Merge tag 'xorg-server-1.19.4' into cygwin-release-1.19

xorg-server-1.19.4

68 files changed, 713 insertions, 395 deletions

diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c
index 18f3ac715..f31b1e054 100644
--- a/Xext/panoramiXprocs.c
+++ b/Xext/panoramiXprocs.c
@@ -1050,7 +1050,7 @@ PanoramiXClearToBackground(ClientPtr client)
 int
 PanoramiXCopyArea(ClientPtr client)
 {
-    int j, result, srcx, srcy, dstx, dsty;
+    int j, result, srcx, srcy, dstx, dsty, width, height;
     PanoramiXRes *gc, *src, *dst;
     Bool srcIsRoot = FALSE;
     Bool dstIsRoot = FALSE;
@@ -1091,6 +1091,8 @@ PanoramiXCopyArea(ClientPtr client)
     srcy = stuff->srcY;
     dstx = stuff->dstX;
     dsty = stuff->dstY;
+    width = stuff->width;
+    height = stuff->height;
     if ((dst->type == XRT_PIXMAP) && (src->type == XRT_WINDOW)) {
         DrawablePtr drawables[MAXSCREENS];
         DrawablePtr pDst;
@@ -1105,13 +1107,12 @@ PanoramiXCopyArea(ClientPtr client)
                 return rc;
         }
 
-        pitch = PixmapBytePad(stuff->width, drawables[0]->depth);
-        if (!(data = calloc(stuff->height, pitch)))
+        pitch = PixmapBytePad(width, drawables[0]->depth);
+        if (!(data = calloc(height, pitch)))
             return BadAlloc;
 
-        XineramaGetImageData(drawables, srcx, srcy,
-                             stuff->width, stuff->height, ZPixmap, ~0, data,
-                             pitch, srcIsRoot);
+        XineramaGetImageData(drawables, srcx, srcy, width, height, ZPixmap, ~0,
+                             data, pitch, srcIsRoot);
 
         FOR_NSCREENS_BACKWARD(j) {
             stuff->gc = gc->info[j].id;
@@ -1123,14 +1124,63 @@ PanoramiXCopyArea(ClientPtr client)
             }
 
             (*pGC->ops->PutImage) (pDst, pGC, pDst->depth, dstx, dsty,
-                                   stuff->width, stuff->height,
-                                   0, ZPixmap, data);
-
+                                   width, height, 0, ZPixmap, data);
             if (dstShared)
                 break;
         }
-
         free(data);
+
+        if (pGC->graphicsExposures) {
+            RegionRec rgn;
+            int dx, dy;
+            BoxRec sourceBox;
+
+            dx = drawables[0]->x;
+            dy = drawables[0]->y;
+            if (srcIsRoot) {
+                dx += screenInfo.screens[0]->x;
+                dy += screenInfo.screens[0]->y;
+            }
+
+            sourceBox.x1 = min(srcx + dx, 0);
+            sourceBox.y1 = min(srcy + dy, 0);
+            sourceBox.x2 = max(sourceBox.x1 + width, 32767);
+            sourceBox.y2 = max(sourceBox.y1 + height, 32767);
+
+            RegionInit(&rgn, &sourceBox, 1);
+
+            /* subtract the (screen-space) clips of the source drawables */
+            FOR_NSCREENS(j) {
+                ScreenPtr screen = screenInfo.screens[j];
+                RegionPtr sd;
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    sd = NotClippedByChildren((WindowPtr)drawables[j]);
+                else
+                    sd = &((WindowPtr)drawables[j])->clipList;
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, -screen->x, -screen->y);
+
+                RegionSubtract(&rgn, &rgn, sd);
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, screen->x, screen->y);
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    RegionDestroy(sd);
+            }
+
+            /* -dx/-dy to get back to dest-relative, plus request offsets */
+            RegionTranslate(&rgn, -dx + dstx, -dy + dsty);
+
+            /* intersect with gc clip; just one screen is fine because pixmap */
+            RegionIntersect(&rgn, &rgn, pGC->pCompositeClip);
+
+            /* and expose */
+            SendGraphicsExpose(client, &rgn, dst->info[0].id, X_CopyArea, 0);
+            RegionUninit(&rgn);
+        }
     }
     else {
         DrawablePtr pDst = NULL, pSrc = NULL;
diff --git a/Xext/shm.c b/Xext/shm.c
index 1b622e353..c98d4a0c3 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -1238,6 +1238,7 @@ ProcShmCreateSegment(ClientPtr client)
     };
 
     REQUEST_SIZE_MATCH(xShmCreateSegmentReq);
+    LEGAL_NEW_RESOURCE(stuff->shmseg, client);
     if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) {
         client->errorValue = stuff->readOnly;
         return BadValue;
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 183f88dae..5ecc228ee 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 {
     CARD32 *p;
     int i;
-    xEvent eventT;
+    xEvent eventT = { .u.u.type = 0 };
     xEvent *eventP;
     EventSwapPtr proc;
 
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
 
     eventP = (xEvent *) &stuff[1];
     for (i = 0; i < stuff->num_events; i++, eventP++) {
+        if (eventP->u.u.type == GenericEvent) {
+            client->errorValue = eventP->u.u.type;
+            return BadValue;
+        }
+
         proc = EventSwapVector[eventP->u.u.type & 0177];
-        if (proc == NotImplemented)     /* no swapping proc; invalid event type? */
+        /* no swapping proc; invalid event type? */
+        if (proc == NotImplemented) {
+            client->errorValue = eventP->u.u.type;
             return BadValue;
+        }
         (*proc) (eventP, &eventT);
         *eventP = eventT;
     }
@@ -117,7 +125,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 int
 ProcXSendExtensionEvent(ClientPtr client)
 {
-    int ret;
+    int ret, i;
     DeviceIntPtr dev;
     xEvent *first;
     XEventClass *list;
@@ -141,10 +149,12 @@ ProcXSendExtensionEvent(ClientPtr client)
     /* The client's event type must be one defined by an extension. */
 
     first = ((xEvent *) &stuff[1]);
-    if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
-          (first->u.u.type < lastEvent))) {
-        client->errorValue = first->u.u.type;
-        return BadValue;
+    for (i = 0; i < stuff->num_events; i++) {
+        if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
+            (first[i].u.u.type < lastEvent))) {
+            client->errorValue = first[i].u.u.type;
+            return BadValue;
+        }
     }
 
     list = (XEventClass *) (first + stuff->num_events);
diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
index a8b92cc18..0bc5761f3 100644
--- a/Xi/xibarriers.c
+++ b/Xi/xibarriers.c
@@ -830,10 +830,13 @@ SProcXIBarrierReleasePointer(ClientPtr client)
     REQUEST(xXIBarrierReleasePointerReq);
     int i;
 
-    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
-
     swaps(&stuff->length);
+    REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+
     swapl(&stuff->num_barriers);
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
+
+    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {
         swaps(&info->deviceid);
         swapl(&info->barrier);
@@ -853,7 +856,7 @@ ProcXIBarrierReleasePointer(ClientPtr client)
     xXIBarrierReleasePointerInfo *info;
 
     REQUEST(xXIBarrierReleasePointerReq);
-    REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
 
     info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {
diff --git a/Xi/xiwarppointer.c b/Xi/xiwarppointer.c
index 780758a9e..8426443fa 100644
--- a/Xi/xiwarppointer.c
+++ b/Xi/xiwarppointer.c
@@ -186,6 +186,10 @@ ProcXIWarpPointer(ClientPtr client)
     pDev->last.valuators[1] = y;
     miPointerUpdateSprite(pDev);
 
+    if (*newScreen->CursorWarpedTo)
+        (*newScreen->CursorWarpedTo) (pDev, newScreen, client,
+                                      dest, pSprite, x, y);
+
     /* FIXME: XWarpPointer is supposed to generate an event. It doesn't do it
        here though. */
     return Success;
diff --git a/configure.ac b/configure.ac
index 931001e82..315a51f08 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.19.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2017-03-15"
-RELEASE_NAME="Lobster Bisque"
+AC_INIT([xorg-server], 1.19.4, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2017-10-04"
+RELEASE_NAME="French Onion Soup"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
@@ -144,7 +144,7 @@ AM_CONDITIONAL(SPECIAL_DTRACE_OBJECTS, [test "x$SPECIAL_DTRACE_OBJECTS" = "xyes"
 AC_HEADER_DIRENT
 AC_HEADER_STDC
 AC_CHECK_HEADERS([fcntl.h stdlib.h string.h unistd.h dlfcn.h stropts.h \
- fnmatch.h sys/mkdev.h sys/utsname.h])
+ fnmatch.h sys/mkdev.h sys/sysmacros.h sys/utsname.h])
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
@@ -2645,6 +2645,7 @@ hw/xfree86/shadowfb/Makefile
 hw/xfree86/vbe/Makefile
 hw/xfree86/vgahw/Makefile
 hw/xfree86/x86emu/Makefile
+hw/xfree86/xkb/Makefile
 hw/xfree86/utils/Makefile
 hw/xfree86/utils/man/Makefile
 hw/xfree86/utils/cvt/Makefile
diff --git a/dix/dispatch.c b/dix/dispatch.c
index b4db19291..64ecea957 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -3419,7 +3419,6 @@ CloseDownClient(ClientPtr client)
         if (grabState != GrabNone && grabClient == client) {
             UngrabServer(client);
         }
-        mark_client_not_ready(client);
         BITCLEAR(grabWaiters, client->index);
         DeleteClientFromAnySelections(client);
         ReleaseActiveGrabs(client);
@@ -3448,8 +3447,9 @@ CloseDownClient(ClientPtr client)
         if (ClientIsAsleep(client))
             ClientSignal(client);
         ProcessWorkQueueZombies();
-        output_pending_clear(client);
         CloseDownConnection(client);
+        output_pending_clear(client);
+        mark_client_not_ready(client);
 
         /* If the client made it to the Running stage, nClients has
          * been incremented on its behalf, so we need to decrement it
diff --git a/dix/events.c b/dix/events.c
index cc26ba5db..3faad53a8 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5366,6 +5366,12 @@ ProcSendEvent(ClientPtr client)
         client->errorValue = stuff->event.u.u.type;
         return BadValue;
     }
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
     if (stuff->event.u.u.type == ClientMessage &&
         stuff->event.u.u.detail != 8 &&
         stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) {
diff --git a/dix/swapreq.c b/dix/swapreq.c
index 61d3ce0f4..8cc64b6ed 100644
--- a/dix/swapreq.c
+++ b/dix/swapreq.c
@@ -292,6 +292,13 @@ SProcSendEvent(ClientPtr client)
     swapl(&stuff->destination);
     swapl(&stuff->eventMask);
 
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
+
     /* Swap event */
     proc = EventSwapVector[stuff->event.u.u.type & 0177];
     if (!proc || proc == NotImplemented)        /* no swapping proc; invalid event type? */
diff --git a/glamor/glamor.c b/glamor/glamor.c
index c54cf3b43..2467443e0 100644
--- a/glamor/glamor.c
+++ b/glamor/glamor.c
@@ -133,6 +133,9 @@ glamor_get_pixmap_texture(PixmapPtr pixmap)
 {
     glamor_pixmap_private *pixmap_priv = glamor_get_pixmap_private(pixmap);
 
+    if (!pixmap_priv)
+        return 0;
+
     if (pixmap_priv->type != GLAMOR_TEXTURE_ONLY)
         return 0;
 
diff --git a/glamor/glamor_copy.c b/glamor/glamor_copy.c
index 3ca56fb09..ed96b2b1e 100644
--- a/glamor/glamor_copy.c
+++ b/glamor/glamor_copy.c
@@ -230,8 +230,8 @@ glamor_copy_cpu_fbo(DrawablePtr src,
             goto bail;
         }
 
-        src_pix->drawable.x = -dst->x;
-        src_pix->drawable.y = -dst->y;
+        src_pix->drawable.x = dst_xoff;
+        src_pix->drawable.y = dst_yoff;
 
         fbGetDrawable(&src_pix->drawable, src_bits, src_stride, src_bpp, src_xoff,
                       src_yoff);
@@ -344,6 +344,7 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
     glamor_program *prog;
     const glamor_facet *copy_facet;
     int n;
+    Bool ret = FALSE;
 
     glamor_make_current(glamor_priv);
 
