Merge tag 'xorg-server-1.20.2' into cygwin-release-1.20xserver-cygwin-1.20.2-1

xorg-server-1.20.2

30 files changed, 260 insertions, 112 deletions

diff --git a/Xext/shm.c b/Xext/shm.c
index 896a966e3..589ed0b4d 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -834,6 +834,19 @@ ProcPanoramiXShmGetImage(ClientPtr client)
             return BadMatch;
     }
 
+    if (format == ZPixmap) {
+        widthBytesLine = PixmapBytePad(w, pDraw->depth);
+        length = widthBytesLine * h;
+    }
+    else {
+        widthBytesLine = PixmapBytePad(w, 1);
+        lenPer = widthBytesLine * h;
+        plane = ((Mask) 1) << (pDraw->depth - 1);
+        length = lenPer * Ones(planemask & (plane | (plane - 1)));
+    }
+
+    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
+
     drawables = calloc(PanoramiXNumScreens, sizeof(DrawablePtr));
     if (!drawables)
         return BadAlloc;
@@ -856,18 +869,6 @@ ProcPanoramiXShmGetImage(ClientPtr client)
         .depth = pDraw->depth
     };
 
-    if (format == ZPixmap) {
-        widthBytesLine = PixmapBytePad(w, pDraw->depth);
-        length = widthBytesLine * h;
-    }
-    else {
-        widthBytesLine = PixmapBytePad(w, 1);
-        lenPer = widthBytesLine * h;
-        plane = ((Mask) 1) << (pDraw->depth - 1);
-        length = lenPer * Ones(planemask & (plane | (plane - 1)));
-    }
-
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
     xgi.size = length;
 
     if (length == 0) {          /* nothing to do */
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index aa965e46f..65d5870f6 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -88,7 +88,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     };
     int i, ret = Success;
     uint32_t *modifiers;
-    xXIGrabModifierInfo *modifiers_failed;
+    xXIGrabModifierInfo *modifiers_failed = NULL;
     GrabMask mask = { 0 };
     GrabParameters param;
     void *tmp;
@@ -232,8 +232,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     if (rep.num_modifiers)
         WriteToClient(client, rep.length * 4, modifiers_failed);
 
-    free(modifiers_failed);
  out:
+    free(modifiers_failed);
     xi2mask_free(&mask.xi2mask);
     return ret;
 }
diff --git a/composite/compalloc.c b/composite/compalloc.c
index 433dc820a..3e2f14fb0 100644
--- a/composite/compalloc.c
+++ b/composite/compalloc.c
@@ -47,24 +47,18 @@
 
 #include "compint.h"
 
-static void
-compScreenUpdate(ScreenPtr pScreen)
-{
-    compCheckTree(pScreen);
-    compPaintChildrenToWindow(pScreen->root);
-}
-
-static void
-compBlockHandler(ScreenPtr pScreen, void *pTimeout)
+static Bool
+compScreenUpdate(ClientPtr pClient, void *closure)
 {
+    ScreenPtr pScreen = closure;
     CompScreenPtr cs = GetCompScreen(pScreen);
 
-    pScreen->BlockHandler = cs->BlockHandler;
-    compScreenUpdate(pScreen);
-    (*pScreen->BlockHandler) (pScreen, pTimeout);
+    compCheckTree(pScreen);
+    compPaintChildrenToWindow(pScreen->root);
 
-    /* Next damage will restore the block handler */
-    cs->BlockHandler = NULL;
+    /* Next damage will restore the worker */
+    cs->pendingScreenUpdate = FALSE;
+    return TRUE;
 }
 
 void
@@ -87,9 +81,9 @@ compReportDamage(DamagePtr pDamage, RegionPtr pRegion, void *closure)
     CompScreenPtr cs = GetCompScreen(pScreen);
     CompWindowPtr cw = GetCompWindow(pWin);
 
-    if (!cs->BlockHandler) {
-        cs->BlockHandler = pScreen->BlockHandler;
-        pScreen->BlockHandler = compBlockHandler;
+    if (!cs->pendingScreenUpdate) {
+        QueueWorkProc(compScreenUpdate, serverClient, pScreen);
+        cs->pendingScreenUpdate = TRUE;
     }
     cw->damaged = TRUE;
 
diff --git a/composite/compinit.c b/composite/compinit.c
index 2590aa46d..6ea33ea4e 100644
--- a/composite/compinit.c
+++ b/composite/compinit.c
@@ -387,6 +387,8 @@ compScreenInit(ScreenPtr pScreen)
     cs->pOverlayWin = NULL;
     cs->pOverlayClients = NULL;
 
