@@ -0,0 +1,94 @@
+From d8271417a5986240f1f81cbe269e0cd07a9104d1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Mon, 10 Feb 2020 18:41:44 +0100
+Subject: [PATCH xserver 10/11] modesetting: Fix build with glamor disabled
+
+Fixes: cb1b1e184723 "modesetting: Indirect the glamor API through
+                     LoaderSymbol"
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+(cherry picked from commit 0cb9fa7949d6c5398de220fbdbe1e262e943fcbb)
+---
+ hw/xfree86/drivers/modesetting/driver.c | 21 +++++++++++++++------
+ hw/xfree86/drivers/modesetting/driver.h |  3 ++-
+ 2 files changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
+index 08cf6a1b4..ce8bac9f5 100644
+--- a/hw/xfree86/drivers/modesetting/driver.c
++++ b/hw/xfree86/drivers/modesetting/driver.c
+@@ -743,9 +743,17 @@ FreeRec(ScrnInfoPtr pScrn)
+ 
+ }
+ 
+-static void
+-bind_glamor_api(void *mod, modesettingPtr ms)
++#ifdef GLAMOR_HAS_GBM
++
++static Bool
++load_glamor(ScrnInfoPtr pScrn)
+ {
++    void *mod = xf86LoadSubModule(pScrn, GLAMOR_EGL_MODULE_NAME);
++    modesettingPtr ms = modesettingPTR(pScrn);
++
++    if (!mod)
++        return FALSE;
++
+     ms->glamor.back_pixmap_from_fd = LoaderSymbolFromModule(mod, "glamor_back_pixmap_from_fd");
+     ms->glamor.block_handler = LoaderSymbolFromModule(mod, "glamor_block_handler");
+     ms->glamor.egl_create_textured_pixmap = LoaderSymbolFromModule(mod, "glamor_egl_create_textured_pixmap");
+@@ -762,8 +770,12 @@ bind_glamor_api(void *mod, modesettingPtr ms)
+     ms->glamor.supports_pixmap_import_export = LoaderSymbolFromModule(mod, "glamor_supports_pixmap_import_export");
+     ms->glamor.xv_init = LoaderSymbolFromModule(mod, "glamor_xv_init");
+     ms->glamor.egl_get_driver_name = LoaderSymbolFromModule(mod, "glamor_egl_get_driver_name");
++
++    return TRUE;
+ }
+ 
++#endif
++
+ static void
+ try_enable_glamor(ScrnInfoPtr pScrn)
+ {
+@@ -772,7 +784,6 @@ try_enable_glamor(ScrnInfoPtr pScrn)
+                                                        OPTION_ACCEL_METHOD);
+     Bool do_glamor = (!accel_method_str ||
+                       strcmp(accel_method_str, "glamor") == 0);
+-    void *mod;
+ 
+     ms->drmmode.glamor = FALSE;
+ 
+@@ -787,9 +798,7 @@ try_enable_glamor(ScrnInfoPtr pScrn)
+         return;
+     }
+ 
+-    mod = xf86LoadSubModule(pScrn, GLAMOR_EGL_MODULE_NAME);
+-    if (mod) {
+-        bind_glamor_api(mod, ms);
++    if (load_glamor(pScrn)) {
+         if (ms->glamor.egl_init(pScrn, ms->fd)) {
+             xf86DrvMsg(pScrn->scrnIndex, X_INFO, "glamor initialized\n");
+             ms->drmmode.glamor = TRUE;
+diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
+index 328a97de1..261f1aac4 100644
+--- a/hw/xfree86/drivers/modesetting/driver.h
++++ b/hw/xfree86/drivers/modesetting/driver.h
+@@ -132,6 +132,7 @@ typedef struct _modesettingRec {
+         void (*UpdatePacked)(ScreenPtr, shadowBufPtr);
+     } shadow;
+ 
++#ifdef GLAMOR_HAS_GBM
+     /* glamor API */
+     struct {
+         Bool (*back_pixmap_from_fd)(PixmapPtr, int, CARD16, CARD16, CARD16,
+@@ -156,7 +157,7 @@ typedef struct _modesettingRec {
+         XF86VideoAdaptorPtr (*xv_init)(ScreenPtr, int);
+         const char *(*egl_get_driver_name)(ScreenPtr);
+     } glamor;
+-
++#endif
+ } modesettingRec, *modesettingPtr;
+ 
+ #define glamor_finish(screen) ms->glamor.finish(screen)
+-- 
+2.33.1
+

0011-modesetting-set-gbm-as-dependency-for-autotools.patch

@@ -0,0 +1,33 @@
+From 55fb707d037004e001623a0d066f748d8ba48d48 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Tue, 23 Nov 2021 12:19:48 +0100
+Subject: [PATCH xserver 11/11] modesetting: set gbm as dependency for
+ autotools
+
+Same as commit 9d628ee5f for automake.
+
+Modifiers support needs gbm as a dependency. Without setting the dependency
+included headers are not found reliably and the build might fail if the
+headers are not placed in the default system include paths.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ hw/xfree86/drivers/modesetting/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/drivers/modesetting/Makefile.am b/hw/xfree86/drivers/modesetting/Makefile.am
+index 961c57408..ac5091be3 100644
+--- a/hw/xfree86/drivers/modesetting/Makefile.am
++++ b/hw/xfree86/drivers/modesetting/Makefile.am
+@@ -41,7 +41,7 @@ AM_CPPFLAGS = \
+ 
+ modesetting_drv_la_LTLIBRARIES = modesetting_drv.la
+ modesetting_drv_la_LDFLAGS = -module -avoid-version
+-modesetting_drv_la_LIBADD = $(UDEV_LIBS) $(DRM_LIBS)
++modesetting_drv_la_LIBADD = $(UDEV_LIBS) $(DRM_LIBS) $(GBM_LIBS)
+ modesetting_drv_ladir = @moduledir@/drivers
+ 
+ modesetting_drv_la_SOURCES = \
+-- 
+2.33.1
+

Makefile

@@ -0,0 +1,30 @@
+# Makefile for source rpm: xorg-x11-server
+# $Id$
+NAME := xorg-x11-server
+SPECFILE = $(firstword $(wildcard *.spec))
+
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attempt a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)
+
+ifeq ($(MAKECMDGOALS),me a sandwich)
+.PHONY :: me a sandwich
+me a:
+	@:
+
+sandwich:
+	@[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay.
+endif

SOURCES/0001-Always-install-vbe-and-int10-sdk-headers.patch

@@ -1,37 +0,0 @@
-From e96a83d9b1b5a52a41213c7a4840dc96b4f5b06f Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Wed, 15 Aug 2012 12:35:21 -0400
-Subject: [PATCH] Always install vbe and int10 sdk headers
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/xfree86/Makefile.am | 12 ++----------
- 1 file changed, 2 insertions(+), 10 deletions(-)
-
-diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
-index b876b79..a170b58 100644
---- a/hw/xfree86/Makefile.am
-+++ b/hw/xfree86/Makefile.am
-@@ -26,17 +26,9 @@ if VGAHW
- VGAHW_SUBDIR = vgahw
- endif
- 
--if VBE
--VBE_SUBDIR = vbe
--endif
--
--if INT10MODULE
--INT10_SUBDIR = int10
--endif
--
--SUBDIRS = common ddc x86emu $(INT10_SUBDIR) os-support parser \
-+SUBDIRS = common ddc x86emu int10 os-support parser \
- 	  ramdac $(VGAHW_SUBDIR) loader modes $(DRI_SUBDIR) \
--	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods xkb \
-+	  $(DRI2_SUBDIR) . vbe i2c dixmods xkb \
- 	  fbdevhw shadowfb exa $(XF86UTILS_SUBDIR) doc man \
- 	  $(GLAMOR_EGL_SUBDIR) drivers
- 
--- 
-2.13.6
-

SOURCES/0001-Fix-segfault-on-probing-a-non-PCI-platform-device-on.patch

@@ -1,31 +0,0 @@
-From e50c85f4ebf559a3bac4817b41074c43d4691779 Mon Sep 17 00:00:00 2001
-From: Eric Anholt <eric@anholt.net>
-Date: Fri, 26 Oct 2018 17:47:30 -0700
-Subject: [PATCH xserver] Fix segfault on probing a non-PCI platform device on
- a system with PCI.
-
-Some Broadcom set-top-box boards have PCI busses, but the GPU is still
-probed through DT.  We would dereference a null busid here in that
-case.
-
-Signed-off-by: Eric Anholt <eric@anholt.net>
----
- hw/xfree86/common/xf86platformBus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
-index cef47da03..dadbac6c8 100644
---- a/hw/xfree86/common/xf86platformBus.c
-+++ b/hw/xfree86/common/xf86platformBus.c
-@@ -289,7 +289,7 @@ xf86platformProbe(void)
-     for (i = 0; i < xf86_num_platform_devices; i++) {
-         char *busid = xf86_platform_odev_attributes(i)->busid;
- 
--        if (pci && (strncmp(busid, "pci:", 4) == 0)) {
-+        if (pci && busid && (strncmp(busid, "pci:", 4) == 0)) {
-             platform_find_pci_info(&xf86_platform_devices[i], busid);
-         }
- 
--- 
-2.14.4
-