@@ -410,9 +411,10 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
             goto bail_ctx;
 
         glamor_pixmap_loop(dst_priv, dst_box_index) {
-            glamor_set_destination_drawable(dst, dst_box_index, FALSE, FALSE,
-                                            prog->matrix_uniform,
-                                            &dst_off_x, &dst_off_y);
+            if (!glamor_set_destination_drawable(dst, dst_box_index, FALSE, FALSE,
+                                                 prog->matrix_uniform,
+                                                 &dst_off_x, &dst_off_y))
+                goto bail_ctx;
 
             glScissor(dst_off_x - args.dx,
                       dst_off_y - args.dy,
@@ -422,13 +424,14 @@ glamor_copy_fbo_fbo_draw(DrawablePtr src,
             glamor_glDrawArrays_GL_QUADS(glamor_priv, nbox);
         }
     }
-    glDisable(GL_SCISSOR_TEST);
-    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
+    ret = TRUE;
 
 bail_ctx:
-    return FALSE;
+    glDisable(GL_SCISSOR_TEST);
+    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+
+    return ret;
 }
 
 /**
diff --git a/glamor/glamor_dash.c b/glamor/glamor_dash.c
index 78a4fa37a..b53ce5c50 100644
--- a/glamor/glamor_dash.c
+++ b/glamor/glamor_dash.c
@@ -147,7 +147,7 @@ glamor_dash_setup(DrawablePtr drawable, GCPtr gc)
         goto bail;
 
     dash_pixmap = glamor_get_dash_pixmap(gc);
-    dash_priv = glamor_get_pixmap_private(pixmap);
+    dash_priv = glamor_get_pixmap_private(dash_pixmap);
 
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
         goto bail;
diff --git a/glamor/glamor_fbo.c b/glamor/glamor_fbo.c
index 988bb585b..9f1288c60 100644
--- a/glamor/glamor_fbo.c
+++ b/glamor/glamor_fbo.c
@@ -156,6 +156,10 @@ glamor_create_fbo(glamor_screen_private *glamor_priv,
                   int w, int h, GLenum format, int flag)
 {
     GLint tex = _glamor_create_tex(glamor_priv, w, h, format);
+
+    if (!tex) /* Texture creation failed due to GL_OUT_OF_MEMORY */
+        return NULL;
+
     return glamor_create_fbo_from_tex(glamor_priv, w, h, format, tex, flag);
 }
 
diff --git a/glamor/glamor_glyphblt.c b/glamor/glamor_glyphblt.c
index b21aa068e..78315ea9b 100644
--- a/glamor/glamor_glyphblt.c
+++ b/glamor/glamor_glyphblt.c
@@ -49,6 +49,7 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
     glamor_program *prog;
     RegionPtr clip = gc->pCompositeClip;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -75,8 +76,9 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
         int off_x, off_y;
         char *vbo_offset;
 
-        glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
+                                              prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         max_points = 500;
         num_points = 0;
@@ -138,11 +140,12 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
-    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+    ret = TRUE;
 
-    return TRUE;
 bail:
-    return FALSE;
+    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+
+    return ret;
 }
 
 void
@@ -174,6 +177,7 @@ glamor_push_pixels_gl(GCPtr gc, PixmapPtr bitmap,
     int num_points;
     INT16 *points = NULL;
     char *vbo_offset;
+    Bool ret = FALSE;
 
     if (w * h > MAXINT / (2 * sizeof(float)))
         goto bail;
@@ -221,17 +225,19 @@ glamor_push_pixels_gl(GCPtr gc, PixmapPtr bitmap,
     glamor_put_vbo_space(screen);
 
     glamor_pixmap_loop(pixmap_priv, box_index) {
-        glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
-                                        prog->matrix_uniform, NULL, NULL);
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, TRUE,
+                                             prog->matrix_uniform, NULL, NULL))
+            goto bail;
 
         glDrawArrays(GL_POINTS, 0, num_points);
     }
 
-    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
-    return TRUE;
+    ret = TRUE;
 
 bail:
-    return FALSE;
+    glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
+
+    return ret;
 }
 
 void
diff --git a/glamor/glamor_largepixmap.c b/glamor/glamor_largepixmap.c
index ebfdc9537..f9adb93bc 100644
--- a/glamor/glamor_largepixmap.c
+++ b/glamor/glamor_largepixmap.c
@@ -1,4 +1,5 @@
 #include <stdlib.h>
+#include <stdint.h> /* For INT16_MAX */
 
 #include "glamor_priv.h"
 
@@ -722,11 +723,11 @@ glamor_compute_transform_clipped_regions(PixmapPtr pixmap,
         temp_box.x2 = MIN(temp_box.x2, pixmap->drawable.width);
         temp_box.y2 = MIN(temp_box.y2, pixmap->drawable.height);
     }
-    /* Now copy back the box32 to a box16 box. */
-    short_box.x1 = temp_box.x1;
-    short_box.y1 = temp_box.y1;
-    short_box.x2 = temp_box.x2;
-    short_box.y2 = temp_box.y2;
+    /* Now copy back the box32 to a box16 box, avoiding overflow. */
+    short_box.x1 = MIN(temp_box.x1, INT16_MAX);
+    short_box.y1 = MIN(temp_box.y1, INT16_MAX);
+    short_box.x2 = MIN(temp_box.x2, INT16_MAX);
+    short_box.y2 = MIN(temp_box.y2, INT16_MAX);
     RegionInitBoxes(temp_region, &short_box, 1);
     DEBUGF("copy to temp source region \n");
     DEBUGRegionPrint(temp_region);
diff --git a/glamor/glamor_lines.c b/glamor/glamor_lines.c
index a2c9b1fcc..5d95333fe 100644
--- a/glamor/glamor_lines.c
+++ b/glamor/glamor_lines.c
@@ -46,6 +46,7 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
     char *vbo_offset;
     int box_index;
     int add_last;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -103,8 +104,9 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -116,12 +118,13 @@ glamor_poly_lines_solid_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-bail:
-    return FALSE;
+    return ret;
 }
 
 static Bool
diff --git a/glamor/glamor_points.c b/glamor/glamor_points.c
index facfe8240..faf6f433b 100644
--- a/glamor/glamor_points.c
+++ b/glamor/glamor_points.c
@@ -47,6 +47,7 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
     GLshort *vbo_ppt;
     char *vbo_offset;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -90,8 +91,9 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -103,13 +105,13 @@ glamor_poly_point_gl(DrawablePtr drawable, GCPtr gc, int mode, int npt, DDXPoint
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-
-bail:
-    return FALSE;
+    return ret;
 }
 
 void
diff --git a/glamor/glamor_rects.c b/glamor/glamor_rects.c
index e4473209d..cc029c8c0 100644
--- a/glamor/glamor_rects.c
+++ b/glamor/glamor_rects.c
@@ -52,6 +52,7 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
     GLshort *v;
     char *vbo_offset;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -115,8 +116,9 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, FALSE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, FALSE,
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -132,14 +134,15 @@ glamor_poly_fill_rect_gl(DrawablePtr drawable,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     if (glamor_priv->glsl_version >= 130)
         glVertexAttribDivisor(GLAMOR_VERTEX_POS, 0);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-bail:
-    return FALSE;
+    return ret;
 }
 
 static void
diff --git a/glamor/glamor_render.c b/glamor/glamor_render.c
index 52f073d05..a8b208101 100644
--- a/glamor/glamor_render.c
+++ b/glamor/glamor_render.c
@@ -992,7 +992,7 @@ glamor_composite_choose_shader(CARD8 op,
                 goto fail;
             }
         } else {
-            if (!glamor_render_format_is_supported(source->format)) {
+            if (source && !glamor_render_format_is_supported(source->format)) {
                 glamor_fallback("Unsupported source picture format.\n");
                 goto fail;
             }
@@ -1411,7 +1411,8 @@ glamor_composite_clipped_region(CARD8 op,
            x_source, y_source, x_mask, y_mask, x_dest, y_dest, width, height);
 
     /* Is the composite operation equivalent to a copy? */
-    if (!mask && !source->alphaMap && !dest->alphaMap
+    if (source &&
+        !mask && !source->alphaMap && !dest->alphaMap
         && source->pDrawable && !source->transform
         /* CopyArea is only defined with matching depths. */
         && dest->pDrawable->depth == source->pDrawable->depth
diff --git a/glamor/glamor_segs.c b/glamor/glamor_segs.c
index 5fffa3b0f..4dfa6553b 100644
--- a/glamor/glamor_segs.c
+++ b/glamor/glamor_segs.c
@@ -46,6 +46,7 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
     char *vbo_offset;
     int box_index;
     int add_last;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -62,7 +63,7 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
                                    &glamor_facet_poly_segment);
 
     if (!prog)
-        goto bail_ctx;
+        goto bail;
 
     /* Set up the vertex buffers for the points */
 
@@ -95,8 +96,9 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, TRUE, TRUE,
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -108,13 +110,13 @@ glamor_poly_segment_solid_gl(DrawablePtr drawable, GCPtr gc,
         }
     }
 
+    ret = TRUE;
+
     glDisable(GL_SCISSOR_TEST);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-bail_ctx:
 bail:
-    return FALSE;
+    return ret;
 }
 
 static Bool
diff --git a/glamor/glamor_spans.c b/glamor/glamor_spans.c
index 9a2aecd9d..b3c028d67 100644
--- a/glamor/glamor_spans.c
+++ b/glamor/glamor_spans.c
@@ -56,6 +56,7 @@ glamor_fill_spans_gl(DrawablePtr drawable,
     char *vbo_offset;
     int c;
     int box_index;
+    Bool ret = FALSE;
 
     pixmap_priv = glamor_get_pixmap_private(pixmap);
     if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
@@ -123,8 +124,9 @@ glamor_fill_spans_gl(DrawablePtr drawable,
         int nbox = RegionNumRects(gc->pCompositeClip);
         BoxPtr box = RegionRects(gc->pCompositeClip);
 
-        glamor_set_destination_drawable(drawable, box_index, FALSE, FALSE,
-                                        prog->matrix_uniform, &off_x, &off_y);
+        if (!glamor_set_destination_drawable(drawable, box_index, FALSE, FALSE,
+                                             prog->matrix_uniform, &off_x, &off_y))
+            goto bail;
 
         while (nbox--) {
             glScissor(box->x1 + off_x,
@@ -140,14 +142,15 @@ glamor_fill_spans_gl(DrawablePtr drawable,
         }
     }
 
+    ret = TRUE;
+
+bail:
     glDisable(GL_SCISSOR_TEST);
     if (glamor_priv->glsl_version >= 130)
         glVertexAttribDivisor(GLAMOR_VERTEX_POS, 0);
     glDisableVertexAttribArray(GLAMOR_VERTEX_POS);
 
-    return TRUE;
-bail:
-    return FALSE;
+    return ret;
 }
 
 static void
diff --git a/glamor/glamor_transform.c b/glamor/glamor_transform.c
index eff500c6d..2d5a634a8 100644
--- a/glamor/glamor_transform.c
+++ b/glamor/glamor_transform.c
@@ -33,7 +33,7 @@
  * clipping computations can be adjusted as appropriate
  */
 
-void
+Bool
 glamor_set_destination_drawable(DrawablePtr     drawable,
                                 int             box_index,
                                 Bool            do_drawable_translate,
@@ -53,6 +53,11 @@ glamor_set_destination_drawable(DrawablePtr     drawable,
     float scale_x = 2.0f / (float) w;
     float scale_y = 2.0f / (float) h;
     float center_adjust = 0.0f;
+    glamor_pixmap_fbo *pixmap_fbo;
+
+    pixmap_fbo = glamor_pixmap_fbo_at(pixmap_priv, box_index);
+    if (!pixmap_fbo)
+        return FALSE;
 
     glamor_get_drawable_deltas(drawable, pixmap, &off_x, &off_y);
 
@@ -94,8 +99,10 @@ glamor_set_destination_drawable(DrawablePtr     drawable,
                 scale_x, (off_x + center_adjust) * scale_x - 1.0f,
                 scale_y, (off_y + center_adjust) * scale_y - 1.0f);
 
