commit 2a0c6c15c35cd262e7cdb86dcc43cb1aeb714c8e
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Oct 15 11:17:35 2018 -0400

    xserver 1.20.2
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>

commit f5dc787fc9bb102e4eea477d1817e35370084ea2
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Oct 10 14:09:11 2018 -0400

    fbdevhw: Refuse to touch PCI devices on the fallback probe path
    
    Fixes: https://gitlab.freedesktop.org/xorg/driver/xf86-video-fbdev/issues/9
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit fc78bcca21e767697de6ad4d8e03b6728856f613)

commit 4795c069a503144ea31f01de0c039f32d9880292
Author: Adam Jackson <ajax@redhat.com>
Date:   Fri Oct 5 14:50:20 2018 -0400

    glamor/egl: Avoid crashing on broken configurations
    
    0a9415cf apparently can tickle bugs in the GL stack where glGetString
    returns NULL, presumably because the eglMakeCurrent() didn't manage to
    actually install a dispatch table and you're hitting a stub function.
    That's clearly not our bug, but if it happens we should at least not
    crash. Notice this case and fail gently.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit af151895f3cb1755a7a5631f2398a3d3b219cbef)

commit 1e3c5d614ee33d9eac1d2cf6366feeb8341fc0f4
Author: Adam Jackson <ajax@redhat.com>
Date:   Fri Sep 14 11:33:43 2018 -0400

    glamor_egl: Don't initialize on llvmpipe
    
    Mesa started supporting GL_OES_EGL_image on llvmpipe in 17.3, after this
    commit:
    
        commit bbdeddd5fd0b797e1e281f058338b3da4d98029d
        Author: Gurchetan Singh <gurchetansingh@chromium.org>
        Date:   Tue Aug 1 14:49:33 2017 -0700
    
            st/dri: add drisw image extension
    
    That's pretty cool, but it means glamor now thinks it can initialize on
    llvmpipe. This is almost certainly not what anyone wants, as glamor on
    llvmpipe is pretty much uniformly slower than fb.
    
    This fixes both Xorg and Xwayland to refuse glamor in such a setup.
    Xephyr is left alone, both because glamor is not the default there and
    because Xephyr+glamor+llvmpipe is one of the easier ways to get xts to
    exercise glamor.
    
    The (very small) downside of this change is that you lose DRI3 support.
    This wouldn't have helped you very much (since an lp glamor blit is
    slower than a pixman blit), but it would eliminate the PutImage overhead
    for llvmpipe's glXSwapBuffers. A future change should add DRI3 support
    for the fb-only case.
    
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 0a9415cf793babed1f28c61f8047d51de04f1528)

commit b58aa8ed9b0a052d615d34b103aa54ce357df12e
Author: Alexander Volkov <a.volkov@rusbitech.ru>
Date:   Mon Feb 26 19:41:18 2018 +0300

    os/xdmcp: Don't create a new socket in XdmcpReset()
    
    xdmcpSocket survives during the reset, there is no
    need to create a new one.
    
    This commit restores logic that was broken by
    49c0f2413d32fdfe36e45861fcb32aaeab633094 in Xorg 1.19.
    
    Signed-off-by: Alexander Volkov <a.volkov@rusbitech.ru>
    (cherry picked from commit 32677ce03d793a1f2aa8871112eb3d19b3cb762f)

commit b1215fb075b0166d5742c72041f58d512273bb50
Author: Pierre Ossman <ossman@cendio.se>
Date:   Wed Oct 3 10:28:52 2018 +0200

    Switch automatic composite update to WorkQueue
    
    It is currently (ab)using the screen BlockHandler callback to do
    this. But this can cause problems with other extension as their
    block handlers might have executed before Composite's. And the
    operations Composite does might result in them wanting to change
    timeouts.
    
    Practically this caused problems for TigerVNC's VNC extension which
    failed to send out updates for Composite's screen updates.
    
    (cherry picked from commit 1bd5d0a53c5ff4169c5a6704c1c4b276f998b938)

commit a41b6ef2244f1a0003dada0962a9d785e74d7981
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Oct 1 11:42:37 2018 -0400

    modesetting: Don't free(dst) in drmmode_prop_info_copy
    
    The destination is always either on the stack or in the middle of some
    struct.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 43a0f9a5dbb469f4f403a8530f33be67618933b8)

commit 9403335910f4e6b862af5c5ef835074be2c52edb
Author: Cedric Roux <sed@free.fr>
Date:   Wed Sep 12 19:14:18 2018 +0200

    miext/damage: take care of the coordinate mode in damagePolyPoint
    
    The mode (CoordModeOrigin or CoordModePrevious) was not taken into
    account when computing the box. The result was a bad drawing of
    points in some situations (on my hardware/software configuration,
    calling XDrawString followed by XDrawPoints in the mode
    CoordModePrevious).
    