SOURCES/0001-link-with-z-now.patch

@@ -1,214 +0,0 @@
-From e84d6f25015d36202fd524b8b8d85d2324348ddb Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Mon, 19 Nov 2018 11:27:09 -0500
-Subject: [PATCH] link with -z now
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/dmx/Makefile.am               | 2 +-
- hw/kdrive/ephyr/Makefile.am      | 2 +-
- hw/vfb/Makefile.am               | 2 +-
- hw/xfree86/Makefile.am           | 3 ++-
- hw/xfree86/dixmods/Makefile.am   | 6 +++---
- hw/xfree86/exa/Makefile.am       | 2 +-
- hw/xfree86/fbdevhw/Makefile.am   | 2 +-
- hw/xfree86/int10/Makefile.am     | 2 +-
- hw/xfree86/shadowfb/Makefile.am  | 2 +-
- hw/xfree86/utils/cvt/Makefile.am | 1 +
- hw/xfree86/utils/gtf/Makefile.am | 1 +
- hw/xfree86/vgahw/Makefile.am     | 2 +-
- hw/xnest/Makefile.am             | 2 +-
- hw/xwayland/Makefile.am          | 2 +-
- 14 files changed, 17 insertions(+), 14 deletions(-)
-
-diff --git a/hw/dmx/Makefile.am b/hw/dmx/Makefile.am
-index eef84cb..9ab20cc 100644
---- a/hw/dmx/Makefile.am
-+++ b/hw/dmx/Makefile.am
-@@ -78,7 +78,7 @@ XDMX_LIBS = \
-         input/libdmxinput.a \
-         config/libdmxconfig.a
- 
--Xdmx_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xdmx_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- Xdmx_DEPENDENCIES= $(XDMX_LIBS)
- Xdmx_LDADD = $(XDMX_LIBS) $(XDMX_SYS_LIBS) $(XSERVER_SYS_LIBS)
- 
-diff --git a/hw/kdrive/ephyr/Makefile.am b/hw/kdrive/ephyr/Makefile.am
-index d12559b..cc37add 100644
---- a/hw/kdrive/ephyr/Makefile.am
-+++ b/hw/kdrive/ephyr/Makefile.am
-@@ -78,7 +78,7 @@ Xephyr_LDADD = 						\
- 
- Xephyr_DEPENDENCIES = @KDRIVE_LOCAL_LIBS@ $(XEPHYR_GLAMOR_LIB)
- 
--Xephyr_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xephyr_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -W,-z,now -pie
- 
- relink:
- 	$(AM_V_at)rm -f $(bin_PROGRAMS) && $(MAKE) $(bin_PROGRAMS)
-diff --git a/hw/vfb/Makefile.am b/hw/vfb/Makefile.am
-index 7033397..c09a9c9 100644
---- a/hw/vfb/Makefile.am
-+++ b/hw/vfb/Makefile.am
-@@ -20,7 +20,7 @@ XVFB_LIBS = \
- 
- Xvfb_LDADD = $(XVFB_LIBS) $(XVFB_SYS_LIBS) $(XSERVER_SYS_LIBS)
- Xvfb_DEPENDENCIES = $(XVFB_LIBS)
--Xvfb_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xvfb_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- relink:
- 	$(AM_V_at)rm -f Xvfb$(EXEEXT) && $(MAKE) Xvfb$(EXEEXT)
-diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
-index 32f98b5..5955148 100644
---- a/hw/xfree86/Makefile.am
-+++ b/hw/xfree86/Makefile.am
-@@ -78,12 +78,13 @@ Xorg_LDADD = \
-             $(XSERVER_SYS_LIBS)
- Xorg_DEPENDENCIES = $(LOCAL_LIBS)
- 
--Xorg_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xorg_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- if SUID_WRAPPER
- wrapexecdir = $(SUID_WRAPPER_DIR)
- wrapexec_PROGRAMS = Xorg.wrap
- Xorg_wrap_SOURCES = xorg-wrapper.c
-+Xorg_wrap_LDFLAGS = -Wl,-z,now -pie
- endif
- 
- BUILT_SOURCES = xorg.conf.example
-diff --git a/hw/xfree86/dixmods/Makefile.am b/hw/xfree86/dixmods/Makefile.am
-index 856659f..6ab101b 100644
---- a/hw/xfree86/dixmods/Makefile.am
-+++ b/hw/xfree86/dixmods/Makefile.am
-@@ -17,17 +17,17 @@ AM_CPPFLAGS = @XORG_INCS@ \
-            -I$(top_srcdir)/miext/shadow \
-            -I$(top_srcdir)/glx
- 
--libfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libfb_la_LIBADD = $(top_builddir)/fb/libfb.la
- libfb_la_SOURCES = fbmodule.c
- libfb_la_CFLAGS = $(AM_CFLAGS)
- 
--libwfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libwfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libwfb_la_LIBADD = $(top_builddir)/fb/libwfb.la
- libwfb_la_SOURCES = fbmodule.c
- libwfb_la_CFLAGS = $(AM_CFLAGS) -DFB_ACCESS_WRAPPER
- 
--libglx_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libglx_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libglx_la_LIBADD = $(top_builddir)/glx/libglx.la $(GLX_SYS_LIBS)
- if DRI2
- libglx_la_LIBADD += $(top_builddir)/glx/libglxdri.la
-diff --git a/hw/xfree86/exa/Makefile.am b/hw/xfree86/exa/Makefile.am
-index ccbb305..7bf7137 100644
---- a/hw/xfree86/exa/Makefile.am
-+++ b/hw/xfree86/exa/Makefile.am
-@@ -2,7 +2,7 @@ SUBDIRS = man
- 
- module_LTLIBRARIES = libexa.la
- 
--libexa_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libexa_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- 
- AM_CPPFLAGS = \
- 	$(XORG_INCS) \
-diff --git a/hw/xfree86/fbdevhw/Makefile.am b/hw/xfree86/fbdevhw/Makefile.am
-index 37cd88c..895cfab 100644
---- a/hw/xfree86/fbdevhw/Makefile.am
-+++ b/hw/xfree86/fbdevhw/Makefile.am
-@@ -2,7 +2,7 @@ SUBDIRS = man
- 
- module_LTLIBRARIES = libfbdevhw.la
- 
--libfbdevhw_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libfbdevhw_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- 
- if FBDEVHW
- libfbdevhw_la_SOURCES = fbdevhw.c
-diff --git a/hw/xfree86/int10/Makefile.am b/hw/xfree86/int10/Makefile.am
-index 66cb14d..aad47a1 100644
---- a/hw/xfree86/int10/Makefile.am
-+++ b/hw/xfree86/int10/Makefile.am
-@@ -4,7 +4,7 @@ sdk_HEADERS = xf86int10.h
- 
- EXTRA_CFLAGS =
- 
--libint10_la_LDFLAGS = -avoid-version
-+libint10_la_LDFLAGS = -avoid-version -Wl,-z,now
- libint10_la_LIBADD = $(PCIACCESS_LIBS)
- 
- COMMON_SOURCES = \
-diff --git a/hw/xfree86/shadowfb/Makefile.am b/hw/xfree86/shadowfb/Makefile.am
-index 67fb2e4..a8c2d59 100644
---- a/hw/xfree86/shadowfb/Makefile.am
-+++ b/hw/xfree86/shadowfb/Makefile.am
-@@ -1,5 +1,5 @@
- module_LTLIBRARIES = libshadowfb.la
--libshadowfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libshadowfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libshadowfb_la_SOURCES = sfbmodule.c shadowfb.c
- libshadowfb_la_LIBADD = $(PIXMAN_LIBS)
- 
-diff --git a/hw/xfree86/utils/cvt/Makefile.am b/hw/xfree86/utils/cvt/Makefile.am
-index 26abeb4..19b0eba 100644
---- a/hw/xfree86/utils/cvt/Makefile.am
-+++ b/hw/xfree86/utils/cvt/Makefile.am
-@@ -33,3 +33,4 @@ cvt_SOURCES = cvt.c \
- 	$(top_srcdir)/os/xprintf.c
- 
- cvt_CFLAGS = $(DIX_CFLAGS) $(XORG_CFLAGS)
-+cvt_LDFLAGS = -Wl,-z,now -pie
-diff --git a/hw/xfree86/utils/gtf/Makefile.am b/hw/xfree86/utils/gtf/Makefile.am
-index f77bf60..f520fb9 100644
---- a/hw/xfree86/utils/gtf/Makefile.am
-+++ b/hw/xfree86/utils/gtf/Makefile.am
-@@ -25,3 +25,4 @@ bin_PROGRAMS = gtf
- gtf_SOURCES = gtf.c
- gtf_CFLAGS = $(XORG_CFLAGS)
- gtf_LDADD = -lm
-+gtf_LDFLAGS = -Wl,-z,now -pie
-diff --git a/hw/xfree86/vgahw/Makefile.am b/hw/xfree86/vgahw/Makefile.am
-index b8196a6..37ac499 100644
---- a/hw/xfree86/vgahw/Makefile.am
-+++ b/hw/xfree86/vgahw/Makefile.am
-@@ -1,5 +1,5 @@
- module_LTLIBRARIES = libvgahw.la
--libvgahw_la_LDFLAGS = -avoid-version
-+libvgahw_la_LDFLAGS = -avoid-version -Wl,-z,now
- libvgahw_la_LIBADD = $(PCIACCESS_LIBS)
- libvgahw_la_SOURCES = vgaHW.c vgaHWmodule.c
- AM_CPPFLAGS = $(XORG_INCS) -I$(srcdir)/../ddc -I$(srcdir)/../i2c
-diff --git a/hw/xnest/Makefile.am b/hw/xnest/Makefile.am
-index c77da64..185803c 100644
---- a/hw/xnest/Makefile.am
-+++ b/hw/xnest/Makefile.am
-@@ -51,7 +51,7 @@ Xnest_SOURCES = $(SRCS)
- 
- Xnest_DEPENDENCIES = $(XNEST_LIBS)
- Xnest_LDADD = $(XNEST_LIBS) $(XNEST_SYS_LIBS) $(XSERVER_SYS_LIBS)
--Xnest_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xnest_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- EXTRA_DIST = icon \
-              screensaver
-diff --git a/hw/xwayland/Makefile.am b/hw/xwayland/Makefile.am
-index bc1cb85..2f70cd1 100644
---- a/hw/xwayland/Makefile.am
-+++ b/hw/xwayland/Makefile.am
-@@ -28,7 +28,7 @@ Xwayland_LDADD =				\
- 	$(XWAYLAND_SYS_LIBS)			\
- 	$(top_builddir)/Xext/libXvidmode.la	\
- 	$(XSERVER_SYS_LIBS)
--Xwayland_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xwayland_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- Xwayland_built_sources =
- 
--- 
-2.19.1
-

SOURCES/0001-linux-Fix-platform-device-PCI-detection-for-complex-.patch

@@ -1,45 +0,0 @@
-From b6e18eb57f3dd104704d0a5ec3d2f051645b9068 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Wed, 19 Jun 2019 14:23:56 -0400
-Subject: [PATCH xserver] linux: Fix platform device PCI detection for complex
- bus topologies
-
-Suppose you're in a Hyper-V guest and are trying to use PCI passthrough.
-The ID_PATH that udev will construct for that looks something like
-"acpi-VMBUS:00-pci-b8c8:00:00.0", and obviously looking for "pci-" in
-the first four characters of that is going to not work.
-
-Instead, strstr. I suppose it's possible you could have _multiple_ PCI
-buses in the path, in which case you'd want strrstr, if that were a
-thing.
----
- config/udev.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/config/udev.c b/config/udev.c
-index 314acba6ce..6e11aa3b88 100644
---- a/config/udev.c
-+++ b/config/udev.c
-@@ -474,7 +474,7 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
-                                config_odev_probe_proc_ptr probe_callback)
- {
-     struct OdevAttributes *attribs = config_odev_allocate_attributes();
--    const char *value;
-+    const char *value, *str;
- 
-     attribs->path = XNFstrdup(path);
-     attribs->syspath = XNFstrdup(syspath);
-@@ -482,8 +482,8 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
-     attribs->minor = minor;
- 
-     value = udev_device_get_property_value(udev_device, "ID_PATH");
--    if (value && !strncmp(value, "pci-", 4)) {
--        attribs->busid = XNFstrdup(value);
-+    if (value && (str = strstr(value, "pci-"))) {
-+        attribs->busid = XNFstrdup(str);
-         attribs->busid[3] = ':';
-     }
- 
--- 
-2.21.0
-