-    glamor_set_destination_pixmap_fbo(glamor_priv, glamor_pixmap_fbo_at(pixmap_priv, box_index),
+    glamor_set_destination_pixmap_fbo(glamor_priv, pixmap_fbo,
                                       0, 0, w, h);
+
+    return TRUE;
 }
 
 /*
diff --git a/glamor/glamor_transform.h b/glamor/glamor_transform.h
index 70d2c1671..28855e3d3 100644
--- a/glamor/glamor_transform.h
+++ b/glamor/glamor_transform.h
@@ -23,7 +23,7 @@
 #ifndef _GLAMOR_TRANSFORM_H_
 #define _GLAMOR_TRANSFORM_H_
 
-void
+Bool
 glamor_set_destination_drawable(DrawablePtr     drawable,
                                 int             box_index,
                                 Bool            do_drawable_translate,
diff --git a/glamor/glamor_utils.h b/glamor/glamor_utils.h
index 6b88527e6..a35917c37 100644
--- a/glamor/glamor_utils.h
+++ b/glamor/glamor_utils.h
@@ -723,8 +723,8 @@ glamor_is_large_pixmap(PixmapPtr pixmap)
 static inline void
 glamor_make_current(glamor_screen_private *glamor_priv)
 {
-    if (lastGLContext != &glamor_priv->ctx) {
-        lastGLContext = &glamor_priv->ctx;
+    if (lastGLContext != glamor_priv->ctx.ctx) {
+        lastGLContext = glamor_priv->ctx.ctx;
         glamor_priv->ctx.make_current(&glamor_priv->ctx);
     }
 }
diff --git a/glamor/glamor_xv.c b/glamor/glamor_xv.c
index 3bcf909b0..31320d124 100644
--- a/glamor/glamor_xv.c
+++ b/glamor/glamor_xv.c
@@ -430,11 +430,14 @@ glamor_xv_put_image(glamor_port_private *port_priv,
                 glamor_destroy_pixmap(port_priv->src_pix[i]);
 
         port_priv->src_pix[0] =
-            glamor_create_pixmap(pScreen, width, height, 8, 0);
+            glamor_create_pixmap(pScreen, width, height, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix[1] =
-            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8, 0);
+            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix[2] =
-            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8, 0);
+            glamor_create_pixmap(pScreen, width >> 1, height >> 1, 8,
+                                 GLAMOR_CREATE_FBO_NO_FBO);
         port_priv->src_pix_w = width;
         port_priv->src_pix_h = height;
 
diff --git a/hw/dmx/dmxinit.c b/hw/dmx/dmxinit.c
index 3d394c52b..24bb875fb 100644
--- a/hw/dmx/dmxinit.c
+++ b/hw/dmx/dmxinit.c
@@ -532,63 +532,6 @@ dmxDisplayInit(DMXScreenInfo * dmxScreen)
     dmxGetPixmapFormats(dmxScreen);
 }
 
-/* If this doesn't compile, just add || defined(yoursystem) to the line
- * below.  This information is to help with bug reports and is not
- * critical. */
-#if !defined(_POSIX_SOURCE)
-static const char *
-dmxExecOS(void)
-{
-    return "";
-}
-#else
-#include <sys/utsname.h>
-static const char *
-dmxExecOS(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-    struct utsname u;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-        uname(&u);
-        snprintf(buffer, sizeof(buffer) - 1, "%s %s %s",
-                 u.sysname, u.release, u.version);
-    }
-    return buffer;
-}
-#endif
-
-static const char *
-dmxBuildCompiler(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-#if defined(__GNUC__) && defined(__GNUC_MINOR__) &&defined(__GNUC_PATCHLEVEL__)
-        snprintf(buffer, sizeof(buffer) - 1, "gcc %d.%d.%d",
-                 __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
-#endif
-    }
-    return buffer;
-}
-
-static const char *
-dmxExecHost(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-        XmuGetHostname(buffer, sizeof(buffer) - 1);
-    }
-    return buffer;
-}
-
 static void dmxAddExtensions(Bool glxSupported)
 {
     const ExtensionModule dmxExtensions[] = {
@@ -641,12 +584,6 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char *argv[])
         SetVendorRelease(VENDOR_RELEASE);
         SetVendorString(VENDOR_STRING);
 
-        if (dmxGeneration == 1) {
-            dmxLog(dmxInfo, "DMX Build OS:       %s (%s)\n", OSNAME, OSVENDOR);
-            dmxLog(dmxInfo, "DMX Build Compiler: %s\n", dmxBuildCompiler());
-            dmxLog(dmxInfo, "DMX Execution OS:   %s\n", dmxExecOS());
-            dmxLog(dmxInfo, "DMX Execution Host: %s\n", dmxExecHost());
-        }
         dmxLog(dmxInfo, "MAXSCREENS:         %d\n", MAXSCREENS);
 
         for (i = 0; i < dmxNumScreens; i++) {
diff --git a/hw/dmx/dmxsync.c b/hw/dmx/dmxsync.c
index 1bc242343..b55c9ddf3 100644
--- a/hw/dmx/dmxsync.c
+++ b/hw/dmx/dmxsync.c
@@ -182,7 +182,7 @@ dmxSync(DMXScreenInfo * dmxScreen, Bool now)
 
         /* Do sync or set time for later */
         if (now || !dmxScreen) {
-            if (!TimerForce(dmxSyncTimer))
+            if (dmxSyncTimer == NULL || !TimerForce(dmxSyncTimer))
                 dmxSyncCallback(NULL, 0, NULL);
             /* At this point, dmxSyncPending == 0 because
              * dmxSyncCallback must have been called. */
diff --git a/hw/dmx/input/usb-keyboard.c b/hw/dmx/input/usb-keyboard.c
index e41ad40eb..b26c822c0 100644
--- a/hw/dmx/input/usb-keyboard.c
+++ b/hw/dmx/input/usb-keyboard.c
@@ -289,7 +289,8 @@ kbdUSBCtrl(DevicePtr pDev, KeybdCtrl * ctrl)
             led = i;
         event.code = led;
         event.value = ! !(ctrl->leds & (1 << led));
-        write(priv->fd, &event, sizeof(event));
+        if (write(priv->fd, &event, sizeof(event)) != sizeof(event))
+            DebugF("Failed to set LEDs!\n");
     }
 }
 
diff --git a/hw/kdrive/ephyr/ephyr.c b/hw/kdrive/ephyr/ephyr.c
index 4eec72af9..ef5350e18 100644
--- a/hw/kdrive/ephyr/ephyr.c
+++ b/hw/kdrive/ephyr/ephyr.c
@@ -725,8 +725,10 @@ ephyrCreateResources(ScreenPtr pScreen)
                            ephyrShadowUpdate, ephyrWindowLinear);
     else {
 #ifdef GLAMOR
-        if (ephyr_glamor)
-            ephyr_glamor_create_screen_resources(pScreen);
+        if (ephyr_glamor) {
+            if (!ephyr_glamor_create_screen_resources(pScreen))
+                return FALSE;
+        }
 #endif
         return ephyrSetInternalDamage(pScreen);
     }
diff --git a/hw/kdrive/ephyr/ephyrvideo.c b/hw/kdrive/ephyr/ephyrvideo.c
index 31b1eee31..17336ab2b 100644
--- a/hw/kdrive/ephyr/ephyrvideo.c
+++ b/hw/kdrive/ephyr/ephyrvideo.c
@@ -226,6 +226,11 @@ ephyrInitVideo(ScreenPtr pScreen)
         return FALSE;
     }
 
+    if (!hostx_has_extension(&xcb_xv_id)) {
+        EPHYR_LOG_ERROR("Host has no XVideo extension\n");
+        return FALSE;
+    }
+
     if (!xv_priv) {
         xv_priv = ephyrXVPrivNew();
     }
diff --git a/hw/kdrive/ephyr/hostx.c b/hw/kdrive/ephyr/hostx.c
index fe69f84ae..d5578deaa 100644
--- a/hw/kdrive/ephyr/hostx.c
+++ b/hw/kdrive/ephyr/hostx.c
@@ -927,7 +927,6 @@ hostx_screen_init(KdScreenInfo *screen,
 #ifdef GLAMOR
     if (ephyr_glamor) {
         *bytes_per_line = 0;
-        *bits_per_pixel = 0;
         ephyr_glamor_set_window_size(scrpriv->glamor,
                                      scrpriv->win_width, scrpriv->win_height);
         return NULL;
@@ -1559,6 +1558,8 @@ ephyr_glamor_create_screen_resources(ScreenPtr pScreen)
                                           pScreen->height,
                                           pScreen->rootDepth,
                                           GLAMOR_CREATE_NO_LARGE);
+    if (!screen_pixmap)
+        return FALSE;
 
     pScreen->SetScreenPixmap(screen_pixmap);
     if (pScreen->root && pScreen->SetWindowPixmap)
@@ -1566,6 +1567,9 @@ ephyr_glamor_create_screen_resources(ScreenPtr pScreen)
 
     /* Tell the GLX code what to GL texture to read from. */
     tex = glamor_get_pixmap_texture(screen_pixmap);
+    if (!tex)
+        return FALSE;
+
     ephyr_glamor_set_texture(scrpriv->glamor, tex);
 
     return TRUE;
diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
index 85bd0bed0..b876b79ab 100644
--- a/hw/xfree86/Makefile.am
+++ b/hw/xfree86/Makefile.am
@@ -36,13 +36,13 @@ endif
 
 SUBDIRS = common ddc x86emu $(INT10_SUBDIR) os-support parser \
 	  ramdac $(VGAHW_SUBDIR) loader modes $(DRI_SUBDIR) \
-	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods \
+	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods xkb \
 	  fbdevhw shadowfb exa $(XF86UTILS_SUBDIR) doc man \
 	  $(GLAMOR_EGL_SUBDIR) drivers
 
 DIST_SUBDIRS = common ddc i2c x86emu int10 fbdevhw os-support \
                parser ramdac shadowfb vbe vgahw \
-               loader dixmods dri dri2 exa modes \
+               loader dixmods xkb dri dri2 exa modes \
 	       utils doc man glamor_egl drivers
 
 bin_PROGRAMS = Xorg
@@ -66,7 +66,7 @@ LOCAL_LIBS = \
             ddc/libddc.la \
             i2c/libi2c.la \
             $(XORG_LIBS) \
-            dixmods/libxorgxkb.la \
+            xkb/libxorgxkb.la \
             $(DRI_LIB) \
             $(DRI2_LIB) \
 	    $(DRI3_LIB) \
@@ -148,5 +148,5 @@ i2c/libi2c.la:
 dixmods/libdixmods.la:
 	$(AM_V_at)cd dixmods && $(MAKE) libdixmods.la
 