    Signed-off-by: Cedric Roux <sed@free.fr>
    Signed-off-by: Eric Anholt <eric@anholt.net>
    (cherry picked from commit bc36594e0eb8bfa5a673bcfd8c8168f70994a1df)

commit c26a47b4f2e170e283ca1683d5b6ca2d04823e80
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Thu Sep 20 16:32:29 2018 +0200

    xwayland: Use `double` for `xwl_tablet_tool`
    
    So we do not lose subpixel precision in Xwayland.
    
    Suggested-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Closes: https://gitlab.freedesktop.org/libinput/libinput/issues/138
    (cherry picked from commit 734b2d6907f730571a2805cbc53fe7056190f19e)

commit fb01b238c610e1955457dd9878d75b2c34c9a0c6
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Aug 29 15:42:20 2018 -0400

    xfree86: Fix Option "MaxClients" validation
    
    The old code would not in fact validate the option value, though it
    might complain about it in the log. It also didn't let you set some
    legal values that the -maxclients command line option would.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 7d689f049c3cc16b8e0cb0103a384a2ceb84ea33)

commit cc4051ad6a3712c4407ffb608c8d23f2b66952d6
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 11:39:32 2018 +1000

    devices: break after finding and removing device from lists
    
    Coverity complains about a use after free in here after the
    freeing, I can't follow the linked list so well, but whot
    says the device can only be on one list once, so break should
    fix it.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit ba0f5d854f4db52974ab5cd09191303b01b075ff)

commit 64a7aac257ddbb000759d37386454866d8810545
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 11:12:51 2018 +1000

    mibltblt: free prgnSrcClip on error path.
    
    Pointed out by coverity.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit c4591ea17110b5c318a5ef4b0f17a4eea306ea71)

commit fcbdb7c8b0d7bcc6a85e0beb2ce1dba76803486b
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 11:09:40 2018 +1000

    xkb: fix what looks to be a copy-paste error with first vs firstMM
    
    Pointed out by coverity.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 758393951233d1b2520cf4cefd33ec4288a3880a)

commit 83ef02839ce8982c2e841bc400abddbeb620481d
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 11:05:45 2018 +1000

    posix_tty: free leak of xf86SetStrOption return value.
    
    Pointed out by coverity.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit cad3a1a82da3c8421b5cc98af27a779a38b5c709)

commit 66d36010a324480ac656e702e53f9c1f6fb60d5c
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 10:56:40 2018 +1000

    modesetting: get pEnt after error checks
    
    This saves us having to make sure we clean it up.
    
    Pointed out by coverity.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit b6c29a881eb49300fddfd0187cb10891f5257d3b)

commit 795c58a1febb3deb9066d981b178d9cf14fdad03
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 10:52:25 2018 +1000

    glamor: fix leak of fs_getcolor_source.
    
    This is created using XNFstrdup, so it needs to be freed.
    
    Pointed out by coverity.
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit f0a5c0d1fdaeee3cd701215f4f57b7eacaf783c2)

commit bb384d0b110a99f2d935ed73d6589af46f818823
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 10:50:21 2018 +1000

    fboverlay: move bpp checks above malloc
    
    Avoids having to free the malloced object.
    
    Pointed out by coverity.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit c7fa6a0a0d4ad28ee21b8dd9ad4fbe33f462bc71)

commit 26a83f9833054f5cf7c7d73b0f5aa080d400c26b
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 10:33:04 2018 +1000

    xi: free modifiers_failed on error path. (v2)
    
    Pointed out by coverity.
    
    v2: set modifies_failed to NULL at start (whot)
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 51ae6126dcf3e234d0f678f02934bc9515abb8ae)

commit bdeab7863eb7abe2d9d05eed259542695935559c
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Sep 12 10:30:13 2018 +1000

    shm: move shmsize verify before allocating the drawable.
    
    Otherwise if the VERIFY_SHMSIZE macro fails we leak the drawables
    we allocated earlier.
    
    Noticed by coverity scan.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 3439929c510501929c6ef1d90477c33bf8838632)

commit 8e646ca9850c071994354b503b5d2b62f99ef2a8
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Aug 29 16:07:59 2018 -0400

    modesetting: Document Option "DoubleShadow" in the man page
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit c4f3e42fe316c90a73908a838ce64abbb28fe0a2)

commit fdb80a327cfe213a206bc76d3cb43cbb33855547
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Aug 29 15:57:46 2018 -0400

    modesetting: Lie less in the man page
    
    We don't support 8bpp, and we do have acceleration.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 0dc2c419e11cf28b8fa1e607d4cf2d15f2eb2306)

commit cffac815b957fd1296d61cc5c20ba3709a77ee4e
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Wed Sep 5 10:49:27 2018 +0200

    xwayland: Remove xwl_present_window from privates on cleanup
    
    Xwayland's `xwl_destroy_window()` invokes `xwl_present_cleanup()`
    before the common `DestroyWindow()`.
    