+    cs->pendingScreenUpdate = FALSE;
+
     cs->numAlternateVisuals = 0;
     cs->alternateVisuals = NULL;
     cs->numImplicitRedirectExceptions = 0;
@@ -442,8 +444,6 @@ compScreenInit(ScreenPtr pScreen)
     cs->ChangeWindowAttributes = pScreen->ChangeWindowAttributes;
     pScreen->ChangeWindowAttributes = compChangeWindowAttributes;
 
-    cs->BlockHandler = NULL;
-
     cs->CloseScreen = pScreen->CloseScreen;
     pScreen->CloseScreen = compCloseScreen;
 
diff --git a/composite/compint.h b/composite/compint.h
index 89f6507b9..d501bad65 100644
--- a/composite/compint.h
+++ b/composite/compint.h
@@ -156,7 +156,8 @@ typedef struct _CompScreen {
      */
     ChangeWindowAttributesProcPtr ChangeWindowAttributes;
 
-    ScreenBlockHandlerProcPtr BlockHandler;
+    Bool pendingScreenUpdate;
+
     CloseScreenProcPtr CloseScreen;
     int numAlternateVisuals;
     VisualID *alternateVisuals;
diff --git a/configure.ac b/configure.ac
index 071da3ce7..cb7a2a25e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.20.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2018-08-07"
-RELEASE_NAME="Kale Salad"
+AC_INIT([xorg-server], 1.20.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2018-10-15"
+RELEASE_NAME="Tofu Biryani"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
diff --git a/dix/devices.c b/dix/devices.c
index 4a628afb0..1b18b168e 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1177,6 +1177,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
             flags[tmp->id] = IsMaster(tmp) ? XIMasterRemoved : XISlaveRemoved;
             CloseDevice(tmp);
             ret = Success;
+            break;
         }
     }
 
@@ -1193,6 +1194,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
                 prev->next = next;
 
             ret = Success;
+            break;
         }
     }
 
diff --git a/dix/inpututils.c b/dix/inpututils.c
index 6bff9efab..c51c83547 100644
--- a/dix/inpututils.c
+++ b/dix/inpututils.c
@@ -282,7 +282,7 @@ change_modmap(ClientPtr client, DeviceIntPtr dev, KeyCode *modkeymap,
     else if (!IsFloating(dev) &&
              GetMaster(dev, MASTER_KEYBOARD)->lastSlave == dev) {
         /* If this fails, expect the results to be weird. */
-        if (check_modmap_change(client, dev->master, modmap))
+        if (check_modmap_change(client, dev->master, modmap) == Success)
             do_modmap_change(client, dev->master, modmap);
     }
 
diff --git a/fb/fboverlay.c b/fb/fboverlay.c
index a028a8de1..d47a7c67b 100644
--- a/fb/fboverlay.c
+++ b/fb/fboverlay.c
@@ -279,11 +279,11 @@ fbOverlayFinishScreenInit(ScreenPtr pScreen,
         (&fbOverlayScreenPrivateKeyRec, PRIVATE_SCREEN, 0))
         return FALSE;
 
-    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
-    if (!pScrPriv)
+    if (bpp1 == 24 || bpp2 == 24)
         return FALSE;
 
-    if (bpp1 == 24 || bpp2 == 24)
+    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
+    if (!pScrPriv)
         return FALSE;
 
     if (!fbInitVisuals(&visuals, &depths, &nvisuals, &ndepths, &depth1,
diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
index 0edfa111c..d3c678d6b 100644
--- a/glamor/glamor_egl.c
+++ b/glamor/glamor_egl.c
@@ -892,6 +892,7 @@ Bool
 glamor_egl_init(ScrnInfoPtr scrn, int fd)
 {
     struct glamor_egl_screen_private *glamor_egl;
+    const GLubyte *renderer;
 
     glamor_egl = calloc(sizeof(*glamor_egl), 1);
     if (glamor_egl == NULL)
@@ -986,6 +987,19 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
                    "Failed to make EGL context current\n");
         goto error;
     }
+
+    renderer = glGetString(GL_RENDERER);
+    if (!renderer) {
+        xf86DrvMsg(scrn->scrnIndex, X_ERROR,
+                   "glGetString() returned NULL, your GL is broken\n");
+        goto error;
+    }
+    if (strstr((const char *)renderer, "llvmpipe")) {
+        xf86DrvMsg(scrn->scrnIndex, X_INFO,
+                   "Refusing to try glamor on llvmpipe\n");
+        goto error;
+    }
+
     /*
      * Force the next glamor_make_current call to set the right context
      * (in case of multiple GPUs using glamor)
@@ -999,7 +1013,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
     }
 
     xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n",
-               glGetString(GL_RENDERER));
+               renderer);
 