SOURCES/0001-linux-Make-platform-device-probe-less-fragile.patch

@@ -1,129 +0,0 @@
-From 28320833d61af76dc3b77b985c69706f3e021836 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 18 Sep 2018 14:37:51 -0400
-Subject: [PATCH xserver] linux: Make platform device probe less fragile
-
-At the point where xf86BusProbe runs we haven't yet taken our own VT,
-which means we can't perform drm "master" operations on the device. This
-is tragic, because we need master to fish the bus id string out of the
-kernel, which we can only do after drmSetInterfaceVersion, which for
-some reason stores that string on the device not the file handle and
-thus needs master access.
-
-Fortunately we know the format of the busid string, and it happens to
-almost be the same as the ID_PATH variable from udev. Use that instead
-and stop calling drmSetInterfaceVersion.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- config/udev.c                              | 17 ++++++++++++-----
- hw/xfree86/os-support/linux/lnx_platform.c | 13 ++-----------
- 2 files changed, 14 insertions(+), 16 deletions(-)
-
-diff --git a/config/udev.c b/config/udev.c
-index 3a73189e25..8c6c4b6665 100644
---- a/config/udev.c
-+++ b/config/udev.c
-@@ -56,7 +56,7 @@ static struct udev_monitor *udev_monitor;
- 
- #ifdef CONFIG_UDEV_KMS
- static void
--config_udev_odev_setup_attribs(const char *path, const char *syspath,
-+config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
-                                int major, int minor,
-                                config_odev_probe_proc_ptr probe_callback);
- #endif
-@@ -128,7 +128,7 @@ device_added(struct udev_device *udev_device)
- 
-         LogMessage(X_INFO, "config/udev: Adding drm device (%s)\n", path);
- 
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
-                                        minor(devnum), NewGPUDeviceRequest);
-         return;
-     }
-@@ -322,7 +322,7 @@ device_removed(struct udev_device *device)
- 
-         LogMessage(X_INFO, "config/udev: removing GPU device %s %s\n",
-                    syspath, path);
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(device, path, syspath, major(devnum),
-                                        minor(devnum), DeleteGPUDeviceRequest);
-         /* Retry vtenter after a drm node removal */
-         systemd_logind_vtenter();
-@@ -465,17 +465,24 @@ config_udev_fini(void)
- #ifdef CONFIG_UDEV_KMS
- 
- static void
--config_udev_odev_setup_attribs(const char *path, const char *syspath,
-+config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
-                                int major, int minor,
-                                config_odev_probe_proc_ptr probe_callback)
- {
-     struct OdevAttributes *attribs = config_odev_allocate_attributes();
-+    const char *value;
- 
-     attribs->path = XNFstrdup(path);
-     attribs->syspath = XNFstrdup(syspath);
-     attribs->major = major;
-     attribs->minor = minor;
- 
-+    value = udev_device_get_property_value(udev_device, "ID_PATH");
-+    if (value && !strncmp(value, "pci-", 4)) {
-+        attribs->busid = XNFstrdup(value);
-+        attribs->busid[3] = ':';
-+    }
-+
-     /* ownership of attribs is passed to probe layer */
-     probe_callback(attribs);
- }
-@@ -516,7 +523,7 @@ config_udev_odev_probe(config_odev_probe_proc_ptr probe_callback)
-         else if (!check_seat(udev_device))
-             goto no_probe;
- 
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
-                                        minor(devnum), probe_callback);
-     no_probe:
-         udev_device_unref(udev_device);
-diff --git a/hw/xfree86/os-support/linux/lnx_platform.c b/hw/xfree86/os-support/linux/lnx_platform.c
-index 70374ace88..0eb6d22875 100644
---- a/hw/xfree86/os-support/linux/lnx_platform.c
-+++ b/hw/xfree86/os-support/linux/lnx_platform.c
-@@ -30,6 +30,8 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     int err = 0;
-     Bool paused, server_fd = FALSE;
- 
-+    LogMessage(X_INFO, "Platform probe for %s\n", attribs->syspath);
-+
-     fd = systemd_logind_take_fd(attribs->major, attribs->minor, path, &paused);
-     if (fd != -1) {
-         if (paused) {
-@@ -53,13 +55,6 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     sv.drm_dd_major = -1;       /* Don't care */
-     sv.drm_dd_minor = -1;       /* Don't care */
- 
--    err = drmSetInterfaceVersion(fd, &sv);
--    if (err) {
--        xf86Msg(X_ERROR, "%s: failed to set DRM interface version 1.4: %s\n",
--                path, strerror(-err));
--        goto out;
--    }
--
-     /* for a delayed probe we've already added the device */
-     if (delayed_index == -1) {
-             xf86_add_platform_device(attribs, FALSE);
-@@ -69,10 +64,6 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     if (server_fd)
-         xf86_platform_devices[delayed_index].flags |= XF86_PDEV_SERVER_FD;
- 
--    buf = drmGetBusid(fd);
--    xf86_platform_odev_attributes(delayed_index)->busid = XNFstrdup(buf);
--    drmFreeBusid(buf);
--
-     v = drmGetVersion(fd);
-     if (!v) {
-         xf86Msg(X_ERROR, "%s: failed to query DRM version\n", path);
--- 
-2.19.0
-

SOURCES/0001-modesetting-Reduce-glamor-initialization-failed-mess.patch

@@ -1,37 +0,0 @@
-From 41e265988a0b6ec456ddd562253e0f82a7c2ede2 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Fri, 27 Sep 2019 11:43:52 -0400
-Subject: [PATCH xserver] modesetting: Reduce "glamor initialization failed"
- message to X_INFO
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This might be an error or not, for example refusing to work on llvmpipe
-is normal and expected. glamor_egl_init() will print X_ERROR messages if
-appropriate, so we don't need to here.
-
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-
-(cherry picked from commit cbdde938cbaf604741cd057fac743859ada342ec)
-Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
----
- hw/xfree86/drivers/modesetting/driver.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
-index 2aaea5f7d..783d53eaa 100644
---- a/hw/xfree86/drivers/modesetting/driver.c
-+++ b/hw/xfree86/drivers/modesetting/driver.c
-@@ -772,7 +772,7 @@ try_enable_glamor(ScrnInfoPtr pScrn)
-             xf86DrvMsg(pScrn->scrnIndex, X_INFO, "glamor initialized\n");
-             ms->drmmode.glamor = TRUE;
-         } else {
--            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
-+            xf86DrvMsg(pScrn->scrnIndex, X_INFO,
-                        "glamor initialization failed\n");
-         }
-     } else {
--- 
-2.26.2
-

SOURCES/0001-mustard-Add-DRI2-fallback-driver-mappings-for-i965-a.patch

@@ -1,28 +0,0 @@
-From efb4bc5b3da511d128144840d7eb3cf3c7cfa0ae Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 3 Sep 2019 12:10:37 -0400
-Subject: [PATCH] mustard: Add DRI2 fallback driver mappings for i965 and
- radeonsi
-
----
- hw/xfree86/dri2/pci_ids/pci_id_driver_map.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-index 689a570..3825f52 100644
---- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-+++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-@@ -45,8 +45,10 @@ static const struct {
-    int num_chips_ids;
- } driver_map[] = {
-    { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
-+   { 0x8086, "i965", "va_gl", NULL, -1 },
-    { 0x1002, "r600","r600",  r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
-    { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
-+   { 0x1002, "radeonsi", "radeonsi", NULL, -1 },
-    { 0x10de, "nouveau", "nouveau", NULL, -1 },
-    { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) },
-    { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) },
--- 
-2.23.0
-

SOURCES/0001-mustard-Don-t-probe-for-drivers-not-shipped-in-RHEL8.patch

@@ -1,278 +0,0 @@
-From b6e50ece375b6b1fbe053b30b52fc40dde5c682b Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 13 Nov 2018 10:11:36 -0500
-Subject: [PATCH] mustard: Don't probe for drivers not shipped in RHEL8
-
-As with RHEL7, this is mostly to keep spurious probe messages out of the
-X log and prevent questions like "why isn't it loading mga on my
-G200SE" or "why isn't it loading radeon_dri.so on my RN50".
----
- hw/xfree86/common/xf86pciBus.c              | 162 --------------------
- hw/xfree86/dri2/pci_ids/pci_id_driver_map.h |  32 ----
- 2 files changed, 194 deletions(-)
-
-diff --git a/hw/xfree86/common/xf86pciBus.c b/hw/xfree86/common/xf86pciBus.c
-index b7f9999..398ed45 100644
---- a/hw/xfree86/common/xf86pciBus.c
-+++ b/hw/xfree86/common/xf86pciBus.c
-@@ -1074,107 +1074,12 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
-     const char *driverList[5] = { NULL, NULL, NULL, NULL, NULL };
- 
-     switch (dev->vendor_id) {
--        /* AMD Geode LX */
--    case 0x1022:
--        if (dev->device_id == 0x2081)
--            driverList[0] = "geode";
--        break;
--        /* older Geode products acquired by AMD still carry an NSC vendor_id */
--    case 0x100b:
--        if (dev->device_id == 0x0030) {
--            /* NSC Geode GX2 specifically */
--            driverList[0] = "geode";
--            /* GX2 support started its life in the NSC tree and was later
--               forked by AMD for GEODE so we keep it as a backup */
--            driverList[1] = "nsc";
--        }
--        else
--            /* other NSC variant e.g. 0x0104 (SC1400), 0x0504 (SCx200) */
--            driverList[0] = "nsc";
--        break;
--        /* Cyrix Geode GX1 */
--    case 0x1078:
--        if (dev->device_id == 0x0104)
--            driverList[0] = "cyrix";
--        break;
--    case 0x1142:
--        driverList[0] = "apm";
--        break;
--    case 0xedd8:
--        driverList[0] = "ark";
--        break;
--    case 0x1a03:
--        driverList[0] = "ast";
--        break;
-     case 0x1002:
-         driverList[0] = "ati";
-         break;
--    case 0x102c:
--        driverList[0] = "chips";
--        break;
--    case 0x1013:
--        driverList[0] = "cirrus";
--        break;
--    case 0x3d3d:
--        driverList[0] = "glint";
--        break;
--    case 0x105d:
--        driverList[0] = "i128";
--        break;
-     case 0x8086:
- 	switch (dev->device_id)
- 	{
--		/* Intel i740 */
--		case 0x00d1:
--		case 0x7800:
--			driverList[0] = "i740";
--			break;
--		/* GMA500/Poulsbo */
--		case 0x8108:
--		case 0x8109:
--			/* Try psb driver on Poulsbo - if available */
--			driverList[0] = "psb";
--			driverList[1] = "psb_drv";
--			break;
--		/* GMA600/Oaktrail */
--		case 0x4100:
--		case 0x4101:
--		case 0x4102:
--		case 0x4103:
--		case 0x4104:
--		case 0x4105:
--		case 0x4106:
--		case 0x4107:
--		/* Atom E620/Oaktrail */
--		case 0x4108:
--		/* Medfield */
--		case 0x0130:
--		case 0x0131:
--		case 0x0132:
--		case 0x0133:
--		case 0x0134:
--		case 0x0135:
--		case 0x0136:
--		case 0x0137:
--		/* GMA 3600/CDV */
--		case 0x0be0:
--		case 0x0be1:
--		case 0x0be2:
--		case 0x0be3:
--		case 0x0be4:
--		case 0x0be5:
--		case 0x0be6:
--		case 0x0be7:
--		case 0x0be8:
--		case 0x0be9:
--		case 0x0bea:
--		case 0x0beb:
--		case 0x0bec:
--		case 0x0bed:
--		case 0x0bee:
--		case 0x0bef:
--			/* Use fbdev/vesa driver on Oaktrail, Medfield, CDV */
--			break;
- 		/* Default to intel only on pre-gen4 chips */
- 		case 0x3577:
- 		case 0x2562:
-@@ -1196,14 +1101,7 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
- 			break;
-         }
-         break;
--    case 0x102b:
--        driverList[0] = "mga";
--        break;
--    case 0x10c8:
--        driverList[0] = "neomagic";
--        break;
-     case 0x10de:
--    case 0x12d2:
-     {
-         int idx = 0;
- 
-@@ -1229,77 +1127,17 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
- 
-         driverList[idx++] = "nouveau";
- #endif
--        driverList[idx++] = "nv";
-         break;
-     }
--    case 0x1106:
--        driverList[0] = "openchrome";
--        break;
-     case 0x1b36:
-         driverList[0] = "qxl";
-         break;
--    case 0x1163:
--        driverList[0] = "rendition";
--        break;
--    case 0x5333:
--        switch (dev->device_id) {
--        case 0x88d0:
--        case 0x88d1:
--        case 0x88f0:
--        case 0x8811:
--        case 0x8812:
--        case 0x8814:
--        case 0x8901:
--            driverList[0] = "s3";
--            break;
--        case 0x5631:
--        case 0x883d:
--        case 0x8a01:
--        case 0x8a10:
--        case 0x8c01:
--        case 0x8c03:
--        case 0x8904:
--        case 0x8a13:
--            driverList[0] = "s3virge";
--            break;
--        default:
--            driverList[0] = "savage";
--            break;
--        }
--        break;
--    case 0x1039:
--        driverList[0] = "sis";
--        break;
--    case 0x126f:
--        driverList[0] = "siliconmotion";
--        break;
--    case 0x121a:
--        if (dev->device_id < 0x0003)
--            driverList[0] = "voodoo";
--        else
--            driverList[0] = "tdfx";
--        break;
--    case 0x1011:
--        driverList[0] = "tga";
--        break;
--    case 0x1023:
--        driverList[0] = "trident";
--        break;
--    case 0x100c:
--        driverList[0] = "tseng";
--        break;
-     case 0x80ee:
-         driverList[0] = "vboxvideo";
-         break;
-     case 0x15ad:
-         driverList[0] = "vmware";
-         break;
--    case 0x18ca:
--        if (dev->device_id == 0x47)
--            driverList[0] = "xgixp";
--        else
--            driverList[0] = "xgi";
--        break;
-     default:
-         break;
-     }
-diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-index 7036d10..689a570 100644
---- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-+++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-@@ -7,38 +7,12 @@
- #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
- #endif
- 
--static const int i915_chip_ids[] = {
--#define CHIPSET(chip, desc, name) chip,
--#include "pci_ids/i915_pci_ids.h"
--#undef CHIPSET
--};
--
- static const int i965_chip_ids[] = {
- #define CHIPSET(chip, family, name) chip,
- #include "pci_ids/i965_pci_ids.h"
- #undef CHIPSET
- };
- 
--#ifndef DRIVER_MAP_GALLIUM_ONLY
--static const int r100_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/radeon_pci_ids.h"
--#undef CHIPSET
--};
--
--static const int r200_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/r200_pci_ids.h"
--#undef CHIPSET
--};
--#endif
--
--static const int r300_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/r300_pci_ids.h"
--#undef CHIPSET
--};
--
- static const int r600_chip_ids[] = {
- #define CHIPSET(chip, name, family) chip,
- #include "pci_ids/r600_pci_ids.h"
-@@ -70,13 +44,7 @@ static const struct {
-    const int *chip_ids;
-    int num_chips_ids;
- } driver_map[] = {
--   { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) },
-    { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
--#ifndef DRIVER_MAP_GALLIUM_ONLY
--   { 0x1002, "radeon", "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) },
--   { 0x1002, "r200", "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) },
--#endif
--   { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) },
-    { 0x1002, "r600","r600",  r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
-    { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
-    { 0x10de, "nouveau", "nouveau", NULL, -1 },
--- 
-2.19.1
-