-dixmods/libxorgxkb.la:
-	$(AM_V_at)cd dixmods && $(MAKE) libxorgxkb.la
+xkb/libxorgxkb.la:
+	$(AM_V_at)cd xkb && $(MAKE) libxorgxkb.la
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index a544b6543..d59c224d5 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -309,6 +309,7 @@ InstallSignalHandlers(void)
     }
     else {
         OsSignal(SIGSEGV, SIG_DFL);
+        OsSignal(SIGABRT, SIG_DFL);
         OsSignal(SIGILL, SIG_DFL);
 #ifdef SIGEMT
         OsSignal(SIGEMT, SIG_DFL);
diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index 39de498a3..136bf50ff 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -84,6 +84,9 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 #ifdef HAVE_SYS_MKDEV_H
 #include <sys/mkdev.h>          /* for major() & minor() on Solaris */
 #endif
diff --git a/hw/xfree86/common/xf86pciBus.c b/hw/xfree86/common/xf86pciBus.c
index 8158c2b62..e61ae0cd4 100644
--- a/hw/xfree86/common/xf86pciBus.c
+++ b/hw/xfree86/common/xf86pciBus.c
@@ -1303,7 +1303,7 @@ xf86MatchDriverFromFiles(uint16_t match_vendor, uint16_t match_chip,
     char *line = NULL;
     size_t len;
     ssize_t read;
-    char path_name[256], vendor_str[5], chip_str[5];
+    char path_name[512], vendor_str[5], chip_str[5];
     uint16_t vendor, chip;
     int i = 0, j;
 
diff --git a/hw/xfree86/dixmods/Makefile.am b/hw/xfree86/dixmods/Makefile.am
index d534c789b..856659f98 100644
--- a/hw/xfree86/dixmods/Makefile.am
+++ b/hw/xfree86/dixmods/Makefile.am
@@ -1,4 +1,4 @@
-noinst_LTLIBRARIES = libdixmods.la libxorgxkb.la
+noinst_LTLIBRARIES = libdixmods.la
 
 if GLX
 GLXMODS = libglx.la
@@ -46,5 +46,3 @@ libshadow_la_SOURCES = shmodule.c
 
 libdixmods_la_SOURCES = $(top_srcdir)/mi/miinitext.c
 libdixmods_la_CFLAGS = $(AM_CFLAGS)
-
-libxorgxkb_la_SOURCES = xkbVT.c xkbPrivate.c xkbKillSrv.c
diff --git a/hw/xfree86/dri2/pci_ids/i965_pci_ids.h b/hw/xfree86/dri2/pci_ids/i965_pci_ids.h
index 1566afd65..57e70b7ae 100644
--- a/hw/xfree86/dri2/pci_ids/i965_pci_ids.h
+++ b/hw/xfree86/dri2/pci_ids/i965_pci_ids.h
@@ -109,6 +109,10 @@ CHIPSET(0x162A, bdw_gt3, "Intel(R) Iris Pro P6300 (Broadwell GT3e)")
 CHIPSET(0x162B, bdw_gt3, "Intel(R) Iris 6100 (Broadwell GT3)")
 CHIPSET(0x162D, bdw_gt3, "Intel(R) Broadwell GT3")
 CHIPSET(0x162E, bdw_gt3, "Intel(R) Broadwell GT3")
+CHIPSET(0x22B0, chv,     "Intel(R) HD Graphics (Cherrytrail)")
+CHIPSET(0x22B1, chv,     "Intel(R) HD Graphics XXX (Braswell)") /* Overridden in brw_get_renderer_string */
+CHIPSET(0x22B2, chv,     "Intel(R) HD Graphics (Cherryview)")
+CHIPSET(0x22B3, chv,     "Intel(R) HD Graphics (Cherryview)")
 CHIPSET(0x1902, skl_gt1, "Intel(R) HD Graphics 510 (Skylake GT1)")
 CHIPSET(0x1906, skl_gt1, "Intel(R) HD Graphics 510 (Skylake GT1)")
 CHIPSET(0x190A, skl_gt1, "Intel(R) Skylake GT1")
@@ -134,8 +138,13 @@ CHIPSET(0x1932, skl_gt4, "Intel(R) Iris Pro Graphics 580 (Skylake GT4e)")
 CHIPSET(0x193A, skl_gt4, "Intel(R) Iris Pro Graphics P580 (Skylake GT4e)")
 CHIPSET(0x193B, skl_gt4, "Intel(R) Iris Pro Graphics 580 (Skylake GT4e)")
 CHIPSET(0x193D, skl_gt4, "Intel(R) Iris Pro Graphics P580 (Skylake GT4e)")
-CHIPSET(0x5902, kbl_gt1, "Intel(R) Kabylake GT1")
-CHIPSET(0x5906, kbl_gt1, "Intel(R) Kabylake GT1")
+CHIPSET(0x0A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x1A84, bxt,     "Intel(R) HD Graphics (Broxton)")
+CHIPSET(0x1A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
+CHIPSET(0x5A84, bxt,     "Intel(R) HD Graphics 505 (Broxton)")
+CHIPSET(0x5A85, bxt_2x6, "Intel(R) HD Graphics 500 (Broxton 2x6)")
+CHIPSET(0x5902, kbl_gt1, "Intel(R) HD Graphics 610 (Kaby Lake GT1)")
+CHIPSET(0x5906, kbl_gt1, "Intel(R) HD Graphics 610 (Kaby Lake GT1)")
 CHIPSET(0x590A, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x5908, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x590B, kbl_gt1, "Intel(R) Kabylake GT1")
@@ -143,23 +152,39 @@ CHIPSET(0x590E, kbl_gt1, "Intel(R) Kabylake GT1")
 CHIPSET(0x5913, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
 CHIPSET(0x5915, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
 CHIPSET(0x5917, kbl_gt1_5, "Intel(R) Kabylake GT1.5")
-CHIPSET(0x5912, kbl_gt2, "Intel(R) Kabylake GT2")
-CHIPSET(0x5916, kbl_gt2, "Intel(R) Kabylake GT2")
-CHIPSET(0x591A, kbl_gt2, "Intel(R) Kabylake GT2")
-CHIPSET(0x591B, kbl_gt2, "Intel(R) Kabylake GT2")
-CHIPSET(0x591D, kbl_gt2, "Intel(R) Kabylake GT2")
-CHIPSET(0x591E, kbl_gt2, "Intel(R) Kabylake GT2")
+CHIPSET(0x5912, kbl_gt2, "Intel(R) HD Graphics 630 (Kaby Lake GT2)")
+CHIPSET(0x5916, kbl_gt2, "Intel(R) HD Graphics 620 (Kaby Lake GT2)")
+CHIPSET(0x591A, kbl_gt2, "Intel(R) HD Graphics P630 (Kaby Lake GT2)")
+CHIPSET(0x591B, kbl_gt2, "Intel(R) HD Graphics 630 (Kaby Lake GT2)")
+CHIPSET(0x591D, kbl_gt2, "Intel(R) HD Graphics P630 (Kaby Lake GT2)")
+CHIPSET(0x591E, kbl_gt2, "Intel(R) HD Graphics 615 (Kaby Lake GT2)")
 CHIPSET(0x5921, kbl_gt2, "Intel(R) Kabylake GT2F")
 CHIPSET(0x5923, kbl_gt3, "Intel(R) Kabylake GT3")
-CHIPSET(0x5926, kbl_gt3, "Intel(R) Kabylake GT3")
-CHIPSET(0x5927, kbl_gt3, "Intel(R) Kabylake GT3")
+CHIPSET(0x5926, kbl_gt3, "Intel(R) Iris Plus Graphics 640 (Kaby Lake GT3)")
+CHIPSET(0x5927, kbl_gt3, "Intel(R) Iris Plus Graphics 650 (Kaby Lake GT3)")
 CHIPSET(0x593B, kbl_gt4, "Intel(R) Kabylake GT4")
-CHIPSET(0x22B0, chv,     "Intel(R) HD Graphics (Cherrytrail)")
-CHIPSET(0x22B1, chv,     "Intel(R) HD Graphics XXX (Braswell)") /* Overridden in brw_get_renderer_string */
-CHIPSET(0x22B2, chv,     "Intel(R) HD Graphics (Cherryview)")
-CHIPSET(0x22B3, chv,     "Intel(R) HD Graphics (Cherryview)")
-CHIPSET(0x0A84, bxt,     "Intel(R) HD Graphics (Broxton)")
-CHIPSET(0x1A84, bxt,     "Intel(R) HD Graphics (Broxton)")
-CHIPSET(0x1A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
-CHIPSET(0x5A84, bxt,     "Intel(R) HD Graphics (Broxton)")
-CHIPSET(0x5A85, bxt_2x6, "Intel(R) HD Graphics (Broxton 2x6)")
+CHIPSET(0x3184, glk,     "Intel(R) HD Graphics (Geminilake)")
+CHIPSET(0x3185, glk_2x6, "Intel(R) HD Graphics (Geminilake 2x6)")
+CHIPSET(0x3E90, cfl_gt1, "Intel(R) HD Graphics (Coffeelake 2x6 GT1)")
+CHIPSET(0x3E93, cfl_gt1, "Intel(R) HD Graphics (Coffeelake 2x6 GT1)")
+CHIPSET(0x3E91, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3E92, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3E96, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3E9B, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3E94, cfl_gt2, "Intel(R) HD Graphics (Coffeelake 3x8 GT2)")
+CHIPSET(0x3EA6, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA7, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA8, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x3EA5, cfl_gt3, "Intel(R) HD Graphics (Coffeelake 3x8 GT3)")
+CHIPSET(0x5A49, cnl_2x8, "Intel(R) HD Graphics (Cannonlake 2x8 GT0.5)")
+CHIPSET(0x5A4A, cnl_2x8, "Intel(R) HD Graphics (Cannonlake 2x8 GT0.5)")
+CHIPSET(0x5A41, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A42, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A44, cnl_3x8, "Intel(R) HD Graphics (Cannonlake 3x8 GT1)")
+CHIPSET(0x5A59, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A5A, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A5C, cnl_4x8, "Intel(R) HD Graphics (Cannonlake 4x8 GT1.5)")
+CHIPSET(0x5A50, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A51, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A52, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
+CHIPSET(0x5A54, cnl_5x8, "Intel(R) HD Graphics (Cannonlake 5x8 GT2)")
diff --git a/hw/xfree86/drivers/modesetting/dri2.c b/hw/xfree86/drivers/modesetting/dri2.c
index 8944ef136..8f44899b3 100644
--- a/hw/xfree86/drivers/modesetting/dri2.c
+++ b/hw/xfree86/drivers/modesetting/dri2.c
@@ -695,19 +695,16 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
     ms_dri2_frame_event_ptr wait_info;
-    drmVBlank vbl;
     int ret;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     CARD64 current_msc, current_ust, request_msc;
     uint32_t seq;
+    uint64_t queued_msc;
 
     /* Drawable not visible, return immediately */
     if (!crtc)
         goto out_complete;
-    drmmode_crtc = crtc->driver_private;
 
     wait_info = calloc(1, sizeof(*wait_info));
     if (!wait_info)
@@ -747,13 +744,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 
         if (current_msc >= target_msc)
             target_msc = current_msc;
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, target_msc);
-        vbl.request.signal = (unsigned long)seq;
 
-        ret = drmWaitVBlank(ms->fd, &vbl);
+        ret = ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, target_msc, &queued_msc, seq);
         if (ret) {
             static int limit = 5;
             if (limit) {
@@ -766,7 +758,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
             goto out_free;
         }
 
-        wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+        wait_info->frame = queued_msc;
         DRI2BlockClient(client, draw);
         return TRUE;
     }
@@ -775,9 +767,6 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
      * If we get here, target_msc has already passed or we don't have one,
      * so we queue an event that will satisfy the divisor/remainder equation.
      */
-    vbl.request.type =
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
     /*
@@ -795,11 +784,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
     if (!seq)
         goto out_free;
 
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc);
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
+    if (!ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, request_msc, &queued_msc, seq)) {
         static int limit = 5;
         if (limit) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
@@ -811,7 +796,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
         goto out_free;
     }
 
-    wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+    wait_info->frame = queued_msc;
+
     DRI2BlockClient(client, draw);
 
     return TRUE;
@@ -839,20 +825,18 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmVBlank vbl;
     int ret, flip = 0;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     ms_dri2_frame_event_ptr frame_info = NULL;
     uint64_t current_msc, current_ust;
     uint64_t request_msc;
     uint32_t seq;
+    ms_queue_flag ms_flag = MS_QUEUE_ABSOLUTE;
+    uint64_t queued_msc;
 
     /* Drawable not displayed... just complete the swap */
     if (!crtc)
         goto blit_fallback;
-    drmmode_crtc = crtc->driver_private;
 
     frame_info = calloc(1, sizeof(*frame_info));
     if (!frame_info)
@@ -878,6 +862,8 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     ms_dri2_reference_buffer(back);
 
     ret = ms_get_crtc_ust_msc(crtc, &current_ust, &current_msc);
+    if (ret != Success)
+        goto blit_fallback;
 
     /* Flips need to be submitted one frame before */
     if (can_flip(scrn, draw, front, back)) {
@@ -892,22 +878,19 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (*target_msc > 0)
         *target_msc -= flip;
 
+    /* If non-pageflipping, but blitting/exchanging, we need to use
+     * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
+     * on.
+     */
+    if (flip == 0)
+        ms_flag |= MS_QUEUE_NEXT_ON_MISS;
+
     /*
      * If divisor is zero, or current_msc is smaller than target_msc
      * we just need to make sure target_msc passes before initiating
      * the swap.
      */
     if (divisor == 0 || current_msc < *target_msc) {
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-
-        /* If non-pageflipping, but blitting/exchanging, we need to use
-         * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
-         * on.
-         */
-        if (flip == 0)
-            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
         /* If target_msc already reached or passed, set it to
          * current_msc to ensure we return a reasonable value back
@@ -922,19 +905,14 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         if (!seq)
             goto blit_fallback;
 