 #ifdef GBM_BO_WITH_MODIFIERS
     if (epoxy_has_egl_extension(glamor_egl->display,
diff --git a/glamor/glamor_gradient.c b/glamor/glamor_gradient.c
index 4e864cd79..eef078860 100644
--- a/glamor/glamor_gradient.c
+++ b/glamor/glamor_gradient.c
@@ -38,7 +38,7 @@
 #define RADIAL_SMALL_STOPS (6 + 2)
 #define RADIAL_LARGE_STOPS (16 + 2)
 
-static const char *
+static char *
 _glamor_create_getcolor_fs_source(ScreenPtr screen, int stops_count,
                                   int use_array)
 {
@@ -310,7 +310,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s\n" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -343,6 +343,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
 
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);
@@ -493,7 +494,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -522,6 +523,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);
diff --git a/glx/createcontext.c b/glx/createcontext.c
index 7d09c3a1c..24b02ddfb 100644
--- a/glx/createcontext.c
+++ b/glx/createcontext.c
@@ -28,6 +28,7 @@
 #include "glxserver.h"
 #include "glxext.h"
 #include "indirect_dispatch.h"
+#include "opaque.h"
 
 #define ALL_VALID_FLAGS \
     (GLX_CONTEXT_DEBUG_BIT_ARB | GLX_CONTEXT_FORWARD_COMPATIBLE_BIT_ARB \
@@ -320,6 +321,17 @@ __glXDisp_CreateContextAttribsARB(__GLXclientState * cl, GLbyte * pc)
         err = BadAlloc;
     }
     else {
+        /* Only allow creating indirect GLX contexts if allowed by
+         * server command line.  Indirect GLX is of limited use (since
+         * it's only GL 1.4), it's slower than direct contexts, and
+         * it's a massive attack surface for buffer overflow type
+         * errors.
+         */
+        if (!enableIndirectGLX) {
+            client->errorValue = req->isDirect;
+            return BadValue;
+        }
+
         ctx = glxScreen->createContext(glxScreen, config, shareCtx,
                                        req->numAttribs, (uint32_t *) attribs,
                                        &err);
diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
index 2c1d335dc..e31030d63 100644
--- a/hw/xfree86/common/xf86Config.c
+++ b/hw/xfree86/common/xf86Config.c
@@ -939,10 +939,12 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
 	from = X_CMDLINE;
     i = -1;
     if (xf86GetOptValInteger(FlagOptions, FLAG_MAX_CLIENTS, &i)) {
-	if (i != 64 && i != 128 && i != 256 && i != 512)
-		ErrorF("MaxClients must be one of 64, 128, 256 or 512\n");
-	from = X_CONFIG;
-	LimitClients = i;
+        if (Ones(i) != 1 || i < 64 || i > 2048) {
+	    ErrorF("MaxClients must be one of 64, 128, 256, 512, 1024, or 2048\n");
+        } else {
+            from = X_CONFIG;
+            LimitClients = i;
+        }
     }
     xf86Msg(from, "Max clients allowed: %i, resource mask: 0x%x\n",
 	    LimitClients, RESOURCE_ID_MASK);
diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
index 9362370c3..8d29b130f 100644
--- a/hw/xfree86/drivers/modesetting/driver.c
+++ b/hw/xfree86/drivers/modesetting/driver.c
@@ -640,19 +640,21 @@ ms_dirty_update(ScreenPtr screen, int *timeout)
     xorg_list_for_each_entry(ent, &screen->pixmap_dirty_list, ent) {
         region = DamageRegion(ent->damage);
         if (RegionNotEmpty(region)) {
-            msPixmapPrivPtr ppriv =
-                msGetPixmapPriv(&ms->drmmode, ent->slave_dst);
+            if (!screen->isGPU) {
+                   msPixmapPrivPtr ppriv =
+                    msGetPixmapPriv(&ms->drmmode, ent->slave_dst->master_pixmap);
 
-            if (ppriv->notify_on_damage) {
-                ppriv->notify_on_damage = FALSE;
+                if (ppriv->notify_on_damage) {
+                    ppriv->notify_on_damage = FALSE;
 
-                ent->slave_dst->drawable.pScreen->
-                    SharedPixmapNotifyDamage(ent->slave_dst);
-            }
+                    ent->slave_dst->drawable.pScreen->
+                        SharedPixmapNotifyDamage(ent->slave_dst);
+                }
 