SOURCES/0001-mustard-Work-around-broken-fbdev-headers.patch

@@ -1,34 +0,0 @@
-From a4fc2f3a55776018eda20e09c11b3710f8f0e542 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Fri, 26 Oct 2018 14:16:17 -0400
-Subject: [PATCH xserver] mustard: Work around broken fbdev headers
-
-This configure check is somewhat pointless as we have our own copy of
-the fbdev ioctl declarations. There's also a bug in the version of the
-kernel headers I happen to want to build against, where an IS_ENABLED()
-escaped into uapi like it oughtn't.
-
-Nerf the test so we build the right fbdevhw code.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- configure.ac | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 57a2331024..2b8477ed61 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -197,8 +197,7 @@ AC_CHECK_HEADERS([linux/agpgart.h sys/agpio.h sys/agpgart.h], AGP=yes)
- AM_CONDITIONAL(AGP, [test "x$AGP" = xyes])
- 
- dnl fbdev header
--AC_CHECK_HEADERS([linux/fb.h], FBDEV=yes)
--AM_CONDITIONAL(FBDEVHW, [test "x$FBDEV" = xyes])
-+AM_CONDITIONAL(FBDEVHW, true)
- 
- dnl FreeBSD kldload support (sys/linker.h)
- AC_CHECK_HEADERS([sys/linker.h],
--- 
-2.19.1
-

SOURCES/0001-xf86-logind-Fix-drm_drop_master-before-vt_reldisp.patch

@@ -1,167 +0,0 @@
-From dafe5f6358edd557d89bb63265d6df2e1249f106 Mon Sep 17 00:00:00 2001
-From: Jocelyn Falempe <jfalempe@redhat.com>
-Date: Thu, 18 Nov 2021 14:45:42 +0100
-Subject: [PATCH] xf86/logind: fix call systemd_logind_vtenter after receiving
- drm device resume
-
-logind send the resume event for input devices and drm device,
-in any order. if we call vt_enter before logind resume the drm device,
-it leads to a driver error, because logind has not done the
-DRM_IOCTL_SET_MASTER on it.
-
-Keep the old workaround to make sure we call systemd_logind_vtenter at
-least once if there are no platform device
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: Fix drm_drop_master before vt_reldisp
-
-When switching to VT, the ioctl DRM_DROP_MASTER must be done before
-the ioctl VT_RELDISP. Otherwise the kernel can't change the modesetting
-reliably, and this leads to the console not showing up in some cases, like
-after unplugging a docking station with a DP or HDMI monitor.
-
-Before doing the VT_RELDISP, send a dbus message to logind, to
-pause the drm device, so logind will do the ioctl DRM_DROP_MASTER.
-
-With this patch, it changes the order logind will send the resume
-event, and drm will be sent last instead of first.
-so there is a also fix to call systemd_logind_vtenter() at the right time.
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: Fix compilation error when built without logind/platform bus
-
-This was introduced by commit 8eb1396d
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1269
-Fixes: da9d012a9 - xf86/logind: Fix drm_drop_master before vt_reldisp
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: fix missing call to vtenter if the platform device is not paused
-
-If there is one platform device, which is not paused nor resumed,
-systemd_logind_vtenter() will never get called.
-This break suspend/resume, and switching to VT on system with Nvidia
-proprietary driver.
-This is a regression introduced by f5bd039633fa83
-
-So now call systemd_logind_vtenter() if there are no paused
-platform devices.
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1271
-Fixes: f5bd0396 - xf86/logind: fix call systemd_logind_vtenter after receiving drm device resume
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Tested-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
----
- hw/xfree86/common/xf86Events.c               |  4 ++
- hw/xfree86/os-support/linux/systemd-logind.c | 41 +++++++++++++++++---
- include/systemd-logind.h                     |  2 +
- 3 files changed, 42 insertions(+), 5 deletions(-)
-
-diff --git a/hw/xfree86/common/xf86Events.c b/hw/xfree86/common/xf86Events.c
-index 8a800bd8f..b683d233b 100644
---- a/hw/xfree86/common/xf86Events.c
-+++ b/hw/xfree86/common/xf86Events.c
-@@ -393,6 +393,10 @@ xf86VTLeave(void)
-     for (i = 0; i < xf86NumGPUScreens; i++)
-         xf86GPUScreens[i]->LeaveVT(xf86GPUScreens[i]);
- 
-+    if (systemd_logind_controls_session()) {
-+        systemd_logind_drop_master();
-+    }
-+
-     if (!xf86VTSwitchAway())
-         goto switch_failed;
- 
-diff --git a/hw/xfree86/os-support/linux/systemd-logind.c b/hw/xfree86/os-support/linux/systemd-logind.c
-index 13784d15c..bd7a341f0 100644
---- a/hw/xfree86/os-support/linux/systemd-logind.c
-+++ b/hw/xfree86/os-support/linux/systemd-logind.c
-@@ -302,6 +302,37 @@ cleanup:
-     dbus_error_free(&error);
- }
- 
-+/*
-+ * Send a message to logind, to pause the drm device
-+ * and ensure the drm_drop_master is done before
-+ * VT_RELDISP when switching VT
-+ */
-+void systemd_logind_drop_master(void)
-+{
-+    int i;
-+    for (i = 0; i < xf86_num_platform_devices; i++) {
-+        if (xf86_platform_devices[i].flags & XF86_PDEV_SERVER_FD) {
-+            dbus_int32_t major, minor;
-+            struct systemd_logind_info *info = &logind_info;
-+
-+            xf86_platform_devices[i].flags |= XF86_PDEV_PAUSED;
-+            major = xf86_platform_odev_attributes(i)->major;
-+            minor = xf86_platform_odev_attributes(i)->minor;
-+            systemd_logind_ack_pause(info, minor, major);
-+        }
-+    }
-+}
-+
-+static Bool are_platform_devices_resumed(void) {
-+    int i;
-+    for (i = 0; i < xf86_num_platform_devices; i++) {
-+        if (xf86_platform_devices[i].flags & XF86_PDEV_PAUSED) {
-+            return FALSE;
-+        }
-+    }
-+    return TRUE;
-+}
-+
- static DBusHandlerResult
- message_filter(DBusConnection * connection, DBusMessage * message, void *data)
- {
-@@ -417,14 +448,14 @@ message_filter(DBusConnection * connection, DBusMessage * message, void *data)
-         /* info->vt_active gets set by systemd_logind_vtenter() */
-         info->active = TRUE;
- 
--        if (pdev)
-+        if (pdev) {
-             pdev->flags &= ~XF86_PDEV_PAUSED;
--        else
-+        } else
-             systemd_logind_set_input_fd_for_all_devs(major, minor, fd,
-                                                      info->vt_active);
--
--        /* Always call vtenter(), in case there are only legacy video devs */
--        systemd_logind_vtenter();
-+        /* Call vtenter if all platform devices are resumed, or if there are no platform device */
-+        if (are_platform_devices_resumed())
-+            systemd_logind_vtenter();
-     }
-     return DBUS_HANDLER_RESULT_HANDLED;
- }
-diff --git a/include/systemd-logind.h b/include/systemd-logind.h
-index a4067d097..5c04d0130 100644
---- a/include/systemd-logind.h
-+++ b/include/systemd-logind.h
-@@ -33,6 +33,7 @@ int systemd_logind_take_fd(int major, int minor, const char *path, Bool *paus);
- void systemd_logind_release_fd(int major, int minor, int fd);
- int systemd_logind_controls_session(void);
- void systemd_logind_vtenter(void);
-+void systemd_logind_drop_master(void);
- #else
- #define systemd_logind_init()
- #define systemd_logind_fini()
-@@ -40,6 +41,7 @@ void systemd_logind_vtenter(void);
- #define systemd_logind_release_fd(major, minor, fd) close(fd)
- #define systemd_logind_controls_session() 0
- #define systemd_logind_vtenter()
-+#define systemd_logind_drop_master()
- #endif
- 
- #endif
--- 
-2.33.1
-

SOURCES/0001-xfree86-Don-t-autoconfigure-vesa-or-fbdev.patch

@@ -1,27 +0,0 @@
-From e4dce2bfaf4a61dd8a8ac099638489d4fdff9024 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 29 May 2018 15:05:10 -0400
-Subject: [PATCH] xfree86: Don't autoconfigure vesa or fbdev
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/xfree86/loader/loadmod.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
-index a6356bd..1c1c2b1 100644
---- a/hw/xfree86/loader/loadmod.c
-+++ b/hw/xfree86/loader/loadmod.c
-@@ -383,6 +383,9 @@ LoaderListDir(const char *subdir, const char **patternlist)
-                 strcpy(fp, dp->d_name);
-                 if (!(stat(buf, &stat_buf) == 0 && S_ISREG(stat_buf.st_mode)))
-                     continue;
-+                if (!strcmp(subdir, "drivers") &&
-+                            (strstr(dp->d_name, "vesa") || strstr(dp->d_name, "fbdev")))
-+                    continue;
-                 for (p = patterns; p->pattern; p++) {
-                     if (regexec(&p->rex, dp->d_name, 2, match, 0) == 0 &&
-                         match[1].rm_so != -1) {
--- 
-2.17.0
-

SOURCES/0001-xfree86-LeaveVT-from-xf86CrtcCloseScreen.patch

@@ -1,27 +0,0 @@
-From 1070ffa0953e9200688fc8fae11e3ab0680b86f2 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 9 Oct 2018 12:28:48 -0400
-Subject: [PATCH xserver] xfree86: LeaveVT from xf86CrtcCloseScreen
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
----
- hw/xfree86/modes/xf86Crtc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
-index 37a45bb3af..45d325f4d2 100644
---- a/hw/xfree86/modes/xf86Crtc.c
-+++ b/hw/xfree86/modes/xf86Crtc.c
-@@ -776,6 +776,8 @@ xf86CrtcCloseScreen(ScreenPtr screen)
-         crtc->randr_crtc = NULL;
-     }
- 
-+    scrn->LeaveVT(scrn);
-+
-     screen->CloseScreen = config->CloseScreen;
- 
-     xf86RotateCloseScreen(screen);
--- 
-2.19.0
-