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, *target_msc);
-        vbl.request.signal = (unsigned long)seq;
-
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (ret) {
+        if (!ms_queue_vblank(crtc, ms_flag, *target_msc, &queued_msc, seq)) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                        "divisor 0 get vblank counter failed: %s\n",
                        strerror(errno));
             goto blit_fallback;
         }
 
-        *target_msc = ms_kernel_msc_to_crtc_msc(crtc,
-                                                vbl.reply.sequence + flip);
+        *target_msc = queued_msc + flip;
         frame_info->frame = *target_msc;
 
         return TRUE;
@@ -945,11 +923,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
      * and we need to queue an event that will satisfy the divisor/remainder
      * equation.
      */
-    vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                        DRM_VBLANK_EVENT |
-                        drmmode_crtc->vblank_pipe);
-    if (flip == 0)
-        vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
@@ -966,7 +939,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (request_msc <= current_msc)
         request_msc += divisor;
 
-
     seq = ms_drm_queue_alloc(crtc, frame_info,
                              ms_dri2_frame_event_handler,
                              ms_dri2_frame_event_abort);
@@ -974,11 +946,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         goto blit_fallback;
 
     /* Account for 1 frame extra pageflip delay if flip > 0 */
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc) - flip;
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
+    if (!ms_queue_vblank(crtc, ms_flag, request_msc - flip, &queued_msc, seq)) {
         xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                    "final get vblank counter failed: %s\n",
                    strerror(errno));
@@ -986,7 +954,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     }
 
     /* Adjust returned value for 1 fame pageflip offset of flip > 0 */
-    *target_msc = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence + flip);
+    *target_msc = queued_msc + flip;
     frame_info->frame = *target_msc;
 
     return TRUE;
diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
index 3da69a396..4d5c4e339 100644
--- a/hw/xfree86/drivers/modesetting/driver.c
+++ b/hw/xfree86/drivers/modesetting/driver.c
@@ -1202,6 +1202,11 @@ msEnableSharedPixmapFlipping(RRCrtcPtr crtc, PixmapPtr front, PixmapPtr back)
          * vblank events */
         if (syspath && strstr(syspath, "usb"))
             return FALSE;
+
+        /* EVDI uses USB transport but is platform device, not usb.
+         * Blacklist it explicitly */
+        if (syspath && strstr(syspath, "evdi"))
+            return FALSE;
     }
 #endif
 
diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
index eee96e50f..66034badb 100644
--- a/hw/xfree86/drivers/modesetting/driver.h
+++ b/hw/xfree86/drivers/modesetting/driver.h
@@ -119,6 +119,10 @@ typedef struct _modesettingRec {
     Bool dirty_enabled;
 
     uint32_t cursor_width, cursor_height;
+
+    Bool has_queue_sequence;
+    Bool tried_queue_sequence;
+
 } modesettingRec, *modesettingPtr;
 
 #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
@@ -129,6 +133,15 @@ uint32_t ms_drm_queue_alloc(xf86CrtcPtr crtc,
                             ms_drm_handler_proc handler,
                             ms_drm_abort_proc abort);
 
+typedef enum ms_queue_flag {
+    MS_QUEUE_ABSOLUTE = 0,
+    MS_QUEUE_RELATIVE = 1,
+    MS_QUEUE_NEXT_ON_MISS = 2
+} ms_queue_flag;
+
+Bool ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                     uint64_t msc, uint64_t *msc_queued, uint32_t seq);
+
 void ms_drm_abort(ScrnInfoPtr scrn,
                   Bool (*match)(void *data, void *match_data),
                   void *match_data);
@@ -140,8 +153,8 @@ xf86CrtcPtr ms_dri2_crtc_covering_drawable(DrawablePtr pDraw);
 
 int ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc);
 
-uint32_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
-uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence);
+uint64_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
+uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence);
 
 
 Bool ms_dri2_screen_init(ScreenPtr screen);
diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
index 6e755e948..025725aaf 100644
--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
+++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
@@ -279,8 +279,6 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
 {
     drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
     msPixmapPrivPtr ppriv = msGetPixmapPriv(drmmode, ppix);
-
-    drmVBlank vbl;
     struct vblank_event_args *event_args;
 
     if (ppix == drmmode_crtc->prime_pixmap)
@@ -303,12 +301,7 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
                            drmmode_SharedPixmapVBlankEventHandler,
                            drmmode_SharedPixmapVBlankEventAbort);
 
-    vbl.request.type =
-        DRM_VBLANK_RELATIVE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-    vbl.request.sequence = 1;
-    vbl.request.signal = (unsigned long) ppriv->flip_seq;
-
-    return drmWaitVBlank(drmmode->fd, &vbl) >= 0;
+    return ms_queue_vblank(crtc, MS_QUEUE_RELATIVE, 1, NULL, ppriv->flip_seq);
 }
 
 Bool
@@ -1566,7 +1559,8 @@ drmmode_output_set_property(xf86OutputPtr output, Atom property,
                 value->size != 1)
                 return FALSE;
             memcpy(&atom, value->data, 4);
-            name = NameForAtom(atom);
+            if (!(name = NameForAtom(atom)))
+                return FALSE;
 
             /* search for matching name string, then set its value down */
             for (j = 0; j < p->mode_prop->count_enums; j++) {
@@ -2262,6 +2256,10 @@ drmmode_setup_colormap(ScreenPtr pScreen, ScrnInfoPtr pScrn)
 }
 
 #ifdef CONFIG_UDEV_KMS
+
+#define DRM_MODE_LINK_STATUS_GOOD       0
+#define DRM_MODE_LINK_STATUS_BAD        1
+
 static void
 drmmode_handle_uevents(int fd, void *closure)
 {
@@ -2281,6 +2279,52 @@ drmmode_handle_uevents(int fd, void *closure)
     if (!found)
         return;
 
+    /* Try to re-set the mode on all the connectors with a BAD link-state:
+     * This may happen if a link degrades and a new modeset is necessary, using
+     * different link-training parameters. If the kernel found that the current
+     * mode is not achievable anymore, it should have pruned the mode before
+     * sending the hotplug event. Try to re-set the currently-set mode to keep
+     * the display alive, this will fail if the mode has been pruned.
+     * In any case, we will send randr events for the Desktop Environment to
+     * deal with it, if it wants to.
+     */
+    for (i = 0; i < config->num_output; i++) {
+        xf86OutputPtr output = config->output[i];
+        drmmode_output_private_ptr drmmode_output = output->driver_private;
+        uint32_t con_id;
+        drmModeConnectorPtr koutput;
+
+        if (drmmode_output->mode_output == NULL)
+            continue;
+        con_id = drmmode_output->mode_output->connector_id;
+        /* Get an updated view of the properties for the current connector and
+         * look for the link-status property
+         */
+        koutput = drmModeGetConnectorCurrent(drmmode->fd, con_id);
+        for (j = 0; koutput && j < koutput->count_props; j++) {
+            drmModePropertyPtr props;
+            props = drmModeGetProperty(drmmode->fd, koutput->props[j]);
+            if (props && props->flags & DRM_MODE_PROP_ENUM &&
+                !strcmp(props->name, "link-status") &&
+                koutput->prop_values[j] == DRM_MODE_LINK_STATUS_BAD) {
+                xf86CrtcPtr crtc = output->crtc;
+                if (!crtc)
+                    continue;
+
+                /* the connector got a link failure, re-set the current mode */
+                drmmode_set_mode_major(crtc, &crtc->mode, crtc->rotation,
+                                       crtc->x, crtc->y);
+
+                xf86DrvMsg(scrn->scrnIndex, X_WARNING,
+                           "hotplug event: connector %u's link-state is BAD, "
+                           "tried resetting the current mode. You may be left"
+                           "with a black screen if this fails...\n", con_id);
+            }
+            drmModeFreeProperty(props);
+        }
+        drmModeFreeConnector(koutput);
+    }
+
     mode_res = drmModeGetResources(drmmode->fd);
     if (!mode_res)
         goto out;
@@ -2345,6 +2389,10 @@ out_free_res:
 out:
     RRGetInfo(xf86ScrnToScreen(scrn), TRUE);
 }
+
+#undef DRM_MODE_LINK_STATUS_BAD
+#undef DRM_MODE_LINK_STATUS_GOOD
+
 #endif
 
 void
diff --git a/hw/xfree86/drivers/modesetting/present.c b/hw/xfree86/drivers/modesetting/present.c
index 55b622cbc..67982d741 100644
--- a/hw/xfree86/drivers/modesetting/present.c
+++ b/hw/xfree86/drivers/modesetting/present.c
@@ -109,13 +109,7 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
                         uint64_t msc)
 {
     xf86CrtcPtr xf86_crtc = crtc->devPrivate;
-    ScreenPtr screen = crtc->pScreen;
-    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmmode_crtc_private_ptr drmmode_crtc = xf86_crtc->driver_private;
     struct ms_present_vblank_event *event;
-    drmVBlank vbl;
-    int ret;
     uint32_t seq;
 
     event = calloc(sizeof(struct ms_present_vblank_event), 1);
@@ -130,22 +124,9 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
         return BadAlloc;
     }
 
-    vbl.request.type =
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(xf86_crtc, msc);
-    vbl.request.signal = seq;
-    for (;;) {
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (!ret)
-            break;
-        /* If we hit EBUSY, then try to flush events.  If we can't, then
-         * this is an error.
-         */
-        if (errno != EBUSY || ms_flush_drm_events(screen) < 0) {
-	    ms_drm_abort_seq(scrn, seq);
-            return BadAlloc;
-        }
-    }
+    if (!ms_queue_vblank(xf86_crtc, MS_QUEUE_ABSOLUTE, msc, NULL, seq))
+        return BadAlloc;
+
     DebugPresent(("\t\tmq %lld seq %u msc %llu (hw msc %u)\n",
                  (long long) event_id, seq, (long long) msc,
                  vbl.request.sequence));
diff --git a/hw/xfree86/drivers/modesetting/vblank.c b/hw/xfree86/drivers/modesetting/vblank.c
index 04a895269..31cf0bd70 100644
--- a/hw/xfree86/drivers/modesetting/vblank.c
+++ b/hw/xfree86/drivers/modesetting/vblank.c
@@ -173,7 +173,7 @@ ms_dri2_crtc_covering_drawable(DrawablePtr pDraw)
 
 static Bool
 ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
-                      uint32_t *msc, uint64_t *ust)
+                      uint64_t *msc, uint64_t *ust)
 {
     ScreenPtr screen = crtc->randr_crtc->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
@@ -198,13 +198,50 @@ ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
     }
 }
 
+Bool
+ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                uint64_t msc, uint64_t *msc_queued, uint32_t seq)
+{
+    ScreenPtr screen = crtc->randr_crtc->pScreen;
+    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
+    modesettingPtr ms = modesettingPTR(scrn);
+    drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+    drmVBlank vbl;
+    int ret;
+
+    for (;;) {
+        /* Queue an event at the specified sequence */
+        vbl.request.type = DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
+        if (flags & MS_QUEUE_RELATIVE)
+            vbl.request.type |= DRM_VBLANK_RELATIVE;
+        else
+            vbl.request.type |= DRM_VBLANK_ABSOLUTE;
+        if (flags & MS_QUEUE_NEXT_ON_MISS)
+            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
+
+        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, msc);
+        vbl.request.signal = seq;
+        ret = drmWaitVBlank(ms->fd, &vbl);
+        if (ret == 0) {
+            if (msc_queued)
+                *msc_queued = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+            return TRUE;
+        }
+        if (errno != EBUSY) {
+            ms_drm_abort_seq(scrn, msc);
+            return FALSE;
+        }
+        ms_flush_drm_events(screen);
+    }
+}
+
 /**
  * Convert a 32-bit kernel MSC sequence number to a 64-bit local sequence
  * number, adding in the vblank_offset and high 32 bits, and dealing
  * with 64-bit wrapping
  */
 uint64_t
-ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
+ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
     sequence += drmmode_crtc->vblank_offset;
@@ -218,7 +255,7 @@ ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
 int
 ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 {
-    uint32_t kernel_msc;
+    uint64_t kernel_msc;
 
     if (!ms_get_kernel_ust_msc(crtc, &kernel_msc, ust))
         return BadMatch;
@@ -230,13 +267,13 @@ ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 #define MAX_VBLANK_OFFSET       1000
 