    But then `DestroyWindow()` calls `present_destroy_window()` which will
    possibly end up in `xwl_present_abort_vblank()` which will try to access
    data that was previously freed by `xwl_present_cleanup()`:
    
      Invalid read of size 8
         at 0x434184: xwl_present_abort_vblank (xwayland-present.c:378)
         by 0x53785B: present_wnmd_abort_vblank (present_wnmd.c:651)
         by 0x53695A: present_free_window_vblank (present_screen.c:87)
         by 0x53695A: present_destroy_window (present_screen.c:152)
         by 0x42A90D: xwl_destroy_window (xwayland.c:653)
         by 0x584298: compDestroyWindow (compwindow.c:613)
         by 0x53CEE3: damageDestroyWindow (damage.c:1570)
         by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326)
         by 0x46F7F6: FreeWindowResources (window.c:1031)
         by 0x472847: DeleteWindow (window.c:1099)
         by 0x46B54C: doFreeResource (resource.c:880)
         by 0x46C706: FreeClientResources (resource.c:1146)
         by 0x446ADE: CloseDownClient (dispatch.c:3473)
       Address 0x182abde0 is 80 bytes inside a block of size 112 free'd
         at 0x4C2FDAC: free (vg_replace_malloc.c:530)
         by 0x42A937: xwl_destroy_window (xwayland.c:647)
         by 0x584298: compDestroyWindow (compwindow.c:613)
         by 0x53CEE3: damageDestroyWindow (damage.c:1570)
         by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326)
         by 0x46F7F6: FreeWindowResources (window.c:1031)
         by 0x472847: DeleteWindow (window.c:1099)
         by 0x46B54C: doFreeResource (resource.c:880)
         by 0x46C706: FreeClientResources (resource.c:1146)
         by 0x446ADE: CloseDownClient (dispatch.c:3473)
         by 0x446DA5: ProcKillClient (dispatch.c:3279)
         by 0x4476AF: Dispatch (dispatch.c:479)
       Block was alloc'd at
         at 0x4C30B06: calloc (vg_replace_malloc.c:711)
         by 0x433F46: xwl_present_window_get_priv (xwayland-present.c:54)
         by 0x434228: xwl_present_get_crtc (xwayland-present.c:302)
         by 0x539728: proc_present_query_capabilities (present_request.c:227)
         by 0x4476AF: Dispatch (dispatch.c:479)
         by 0x44B5B5: dix_main (main.c:276)
         by 0x75F611A: (below main) (libc-start.c:308)
    
    This is because `xwl_present_cleanup()` frees the memory but does not
    remove it from the window's privates, and `xwl_present_abort_vblank()`
    will still find it and hence try to access that freed memory...
    
    Remove `xwl_present_window` from window's privates on cleanup so that no
    other function can find and reuse that data once it's freed.
    
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1616269
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit 3f31f56929e80001970e3821ed8b10c6075df8e6)

commit 8dd7173eeba08f1ecfb414915625c609ad4b3297
Author: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date:   Tue Aug 28 21:30:05 2018 +0100

    xwayland: fix access to invalid pointer
    
    xwl_output->randr_crtc is used in the update_screen_size() function :
    
    ==5331== Invalid read of size 4
    ==5331==    at 0x15263D: update_screen_size (xwayland-output.c:190)
    ==5331==    by 0x152C48: xwl_output_remove (xwayland-output.c:413)
    ==5331==    by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x14BCCA: xwl_read_events (xwayland.c:814)
    ==5331==    by 0x2AC0D0: ospoll_wait (ospoll.c:651)
    ==5331==    by 0x2A5322: WaitForSomething (WaitFor.c:208)
    ==5331==    by 0x27574B: Dispatch (dispatch.c:421)
    ==5331==    by 0x279945: dix_main (main.c:276)
    ==5331==  Address 0x1aacb5f4 is 36 bytes inside a block of size 154 free'd
    ==5331==    at 0x48369EB: free (vg_replace_malloc.c:530)
    ==5331==    by 0x1F8AE8: RROutputDestroyResource (rroutput.c:421)
    ==5331==    by 0x29A2AC: doFreeResource (resource.c:880)
    ==5331==    by 0x29AE5B: FreeResource (resource.c:910)
    ==5331==    by 0x152BE0: xwl_output_remove (xwayland-output.c:408)
    ==5331==    by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x14BCCA: xwl_read_events (xwayland.c:814)
    ==5331==    by 0x2AC0D0: ospoll_wait (ospoll.c:651)
    ==5331==  Block was alloc'd at
    ==5331==    at 0x48357BF: malloc (vg_replace_malloc.c:299)
    ==5331==    by 0x1F93E0: RROutputCreate (rroutput.c:83)
    ==5331==    by 0x152A75: xwl_output_create (xwayland-output.c:361)
    ==5331==    by 0x14BE59: registry_global (xwayland.c:764)
    ==5331==    by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x14BCCA: xwl_read_events (xwayland.c:814)
    ==5331==    by 0x2AC0D0: ospoll_wait (ospoll.c:651)
    ==5331==    by 0x2A5322: WaitForSomething (WaitFor.c:208)
    
    Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
    Reviewed-by: Daniel Stone <daniels@collabora.com>
    (cherry picked from commit 53ce2ba0a19af9c549f47a4cc678afcebeb6087e)

commit 1191b23f942cace785234f5d7fac972251c8f1db
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Wed Sep 5 15:20:17 2018 +0200

    glx: check for indirect context in CreateContextAttribsARB()
    
    Commit 99f0365b "Add a command line argument for disabling indirect GLX"
    added a test to check if indirect context are enabled in
    `DoCreateContext()` but `__glXDisp_CreateContextAttribsARB()` doesn't
    use `DoCreateContext()` and doesn't check if indirect context is
    enabled.
    
    As a result, clients can still manage to create indirect contexts using
    `glXCreateContextAttribsARB()` even if indirect contexts are disabled,
    which can possibly crash Xservers such as Xwayland or Xephyr when the
    context is destroyed.
    
    To avoid the issue, check for `enableIndirectGLX` in
    `__glXDisp_CreateContextAttribsARB()` as well.
    
    Fixes: 99f0365b "Add a command line argument for disabling indirect GLX"
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107508
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit 75448671abe2c6ae3745eb5d2ed2e76df2de9c41)

commit 1b0db2c74258d20e3f99bd69c2914fd445abe920
Author: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date:   Mon Aug 27 01:04:45 2018 +0100

    present: fix freed pointer access
    
    When a vblank has been marked as aborted, it's going to be free in the
    flip_notify function when stopped. We can't notify it after it's
    stopped because the pointer is invalid.
    
    Valgrind backtrace:
    
    ==5331== Invalid read of size 8
    ==5331==    at 0x212B4D: present_vblank_notify (present_vblank.c:34)
    ==5331==    by 0x21439B: present_wnmd_flip_notify (present_wnmd.c:194)
    ==5331==    by 0x21439B: present_wnmd_event_notify (present_wnmd.c:228)
    ==5331==    by 0x156216: xwl_present_sync_callback (xwayland-present.c:282)
    ==5331==    by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x14BCCA: xwl_read_events (xwayland.c:814)
    ==5331==    by 0x2AC0D0: ospoll_wait (ospoll.c:651)
    ==5331==    by 0x2A5322: WaitForSomething (WaitFor.c:208)
    ==5331==    by 0x27574B: Dispatch (dispatch.c:421)
    ==5331==  Address 0x1b44dc98 is 40 bytes inside a block of size 184 free'd
    ==5331==    at 0x48369EB: free (vg_replace_malloc.c:530)
    ==5331==    by 0x213B0A: present_wnmd_free_idle_vblanks (present_wnmd.c:118)
    ==5331==    by 0x213B0A: present_wnmd_flips_stop (present_wnmd.c:161)
    ==5331==    by 0x2143EF: present_wnmd_flip_notify (present_wnmd.c:192)
    ==5331==    by 0x2143EF: present_wnmd_event_notify (present_wnmd.c:228)
    ==5331==    by 0x156216: xwl_present_sync_callback (xwayland-present.c:282)
    ==5331==    by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
    ==5331==    by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0)
    ==5331==    by 0x14BCCA: xwl_read_events (xwayland.c:814)
    ==5331==    by 0x2AC0D0: ospoll_wait (ospoll.c:651)
    ==5331==    by 0x2A5322: WaitForSomething (WaitFor.c:208)
    ==5331==  Block was alloc'd at
    ==5331==    at 0x48377D5: calloc (vg_replace_malloc.c:711)
    ==5331==    by 0x212D9F: present_vblank_create (present_vblank.c:69)
    ==5331==    by 0x214014: present_wnmd_pixmap (present_wnmd.c:610)
    ==5331==    by 0x21576C: proc_present_pixmap (present_request.c:150)
    ==5331==    by 0x27599D: Dispatch (dispatch.c:479)
    ==5331==    by 0x279945: dix_main (main.c:276)
    ==5331==    by 0x633AB16: (below main) (libc-start.c:310)
    
    v2: Still notify aborted flips (Roman)
    
    Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
    Reviewed-by: Daniel Stone <daniels@collabora.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107314
    Reviewed-by: Roman Gilg <subdiff@gmail.com>
    Tested-by: Roman Gilg <subdiff@gmail.com>
    (cherry picked from commit ce271535adb6974e0a43bb64c8ed7a5dcaff67a2)

commit 48300a7775b4ff3200de200e8c5502d99bd99104
Author: Scott Anderson <scott@anderso.nz>
Date:   Mon Aug 6 18:09:26 2018 +1200

    xwayland: use wayland axis_discrete event
    
    This prevents multiple scroll events happening for wayland compositors
    which send axis values other than 10. For example, libinput will
    typically return 15 for each scroll wheel step, and if a wayland
    compositor sends those to xwayland without normalising them, 2 scroll
    wheel steps will end up as 3 xorg scroll events. By listening for the
    discrete_axis event, this will now correctly send only 2 xorg scroll
    events.
    