-            /* Requested manual updating */
-            if (ppriv->defer_dirty_update)
-                continue;
+                /* Requested manual updating */
+                if (ppriv->defer_dirty_update)
+                    continue;
+            }
 
             redisplay_dirty(screen, ent, timeout);
             DamageEmpty(ent->damage);
@@ -898,8 +900,6 @@ PreInit(ScrnInfoPtr pScrn, int flags)
     if (pScrn->numEntities != 1)
         return FALSE;
 
-    pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
-
     if (flags & PROBE_DETECT) {
         return FALSE;
     }
@@ -908,6 +908,8 @@ PreInit(ScrnInfoPtr pScrn, int flags)
     if (!GetRec(pScrn))
         return FALSE;
 
+    pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
+
     ms = modesettingPTR(pScrn);
     ms->SaveGeneration = -1;
     ms->pEnt = pEnt;
@@ -1251,8 +1253,8 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
     ScreenPtr pScreen = src->pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
-                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
 
     if (!PixmapStartDirtyTracking(src, slave_dst1, x, y,
                                   dst_x, dst_y, rotation)) {
@@ -1280,10 +1282,10 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
 static Bool
 msPresentSharedPixmap(PixmapPtr slave_dst)
 {
-    ScreenPtr pScreen = slave_dst->drawable.pScreen;
+    ScreenPtr pScreen = slave_dst->master_pixmap->drawable.pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst);
+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst->master_pixmap);
 
     RegionPtr region = DamageRegion(ppriv->dirty->damage);
 
@@ -1304,8 +1306,8 @@ msStopFlippingPixmapTracking(DrawablePtr src,
     ScreenPtr pScreen = src->pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
-                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
 
     Bool ret = TRUE;
 
@@ -1471,7 +1473,7 @@ msRequestSharedPixmapNotifyDamage(PixmapPtr ppix)
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
     modesettingPtr ms = modesettingPTR(scrn);
 
-    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix);
+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix->master_pixmap);
 
     ppriv->notify_on_damage = TRUE;
 
diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
index f6f2e9fd1..9717d9d39 100644
--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
+++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
@@ -398,7 +398,6 @@ drmmode_prop_info_copy(drmmode_prop_info_ptr dst,
 err:
     while (i--)
         free(dst[i].enum_values);
-    free(dst);
     return FALSE;
 }
 
diff --git a/hw/xfree86/drivers/modesetting/modesetting.man b/hw/xfree86/drivers/modesetting/modesetting.man
index d90352380..d530d7c4c 100644
--- a/hw/xfree86/drivers/modesetting/modesetting.man
+++ b/hw/xfree86/drivers/modesetting/modesetting.man
@@ -14,10 +14,13 @@ modesetting \- video driver for framebuffer device
 .fi
 .SH DESCRIPTION
 .B modesetting
-is an @xservername@ driver for KMS devices.  This is a non-accelerated
-driver, the following framebuffer depths are supported: 8, 15, 16, 24.
-All visual types are supported for depth 8, and TrueColor visual is
-supported for the other depths.  RandR 1.2 is supported.
+is an @xservername@ driver for KMS devices.  This driver supports
+TrueColor visuals at framebuffer depths of 15, 16, 24, and 30. RandR
+1.2 is supported for multi-head configurations. Acceleration is available
+through glamor for devices supporting at least OpenGL ES 2.0 or OpenGL 2.1.
+If glamor is not enabled, a shadow framebuffer is configured based on the
+KMS drivers' preference (unless the framebuffer is 24 bits per pixel, in
+which case the shadow framebuffer is always used).
 .SH SUPPORTED HARDWARE
 The 
 .B modesetting
@@ -51,8 +54,18 @@ The framebuffer device to use. Default: /dev/dri/card0.
 .BI "Option \*qShadowFB\*q \*q" boolean \*q
 Enable or disable use of the shadow framebuffer layer.  Default: on.
 .TP
+.BI "Option \*qDoubleShadow\*q \*q" boolean \*q
+Double-buffer shadow updates. When enabled, the driver will keep two copies of
+the shadow framebuffer. When the shadow framebuffer is flushed, the old and new
+versions of the shadow are compared, and only tiles that have actually changed
+are uploaded to the device. This is an optimization for server-class GPUs with
+a remote display function (typically VNC), where remote updates are triggered
+by any framebuffer write, so minimizing the amount of data uploaded is crucial.
+This defaults to enabled for ASPEED and Matrox G200 devices, and disabled
+otherwise.
+.TP
 .BI "Option \*qAccelMethod\*q \*q" string \*q
-One of \*qglamor\*q or \*qnone\*q.  Default: glamor
+One of \*qglamor\*q or \*qnone\*q.  Default: glamor.
 .TP
 .BI "Option \*qPageFlip\*q \*q" boolean \*q
 Enable DRI3 page flipping.  The default is
diff --git a/hw/xfree86/fbdevhw/fbdevhw.c b/hw/xfree86/fbdevhw/fbdevhw.c
index 0bd77df87..3fb1d2bba 100644
--- a/hw/xfree86/fbdevhw/fbdevhw.c
+++ b/hw/xfree86/fbdevhw/fbdevhw.c
@@ -329,6 +329,22 @@ fbdev_open(int scrnIndex, const char *dev, char **namep)
         return -1;
     }
 