 /**
- * Convert a 64-bit adjusted MSC value into a 32-bit kernel sequence number,
- * removing the high 32 bits and subtracting out the vblank_offset term.
+ * Convert a 64-bit adjusted MSC value into a 64-bit kernel sequence number,
+ * by subtracting out the vblank_offset term.
  *
  * This also updates the vblank_offset when it notices that the value should
  * change.
  */
-uint32_t
+uint64_t
 ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
@@ -257,7 +294,7 @@ ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
                 drmmode_crtc->vblank_offset = 0;
         }
     }
-    return (uint32_t) (expect - drmmode_crtc->vblank_offset);
+    return (expect - drmmode_crtc->vblank_offset);
 }
 
 /**
@@ -375,25 +412,31 @@ ms_drm_abort(ScrnInfoPtr scrn, Bool (*match)(void *data, void *match_data),
  * drm event queue and calls the handler for it.
  */
 static void
-ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
-               void *user_ptr)
+ms_drm_sequence_handler(int fd, uint64_t frame, uint64_t ns, uint64_t user_data)
 {
     struct ms_drm_queue *q, *tmp;
-    uint32_t user_data = (uint32_t) (intptr_t) user_ptr;
+    uint32_t seq = (uint32_t) user_data;
 
     xorg_list_for_each_entry_safe(q, tmp, &ms_drm_queue, list) {
-        if (q->seq == user_data) {
+        if (q->seq == seq) {
             uint64_t msc;
 
             msc = ms_kernel_msc_to_crtc_msc(q->crtc, frame);
             xorg_list_del(&q->list);
-            q->handler(msc, (uint64_t) sec * 1000000 + usec, q->data);
+            q->handler(msc, ns / 1000, q->data);
             free(q);
             break;
         }
     }
 }
 
+static void
+ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
+               void *user_ptr)
+{
+    ms_drm_sequence_handler(fd, frame, ((uint64_t) sec * 1000000 + usec) * 1000, (uint32_t) (uintptr_t) user_ptr);
+}
+
 Bool
 ms_vblank_screen_init(ScreenPtr screen)
 {
@@ -402,7 +445,7 @@ ms_vblank_screen_init(ScreenPtr screen)
     modesettingEntPtr ms_ent = ms_ent_priv(scrn);
     xorg_list_init(&ms_drm_queue);
 
-    ms->event_context.version = DRM_EVENT_CONTEXT_VERSION;
+    ms->event_context.version = 2;
     ms->event_context.vblank_handler = ms_drm_handler;
     ms->event_context.page_flip_handler = ms_drm_handler;
 
diff --git a/hw/xfree86/modes/xf86RandR12.c b/hw/xfree86/modes/xf86RandR12.c
index d83461997..aac02db43 100644
--- a/hw/xfree86/modes/xf86RandR12.c
+++ b/hw/xfree86/modes/xf86RandR12.c
@@ -1174,8 +1174,7 @@ xf86RandR12CrtcSet(ScreenPtr pScreen,
     if ((transform != NULL) != crtc->transformPresent)
         changed = TRUE;
     else if (transform &&
-             memcmp(&transform->transform, &crtc->transform.transform,
-                    sizeof(transform->transform)) != 0)
+             !RRTransformEqual(transform, &crtc->transform))
         changed = TRUE;
 
     if (x != crtc->x || y != crtc->y)
@@ -1250,33 +1249,50 @@ xf86RandR12CrtcSet(ScreenPtr pScreen,
 }
 
 static void
-xf86RandR12CrtcComputeGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
+xf86RandR12CrtcComputeGamma(xf86CrtcPtr crtc, LOCO *palette,
+                            int palette_red_size, int palette_green_size,
+                            int palette_blue_size, CARD16 *gamma_red,
+                            CARD16 *gamma_green, CARD16 *gamma_blue,
+                            int gamma_size)
 {
-    XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
-    xf86CrtcPtr crtc = randr_crtc->devPrivate;
     int gamma_slots;
-    CARD16 value;
+    unsigned shift;
+    CARD32 value;
     int i, j;
 
-    gamma_slots = crtc->gamma_size / randrp->palette_red_size;
-    for (i = 0; i < randrp->palette_red_size; i++) {
-        value = randr_crtc->gammaRed[randrp->palette[i].red];
+    for (shift = 0; (gamma_size << shift) < (1 << 16); shift++);
+
+    gamma_slots = crtc->gamma_size / palette_red_size;
+    for (i = 0; i < palette_red_size; i++) {
+        value = palette[i].red;
+        if (gamma_red)
+            value = gamma_red[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_red[i * gamma_slots + j] = value;
     }
 
-    gamma_slots = crtc->gamma_size / randrp->palette_green_size;
-    for (i = 0; i < randrp->palette_green_size; i++) {
-        value = randr_crtc->gammaGreen[randrp->palette[i].green];
+    gamma_slots = crtc->gamma_size / palette_green_size;
+    for (i = 0; i < palette_green_size; i++) {
+        value = palette[i].green;
+        if (gamma_green)
+            value = gamma_green[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_green[i * gamma_slots + j] = value;
     }
 
-    gamma_slots = crtc->gamma_size / randrp->palette_blue_size;
-    for (i = 0; i < randrp->palette_blue_size; i++) {
-        value = randr_crtc->gammaBlue[randrp->palette[i].blue];
+    gamma_slots = crtc->gamma_size / palette_blue_size;
+    for (i = 0; i < palette_blue_size; i++) {
+        value = palette[i].blue;
+        if (gamma_blue)
+            value = gamma_blue[value];
+        else
+            value <<= shift;
 
         for (j = 0; j < gamma_slots; j++)
             crtc->gamma_blue[i * gamma_slots + j] = value;
@@ -1284,10 +1300,8 @@ xf86RandR12CrtcComputeGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
 }
 
 static void
-xf86RandR12CrtcReloadGamma(RRCrtcPtr randr_crtc)
+xf86RandR12CrtcReloadGamma(xf86CrtcPtr crtc)
 {
-    xf86CrtcPtr crtc = randr_crtc->devPrivate;
-
     if (!crtc->scrn->vtSema || !crtc->funcs->gamma_set)
         return;
 
@@ -1309,7 +1323,14 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
         return FALSE;
 
     if (randrp->palette_size) {
-        xf86RandR12CrtcComputeGamma(pScreen, randr_crtc);
+        xf86RandR12CrtcComputeGamma(crtc, randrp->palette,
+                                    randrp->palette_red_size,
+                                    randrp->palette_green_size,
+                                    randrp->palette_blue_size,
+                                    randr_crtc->gammaRed,
+                                    randr_crtc->gammaGreen,
+                                    randr_crtc->gammaBlue,
+                                    randr_crtc->gammaSize);
     } else {
         memcpy(crtc->gamma_red, randr_crtc->gammaRed,
                crtc->gamma_size * sizeof(crtc->gamma_red[0]));
@@ -1319,7 +1340,7 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
                crtc->gamma_size * sizeof(crtc->gamma_blue[0]));
     }
 
-    xf86RandR12CrtcReloadGamma(randr_crtc);
+    xf86RandR12CrtcReloadGamma(crtc);
 
     return TRUE;
 }
@@ -1394,6 +1415,13 @@ xf86RandR12OutputInitGamma(xf86OutputPtr output)
      * different gamma
      */
     if (gamma_red != 1.0 || gamma_green != 1.0 || gamma_blue != 1.0) {
+        if (!output->crtc->randr_crtc) {
+            xf86DrvMsg(output->scrn->scrnIndex, X_WARNING,
+                       "Gamma correction for output %s not possible because "
+                       "RandR is disabled\n", output->name);
+            return TRUE;
+        }
+
         xf86DrvMsg(output->scrn->scrnIndex, X_INFO,
                    "Output %s wants gamma correction (%.1f, %.1f, %.1f)\n",
                    output->name, gamma_red, gamma_green, gamma_blue);
@@ -1415,6 +1443,9 @@ xf86RandR12InitGamma(ScrnInfoPtr pScrn, unsigned gammaSize) {
     for (c = 0; c < config->num_crtc; c++) {
         xf86CrtcPtr crtc = config->crtc[c];
 
+        if (!crtc->randr_crtc)
+            continue;
+
         if (!RRCrtcGammaSetSize(crtc->randr_crtc, gammaSize) ||
             !xf86RandR12CrtcInitGamma(crtc, 1.0f, 1.0f, 1.0f))
             return FALSE;
@@ -1876,7 +1907,6 @@ xf86RandR12LoadPalette(ScrnInfoPtr pScrn, int numColors, int *indices,
                        LOCO *colors, VisualPtr pVisual)
 {
     ScreenPtr pScreen = pScrn->pScreen;
-    XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
     xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
     int reds, greens, blues, index, palette_size;
     int c, i;
@@ -1891,36 +1921,51 @@ xf86RandR12LoadPalette(ScrnInfoPtr pScrn, int numColors, int *indices,
 
     palette_size = max(reds, max(greens, blues));
 
-    if (randrp->palette_size != palette_size) {
-        randrp->palette = reallocarray(randrp->palette, palette_size,
-                                       sizeof(colors[0]));
-        if (!randrp->palette) {
-            randrp->palette_size = 0;
-            return;
-        }
-
-        randrp->palette_size = palette_size;
-    }
-    randrp->palette_red_size = reds;
-    randrp->palette_green_size = greens;
-    randrp->palette_blue_size = blues;
+    if (dixPrivateKeyRegistered(rrPrivKey)) {
+        XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
 
-    for (i = 0; i < numColors; i++) {
-        index = indices[i];
+        if (randrp->palette_size != palette_size) {
+            randrp->palette = reallocarray(randrp->palette, palette_size,
+                                           sizeof(colors[0]));
+            if (!randrp->palette) {
+                randrp->palette_size = 0;
+                return;
+            }
 
-        if (index < reds)
-            randrp->palette[index].red = colors[index].red;
-        if (index < greens)
-            randrp->palette[index].green = colors[index].green;
-        if (index < blues)
-            randrp->palette[index].blue = colors[index].blue;
+            randrp->palette_size = palette_size;
+        }
+        randrp->palette_red_size = reds;
+        randrp->palette_green_size = greens;
+        randrp->palette_blue_size = blues;
+
+        for (i = 0; i < numColors; i++) {
+            index = indices[i];
+
+            if (index < reds)
+                randrp->palette[index].red = colors[index].red;
+            if (index < greens)
+                randrp->palette[index].green = colors[index].green;
+            if (index < blues)
+                randrp->palette[index].blue = colors[index].blue;
+        }
     }
 
     for (c = 0; c < config->num_crtc; c++) {
-        RRCrtcPtr randr_crtc = config->crtc[c]->randr_crtc;
-
-        xf86RandR12CrtcComputeGamma(pScreen, randr_crtc);
-        xf86RandR12CrtcReloadGamma(randr_crtc);
+        xf86CrtcPtr crtc = config->crtc[c];
+        RRCrtcPtr randr_crtc = crtc->randr_crtc;
+
+        if (randr_crtc) {
+            xf86RandR12CrtcComputeGamma(crtc, colors, reds, greens, blues,
+                                        randr_crtc->gammaRed,
+                                        randr_crtc->gammaGreen,
+                                        randr_crtc->gammaBlue,
+                                        randr_crtc->gammaSize);
+        } else {
+            xf86RandR12CrtcComputeGamma(crtc, colors, reds, greens, blues,
+                                        NULL, NULL, NULL,
+                                        xf86GetGammaRampSize(pScreen));
+        }
+        xf86RandR12CrtcReloadGamma(crtc);
     }
 }
 
@@ -1973,7 +2018,7 @@ xf86RandR12EnterVT(ScrnInfoPtr pScrn)
 