    The wayland protocol gurantees that there will always be an axis event
    following an axis_discrete event. However, it does not gurantee that
    other events (including other axis_discrete+axis pairs) will not happen
    in between them. So we must keep a list of outstanding axis_discrete
    events.
    
    Signed-off-by: Scott Anderson <scott@anderso.nz>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit cd285922cdec966825e47220b1182a57abc1ff90)

commit cd19a752f8bbc6caae7bf2457c53c850121fe9b7
Author: Jim Qu <Jim.Qu@amd.com>
Date:   Mon Aug 27 13:37:38 2018 +0800

    modesetting: code refactor for PRIME sync
    
    The X will be crashed on the system with other DDX driver,
    such as amdgpu.
    
    show the log like:
    
    randr: falling back to unsynchronized pixmap sharing
    (EE)
    (EE) Backtrace:
    (EE) 0: /usr/lib/xorg/Xorg (xorg_backtrace+0x4e)
    (EE) 1: /usr/lib/xorg/Xorg (0x55cb0151a000+0x1b5ce9)
    (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f1587a1d000+0x11390)
    (EE)
    (EE) Segmentation fault at address 0x0
    (EE)
    
    The issue is that modesetting as the master, and amdgpu as the slave.
    Thus, when the master attempts to access pSlavePixPriv in ms_dirty_update(),
    problems result due to the fact that it's accessing AMD's 'ppriv' using the
    modesetting structure definition.
    
    Apart from fixing crash issue, the patch fix other issue in master interface
    in which driver should refer to master pixmap.
    
    Signed-off-by: Jim Qu <Jim.Qu@amd.com>
    Reviewed-by: Alex Goins <agoins@nvidia.com>
    (cherry picked from commit f79e5368512b72bb463925983d265b070261b7aa)

commit 5396a4aa084853805a73a2cfbbce156c47573916
Author: Alex Goins <agoins@nvidia.com>
Date:   Tue Aug 14 15:05:46 2018 -0500

    randr: rrCheckPixmapBounding should only increase screen size
    
    The purpose of rrCheckPixmapBounding() is to make sure that the fb is large
    enough to accommodate the region scanned out by a GPU screen. Currently, however,
    it will actually shrink the fb if it's larger than it needs to be.
    
    This is a problem when combining PRIME output slaving with arbitrary transforms
    with xrandr.
    
    Although arbitrary transforms are not supposed to constrain the size of the fb
    (https://lists.freedesktop.org/archives/xorg-devel/2018-January/055563.html),
    xrandr will use RRSetScreenSize to resize the desktop to accommodate scaling
    transforms, e.g. scaling a 1920x1080 display to 3840x2160 will result in a
    desktop size of 3840x2160.
    
    In the case of PRIME, rrCheckPixmapBounding() will be called after
    RRSetScreenSize() and it will resize the fb back down to what it would be
    without the scaling transform, e.g. 1920x1080. This represents divergence in
    behavior between PRIME and non-PRIME outputs.
    
    I had originally made rrCheckPixmapBounding() account for arbitrary transforms,
    but realized that the fb being large enough to accommodate arbitrary transforms
    is not a hard requirement enforced in the server. Instead, this change simply
    makes it so that rrCheckPixmapBounding() will only resize the fb to be larger
    than it already is, preventing it from stepping on prior requests to increase
    the size of the fb.
    
    Signed-off-by: Alex Goins <agoins@nvidia.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    (cherry picked from commit a90f33721eba7f2dbde4a7278f1a213d696c85e9)

commit 051a0efc5c28fb4be1199d73d59e0e4d329b1144
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Aug 8 15:22:41 2018 +1000

    dix: check_modmap_change() returns Success, not true
    
    Not sure what if anything calls XSetDeviceModifierMapping() but this would've
    failed all the time. check_modmap_change() returns Success but we were
    treating it like a boolean. Fix this.
    
    Reported-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 4fe02b8da3ca58500f7e6e017e388907cf4a8b73)

commit 1508ea68065b7976dbf56039f9b20dcaf0394431
Author: Adam Jackson <ajax@redhat.com>
Date:   Tue Aug 7 12:26:05 2018 -0400

    xserver 1.20.1
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>

commit 101d15c7634b26eafb3c5f2edb7cafde102ce208
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Jun 26 09:20:00 2018 -0700

    During reset/shutdown, clean up leases in DIX instead of each driver
    
    Instead of having every video driver loop over any pending leases to
    free them during CloseScreen, do this up in the DIX layer by
    terminating leases when a leased CRTC or Output is destroyed and
    (just to make sure), also terminating leases in RRCloseScreen. The
    latter should "never" get invoked as any lease should be associated
    with a resource which was destroyed.
    