+    /* only touch non-PCI devices on this path */
+    {
+        char buf[PATH_MAX];
+        char *sysfs_path = NULL;
+        char *node = strrchr(dev, '/') + 1;
+
+        if (asprintf(&sysfs_path, "/sys/class/graphics/%s", node) < 0 ||
+            readlink(sysfs_path, buf, sizeof(buf) < 0) ||
+            strstr(buf, "devices/pci")) {
+            free(sysfs_path);
+            close(fd);
+            return -1;
+        }
+        free(sysfs_path);
+    }
+
     if (namep) {
         if (-1 == ioctl(fd, FBIOGET_FSCREENINFO, (void *) (&fix))) {
             *namep = NULL;
diff --git a/hw/xfree86/os-support/shared/posix_tty.c b/hw/xfree86/os-support/shared/posix_tty.c
index 6768d290b..0cb9788cc 100644
--- a/hw/xfree86/os-support/shared/posix_tty.c
+++ b/hw/xfree86/os-support/shared/posix_tty.c
@@ -188,7 +188,7 @@ xf86SetSerial(int fd, XF86OptionPtr options)
 {
     struct termios t;
     int val;
-    const char *s;
+    char *s;
     int baud, r;
 
     if (fd < 0)
@@ -264,8 +264,10 @@ xf86SetSerial(int fd, XF86OptionPtr options)
         }
         else {
             xf86Msg(X_ERROR, "Invalid Option Parity value: %s\n", s);
+            free(s);
             return -1;
         }
+        free(s);
     }
 
     if ((val = xf86SetIntOption(options, "Vmin", -1)) != -1) {
@@ -291,8 +293,10 @@ xf86SetSerial(int fd, XF86OptionPtr options)
         }
         else {
             xf86Msg(X_ERROR, "Invalid Option FlowControl value: %s\n", s);
+            free(s);
             return -1;
         }
+        free(s);
     }
 
     if ((xf86SetBoolOption(options, "ClearDTR", FALSE))) {
diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c
index 06fcf5239..6aa1e4641 100644
--- a/hw/xwayland/xwayland-glamor-gbm.c
+++ b/hw/xwayland/xwayland-glamor-gbm.c
@@ -797,6 +797,7 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen)
         GLAMOR_GL_CORE_VER_MINOR,
         EGL_NONE
     };
+    const GLubyte *renderer;
 
     if (!xwl_gbm->fd_render_node && !xwl_gbm->drm_authenticated) {
         ErrorF("Failed to get wl_drm, disabling Glamor and DRI3\n");
@@ -843,6 +844,16 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen)
         goto error;
     }
 
+    renderer = glGetString(GL_RENDERER);
+    if (!renderer) {
+        ErrorF("glGetString() returned NULL, your GL is broken\n");
+        goto error;
+    }
+    if (strstr((const char *)renderer, "llvmpipe")) {
+        ErrorF("Refusing to try glamor on llvmpipe\n");
+        goto error;
+    }
+
     if (!epoxy_has_gl_extension("GL_OES_EGL_image")) {
         ErrorF("GL_OES_EGL_image not available\n");
         goto error;
diff --git a/hw/xwayland/xwayland-input.c b/hw/xwayland/xwayland-input.c
index 0a37f97bd..fbbcb39cc 100644
--- a/hw/xwayland/xwayland-input.c
+++ b/hw/xwayland/xwayland-input.c
@@ -37,6 +37,12 @@
 #include <misc.h>
 #include "tablet-unstable-v2-client-protocol.h"
 
+struct axis_discrete_pending {
+    struct xorg_list l;
+    uint32_t axis;
+    int32_t discrete;
+};
+
 struct sync_pending {
     struct xorg_list l;
     DeviceIntPtr pending_dev;
@@ -565,6 +571,8 @@ pointer_handle_axis(void *data, struct wl_pointer *pointer,
     int index;
     const int divisor = 10;
     ValuatorMask mask;
+    struct axis_discrete_pending *pending = NULL;
+    struct axis_discrete_pending *iter;
 
     switch (axis) {
     case WL_POINTER_AXIS_VERTICAL_SCROLL:
@@ -577,8 +585,22 @@ pointer_handle_axis(void *data, struct wl_pointer *pointer,
         return;
     }
 