     /* reload gamma */
     for (i = 0; i < rp->numCrtcs; i++)
-        xf86RandR12CrtcReloadGamma(rp->crtcs[i]);
+        xf86RandR12CrtcReloadGamma(rp->crtcs[i]->devPrivate);
 
     return RRGetInfo(pScreen, TRUE);    /* force a re-probe of outputs and notify clients about changes */
 }
diff --git a/hw/xfree86/os-support/linux/lnx_init.c b/hw/xfree86/os-support/linux/lnx_init.c
index dbf497ca2..9e5ddcd50 100644
--- a/hw/xfree86/os-support/linux/lnx_init.c
+++ b/hw/xfree86/os-support/linux/lnx_init.c
@@ -38,6 +38,9 @@
 #include "xf86_OSlib.h"
 
 #include <sys/stat.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 
 #ifndef K_OFF
 #define K_OFF 0x4
diff --git a/hw/xfree86/os-support/shared/posix_tty.c b/hw/xfree86/os-support/shared/posix_tty.c
index 6249a625c..a795ae19d 100644
--- a/hw/xfree86/os-support/shared/posix_tty.c
+++ b/hw/xfree86/os-support/shared/posix_tty.c
@@ -394,6 +394,9 @@ xf86WaitForInput(int fd, int timeout)
     poll_fd.fd = fd;
     poll_fd.events = POLLIN;
 
+    /* convert microseconds to milliseconds */
+    timeout = (timeout + 999) / 1000;
+
     if (fd >= 0) {
         SYSCALL(r = xserver_poll(&poll_fd, 1, timeout));
     }
diff --git a/hw/xfree86/parser/scan.c b/hw/xfree86/parser/scan.c
index 81a454b23..3356224ce 100644
--- a/hw/xfree86/parser/scan.c
+++ b/hw/xfree86/parser/scan.c
@@ -1046,6 +1046,8 @@ xf86nameCompare(const char *s1, const char *s2)
             return 0;
         else
             return 1;
+    } else if (!s2 || *s2 == 0) {
+        return -1;
     }
 
     while (*s1 == '_' || *s1 == ' ' || *s1 == '\t')
diff --git a/hw/xfree86/xkb/Makefile.am b/hw/xfree86/xkb/Makefile.am
new file mode 100644
index 000000000..252cf3b5d
--- /dev/null
+++ b/hw/xfree86/xkb/Makefile.am
@@ -0,0 +1,6 @@
+noinst_LTLIBRARIES = libxorgxkb.la
+
+AM_CFLAGS = @XORG_CFLAGS@ @DIX_CFLAGS@
+AM_CPPFLAGS = @XORG_INCS@
+
+libxorgxkb_la_SOURCES = xkbVT.c xkbPrivate.c xkbKillSrv.c
diff --git a/hw/xfree86/xkb/meson.build b/hw/xfree86/xkb/meson.build
new file mode 100644
index 000000000..894aa5ca3
--- /dev/null
+++ b/hw/xfree86/xkb/meson.build
@@ -0,0 +1,12 @@
+srcs_xorg_xkb = [
+    'xkbVT.c',
+    'xkbPrivate.c',
+    'xkbKillSrv.c',
+]
+
+xorg_xkb = static_library('xorg_xkb',
+    srcs_xorg_xkb,
+    include_directories: [inc, xorg_inc],
+    dependencies: common_dep,
+    c_args: xorg_c_args,
+)
diff --git a/hw/xfree86/dixmods/xkbKillSrv.c b/hw/xfree86/xkb/xkbKillSrv.c
index 79cf08198..79cf08198 100644
--- a/hw/xfree86/dixmods/xkbKillSrv.c
+++ b/hw/xfree86/xkb/xkbKillSrv.c
diff --git a/hw/xfree86/dixmods/xkbPrivate.c b/hw/xfree86/xkb/xkbPrivate.c
index 4b9ef3397..4b9ef3397 100644
--- a/hw/xfree86/dixmods/xkbPrivate.c
+++ b/hw/xfree86/xkb/xkbPrivate.c
diff --git a/hw/xfree86/dixmods/xkbVT.c b/hw/xfree86/xkb/xkbVT.c
index 984096122..984096122 100644
--- a/hw/xfree86/dixmods/xkbVT.c
+++ b/hw/xfree86/xkb/xkbVT.c
diff --git a/hw/xfree86/xorg-wrapper.c b/hw/xfree86/xorg-wrapper.c
index a25e6ff5f..c5e4a278b 100644
--- a/hw/xfree86/xorg-wrapper.c
+++ b/hw/xfree86/xorg-wrapper.c
@@ -35,6 +35,9 @@
 #include <string.h>
 #include <sys/ioctl.h>
 #include <sys/stat.h>
+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
 #include <sys/types.h>
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 #include <sys/consio.h>
diff --git a/hw/xquartz/quartz.c b/hw/xquartz/quartz.c
index c8b6f966d..c8ea3bf8b 100644
--- a/hw/xquartz/quartz.c
+++ b/hw/xquartz/quartz.c
@@ -178,6 +178,7 @@ QuartzInitOutput(int argc,
 {
     /* For XQuartz, we want to just use the default signal handler to work better with CrashTracer */
     signal(SIGSEGV, SIG_DFL);
+    signal(SIGABRT, SIG_DFL);
     signal(SIGILL, SIG_DFL);
 #ifdef SIGEMT
     signal(SIGEMT, SIG_DFL);
diff --git a/hw/xwayland/drm.xml b/hw/xwayland/drm.xml
index 8a3ad69b2..5e64622df 100644
--- a/hw/xwayland/drm.xml
+++ b/hw/xwayland/drm.xml
@@ -135,22 +135,6 @@
       <arg name="stride2" type="int"/>
     </request>
 
-    <!-- Create a wayland buffer for the prime fd.  Use for regular and planar
-         buffers.  Pass 0 for offset and stride for unused planes. -->
-    <request name="create_prime_buffer" since="2">
-      <arg name="id" type="new_id" interface="wl_buffer"/>
-      <arg name="name" type="fd"/>
-      <arg name="width" type="int"/>
-      <arg name="height" type="int"/>
-      <arg name="format" type="uint"/>
-      <arg name="offset0" type="int"/>
-      <arg name="stride0" type="int"/>
-      <arg name="offset1" type="int"/>
-      <arg name="stride1" type="int"/>
-      <arg name="offset2" type="int"/>
-      <arg name="stride2" type="int"/>
-    </request>
-
     <!-- Notification of the path of the drm device which is used by
          the server.  The client should use this device for creating
          local buffers.  Only buffers created from this device should
@@ -177,6 +161,25 @@
     <event name="capabilities">
       <arg name="value" type="uint"/>
     </event>
+
+    <!-- Version 2 additions -->
+
+    <!-- Create a wayland buffer for the prime fd.  Use for regular and planar
+         buffers.  Pass 0 for offset and stride for unused planes. -->
+    <request name="create_prime_buffer" since="2">
+      <arg name="id" type="new_id" interface="wl_buffer"/>
+      <arg name="name" type="fd"/>
+      <arg name="width" type="int"/>
+      <arg name="height" type="int"/>
+      <arg name="format" type="uint"/>
+      <arg name="offset0" type="int"/>
+      <arg name="stride0" type="int"/>
+      <arg name="offset1" type="int"/>
+      <arg name="stride1" type="int"/>
+      <arg name="offset2" type="int"/>
+      <arg name="stride2" type="int"/>
+    </request>
+
   </interface>
 
 </protocol>
diff --git a/hw/xwayland/xwayland-input.c b/hw/xwayland/xwayland-input.c
index f06e88aa5..f2564d5d3 100644
--- a/hw/xwayland/xwayland-input.c
+++ b/hw/xwayland/xwayland-input.c
@@ -1524,11 +1524,38 @@ xwl_seat_emulate_pointer_warp(struct xwl_seat *xwl_seat,
                                    x, y);
 }
 
+static Bool
+xwl_seat_maybe_lock_on_hidden_cursor(struct xwl_seat *xwl_seat)
+{
+    /* Some clients use hidden cursor+confineTo+relative motion
+     * to implement infinite panning (eg. 3D views), lock the
+     * pointer for so the relative pointer is used.
+     */
+    if (xwl_seat->x_cursor ||
+        !xwl_seat->cursor_confinement_window)
+        return FALSE;
+
+    if (!xwl_seat->focus_window)
+        return FALSE;
+
+    if (xwl_seat->confined_pointer)
+        xwl_seat_destroy_confined_pointer(xwl_seat);
+
+    xwl_seat_create_pointer_warp_emulator(xwl_seat);
+    xwl_pointer_warp_emulator_lock(xwl_seat->pointer_warp_emulator);
+    return TRUE;
+}
+
 void
 xwl_seat_cursor_visibility_changed(struct xwl_seat *xwl_seat)
 {
-    if (xwl_seat->pointer_warp_emulator && xwl_seat->x_cursor != NULL)
+    if (xwl_seat->pointer_warp_emulator && xwl_seat->x_cursor != NULL) {
         xwl_seat_destroy_pointer_warp_emulator(xwl_seat);
+    } else if (!xwl_seat->x_cursor && xwl_seat->cursor_confinement_window) {
+        /* If the cursor goes hidden as is confined, lock it for
+         * relative motion to work. */
+        xwl_seat_maybe_lock_on_hidden_cursor(xwl_seat);
+    }
 }
 
 void
@@ -1567,6 +1594,9 @@ xwl_seat_confine_pointer(struct xwl_seat *xwl_seat,
     if (xwl_seat->pointer_warp_emulator)
         return;
 
+    if (xwl_seat_maybe_lock_on_hidden_cursor(xwl_seat))
+        return;
+
     xwl_seat->confined_pointer =
         zwp_pointer_constraints_v1_confine_pointer(pointer_constraints,
                                                    xwl_window->surface,
diff --git a/hw/xwayland/xwayland-output.c b/hw/xwayland/xwayland-output.c
index a4bc185da..5a0f739f3 100644
--- a/hw/xwayland/xwayland-output.c
+++ b/hw/xwayland/xwayland-output.c
@@ -187,8 +187,11 @@ update_screen_size(struct xwl_output *xwl_output, int width, int height)
     SetRootClip(xwl_screen->screen, xwl_screen->root_clip_mode);
 
     if (xwl_screen->screen->root) {
+        BoxRec box = { 0, 0, width, height };
+
         xwl_screen->screen->root->drawable.width = width;
         xwl_screen->screen->root->drawable.height = height;
+        RegionReset(&xwl_screen->screen->root->winSize, &box);
         RRScreenSizeNotify(xwl_screen->screen);
     }
 
diff --git a/hw/xwayland/xwayland.c b/hw/xwayland/xwayland.c
index c27787018..939f3392c 100644
--- a/hw/xwayland/xwayland.c
+++ b/hw/xwayland/xwayland.c
@@ -175,11 +175,31 @@ xwl_cursor_warped_to(DeviceIntPtr device,
     struct xwl_screen *xwl_screen = xwl_screen_get(screen);
     struct xwl_seat *xwl_seat = device->public.devicePrivate;
     struct xwl_window *xwl_window;
+    WindowPtr focus;
 
     if (!xwl_seat)
         xwl_seat = xwl_screen_get_default_seat(xwl_screen);
 
     xwl_window = xwl_window_from_window(window);
+    if (!xwl_window && xwl_seat->focus_window) {
+        focus = xwl_seat->focus_window->window;
+
+        /* Warps on non wl_surface backed Windows are only allowed
+         * as long as the pointer stays within the focus window.
+         */
+        if (x >= focus->drawable.x &&
+            y >= focus->drawable.y &&
+            x < focus->drawable.x + focus->drawable.width &&
+            y < focus->drawable.y + focus->drawable.height) {
+            if (!window) {
+                DebugF("Warp relative to pointer, assuming pointer focus\n");
+                xwl_window = xwl_seat->focus_window;
+            } else if (window == screen->root) {
+                DebugF("Warp on root window, assuming pointer focus\n");
+                xwl_window = xwl_seat->focus_window;
+            }
+        }
+    }
     if (!xwl_window)
         return;
 
@@ -204,6 +224,15 @@ xwl_cursor_confined_to(DeviceIntPtr device,
     }
 
     xwl_window = xwl_window_from_window(window);
+    if (!xwl_window && xwl_seat->focus_window) {
+        /* Allow confining on InputOnly windows, but only if the geometry
+         * is the same than the focus window.
+         */
+        if (window->drawable.class == InputOnly) {
+            DebugF("Confine on InputOnly window, assuming pointer focus\n");
+            xwl_window = xwl_seat->focus_window;
+        }
+    }
     if (!xwl_window)
         return;
 