    This is required as by the time the driver's CloseScreen function is
    invoked, we've already freed all of the DIX randr structures and no
    longer have any way to reference the leases
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=106960
    Cc: Thomas Hellstrom <thellstrom@vmware.com>
    (cherry picked from commit 1ef7aed3e2bb2af32330f19b1e7560000512ddfe)

commit 9347326d28fffc7534cad0b084539e936aacfd45
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Jul 18 13:22:43 2018 +1000

    Xext: dynamically allocate the PanoramiXDepths[j].vids array
    
    Control flow is:
       PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
       PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
       and writes those into the previously allocated array.
    
    This caused invalid reads/writes followed by eventually a double-free abort.
    
    Reproduced with xorg-integration-tests server test
    XineramaTest.ScreenCrossing/* (and a bunch of others).
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 93cafb0828d2e24bd14616df1aa9883fb843dd6c)

commit cbf1ca2dba7bc3561cf1a8023e5e18706adbdba6
Author: emersion <contact@emersion.fr>
Date:   Fri Jul 13 15:51:26 2018 -0400

    xwayland: rotate logical size for RRMode
    
    The logical size is the size of the output in the global compositor
    space. The mode width/height should be scaled as in the logical
    size, but shouldn't be transformed. Thus we need to rotate back
    the logical size to be able to use it as the mode width/height.
    
    This fixes issues with pointer input on transformed outputs.
    
    Signed-Off-By: Simon Ser <contact@emersion.fr>
    Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
    (cherry picked from commit ce2dde9ed0243a18ae18af0879134f7c1afbd700)

commit 18a52a8e16046d8cabea6cf45913bf0b5be07709
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Wed Jul 25 16:33:23 2018 +0200

    xwayland: Enable DRI3 for glamor
    
    glamor_fds_from_pixmap() will bail out early if DRI3 is not enabled,
    unfortunately Xwayland's glamor code would not set it as enabled which
    would lead to blank pixmaps when using texture from pixmap.
    
    Make sure to mark DRI3 as enabled from glamor_egl_screen_init() in
    Xwayland.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107287
    Fixes: c8c276c956 ("glamor: Implement PixmapFromBuffers and BuffersFromPixmap")
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    (cherry picked from commit cdec2b3c195d1d080207ef01c55ff14b45370010)

commit c256e31a9eba20da259f31ee70d1c8e1870993f1
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 19 14:38:19 2018 +0200

    modesetting: Fix cirrus 24bpp breakage
    
    The recent rewrite of modesetting driver broke the 24bpp support.
    As typically found on cirrus KMS, it leads to a blank screen, spewing
    the error like:
      failed to add fb -22
      (EE) modeset(0): failed to set mode: Invalid argument
    
    The culript is that the wrong bpp value of the front buffer is passed
    to drmModeAddFB().  Fix it by replacing with the back buffer bpp,
    drmmode->kbpp.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Tested-by: Stefan Dirsch <sndirsch@suse.de>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit d625e16918ef9104863709eb108346464767c444)

commit 2da0bde4498cf4ee422e5a2cb2c53cbbb73df937
Author: Matt Turner <mattst88@gmail.com>
Date:   Tue May 22 21:10:55 2018 -0700

    xfree86: Inline xf86{Read,Write}Mmio{8,16,32} on alpha
    
    In commit 9db2af6f757e (xfree86: Remove xf86{Map,Unmap}VidMem) we
    somehow stopped exporting xf86{Read,Write}Mmio{8,16,32}. Since the
    function pointer indirection was intended to support dense vs sparse and
    sparse support is now gone, we can just make the functions static inline
    in compiler.h and avoid all of this.
    
    Bugzilla: https://bugs.gentoo.org/548906
    Tested-by: Christopher May-Townsend <chris@maytownsend.co.uk>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Matt Turner <mattst88@gmail.com>
    (cherry picked from commit 166ac294aefe21a6cfcc0e7a4c9525eef49c2f0c)

commit b9e9eda08bd9198a6d089acd5d50677cd8713b33
Author: Stefan Agner <stefan@agner.ch>
Date:   Thu Dec 22 15:41:06 2016 +0100

    modesetting: Fix 16 bit depth/bpp mode
    
    When setting DefaultDepth to 16 in the Screen section, the current
    code requests a 32 bpp framebuffer, however the X-Server seems to
    assumes 16 bpp.
    
    Fixes commit 21217d02168d ("modesetting: Implement 32->24 bpp
    conversion in shadow update")
    
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Stefan Agner <stefan@agner.ch>
    (cherry picked from commit 1c7f34e99ff9750979a03ae20c6be1f2b42c284c)

commit 5c0662d44852363fe258c045250710ed881e56b7
Author: Lyude Paul <lyude@redhat.com>
Date:   Fri Jun 22 12:49:47 2018 -0400

    meson: ensure the libc has RPC functions when secure-rpc is enabled
    
    Currently our meson.build just makes the assumption that the libc is
    going to provide RPC functions. This doesn't actually seem to be the
    case on Fedora, which causes compilation to fail unexpectedly:
    
    ../../Projects/xserver/os/rpcauth.c:47:10: fatal error: rpc/rpc.h: No such file or directory
     #include <rpc/rpc.h>
              ^~~~~~~~~~~
    compilation terminated.
    