+    xorg_list_for_each_entry(iter, &xwl_seat->axis_discrete_pending, l) {
+        if (iter->axis == axis) {
+            pending = iter;
+            break;
+        }
+    }
+
     valuator_mask_zero(&mask);
-    valuator_mask_set_double(&mask, index, wl_fixed_to_double(value) / divisor);
+
+    if (pending) {
+        valuator_mask_set(&mask, index, pending->discrete);
+        xorg_list_del(&pending->l);
+        free(pending);
+    } else {
+        valuator_mask_set_double(&mask, index, wl_fixed_to_double(value) / divisor);
+    }
     QueuePointerEvents(xwl_seat->pointer, MotionNotify, 0, POINTER_RELATIVE, &mask);
 }
 
@@ -608,6 +630,16 @@ static void
 pointer_handle_axis_discrete(void *data, struct wl_pointer *wl_pointer,
                              uint32_t axis, int32_t discrete)
 {
+    struct xwl_seat *xwl_seat = data;
+
+    struct axis_discrete_pending *pending = malloc(sizeof *pending);
+    if (!pending)
+        return;
+
+    pending->axis = axis;
+    pending->discrete = discrete;
+
+    xorg_list_add(&pending->l, &xwl_seat->axis_discrete_pending);
 }
 
 static const struct wl_pointer_listener pointer_listener = {
@@ -1337,6 +1369,7 @@ create_input_device(struct xwl_screen *xwl_screen, uint32_t id, uint32_t version
     wl_array_init(&xwl_seat->keys);
 
     xorg_list_init(&xwl_seat->touches);
+    xorg_list_init(&xwl_seat->axis_discrete_pending);
     xorg_list_init(&xwl_seat->sync_pending);
 }
 
@@ -1345,6 +1378,7 @@ xwl_seat_destroy(struct xwl_seat *xwl_seat)
 {
     struct xwl_touch *xwl_touch, *next_xwl_touch;
     struct sync_pending *p, *npd;
+    struct axis_discrete_pending *ad, *ad_next;
 
     xorg_list_for_each_entry_safe(xwl_touch, next_xwl_touch,
                                   &xwl_seat->touches, link_touch) {
@@ -1357,6 +1391,11 @@ xwl_seat_destroy(struct xwl_seat *xwl_seat)
         free (p);
     }
 
+    xorg_list_for_each_entry_safe(ad, ad_next, &xwl_seat->axis_discrete_pending, l) {
+        xorg_list_del(&ad->l);
+        free(ad);
+    }
+
     release_tablet_manager_seat(xwl_seat);
 
     release_grab(xwl_seat);
@@ -1565,8 +1604,8 @@ tablet_tool_motion(void *data, struct zwp_tablet_tool_v2 *tool,
     struct xwl_tablet_tool *xwl_tablet_tool = data;
     struct xwl_seat *xwl_seat = xwl_tablet_tool->seat;
     int32_t dx, dy;
-    int sx = wl_fixed_to_int(x);
-    int sy = wl_fixed_to_int(y);
+    double sx = wl_fixed_to_double(x);
+    double sy = wl_fixed_to_double(y);
 
     if (!xwl_seat->tablet_focus_window)
         return;
@@ -1574,8 +1613,8 @@ tablet_tool_motion(void *data, struct zwp_tablet_tool_v2 *tool,
     dx = xwl_seat->tablet_focus_window->window->drawable.x;
     dy = xwl_seat->tablet_focus_window->window->drawable.y;
 
-    xwl_tablet_tool->x = dx + sx;
-    xwl_tablet_tool->y = dy + sy;
+    xwl_tablet_tool->x = (double) dx + sx;
+    xwl_tablet_tool->y = (double) dy + sy;
 }
 
 static void
@@ -1733,15 +1772,15 @@ tablet_tool_frame(void *data, struct zwp_tablet_tool_v2 *tool, uint32_t time)
     int button;
 
     valuator_mask_zero(&mask);
-    valuator_mask_set(&mask, 0, xwl_tablet_tool->x);
-    valuator_mask_set(&mask, 1, xwl_tablet_tool->y);
+    valuator_mask_set_double(&mask, 0, xwl_tablet_tool->x);
+    valuator_mask_set_double(&mask, 1, xwl_tablet_tool->y);
     valuator_mask_set(&mask, 2, xwl_tablet_tool->pressure);
-    valuator_mask_set(&mask, 3, xwl_tablet_tool->tilt_x);
-    valuator_mask_set(&mask, 4, xwl_tablet_tool->tilt_y);
-    valuator_mask_set(&mask, 5, xwl_tablet_tool->rotation + xwl_tablet_tool->slider);
+    valuator_mask_set_double(&mask, 3, xwl_tablet_tool->tilt_x);
+    valuator_mask_set_double(&mask, 4, xwl_tablet_tool->tilt_y);
+    valuator_mask_set_double(&mask, 5, xwl_tablet_tool->rotation + xwl_tablet_tool->slider);
 