SOURCES/0001-xfree86-Only-switch-to-original-VT-if-it-is-active.patch

@@ -1,136 +0,0 @@
-From ff91c696ff8f5f56da40e107cb5c321539758a81 Mon Sep 17 00:00:00 2001
-From: Michal Srb <msrb@suse.com>
-Date: Tue, 16 Oct 2018 09:32:13 +0200
-Subject: [PATCH xserver] xfree86: Only switch to original VT if it is active.
-
-If the X server is terminated while its VT is not active, it should
-not change the current VT.
-
-v2: Query current state in xf86CloseConsole using VT_GETSTATE instead of
-    keeping track in xf86VTEnter/xf86VTLeave/etc.
----
- hw/xfree86/os-support/linux/lnx_init.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/hw/xfree86/os-support/linux/lnx_init.c b/hw/xfree86/os-support/linux/lnx_init.c
-index 039dc4a4d..358d89f0f 100644
---- a/hw/xfree86/os-support/linux/lnx_init.c
-+++ b/hw/xfree86/os-support/linux/lnx_init.c
-@@ -272,101 +272,111 @@ xf86OpenConsole(void)
-                 xf86SetConsoleHandler(drain_console, NULL);
-             }
- 
-             nTty = tty_attr;
-             nTty.c_iflag = (IGNPAR | IGNBRK) & (~PARMRK) & (~ISTRIP);
-             nTty.c_oflag = 0;
-             nTty.c_cflag = CREAD | CS8;
-             nTty.c_lflag = 0;
-             nTty.c_cc[VTIME] = 0;
-             nTty.c_cc[VMIN] = 1;
-             cfsetispeed(&nTty, 9600);
-             cfsetospeed(&nTty, 9600);
-             tcsetattr(xf86Info.consoleFd, TCSANOW, &nTty);
-         }
-     }
-     else {                      /* serverGeneration != 1 */
-         if (!xf86Info.ShareVTs && xf86Info.autoVTSwitch) {
-             /* now get the VT */
-             if (!switch_to(xf86Info.vtno, "xf86OpenConsole"))
-                 FatalError("xf86OpenConsole: Switching VT failed\n");
-         }
-     }
- }
- 
- #pragma GCC diagnostic pop
- 
- void
- xf86CloseConsole(void)
- {
-     struct vt_mode VT;
-+    struct vt_stat vts;
-     int ret;
- 
-     if (xf86Info.ShareVTs) {
-         close(xf86Info.consoleFd);
-         return;
-     }
- 
-     /*
-      * unregister the drain_console handler
-      * - what to do if someone else changed it in the meantime?
-      */
-     xf86SetConsoleHandler(NULL, NULL);
- 
-     /* Back to text mode ... */
-     SYSCALL(ret = ioctl(xf86Info.consoleFd, KDSETMODE, KD_TEXT));
-     if (ret < 0)
-         xf86Msg(X_WARNING, "xf86CloseConsole: KDSETMODE failed: %s\n",
-                 strerror(errno));
- 
-     SYSCALL(ioctl(xf86Info.consoleFd, KDSKBMODE, tty_mode));
-     tcsetattr(xf86Info.consoleFd, TCSANOW, &tty_attr);
- 
-     SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_GETMODE, &VT));
-     if (ret < 0)
-         xf86Msg(X_WARNING, "xf86CloseConsole: VT_GETMODE failed: %s\n",
-                 strerror(errno));
-     else {
-         /* set dflt vt handling */
-         VT.mode = VT_AUTO;
-         SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_SETMODE, &VT));
-         if (ret < 0)
-             xf86Msg(X_WARNING, "xf86CloseConsole: VT_SETMODE failed: %s\n",
-                     strerror(errno));
-     }
- 
-     if (xf86Info.autoVTSwitch) {
-         /*
--         * Perform a switch back to the active VT when we were started
--         */
-+        * Perform a switch back to the active VT when we were started if our
-+        * vt is active now.
-+        */
-         if (activeVT >= 0) {
--            switch_to(activeVT, "xf86CloseConsole");
-+            SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_GETSTATE, &vts));
-+            if (ret < 0) {
-+                xf86Msg(X_WARNING, "xf86OpenConsole: VT_GETSTATE failed: %s\n",
-+                        strerror(errno));
-+            } else {
-+                if (vts.v_active == xf86Info.vtno) {
-+                    switch_to(activeVT, "xf86CloseConsole");
-+                }
-+            }
-             activeVT = -1;
-         }
-     }
-     close(xf86Info.consoleFd);  /* make the vt-manager happy */
- }
- 
- #define CHECK_FOR_REQUIRED_ARGUMENT() \
-     if (((i + 1) >= argc) || (!argv[i + 1])) { 				\
-       ErrorF("Required argument to %s not specified\n", argv[i]); 	\
-       UseMsg(); 							\
-       FatalError("Required argument to %s not specified\n", argv[i]);	\
-     }
- 
- int
- xf86ProcessArgument(int argc, char *argv[], int i)
- {
-     /*
-      * Keep server from detaching from controlling tty.  This is useful
-      * when debugging (so the server can receive keyboard signals.
-      */
-     if (!strcmp(argv[i], "-keeptty")) {
-         KeepTty = TRUE;
-         return 1;
-     }
- 
-     if ((argv[i][0] == 'v') && (argv[i][1] == 't')) {
-         if (sscanf(argv[i], "vt%2d", &xf86Info.vtno) == 0) {
-             UseMsg();
-             xf86Info.vtno = -1;
-             return 0;
--- 
-2.18.4
-

SOURCES/0001-xfree86-ensure-the-readlink-buffer-is-null-terminate.patch

@@ -1,34 +0,0 @@
-From 71703e4e8bd00719eefad53c2ed6c604079f87ea Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 17 Oct 2018 09:00:59 +1000
-Subject: [PATCH xserver] xfree86: ensure the readlink buffer is
- null-terminated
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-Reviewed-by: Dave Airlie <airlied@redhat.com>
----
- hw/xfree86/fbdevhw/fbdevhw.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/xfree86/fbdevhw/fbdevhw.c b/hw/xfree86/fbdevhw/fbdevhw.c
-index 95089515c..f146ff4a4 100644
---- a/hw/xfree86/fbdevhw/fbdevhw.c
-+++ b/hw/xfree86/fbdevhw/fbdevhw.c
-@@ -331,12 +331,12 @@ fbdev_open(int scrnIndex, const char *dev, char **namep)
- 
-     /* only touch non-PCI devices on this path */
-     {
--        char buf[PATH_MAX];
-+        char buf[PATH_MAX] = {0};
-         char *sysfs_path = NULL;
-         char *node = strrchr(dev, '/') + 1;
- 
-         if (asprintf(&sysfs_path, "/sys/class/graphics/%s", node) < 0 ||
--            readlink(sysfs_path, buf, sizeof(buf)) < 0 ||
-+            readlink(sysfs_path, buf, sizeof(buf) - 1) < 0 ||
-             strstr(buf, "devices/pci")) {
-             free(sysfs_path);
-             close(fd);
--- 
-2.19.1
-

SOURCES/0001-xfree86-try-harder-to-span-on-multihead.patch

@@ -1,190 +0,0 @@
-From 326f992a90dae7a747da45626e588fa3c1dfa5dc Mon Sep 17 00:00:00 2001
-From: Ray Strode <rstrode@redhat.com>
-Date: Fri, 21 Sep 2018 14:38:31 -0400
-Subject: [PATCH xserver] xfree86: try harder to span on multihead
-
-right now if one of the monitors can't give
-it's native resolution because of bandwidth limitations,
-X decides to avoid spanning and instead clone.
-
-That's suboptimal, spanning is normally the right
-thing to do (with the exception of some projector
-use cases and other edge cases)
-
-This commit tries harder to make spanning work.
----
- hw/xfree86/modes/xf86Crtc.c | 33 +++++++++++++++++++++++++++++----
- 1 file changed, 29 insertions(+), 4 deletions(-)
-
-diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
-index 37a45bb3a..686cb51b8 100644
---- a/hw/xfree86/modes/xf86Crtc.c
-+++ b/hw/xfree86/modes/xf86Crtc.c
-@@ -2132,135 +2132,160 @@ bestModeForAspect(xf86CrtcConfigPtr config, Bool *enabled, float aspect)
-             if (test->HDisplay != mode->HDisplay ||
-                 test->VDisplay != mode->VDisplay) {
-                 test = NULL;
-                 break;
-             }
-         }
- 
-         /* if we didn't match it on all outputs, try the next one */
-         if (!test)
-             continue;
- 
-         /* if it's bigger than the last one, save it */
-         if (!match || (test->HDisplay > match->HDisplay))
-             match = test;
-     }
- 
-     /* return the biggest one found */
-     return match;
- }
- 
- static int
- numEnabledOutputs(xf86CrtcConfigPtr config, Bool *enabled)
- {
-     int i = 0, p;
- 
-     for (i = 0, p = -1; nextEnabledOutput(config, enabled, &p); i++) ;
- 
-     return i;
- }
- 
-+static DisplayModePtr
-+findReasonableMode(xf86CrtcConfigPtr config, xf86OutputPtr output, Bool *enabled, int width, int height)
-+{
-+    DisplayModePtr mode =
-+        xf86OutputHasPreferredMode(output, width, height);
-+
-+    /* if there's no preferred mode, just try to find a reasonable one */
-+    if (!mode) {
-+        float aspect = 0.0;
-+        DisplayModePtr a = NULL, b = NULL;
-+
-+        if (output->mm_height)
-+            aspect = (float) output->mm_width /
-+                (float) output->mm_height;
-+
-+        a = bestModeForAspect(config, enabled, 4.0/3.0);
-+        if (aspect)
-+            b = bestModeForAspect(config, enabled, aspect);
-+
-+        mode = biggestMode(a, b);
-+    }
-+
-+    return mode;
-+}
-+
- static Bool
- xf86TargetRightOf(ScrnInfoPtr scrn, xf86CrtcConfigPtr config,
-                   DisplayModePtr *modes, Bool *enabled,
-                   int width, int height)
- {
-     int o;
-     int w = 0;
-     Bool has_tile = FALSE;
-     uint32_t configured_outputs;
- 
-     xf86GetOptValBool(config->options, OPTION_PREFER_CLONEMODE,
-                       &scrn->preferClone);
-     if (scrn->preferClone)
-         return FALSE;
- 
-     if (numEnabledOutputs(config, enabled) < 2)
-         return FALSE;
- 
-     for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-         DisplayModePtr mode =
--            xf86OutputHasPreferredMode(config->output[o], width, height);
-+            findReasonableMode(config, config->output[o], enabled, width, height);
- 
-         if (!mode)
-             return FALSE;
- 
-         w += mode->HDisplay;
-     }
- 
-     if (w > width)
-         return FALSE;
- 
-     w = 0;
-     configured_outputs = 0;
- 
-     for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-         DisplayModePtr mode =
--            xf86OutputHasPreferredMode(config->output[o], width, height);
-+            findReasonableMode(config, config->output[o], enabled, width, height);
- 
-         if (configured_outputs & (1 << o))
-             continue;
- 
-         if (config->output[o]->tile_info.group_id) {
-             has_tile = TRUE;
-             continue;
-         }
- 
-         config->output[o]->initial_x = w;
-         w += mode->HDisplay;
- 
-         configured_outputs |= (1 << o);
-         modes[o] = mode;
-     }
- 
-     if (has_tile) {
-         for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-             int ht, vt, ot;
-             int add_x, cur_x = w;
-             struct xf86CrtcTileInfo *tile_info = &config->output[o]->tile_info, *this_tile;
-             if (configured_outputs & (1 << o))
-                 continue;
-             if (!tile_info->group_id)
-                 continue;
- 
-             if (tile_info->tile_h_loc != 0 && tile_info->tile_v_loc != 0)
-                 continue;
- 
-             for (ht = 0; ht < tile_info->num_h_tile; ht++) {
-                 int cur_y = 0;
-                 add_x = 0;
-                 for (vt = 0; vt < tile_info->num_v_tile; vt++) {
- 
-                     for (ot = -1; nextEnabledOutput(config, enabled, &ot); ) {
--
-                         DisplayModePtr mode =
--                            xf86OutputHasPreferredMode(config->output[ot], width, height);
-+                            findReasonableMode(config, config->output[ot], enabled, width, height);
-+
-                         if (!config->output[ot]->tile_info.group_id)
-                             continue;
- 
-                         this_tile = &config->output[ot]->tile_info;
-                         if (this_tile->group_id != tile_info->group_id)
-                             continue;
- 
-                         if (this_tile->tile_h_loc != ht ||
-                             this_tile->tile_v_loc != vt)
-                             continue;
- 
-                         config->output[ot]->initial_x = cur_x;
-                         config->output[ot]->initial_y = cur_y;
- 
-                         if (vt == 0)
-                             add_x = this_tile->tile_h_size;
-                         cur_y += this_tile->tile_v_size;
-                         configured_outputs |= (1 << ot);
-                         modes[ot] = mode;
-                     }
-                 }
-                 cur_x += add_x;
-             }
-             w = cur_x;
-         }
-     }
-     return TRUE;
- }
- 
- static Bool
--- 
-2.17.1
-