@@ -305,9 +334,11 @@ xwl_realize_window(WindowPtr window)
     screen->RealizeWindow = xwl_realize_window;
 
     if (xwl_screen->rootless && !window->parent) {
+        BoxRec box = { 0, 0, xwl_screen->width, xwl_screen->height };
+
+        RegionReset(&window->winSize, &box);
         RegionNull(&window->clipList);
         RegionNull(&window->borderClip);
-        RegionNull(&window->winSize);
     }
 
     if (xwl_screen->rootless) {
@@ -880,8 +911,9 @@ InitOutput(ScreenInfo * screen_info, int argc, char **argv)
     screen_info->bitmapBitOrder = BITMAP_BIT_ORDER;
     screen_info->numPixmapFormats = ARRAY_SIZE(depths);
 
-    LoadExtensionList(xwayland_extensions,
-                      ARRAY_SIZE(xwayland_extensions), FALSE);
+    if (serverGeneration == 1)
+        LoadExtensionList(xwayland_extensions,
+                          ARRAY_SIZE(xwayland_extensions), FALSE);
 
     /* Cast away warning from missing printf annotation for
      * wl_log_func_t.  Wayland 1.5 will have the annotation, so we can
diff --git a/include/xorg-config.h.in b/include/xorg-config.h.in
index a7d80b5af..931609f90 100644
--- a/include/xorg-config.h.in
+++ b/include/xorg-config.h.in
@@ -124,6 +124,9 @@
 /* Define to 1 if you have the <sys/mkdev.h> header file. */
 #undef HAVE_SYS_MKDEV_H
 
+/* Define to 1 if you have the <sys/sysmacros.h> header file. */
+#undef HAVE_SYS_SYSMACROS_H
+
 /* Path to text files containing PCI IDs */
 #undef PCI_TXT_IDS_PATH
 
diff --git a/os/io.c b/os/io.c
index 234c0f33f..f80580cfc 100644
--- a/os/io.c
+++ b/os/io.c
@@ -634,6 +634,28 @@ SetCriticalOutputPending(void)
 }
 
 /*****************
+ * AbortClient:
+ *    When a write error occurs to a client, close
+ *    the connection and clean things up. Mark
+ *    the client as 'ready' so that the server will
+ *    try to read from it again, notice that the fd is
+ *    closed and clean up from there.
+ *****************/
+
+static void
+AbortClient(ClientPtr client)
+{
+    OsCommPtr oc = client->osPrivate;
+
+    if (oc->trans_conn) {
+        _XSERVTransDisconnect(oc->trans_conn);
+        _XSERVTransClose(oc->trans_conn);
+        oc->trans_conn = NULL;
+        mark_client_ready(client);
+    }
+}
+
+/*****************
  * WriteToClient
  *    Copies buf into ClientPtr.buf if it fits (with padding), else
  *    flushes ClientPtr.buf and buf to client.  As of this writing,
@@ -708,11 +730,7 @@ WriteToClient(ClientPtr who, int count, const void *__buf)
             FreeOutputs = oco->next;
         }
         else if (!(oco = AllocateOutputBuffer())) {
-            if (oc->trans_conn) {
-                _XSERVTransDisconnect(oc->trans_conn);
-                _XSERVTransClose(oc->trans_conn);
-                oc->trans_conn = NULL;
-            }
+            AbortClient(who);
             MarkClientException(who);
             return -1;
         }
@@ -893,9 +911,7 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
                     obuf = realloc(oco->buf, notWritten + BUFSIZE);
                 }
                 if (!obuf) {
-                    _XSERVTransDisconnect(oc->trans_conn);
-                    _XSERVTransClose(oc->trans_conn);
-                    oc->trans_conn = NULL;
+                    AbortClient(who);
                     MarkClientException(who);
                     oco->count = 0;
                     return -1;
@@ -922,11 +938,7 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
         }
 #endif
         else {
-            if (oc->trans_conn) {
-                _XSERVTransDisconnect(oc->trans_conn);
-                _XSERVTransClose(oc->trans_conn);
-                oc->trans_conn = NULL;
-            }
+            AbortClient(who);
             MarkClientException(who);
             oco->count = 0;
             return -1;
diff --git a/os/osinit.c b/os/osinit.c
index 3af88974f..7715d1060 100644
--- a/os/osinit.c
+++ b/os/osinit.c
@@ -181,6 +181,7 @@ OsInit(void)
             int i;
 
             int siglist[] = { SIGSEGV, SIGQUIT, SIGILL, SIGFPE, SIGBUS,
+            SIGABRT,
                 SIGSYS,
                 SIGXCPU,
                 SIGXFSZ,
diff --git a/os/utils.c b/os/utils.c
index ddcd482e1..8d1418255 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -320,7 +320,7 @@ LockServer(void)
     }
     if (lfd < 0)
         FatalError("Could not create lock file in %s\n", tmp);
-    snprintf(pid_str, sizeof(pid_str), "%10ld\n", (long) getpid());
+    snprintf(pid_str, sizeof(pid_str), "%10lu\n", (unsigned long) getpid());
     if (write(lfd, pid_str, 11) != 11)
         FatalError("Could not write pid to lock file in %s\n", tmp);
     (void) fchmod(lfd, 0444);
@@ -1364,6 +1364,12 @@ OsAbort(void)
 #ifndef __APPLE__
     OsBlockSignals();
 #endif
+#if !defined(WIN32) || defined(__CYGWIN__)
+    /* abort() raises SIGABRT, so we have to stop handling that to prevent
+     * recursion
+     */
+    OsSignal(SIGABRT, SIG_DFL);
+#endif
     abort();
 }
 
diff --git a/present/present.c b/present/present.c
index c9c68dcba..7d428fca7 100644
--- a/present/present.c
+++ b/present/present.c
@@ -543,8 +543,6 @@ present_event_notify(uint64_t event_id, uint64_t ust, uint64_t msc)
             present_execute(vblank, ust, msc);
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {
@@ -1007,8 +1005,6 @@ present_abort_vblank(ScreenPtr screen, RRCrtcPtr crtc, uint64_t event_id, uint64
             vblank->queued = FALSE;
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index d1a51f0aa..401a1c178 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -843,9 +843,8 @@ RRCrtcGetTransform(RRCrtcPtr crtc)
 Bool
 RRCrtcPendingTransform(RRCrtcPtr crtc)
 {
-    return memcmp(&crtc->client_current_transform.transform,
-                  &crtc->client_pending_transform.transform,
-                  sizeof(PictTransform)) != 0;
+    return !RRTransformEqual(&crtc->client_current_transform,
+                             &crtc->client_pending_transform);
 }
 
 /*
diff --git a/record/record.c b/record/record.c
index 82bb0607e..600d55f53 100644
--- a/record/record.c
+++ b/record/record.c
@@ -1910,7 +1910,8 @@ ProcRecordUnregisterClients(ClientPtr client)
     int i;
 
     REQUEST_AT_LEAST_SIZE(xRecordUnregisterClientsReq);
-    if ((client->req_len << 2) - SIZEOF(xRecordUnregisterClientsReq) !=
+    if (INT_MAX / 4 < stuff->nClients ||
+        (client->req_len << 2) - SIZEOF(xRecordUnregisterClientsReq) !=
         4 * stuff->nClients)
         return BadLength;
     VERIFY_CONTEXT(pContext, stuff->context, client);
diff --git a/test/Makefile.am b/test/Makefile.am
index b2358c219..202a6d0d5 100644
--- a/test/Makefile.am
+++ b/test/Makefile.am
@@ -81,7 +81,7 @@ libxservertest_la_LIBADD += \
             $(top_builddir)/hw/xfree86/ramdac/libramdac.la \
             $(top_builddir)/hw/xfree86/ddc/libddc.la \
             $(top_builddir)/hw/xfree86/i2c/libi2c.la \
-            $(top_builddir)/hw/xfree86/dixmods/libxorgxkb.la \
+            $(top_builddir)/hw/xfree86/xkb/libxorgxkb.la \
             $(top_builddir)/Xext/libXvidmode.la \
             @XORG_LIBS@
 
diff --git a/test/signal-logging.c b/test/signal-logging.c
index 3d2d04801..7f2972003 100644
--- a/test/signal-logging.c
+++ b/test/signal-logging.c
@@ -177,7 +177,7 @@ static void logging_format(void)
     strcpy(&buf[sizeof(buf) - 4], "end");
 
     LogInit(log_file_path, NULL);
-    assert(f = fopen(log_file_path, "r"));
+    assert((f = fopen(log_file_path, "r")));
 
 #define read_log_msg(msg) do {                                  \
         msg = fgets(read_buf, sizeof(read_buf), f);             \
diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index ffbc546b3..d2a2567fc 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -47,23 +47,27 @@
 
 /***====================================================================***/
 
-#define	BUFFER_SIZE	512
-
-static char textBuffer[BUFFER_SIZE];
-static int tbNext = 0;
+#define NUM_BUFFER      8
+static struct textBuffer {
+    int size;
+    char *buffer;
+} textBuffer[NUM_BUFFER];
+static int textBufferIndex;
 
 static char *
 tbGetBuffer(unsigned size)
 {
-    char *rtrn;
+    struct textBuffer *tb;
 
-    if (size >= BUFFER_SIZE)
-        return NULL;
-    if ((BUFFER_SIZE - tbNext) <= size)
-        tbNext = 0;
-    rtrn = &textBuffer[tbNext];
-    tbNext += size;
-    return rtrn;
+    tb = &textBuffer[textBufferIndex];
+    textBufferIndex = (textBufferIndex + 1) % NUM_BUFFER;
+
+    if (size > tb->size) {
+        free(tb->buffer);
+        tb->buffer = xnfalloc(size);
+        tb->size = size;
+    }
+    return tb->buffer;
 }
 
 /***====================================================================***/
@@ -79,8 +83,6 @@ XkbAtomText(Atom atm, unsigned format)
         int len;
 
         len = strlen(atmstr) + 1;
-        if (len > BUFFER_SIZE)
-            len = BUFFER_SIZE - 2;
         rtrn = tbGetBuffer(len);
         strlcpy(rtrn, atmstr, len);
     }
@@ -128,8 +130,6 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
     len = strlen(tmp) + 1;
     if (format == XkbCFile)
         len += 4;
-    if (len >= BUFFER_SIZE)
-        len = BUFFER_SIZE - 1;
     rtrn = tbGetBuffer(len);
     if (format == XkbCFile) {
         strcpy(rtrn, "vmod_");
@@ -140,6 +140,8 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
     return rtrn;
 }
 
+#define VMOD_BUFFER_SIZE        512
+
 char *
 XkbVModMaskText(XkbDescPtr xkb,
                 unsigned modMask, unsigned mask, unsigned format)
@@ -147,7 +149,7 @@ XkbVModMaskText(XkbDescPtr xkb,
     register int i, bit;
     int len;
     char *mm, *rtrn;
-    char *str, buf[BUFFER_SIZE];
+    char *str, buf[VMOD_BUFFER_SIZE];
 
     if ((modMask == 0) && (mask == 0)) {
         rtrn = tbGetBuffer(5);
@@ -173,7 +175,7 @@ XkbVModMaskText(XkbDescPtr xkb,
                 len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
                 if (format == XkbCFile)
                     len += 4;
-                if ((str - (buf + len)) <= BUFFER_SIZE) {
+                if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
                     if (str != buf) {
                         if (format == XkbCFile)
                             *str++ = '|';
@@ -199,8 +201,6 @@ XkbVModMaskText(XkbDescPtr xkb,
         len = 0;
     if (str)
         len += strlen(str) + (mm == NULL ? 0 : 1);
-    if (len >= BUFFER_SIZE)
-        len = BUFFER_SIZE - 1;
     rtrn = tbGetBuffer(len + 1);
     rtrn[0] = '\0';
 
@@ -603,7 +603,7 @@ XkbStringText(char *str, unsigned format)
             }
             else {
                 *out++ = '0';
-                sprintf(out, "%o", *in);
+                sprintf(out, "%o", (unsigned char) *in);
                 while (*out != '\0')
                     out++;
             }