     QueuePointerEvents(xwl_tablet_tool->xdevice, MotionNotify, 0,
-               POINTER_ABSOLUTE | POINTER_SCREEN, &mask);
+               POINTER_ABSOLUTE | POINTER_DESKTOP, &mask);
 
     valuator_mask_zero(&mask);
 
diff --git a/hw/xwayland/xwayland-output.c b/hw/xwayland/xwayland-output.c
index 0d2ec7890..cc68f0340 100644
--- a/hw/xwayland/xwayland-output.c
+++ b/hw/xwayland/xwayland-output.c
@@ -404,14 +404,15 @@ xwl_output_remove(struct xwl_output *xwl_output)
     int width = 0, height = 0;
     Bool need_rotate = (xwl_output->xdg_output == NULL);
 
-    RRCrtcDestroy(xwl_output->randr_crtc);
-    RROutputDestroy(xwl_output->randr_output);
     xorg_list_del(&xwl_output->link);
 
     xorg_list_for_each_entry(it, &xwl_screen->output_list, link)
         output_get_new_size(it, need_rotate, &height, &width);
     update_screen_size(xwl_output, width, height);
 
+    RRCrtcDestroy(xwl_output->randr_crtc);
+    RROutputDestroy(xwl_output->randr_output);
+
     xwl_output_destroy(xwl_output);
 }
 
diff --git a/hw/xwayland/xwayland-present.c b/hw/xwayland/xwayland-present.c
index 81e0eb9ce..316e04443 100644
--- a/hw/xwayland/xwayland-present.c
+++ b/hw/xwayland/xwayland-present.c
@@ -147,6 +147,11 @@ xwl_present_cleanup(WindowPtr window)
     /* Clear timer */
     xwl_present_free_timer(xwl_present_window);
 
+    /* Remove from privates so we don't try to access it later */
+    dixSetPrivate(&window->devPrivates,
+                  &xwl_present_window_private_key,
+                  NULL);
+
     free(xwl_present_window);
 }
 
diff --git a/hw/xwayland/xwayland.h b/hw/xwayland/xwayland.h
index d70ad54bf..67819e178 100644
--- a/hw/xwayland/xwayland.h
+++ b/hw/xwayland/xwayland.h
@@ -272,6 +272,7 @@ struct xwl_seat {
     char *keymap;
     struct wl_surface *keyboard_focus;
 
+    struct xorg_list axis_discrete_pending;
     struct xorg_list sync_pending;
 
     struct xwl_pointer_warp_emulator *pointer_warp_emulator;
@@ -310,13 +311,13 @@ struct xwl_tablet_tool {
 
     DeviceIntPtr xdevice;
     uint32_t proximity_in_serial;
-    uint32_t x;
-    uint32_t y;
+    double x;
+    double y;
     uint32_t pressure;
-    float tilt_x;
-    float tilt_y;
-    float rotation;
-    float slider;
+    double tilt_x;
+    double tilt_y;
+    double rotation;
+    double slider;
 
     uint32_t buttons_now,
              buttons_prev;
diff --git a/meson.build b/meson.build
index 9858fa960..c40258e8b 100644
--- a/meson.build
+++ b/meson.build
@@ -3,7 +3,7 @@ project('xserver', 'c',
             'buildtype=debugoptimized',
             'c_std=gnu99',
         ],
-        version: '1.20.1',
+        version: '1.20.2',
         meson_version: '>= 0.47.0',
 )
 add_project_arguments('-DHAVE_DIX_CONFIG_H', language: 'c')
diff --git a/mi/mibitblt.c b/mi/mibitblt.c
index 2de5bf8fd..43d9bd917 100644
--- a/mi/mibitblt.c
+++ b/mi/mibitblt.c
@@ -141,6 +141,8 @@ miCopyArea(DrawablePtr pSrcDrawable,
         free(ordering);
         free(pwidthFirst);
         free(pptFirst);
+        if (realSrcClip)
+            RegionDestroy(prgnSrcClip);
         return NULL;
     }
 
diff --git a/miext/damage/damage.c b/miext/damage/damage.c
index de14d5cc8..f3ae4ebbc 100644
--- a/miext/damage/damage.c
+++ b/miext/damage/damage.c
@@ -829,16 +829,36 @@ damagePolyPoint(DrawablePtr pDrawable,
 