commitid

@@ -0,0 +1 @@
+d13cb974426f7f1110b0bdb08c4ebb46ff8975f7

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

import.log

@@ -0,0 +1,6 @@
+xorg-x11-server-1_5_0-1_fc10:HEAD:xorg-x11-server-1.5.0-1.fc10.src.rpm:1220485219
+xorg-x11-server-1_5_1-1_fc10:HEAD:xorg-x11-server-1.5.1-1.fc10.src.rpm:1222198557
+xorg-x11-server-1_5_2-1_fc10:HEAD:xorg-x11-server-1.5.2-1.fc10.src.rpm:1223667007
+xorg-x11-server-1_5_3-1_fc10:HEAD:xorg-x11-server-1.5.3-1.fc10.src.rpm:1225918317
+xorg-x11-server-1_6_0-1_fc11:HEAD:xorg-x11-server-1.6.0-1.fc11.src.rpm:1235594175
+xorg-x11-server-1_6_1-1_fc11:HEAD:xorg-x11-server-1.6.1-1.fc11.src.rpm:1239742477

make-git-snapshot.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+DIRNAME=xorg-server-$( date +%Y%m%d )
+
+rm -rf $DIRNAME
+git clone git://git.freedesktop.org/git/xorg/xserver $DIRNAME
+cd $DIRNAME
+if [ -z "$1" ]; then
+    git log | head -1
+else
+    git checkout $1
+fi
+git log | head -1 | awk '{ print $2 }' > ../commitid
+git repack -a -d
+cd ..
+tar cf - $DIRNAME | xz -c9 > $DIRNAME.tar.xz
+rm -rf $DIRNAME

sources

@@ -0,0 +1 @@
+SHA512 (xorg-server-1.20.11.tar.bz2) = 1017015b9fd5d53788abe3641d877e6df8609841fa5c1847c0a5e133ddcc1b758a5d695304ebd36828099ec201a85b6b70b46f5ea4f81c5bd3a16fa6e175e3c2

xorg-x11-server.spec

@@ -8,10 +8,6 @@
 # format, and add a PatchN: line.  If you want to push something upstream,
 # check out the master branch, pull, cherry-pick, and push.
 
-# X.org requires lazy relocations to work.
-%undefine _hardened_build
-%undefine _strict_symbol_defs_build
-
 #global gitdate 20161026
 %global stable_abi 1
 
@@ -46,10 +42,9 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.20.11
-Release:   15%{?gitdate:.%{gitdate}}%{?dist}
+Release:   24%{?gitdate:.%{gitdate}}%{?dist}
 URL:       http://www.x.org
 License:   MIT
-Group:     User Interface/X
 
 #VCS:      git:git://git.freedesktop.org/git/xorg/xserver
 %if 0%{?gitdate}
@@ -82,34 +77,49 @@ Source40: driver-abi-rebuild.sh
 Patch1: 06_use-intel-only-on-pre-gen4.diff
 # Default to xf86-video-modesetting on GeForce 8 and newer
 Patch2: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch
+
+# Default to va_gl on intel i965 as we use the modesetting drv there
+# va_gl should probably just be the default everywhere ?
 Patch3: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch
-Patch4: 0001-Always-install-vbe-and-int10-sdk-headers.patch
+
 # Submitted upstream, but not going anywhere
 Patch5: 0001-autobind-GPUs-to-the-screen.patch
+
 # because the display-managers are not ready yet, do not upstream
 Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch
 
-# RHEL mustard
-Patch10: 0001-mustard-Don-t-probe-for-drivers-not-shipped-in-RHEL8.patch
-Patch11: 0001-mustard-Add-DRI2-fallback-driver-mappings-for-i965-a.patch
-#Patch11: 0001-Enable-PAM-support.patch
-Patch12: 0001-link-with-z-now.patch
-Patch14: 0001-xfree86-Don-t-autoconfigure-vesa-or-fbdev.patch
-Patch15: 0001-xfree86-LeaveVT-from-xf86CrtcCloseScreen.patch
-Patch16: 0001-xfree86-try-harder-to-span-on-multihead.patch
-Patch18: 0001-mustard-Work-around-broken-fbdev-headers.patch
+# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/761
+Patch7: 0001-xkb-Drop-check-for-XkbSetMapResizeTypes.patch
 
-# fix to be upstreamed
-Patch100: 0001-linux-Make-platform-device-probe-less-fragile.patch
-Patch102: 0001-xfree86-ensure-the-readlink-buffer-is-null-terminate.patch
+# 1988922 - [Hyper-V]Installation failed with: 'x or window manager startup failed' when the VM was created with GEN1
+# 2029769 - fbdev Xorg driver no longer works as a fallback with unsupported hardware
+Patch8: 0001-mustard-xfree86-Disable-the-PCI-probe-path.patch
 
-# fix already upstream
-Patch200: 0001-Fix-segfault-on-probing-a-non-PCI-platform-device-on.patch
-Patch201: 0001-linux-Fix-platform-device-PCI-detection-for-complex-.patch
-Patch202: 0001-modesetting-Reduce-glamor-initialization-failed-mess.patch
-Patch203: 0001-xfree86-Only-switch-to-original-VT-if-it-is-active.patch
-Patch204: 0001-xf86-logind-Fix-drm_drop_master-before-vt_reldisp.patch
-Patch205: 0001-present-Check-for-NULL-to-prevent-crash.patch
+# 2148292 - Drop dependency on xorg-x11-font-utils
+# Upstream MR #1001 but that one is meson only
+Patch9: 0001-configure.ac-search-for-the-fontrootdir-ourselves.patch
+
+# Backports from current stable "server-1.20-branch":
+# <empty>
+
+# Backports from "master" upstream:
+Patch102: 0002-xfree86-Link-fb-statically.patch
+Patch104: 0004-loader-Move-LoaderSymbolFromModule-to-public-API.patch
+Patch105: 0005-loader-Make-LoaderSymbolFromModule-take-a-ModuleDesc.patch
+Patch106: 0006-modesetting-Indirect-the-shadow-API-through-LoaderSy.patch
+Patch107: 0007-modesetting-Indirect-the-glamor-API-through-LoaderSy.patch
+Patch108: 0008-modesetting-Add-glamor_finish-convenience-macro.patch
+Patch109: 0009-modesetting-Use-EGL_MESA_query_driver-to-select-DRI-.patch
+Patch110: 0010-modesetting-Fix-build-with-glamor-disabled.patch
+# Because we still use automake
+Patch111: 0011-modesetting-set-gbm-as-dependency-for-autotools.patch
+# Xorg crashes with NVIDIA proprietary driver when uisng Present
+# https://bugzilla.redhat.com/show_bug.cgi?id=2046330
+Patch112: 0001-present-Check-for-NULL-to-prevent-crash.patch
+# Fix a regression with hybrid gfx and NVIDIA proprietary driver
+# https://bugzilla.redhat.com/show_bug.cgi?id=2052605
+Patch113: 0001-modesetting-Fix-msSharePixmapBacking-Segfault-Regres.patch
+Patch114: 0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch
 
 # CVE-2021-4011
 Patch10009: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
@@ -139,21 +149,49 @@ Patch10021: 0004-Xi-disallow-passive-grabs-with-a-detail-255.patch
 Patch10022: 0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch
 # CVE-2022-46342
 Patch10023: 0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch
-# CVE-2022-4283
+# CVE-2022-46283
 Patch10024: 0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch
 # Follow-up to CVE-2022-46340
 Patch10025: 0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch
 # CVE-2023-0494
 Patch10026: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
+# CVE-2023-1393
+Patch10027: 0001-composite-Fix-use-after-free-of-the-COW.patch
+# CVE-2023-5367
+Patch10028: 0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch
+# CVE-2023-5380
+Patch10029: 0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch
+# CVE-2023-6377
+Patch10030: 0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch
+# CVE-2023-6478
+Patch10031: 0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch
+# CVE-2023-6816
+Patch10032: 0001-dix-allocate-enough-space-for-logical-button-maps.patch
+# CVE-2024-0229
+Patch10033: 0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch
+Patch10034: 0003-dix-fix-DeviceStateNotify-event-calculation.patch
+Patch10035: 0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch
+# CVE-2024-21885
+Patch10036: 0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch
+# CVE-2024-21886
+Patch10037: 0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch
+Patch10038: 0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch
+# CVE-2024-0408
+Patch10039: 0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch
+# CVE-2024-0409
+Patch10040: 0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch
+# Fix compilation error
+Patch10041: 0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch
+# Related to CVE-2024-21886
+Patch10042: 0001-dix-Fix-use-after-free-in-input-device-shutdown.patch
 
 BuildRequires: make
 BuildRequires: systemtap-sdt-devel
-BuildRequires: git
+BuildRequires: git-core
 BuildRequires: automake autoconf libtool pkgconfig
 BuildRequires: xorg-x11-util-macros >= 1.17
 
 BuildRequires: xorg-x11-proto-devel >= 7.7-10
-BuildRequires: xorg-x11-font-utils >= 7.2-11
 
 BuildRequires: dbus-devel libepoxy-devel systemd-devel
 BuildRequires: xorg-x11-xtrans-devel >= 1.3.2
@@ -170,13 +208,13 @@ BuildRequires: pkgconfig(epoxy)
 BuildRequires: pkgconfig(xshmfence) >= 1.1
 BuildRequires: libXv-devel
 BuildRequires: pixman-devel >= 0.30.0
-BuildRequires: libpciaccess-devel >= 0.13.1 openssl-devel bison flex flex-devel
+BuildRequires: libpciaccess-devel >= 0.13.1 openssl-devel bison flex
 BuildRequires: mesa-libGL-devel >= 9.2
 BuildRequires: mesa-libEGL-devel
 BuildRequires: mesa-libgbm-devel
 # XXX silly...
 BuildRequires: libdrm-devel >= 2.4.0 kernel-headers
-BuildRequires: pam-devel
+
 BuildRequires: audit-libs-devel libselinux-devel >= 2.0.86-1
 BuildRequires: libudev-devel
 # libunwind is Exclusive for the following arches
@@ -195,7 +233,6 @@ X.Org X11 X server
 
 %package common
 Summary: Xorg server common files
-Group: User Interface/X
 Requires: pixman >= 0.30.0
 Requires: xkeyboard-config xkbcomp
 
@@ -205,7 +242,6 @@ Common files shared among all X servers.
 
 %package Xorg
 Summary: Xorg X server
-Group: User Interface/X
 Provides: Xorg = %{version}-%{release}
 Provides: Xserver
 # HdG: This should be moved to the wrapper package once the wrapper gets
@@ -233,12 +269,6 @@ Obsoletes: xorg-x11-drv-vmmouse < 13.1.0-4
 Requires: xorg-x11-server-common >= %{version}-%{release}
 Requires: system-setup-keyboard
 Requires: xorg-x11-drv-libinput
-%ifnarch s390 s390x
-Requires: xorg-x11-drv-fbdev
-%ifarch x86_64
-Requires: xorg-x11-drv-vesa
-%endif
-%endif
 Requires: libEGL
 
 %description Xorg
@@ -250,7 +280,6 @@ upon.
 