    So, in the event that we can't use libtirpc ensure that we actually
    check whether or not the libc provides rpc/rpc.h. If it doesn't, raise
    an error.
    
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    (cherry picked from commit d95a1310ef8e08a93a28f9766d1b4093f7891404)

commit 10285bc36b411edd923ee5d369244647ba2b714b
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Jun 26 16:34:29 2018 -0700

    xf86-video-modesetting: Lease planes as well if using atomic
    
    If we're using atomic modesetting, then we're also using universal
    planes, and so the lease we create needs to include the plane.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Daniel Stone <daniels@collabora.com>
    (cherry picked from commit d83efc47b7a524b4f8d4a993c27a3e402a98fa7c)

commit a530198ac0ffdc4c268d13e59079f7583930a284
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Jun 26 14:05:31 2018 -0700

    xf86-video-modesetting: Don't enable UNIVERSAL_PLANES separately
    
    We don't want universal_planes unless we're using atomic APIs for
    modesetting, and the kernel already enables universal_planes
    automatically when atomic is enabled.
    
    If we enable universal_planes when we're not using atomic, then we
    won't have selected a plane for each crtc, and this will break lease
    creation which requires planes for each output when universal_planes
    is enabled.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Daniel Stone <daniels@collabora.com>
    (cherry picked from commit 4a11f66e4690f9e94dc61cb264f5ef78dbdb255a)

commit cd7680adccdf8f6905a83ae08cbde7ac76693fe5
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jun 28 11:45:16 2018 -0700

    xfree86: Wrap RRCrtcIsLeased and RROutputIsLeased to check for DIX structures
    
    Before DIX structures are allocated for crtcs and outputs, we don't
    want to call DIX randr code with NULL pointers. This can happen if the
    driver sets video modes early in server initialization, which Nouveau
    does in zaphod mode.
    
    Cc: thellstrom@vmware.com
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=106772
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=106960
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 2faf4cef8bcf9bb2034a27219a656ea7221afc6c)

commit ebd4cd71f49151fb699cf45e835f3719e6b31bf5
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jun 28 11:45:15 2018 -0700

    xfree86: Reset randr_crtc and randr_output early in xf86CrtcCloseScreen
    
    The DIX crtc and output structures are freed when their resources are
    destroyed, which happens before CloseScreen is called. As a result, we
    know these pointers are invalid and referencing them during any of the
    remaining CloseScreen sequence will be bad.
    
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Cc: thellstrom@vmware.com
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=106960
    (cherry picked from commit c55a44a9a86aaece17c1a2e73c77e3e665c4888e)

commit 1f169d5b38d93d725029d5f7dc237b558e8bb137
Author: Jon Turney <jon.turney@dronecode.org.uk>
Date:   Sat Jun 30 12:53:35 2018 +0100

    meson: use absolute paths in manpage substitutions
    
    paths returned by get_option('foodir') are potentially relative to prefix
    
    Noticed when comparing manpages generated by a meson build with those
    generated by an autotools build
    
    Signed-off-by: Jon Turney <jon.turney@dronecode.org.uk>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 49283e238a0ba6051034ae635e5970891f17f9df)

commit bc1882aa23a129c4b72b0bfc132cfd04db801a90
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jan 18 18:07:29 2018 -0800

    modesetting: Allow a DRM fd to be passed on command line with -masterfd [v2]
    
    This lets an application open a suitable DRM device and pass the file
    descriptor to the mode setting driver through an X server command line
    option, '-masterfd'.
    
    There's a companion application, xlease, which creates a DRM master by
    leasing an output from another X server. That is available at
    
            git clone git://people.freedesktop.org/~keithp/xlease
    
    v2:
            Always print usage, but note that it can't be used if
            setuid/gid
    
            Suggested-by: Lyude Paul <lyude@redhat.com>
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Lyude Paul <lyude@redhat.com>
    (cherry picked from commit 38ff29ec8ead0a293f50ac52146199babe4205ca)

commit d60ce5b01f5988abc9957473d7175872c8845b08
Author: Laurent Carlier <lordheavym@gmail.com>
Date:   Sat Jun 16 13:00:01 2018 +0200

    meson: Add configuration of listening on tcp, unix and local
    
    bugzilla: https://bugs.kde.org/show_bug.cgi?id=395419
    bugzilla: https://bugs.archlinux.org/task/59025
    
    Signed-off-by: Laurent Carlier <lordheavym@gmail.com>
    Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 2f39b2a07805194fdd7def30d941666963d6e670)

commit 79795bf9df395001c8d659ac8d28090ea9cefc8d
Author: Lyude Paul <lyude@redhat.com>
Date:   Wed Jun 27 20:29:42 2018 -0400

    modesetting: Fix uninitialized memory usage in drmmode_crtc_get_fb_id()
    