         /* this could be slow if the points were spread out */
 
-        while (--nptTmp) {
-            pptTmp++;
-            if (box.x1 > pptTmp->x)
-                box.x1 = pptTmp->x;
-            else if (box.x2 < pptTmp->x)
-                box.x2 = pptTmp->x;
-            if (box.y1 > pptTmp->y)
-                box.y1 = pptTmp->y;
-            else if (box.y2 < pptTmp->y)
-                box.y2 = pptTmp->y;
+        if (mode == CoordModePrevious) {
+            int x = box.x1;
+            int y = box.y1;
+
+            while (--nptTmp) {
+                pptTmp++;
+                x += pptTmp->x;
+                y += pptTmp->y;
+                if (box.x1 > x)
+                    box.x1 = x;
+                else if (box.x2 < x)
+                    box.x2 = x;
+                if (box.y1 > y)
+                    box.y1 = y;
+                else if (box.y2 < y)
+                    box.y2 = y;
+            }
+        }
+        else {
+            while (--nptTmp) {
+                pptTmp++;
+                if (box.x1 > pptTmp->x)
+                    box.x1 = pptTmp->x;
+                else if (box.x2 < pptTmp->x)
+                    box.x2 = pptTmp->x;
+                if (box.y1 > pptTmp->y)
+                    box.y1 = pptTmp->y;
+                else if (box.y2 < pptTmp->y)
+                    box.y2 = pptTmp->y;
+            }
         }
 
         box.x2++;
diff --git a/os/xdmcp.c b/os/xdmcp.c
index d8c81fbf8..62adead84 100644
--- a/os/xdmcp.c
+++ b/os/xdmcp.c
@@ -569,10 +569,9 @@ XdmcpRegisterDisplayClass(const char *name, int length)
 }
 
 static void
-xdmcp_start(void)
+xdmcp_reset(void)
 {
     timeOutRtx = 0;
-    get_xdmcp_sock();
     if (xdmcpSocket >= 0)
         SetNotifyFd(xdmcpSocket, XdmcpSocketNotify, X_NOTIFY_READ, NULL);
 #if defined(IPv6) && defined(AF_INET6)
@@ -583,6 +582,13 @@ xdmcp_start(void)
     send_packet();
 }
 
+static void
+xdmcp_start(void)
+{
+    get_xdmcp_sock();
+    xdmcp_reset();
+}
+
 /*
  * initialize XDMCP; create the socket, compute the display
  * number, set up the state machine
@@ -611,7 +617,7 @@ XdmcpReset(void)
 {
     state = XDM_INIT_STATE;
     if (state != XDM_OFF)
-        xdmcp_start();
+        xdmcp_reset();
 }
 
 /*
diff --git a/present/present_wnmd.c b/present/present_wnmd.c
index 035ae8ffe..8f3836440 100644
--- a/present/present_wnmd.c
+++ b/present/present_wnmd.c
@@ -188,10 +188,11 @@ present_wnmd_flip_notify(present_vblank_ptr vblank, uint64_t ust, uint64_t crtc_
     window_priv->flip_active = vblank;
     window_priv->flip_pending = NULL;
 
+    present_vblank_notify(vblank, PresentCompleteKindPixmap, PresentCompleteModeFlip, ust, crtc_msc);
+
     if (vblank->abort_flip)
         present_wnmd_flips_stop(window);
 
-    present_vblank_notify(vblank, PresentCompleteKindPixmap, PresentCompleteModeFlip, ust, crtc_msc);
     present_wnmd_flip_try_ready(window);
 }
 
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 5d9026266..a851aebcc 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -702,8 +702,8 @@ rrCheckPixmapBounding(ScreenPtr pScreen,
     if (new_height < screen_pixmap->drawable.height)
         new_height = screen_pixmap->drawable.height;
 
-    if (new_width == screen_pixmap->drawable.width &&
-        new_height == screen_pixmap->drawable.height) {
+    if (new_width <= screen_pixmap->drawable.width &&
+        new_height <= screen_pixmap->drawable.height) {
     } else {
         pScrPriv->rrScreenSetSize(pScreen, new_width, new_height, 0, 0);
     }
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 0fe6ebf4a..764079506 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2570,7 +2570,7 @@ _XkbSetMap(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req, char *values)
             first = last = 0;
         if (change.map.num_modmap_keys > 0) {
             firstMM = change.map.first_modmap_key;
-            lastMM = first + change.map.num_modmap_keys - 1;
+            lastMM = firstMM + change.map.num_modmap_keys - 1;
         }
         else
             firstMM = lastMM = 0;