 %package Xnest
 Summary: A nested server
-Group: User Interface/X
 Requires: xorg-x11-server-common >= %{version}-%{release}
 Provides: Xnest
 
@@ -264,7 +293,6 @@ applications without running them on their real X server.
 
 %package Xdmx
 Summary: Distributed Multihead X Server and utilities
-Group: User Interface/X
 Requires: xorg-x11-server-common >= %{version}-%{release}
 Provides: Xdmx
 
@@ -281,7 +309,6 @@ application for Xdmx would be to unify a 4 by 4 grid of 1280x1024 displays
 
 %package Xvfb
 Summary: A X Windows System virtual framebuffer X server
-Group: User Interface/X
 # xvfb-run is GPLv2, rest is MIT
 License: MIT and GPLv2
 Requires: xorg-x11-server-common >= %{version}-%{release}
@@ -299,7 +326,6 @@ is normally used for testing servers.
 
 %package Xephyr
 Summary: A nested server
-Group: User Interface/X
 Requires: xorg-x11-server-common >= %{version}-%{release}
 Provides: Xephyr
 
@@ -316,7 +342,6 @@ Render and Composite.
 
 %package devel
 Summary: SDK for X server driver module development
-Group: User Interface/X
 Requires: xorg-x11-util-macros
 Requires: xorg-x11-proto-devel
 Requires: libXfont2-devel
@@ -334,7 +359,6 @@ drivers, input drivers, or other X modules should install this package.
 
 %package source
 Summary: Xserver source code required to build VNC server (Xvnc)
-Group: Development/Libraries
 BuildArch: noarch
 
 %description source
@@ -375,18 +399,20 @@ test `getminor extension` == %{extension_minor}
 
 %build
 
-export CFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1"
-export CXXFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1"
-export LDFLAGS="$RPM_LD_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"
+%if !0%{?rhel}
+%ifarch %{ix86} x86_64
+%global int10_arch 1
+%endif
+%endif
 
-%ifnarch %{ix86} x86_64
+%if %{undefined int10_arch}
 %global no_int10 --disable-vbe --disable-int10-module
 %endif
 
 %global kdrive --enable-kdrive --enable-xephyr --disable-xfake --disable-xfbdev
 %global xservers --enable-xvfb --enable-xnest %{kdrive} --enable-xorg
 %global default_font_path "catalogue:/etc/X11/fontpath.d,built-ins"
-%global dri_flags --enable-dri --enable-dri2 %{?!rhel:--enable-dri3} --enable-suid-wrapper --enable-glamor
+%global dri_flags --disable-dri --enable-dri2 %{?!rhel:--enable-dri3} --enable-suid-wrapper --enable-glamor
 
 autoreconf -f -v --install || exit 1
 
@@ -394,7 +420,7 @@ autoreconf -f -v --install || exit 1
 	--enable-dependency-tracking \
 	--disable-static \
 	--with-pic \
-	%{?no_int10} --with-int10=x86emu \
+	%{?no_int10} \
 	--with-default-font-path=%{default_font_path} \
 	--with-module-dir=%{_libdir}/xorg/modules \
 	--with-builderstring="Build ID: %{name} %{version}-%{release}" \
@@ -408,7 +434,7 @@ autoreconf -f -v --install || exit 1
 	--disable-unit-tests \
 	--enable-dmx \
 	--disable-xwayland \
-	%{dri_flags} %{?bodhi_flags} \
+	%{dri_flags} \
 	${CONFIGURE}
 
 make V=1 %{?_smp_mflags}
@@ -421,9 +447,6 @@ mkdir -p $RPM_BUILD_ROOT%{_libdir}/xorg/modules/{drivers,input}
 
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
 install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/xserver
-# restore this if/when restoring the PAM patch
-#mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps
-#touch $RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps/xserver
 
 mkdir -p $RPM_BUILD_ROOT%{_datadir}/X11/xorg.conf.d
 install -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_datadir}/X11/xorg.conf.d
@@ -464,6 +487,7 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
 # Remove unwanted files/dirs
 {
     find $RPM_BUILD_ROOT -type f -name '*.la' | xargs rm -f -- || :
+# wtf
 %ifnarch %{ix86} x86_64
     rm -f $RPM_BUILD_ROOT%{_libdir}/xorg/modules/lib{int10,vbe}.so
 %endif
@@ -484,10 +508,8 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
 %global Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe)
 %endif
 
-# restore the missingok one if/when restoring the PAM patch
 %files Xorg
 %config %attr(0644,root,root) %{_sysconfdir}/pam.d/xserver
-#config(missingok) /etc/security/console.apps/xserver
 %{_bindir}/X
 %{_bindir}/Xorg
 %{_libexecdir}/Xorg
@@ -503,13 +525,12 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
 %dir %{_libdir}/xorg/modules/input
 %{_libdir}/xorg/modules/libfbdevhw.so
 %{_libdir}/xorg/modules/libexa.so
-%{_libdir}/xorg/modules/libfb.so
 %{_libdir}/xorg/modules/libglamoregl.so
 %{_libdir}/xorg/modules/libshadow.so
 %{_libdir}/xorg/modules/libshadowfb.so
 %{_libdir}/xorg/modules/libvgahw.so
 %{_libdir}/xorg/modules/libwfb.so
-%ifarch %{ix86} x86_64
+%if %{defined int10_arch}
 %{_libdir}/xorg/modules/libint10.so
 %{_libdir}/xorg/modules/libvbe.so
 %endif
@@ -572,186 +593,235 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
 
 
 %changelog
-* Wed Feb 22 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-15
-- Rebuild for the missing debuginfo
-  Related: rhbz#2169522
+* Thu Jan 18 2024 José Expósito <jexposit@redhat.com> - 1.20.4-24
+- Fix use after free related to CVE-2024-21886
 
-* Tue Feb 21 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-14
+* Tue Jan 16 2024 José Expósito <jexposit@redhat.com> - 1.20.11-23
+- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
+  CVE-2024-0408 and CVE-2024-0409
+  Resolves: https://issues.redhat.com/browse/RHEL-21203
+  Resolves: https://issues.redhat.com/browse/RHEL-20531
+  Resolves: https://issues.redhat.com/browse/RHEL-20380
+  Resolves: https://issues.redhat.com/browse/RHEL-20386
+  Resolves: https://issues.redhat.com/browse/RHEL-21193
+  Resolves: https://issues.redhat.com/browse/RHEL-21200
+
+* Thu Dec 14 2023 José Expósito <jexposit@redhat.com> - 1.20.11-22
+- CVE fix for: CVE-2023-6377, CVE-2023-6478
+  Resolves: https://issues.redhat.com/browse/RHEL-18322
+  Resolves: https://issues.redhat.com/browse/RHEL-18329
+
+* Wed Oct 25 2023 José Expósito <jexposit@redhat.com> - 1.20.11-20
+- CVE fix for: CVE-2023-5380
+  Resolves: https://issues.redhat.com/browse/RHEL-14062
+
+* Wed Oct 25 2023 José Expósito <jexposit@redhat.com> - 1.20.11-20
+- CVE fix for: CVE-2023-5367
+  Resolves: https://issues.redhat.com/browse/RHEL-13430
+
+* Tue Jun  6 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-19
+- Backport fix for a deadlock with DRI3
+  Resolves: rhbz#2192550
+
+* Fri Mar 31 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-18
+- CVE fix for: CVE-2023-1393
+  Resolves: rhbz#2180297
+
+* Tue Feb 21 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-17
 - Fix xvfb-run script with --listen-tcp
-  Resolves: rhbz#2169522
+  Resolves: rhbz#2172116
 
-* Fri Feb 03 2023 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-13
-- Fix CVE-2023-0494 (#2166977)
+* Wed Feb 08 2023 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-16
+- CVE-2023-0494 (#2166973)
 
-* Mon Dec 19 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-12
-- Follow-up fix for CVE-2022-46340 (#2151774)
+* Mon Dec 19 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-15
+- Follow-up fix for CVE-2022-46340 (#2151776)
 
-* Mon Dec 12 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
-- CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
-  CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
-  CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)
+* Wed Dec 14 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-14
+- CVE fix for: CVE-2022-4283 (#2151801), CVE-2022-46340 (#2151776),
+  CVE-2022-46341 (#2151781), CVE-2022-46342 (#2151788),
+  CVE-2022-46343 (#2151791), CVE-2022-46344 (#2151798)
 
-* Mon Nov 14 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-10
+* Tue Nov 29 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-13
+- Drop dependency on xorg-x11-font-utils, it was only there for one pkgconfig
+  query for a variable that never changes value (#2148292)
+
+* Mon Nov 14 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-12
 - Fix CVE-2022-3550, CVE-2022-3551
-  Resolves: rhbz#2140766, rhbz#2140772
+  Resolves: rhbz#2140768, rhbz#2140773
 
-* Fri Jul 29 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
+* Fri Jul 29 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-11
 - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
-  Resolves: rhbz#2108156, rhbz#2108161
+  Resolves: rhbz#2108157, rhbz#2108162
 
-* Thu Jun 09 2022 Ray Strode <rstrode@redhat.com> - 1.20.11-8
-- Rebuild again for ipv6 xtrans fix
-  Related: #2075132
+* Thu Feb 10 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-10
+- Fix a regression with hybrid gfx and NVIDIA proprietary driver (#2052605)
 
-* Tue May 24 2022 Ray Strode <rstrode@redhat.com> - 1.20.11-6
-- Rebuild for ipv6 xtrans fix
-  Related: #2075132
+* Fri Jan 28 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
+- Fix crash with NVIDIA proprietary driver with Present (#2046330)
 
-* Fri Jan 28 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-5
-- Fix crash with NVIDIA proprietary driver with Present (#2046329)
+* Wed Jan 26 2022 Adam Jackson <ajax@redhat.com> - 1.20.11-8
+- Only disable the PCI-specific driver probe, since we do still want fallback
+  to fbdev to work.
+  Resolves: #2029769
 
-* Thu Jan  6 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-4
-- CVE fix for: CVE-2021-4008 (#2030162), CVE-2021-4009 (#2030172),
-  CVE-2021-4010 (#2030175), CVE-2021-4011 (#2030181)
+* Thu Jan  6 2022 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-7
+- CVE fix for: CVE-2021-4008 (#2030160), CVE-2021-4009 (#2030170),
+  CVE-2021-4010 (#2030174), CVE-2021-4011 (#2030179)
 
-* Mon Nov  29 2021 Jocelyn Falempe <jfalempe@redhat.com> - 1.20.11-3
-- xf86/logind Fix drm_drop_master before vt_reldis
-  Resolves: #1771863
+* Tue Nov 23 2021 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-6
+- Restore hardened builds
+  Resolves: #2024556
 
-* Wed Jun  9 2021 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-2
+* Tue Nov  9 2021 Adam Jackson <ajax@redhat.com> - 1.20.11-5
+- Disable non-platform video driver probe, it should never be needed and the
+  PCI probe code interferes with the (default) platform path.
+  Resolves: #2000921
+
+* Tue Oct 26 2021 Ray Strode <rstrode@redhat.com> - 1.20.11-4
+- Fix XkbChangeMap
+  Resolves: #2009928
+
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 1.20.11-3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 1.20.11-2
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Thu Jun 17 2021 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-1
+- xserver 1.20.11 (#1952895)
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.20.10-6
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Wed Feb 03 2021 Peter Hutterer <peter.hutterer@redhat.com> 1.20.10-5
+- Drop BuildRequires for flex-devel (#1871101)
+
+* Mon Feb  1 2021 Olivier Fourdan <ofourdan@redhat.com> - 1.20.10-4
 - Remove Xwayland from the xserver builds
-  Resolves: #1956838
 