    This really sucked to find out :(
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Reviewed-by: Karol Herbst <kherbst@redhat.com>
    (cherry picked from commit c41d4ff48f72aa964afd131b59e1538295d062dc)

commit 820ce7cb8bb07018de89e13aa50ae6090f2d84eb
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Wed Jun 20 19:23:48 2018 +0200

    glamor: Work around GEM usage v2
    
    KMS drivers are not required to support GEM. In particular, vmwgfx
    doesn't support flink and handles and names are identical.
    Getting a bo name should really be part of a lower level API, if needed,
    but in the mean time work around this by setting the name identical to
    the handle if GEM isn't supported.
    
    This fixes modesetting driver dri2 on vmwgfx.
    
    Reviewed-by: Deepak Rawat <drawat@vmware.com>
    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    (cherry picked from commit 9f02855e7a1b7a3c1e2ee7bfbc73e87c29126920)

commit ba6a9283817254dca90fd8f9ee695504e7c20908
Author: Lyude Paul <lyude@redhat.com>
Date:   Wed Jun 20 19:12:32 2018 -0400

    randr: Scream when creating a shared pixmap fails
    
    This seems like a problem worth screaming about.
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit dc90b1c3c328f1d0b022a234b69ef32bda7ccb01)

commit 91ec6245d6269a88a3f3ecd10fa7a7b326b0a616
Author: Lyude Paul <lyude@redhat.com>
Date:   Wed Jun 20 19:12:31 2018 -0400

    glamor: Unbreak glamor_fd_from_pixmap()
    
    When support for allocating GBM BOs with modifiers was added,
    glamor_fd_from_pixmap() was changed so that it would return an error if
    it got a bo with modifiers set from glamor_fds_from_pixmap(). The
    problem is that on systems that support BOs with modifiers,
    glamor_fds_from_pixmap() will always return BOs with modifiers.
    
    This means that glamor_fd_from_pixmap() was broken entirely, which broke
    a number of other things including glamor_shareable_fd_from_pixmap(),
    which meant that modesetting using multiple GPUs with the modesetting
    DDX was also broken. Easy reproducer:
    
    - Find a laptop with DRI prime that has outputs connected to the
      dedicated GPU and integrated GPU
    - Try to enable one display on each using the modesetting DDX
    - Fail
    
    Since there isn't a way to ask for no modifiers from
    glamor_fds_from_pixmap, we create a shared _glamor_fds_from_pixmap()
    function used by both glamor_fds_from_pixmap() and
    glamor_fd_from_pixmap() that calls down to the appropriate
    glamor_egl_fd*_from_pixmap() function.
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    Cc: Louis-Francis Ratté-Boulianne <lfrb@collabora.com>
    Fixes: c8c276c956 ("glamor: Implement PixmapFromBuffers and BuffersFromPixmap")
    (cherry picked from commit 186a21c4bac744ffe645c8d1a6dda2d41c6d33d8)

commit 821f38fa56087fcb11d2d2483366307fc88bf365
Author: Lyude Paul <lyude@redhat.com>
Date:   Thu Jun 7 20:30:34 2018 -0400

    modesetting: Also disable CRTC in drmmode_output_disable()
    
    So, this did actually work on older kernels at one point in time,
    however it seems that this working was a result of some of the Linux
    kernel's atomic modesetting helpers not preserving the CRTC's enabled
    state in the right spots. This was fixed in:
    
    846c7dfc1193 ("drm/atomic: Try to preserve the crtc enabled state in drm_atomic_remove_fb, v2")
    
    As a result, atomic commits which simply disassociate a DRM connector
    with it's CRTC while leaving the CRTC in an enabled state aren't enough
    to disable the CRTC, and result in the atomic commit failing. This
    currently can cause issues with MST hotplugging where X will end up
    failing to disable the MST outputs after they've left the system. A
    simple reproducer:
    
    - Start up Xorg
    - Connect an MST hub with displays connected to it
    - Remove the hub
    - Now there should be CRTCs stuck on the orphaned MST connectors, and X
      won't be able to reclaim them.
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Cc: Louis-Francis Ratté-Boulianne <lfrb@collabora.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit c12f1bd4b76088ea66e3bec9ab9721a52b20cdf2)

commit 2f4d0d84266b82d8838b8b9b7972f45d66f0e2d1
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Fri Jun 15 08:57:12 2018 +0200

    modesetting: use drmmode_bo_import() for rotate_fb
    
    drmmode_shadow_allocate() still uses drmModeAddFB() which may fail if
    the format is not as expected, preventing from using a rotated output.
    
    Change it to use the new function drmmode_bo_import() which takes care
    of calling the drmModeAddFB2() API.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=106715
    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
    Tested-by: Tomas Pelka <tpelka@redhat.com>
    Reviewed-by: Lyude Paul <lyude@redhat.com>