-* Tue Jun  1 2021 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-1
-- xserver 1.20.11
-  Resolves: #1954260
+* Thu Jan 28 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.10-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 
-* Thu Dec 10 2020 Adam Jackson <ajax@redhat.com> - 1.20.10-1
-- xserver 1.20.10
-  Resolves: #1891871
+* Tue Jan 19 2021 Adam Jackson <ajax@redhat.com> - 1.20.10-2
+- Disable int10 and vbe on RHEL
+- Disable DRI1
+- Stop overriding the vendor name
 
-* Wed Dec  9 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-10
-- modesetting: keep going if a modeset fails on EnterVT
-  Resolves: #1838392
+* Wed Dec  2 2020 Olivier Fourdan <ofourdan@redhat.com> - 1.20.10-1
+- xserver 1.20.10 (CVE-2020-14360, CVE-2020-25712)
 
-* Mon Nov 16 2020 Adam Jackson <ajax@redhat.com> - 1.20.8-9
-- CVE fix for: CVE-2020-14347 (#1862320)
+* Thu Nov  5 10:35:09 AEST 2020 Peter Hutterer <peter.hutterer@redhat.com> - 1.20.9-3
+- Add BuildRequires for make
 
-* Thu Oct 29 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
-- CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
-  CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)
+* Wed Nov 04 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.20.9-2
+- Drop BuildRequires to git-core only
 
-* Tue Oct 27 2020 Adam Jackson <ajax@redhat.com> - 1.20.8-7
+* Thu Oct  8 2020 Olivier Fourdan <ofourdan@redhat.com> - 1.20.9-1
+- xserver 1.20.9 + all current fixes from upstream
+
+* Wed Aug 12 2020 Adam Jackson <ajax@redhat.com> - 1.20.8-4
 - Enable XC-SECURITY
-  Resolves: #1863142
 
-* Thu Aug 20 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-6
-- xfree86: add drm modes on non-GTF panels
-  Resolves: #1823461
+* Fri Jul 31 2020 Adam Jackson <ajax@redhat.com> - 1.20.8-3
+- Fix information disclosure bug in pixmap allocation (CVE-2020-14347)
 
-* Tue Aug  4 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
-- xwayland: Hold a pixmap reference in struct xwl_present_event
-  Related: #1728684
-- glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
-  Resolves: #1740250
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
-* Fri Jul 10 2020 Ray Strode <rstrode@redhat.com> - 1.20.8-4
-- Don't switch VTs in the exit path, if killed on inactive VT
-  Related: #1618481
-
-* Fri Jun 26 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
-- Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
-  Resolves: #1724573
-- Xwayland / Present leak fixes for #1728684
-
-* Wed Jun 10 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-2
-- Re-enable Xwayland Present support
-  Resolves: #1728684, #1715676
-- Remove unused patch
-
-* Tue May 26 2020 Adam Jackson <ajax@redhat.com> - 1.20.8-1
+* Mon Mar 30 2020 Olivier Fourdan <ofourdan@redhat.com> - 1.20.8-1
 - xserver 1.20.8
+- Backport latest Xwayland randr resolution change emulation support
+  patches.
 
-* Tue Feb 11 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.20.6-3
-- Add fix for crash with Option "Rotate" in xorg.conf
-  Resolves: #1795328
+* Wed Mar 18 2020 Olivier Fourdan <ofourdan@redhat.com> - 1.20.7-2
+- Fix a crash on closing a window using Present found upstream:
+  https://gitlab.freedesktop.org/xorg/xserver/issues/1000
 
-* Wed Dec 11 2019 Michel Dänzer <mdaenzer@redhat.com> - 1.20.6-2
-- Add fixes for intermittent modesetting artifacts
-  Resolves: #1738670
+* Fri Mar 13 2020 Olivier Fourdan <ofourdan@redhat.com> - 1.20.7-1
+- xserver 1.20.7
+- backport from stable "xserver-1.20-branch" up to commit ad7364d8d
+  (for mutter fullscreen unredirect on Wayland)
+- Update videodrv minor ABI as 1.20.7 changed the minor ABI version
+  (backward compatible, API addition in glamor)
+- Rebase Xwayland randr resolution change emulation support patches
 
-* Mon Dec  9 2019 Olivier Fourdan <ofourdan@redhat.com> - 1.20.6-1
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Mon Nov 25 2019 Olivier Fourdan <ofourdan@redhat.com> - 1.20.6-1
 - xserver 1.20.6
 
-* Tue Sep 03 2019 Adam Jackson <ajax@redhat.com> - 1.20.3-11
-- Add DRI2 fallback driver mappings for i965 and radeonsi
+* Mon Nov  4 2019 Hans de Goede <hdegoede@redhat.com> - 1.20.5-9
+- Fix building with new libglvnd-1.2.0 (E)GL headers and pkgconfig files
 
-* Mon Aug 19 2019 Adam Jackson <ajax@redhat.com> - 1.20.3-10
-- Backport glvnd vendor selection for prime render offloading
+* Mon Nov  4 2019 Hans de Goede <hdegoede@redhat.com> - 1.20.5-8
+- Backport Xwayland randr resolution change emulation support
 
-* Fri Jul 12 2019 Adam Jackson <ajax@redhat.com> - 1.20.3-8
-- Fix platform device PCI detection for complex bus topologies
+* Thu Aug 29 2019 Olivier Fourdan <ofourdan@redhat.com> 1.20.5-7
+- Pick latest fixes from xserver stable branch upstream (rhbz#1729925)
 
-* Wed Apr 10 2019 Adam Jackson <ajax@redhat.com> - 1.20.3-7
-- Don't require fbdev on s390x, where it doesn't exist
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.5-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
-* Wed Apr 03 2019 Adam Jackson <ajax@redhat.com> - 1.20.3-6
-- Add Requires: fbdev (and on x86_64, vesa) to Xorg subpackage
+* Mon Jul  8 2019 Olivier Fourdan <ofourdan@redhat.com> 1.20.5-5
+- Do not include <sys/io.h> on ARM with glibc to avoid compilation failure.
+- Do not force vbe and int10 sdk headers as this enables int10 which does
+  not build on ARM without <sys/io.h>
 
-* Mon Jan 14 2019 Ben Crocker <bcrocker@redhat.com> - 1.20.3-5
-- Add Eric Anholt's patch e50c85f4ebf559 from upstream:
-- Fix segfault on probing a non-PCI platform device on a system with PCI
-- NOTE: also pertains on a system with no PCI, e.g. s390x.
-  Resolves: #1652013
+* Mon Jul  8 2019 Olivier Fourdan <ofourdan@redhat.com> 1.20.5-4
+- Fix regression causing screen tearing with upstream xserver 1.20.5
+  (rhbz#1726419)
 
-* Mon Jan 07 2019 Olivier Fourdan <ofourdan@redhat.com> - 1.20.3-4
-- Move LeaveVT after resetting randr pointers in xf86CrtcCloseScreen
+* Fri Jun 28 2019 Olivier Fourdan <ofourdan@redhat.com> 1.20.5-3
+- Remove atomic downstream patches causing regressions (#1714981, #1723715)
+- Xwayland crashes (#1708119, #1691745)
+- Cursor issue with tablet on Xwayland
+- Xorg/modesetting issue with flipping pixmaps with Present (#1645553)
 
-* Mon Nov 19 2018 Adam Jackson <ajax@redhat.com> - 1.20.3-3
-- Apply even more -z now and -pie
+* Thu Jun 06 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.20.5-2
+- Return AlreadyGrabbed for keycodes > 255 (#1697804)
 
-* Mon Nov 19 2018 Ray Strode <rstrode@redhat.com> - 1.20.3-2
-- Fix crash in Xephyr on server reset
-  Resolves: #1650168
+* Thu May 30 2019 Adam Jackson <ajax@redhat.com> - 1.20.5-1
+- xserver 1.20.5
 
-* Tue Nov 13 2018 Adam Jackson <ajax@redhat.com> - 1.20.3-1
+* Tue Apr 23 2019 Adam Jackson <ajax@redhat.com> - 1.20.4-4
+- Fix some non-atomic modesetting calls to be atomic
+
+* Wed Mar 27 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.20.4-3
+- Fix a Qt scrolling bug, don't reset the valuator on slave switch
+
+* Thu Mar 21 2019 Adam Jackson <ajax@redhat.com> - 1.20.4-2
+- Backport an Xwayland crash fix in the Present code
+
+* Tue Feb 26 2019 Adam Jackson <ajax@redhat.com> - 1.20.4-1
+- xserver 1.20.4
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jan 11 2019 Olivier Fourdan <ofourdan@redhat.com> - 1.20.3-3
+- More Xwayland/Present fixes from upstream (rhbz#1609181, rhbz#1661748)
+
+* Thu Dec 06 2018 Olivier Fourdan <ofourdan@redhat.com> - 1.20.3-2
+- Xwayland/Present fixes from master upstream
+
+* Thu Nov 01 2018 Adam Jackson <ajax@redhat.com> - 1.20.3-1
 - xserver 1.20.3
-- Also forget about DRI driver names for drivers we're not shipping
-
-* Fri Oct 26 2018 Adam Jackson <ajax@redhat.com> - 1.20.2-5
-- Work around broken fbdev headers
-
-* Mon Oct 22 2018 Adam Jackson <ajax@redhat.com> - 1.20.2-4
-- Back out the PAM patch, may not be necessary in 8
-
-* Wed Oct 17 2018 Peter Hutterer <peter.hutterer@redhat.com> 1.20.2-3
-- Backport fix for readlink call from master
-
-* Tue Oct 16 2018 Adam Jackson <ajax@redhat.com> - 1.20.2-2
-- Avoid drmSetInterfaceVersion in platform device probe
-- Backport a misparenthesis fix from master
 
 * Mon Oct 15 2018 Adam Jackson <ajax@redhat.com> - 1.20.2-1
 - xserver 1.20.2
 
-* Mon Oct 15 2018 Olivier Fourdan <ofourdan@redhat.com>> - 1.20.1-4
-- Some more RHEL mustard:
-  - Disable Present support in Xwayland (rhbz#1638463)
+* Thu Oct  4 2018 Hans de Goede <hdegoede@redhat.com> - 1.20.1-4
+- Rebase patch to use va_gl as vdpau driver on i965 GPUs, re-fix rhbz#1413733
 
-* Fri Oct 12 2018 Adam Jackson <ajax@redhat.com> - 1.20.1-3
-- Assorted RHEL mustard:
-  - Don't probe for drivers we're not shipping
-  - Enable PAM
-  - Link Xorg with -z now
-  - Nerf modesetting's atomic ioctl support
-  - Don't autoconfigure vesa or fbdev from X -configure
-  - Call LeaveVT on RANDR's CloseScreen path so we drop drm master
-  - Try harder to get initial spanning desktop if the output's
-    preferred mode was filtered away
-- Sync va_gl/vdpau patch from F29
+* Thu Sep 13 2018 Dave Airlie <airlied@redhat.com> - 1.20.1-3
+- Build with PIE enabled (this doesn't enable bind now)
 
-* Thu Sep 13 2018 Dave Airlie <airlied@redhat.com> - 1.20.1-2
-- build with PIE flags
+* Mon Sep 10 2018 Olivier Fourdan <ofourdan@redhat.com> - 1.20.1-2
+- Include patches from upstream to fix Xwayland crashes
 
 * Thu Aug 09 2018 Adam Jackson <ajax@redhat.com> - 1.20.1-1
 - xserver 1.20.1

xserver-sdk-abi-requires.release

@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# The X server provides capabilities of the form:
+#
+# Provides: xserver-abi(ansic-0) = 4
+#
+# for an ABI version of 0.4.  The major number is encoded into the name so
+# that major number changes force upgrades.  If we didn't, then
+#
+# Requires: xserver-abi(ansic) >= 0.4
+#
+# would also match 1.0, which is wrong since major numbers mean an ABI break.
+
+ver=$(pkg-config --variable abi_$1 xorg-server)
+
+major=$(echo $ver | cut -f 1 -d .)
+minor=$(echo $ver | cut -f 2 -d .)
+
+echo "xserver-abi($1-$major) >= $minor"