GL/glx/glxdri.c                                    |   16 +
Xext/xvdisp.c                                      |   52 +-
composite/compwindow.c                             |    8 +-
config/10-x11-input.fdi                            |   12 +
config/Makefile.am                                 |    5 +-
config/dbus-core.c                                 |    5 +-
config/dbus.c                                      |    7 +-
config/hal.c                                       |  294 +++++--
configure.ac                                       |    7 +-
dix/colormap.c                                     |    1 +
dix/devices.c                                      |    1 +
dix/pixmap.c                                       |    2 +-
dix/window.c                                       |    4 +-
fb/fbblt.c                                         |    6 +
hw/kdrive/Makefile.am                              |   16 -
hw/xfree86/Makefile.am                             |    4 +-
hw/xfree86/common/Makefile.am                      |    2 +-
hw/xfree86/common/extramodes                       |  147 +++-
hw/xfree86/common/xf86AutoConfig.c                 |    8 +-
hw/xfree86/common/xf86Config.c                     |   19 +-
hw/xfree86/common/xf86Config.h                     |    2 -
hw/xfree86/common/xf86Globals.c                    |    2 +-
hw/xfree86/common/xf86Helper.c                     |    4 +-
hw/xfree86/common/xf86Init.c                       |    7 +-
hw/xfree86/common/xf86Xinput.c                     |   81 +-
hw/xfree86/common/xf86str.h                        |    1 +
hw/xfree86/dixmods/Makefile.am                     |   10 +-
hw/xfree86/dixmods/extmod/xf86misc.c               |   33 +-
hw/xfree86/doc/man/xorg.conf.man.pre               |   24 +-
hw/xfree86/int10/helper_exec.c                     |   95 ++-
hw/xfree86/loader/loadmod.c                        |    3 +-
hw/xfree86/modes/xf86Crtc.c                        |  125 ++-
hw/xfree86/modes/xf86Crtc.h                        |    3 +
hw/xfree86/modes/xf86EdidModes.c                   |    6 +-
hw/xfree86/modes/xf86RandR12.c                     |   11 +-
hw/xfree86/modes/xf86Rotate.c                      |    3 +-
hw/xfree86/os-support/linux/lnx_acpi.c             |   23 +-
hw/xfree86/os-support/linux/lnx_video.c            |   11 +-
hw/xfree86/parser/Makefile.am                      |   19 +-
hw/xfree86/parser/Module.c                         |   13 +
hw/xfree86/parser/Monitor.c                        |    2 -
hw/xfree86/parser/cpconfig.c                       |   18 -
hw/xfree86/parser/error.c                          |   20 +
hw/xfree86/scanpci/Makefile.am                     |    4 +-
hw/xfree86/utils/Makefile.am                       |    1 -
hw/xfree86/utils/xorgcfg/Makefile.am               |    4 +-
hw/xfree86/utils/xorgconfig/Makefile.am            |    2 +-
hw/xfree86/vbe/vbe.c                               |    4 +-
hw/xfree86/x86emu/ops2.c                           |   16 +-
hw/xfree86/x86emu/prim_ops.c                       |   66 ++
hw/xfree86/x86emu/x86emu/prim_ops.h                |    1 +
hw/xfree86/x86emu/x86emu/prim_x86_gcc.h            |   79 ++
hw/xfree86/xaa/xaaInit.c                           |   24 +
randr/rrcrtc.c                                     |    3 +-
render/glyph.c                                     |    2 +-
render/miindex.c                                   |    2 +
render/picture.c                                   |    4 +-
x11-switch                                         |    8 +
xkb/xkbUtils.c                                     |    1 +
xorg-sdk.rpmmacros                                 |    7 +
xorg-server.spec                                   |  934 ++++++++++++++++++++
xserver.pamd                                       |    4 +
65 files changed, 1963 insertions(+), 351 deletions(-)

--- a/GL/glx/glxdri.c
+++ b/GL/glx/glxdri.c
@@ -380,6 +380,22 @@ __glXDRIbindTexImage(__GLXcontext *baseContext,
    __GLXDRIscreen * const screen =
       (__GLXDRIscreen *) __glXgetActiveScreen(pScreen->myNum);

+    if (!screen->texOffsetStart) {
+         /* When the GLX_EXT_texture_from_pixmap is used, as it's
+          * implemented here, we want to pull pixmap out of video memory
+          * and into host memory. */
+         extern void XAAEvictPixmaps(void);
+         static int evictedPixmaps = 0;
+
+         if (!evictedPixmaps) {
+             __glXDRIenterServer(GL_FALSE);
+                 if (dlsym(RTLD_DEFAULT, "XAAEvictPixmaps"))
+                      XAAEvictPixmaps();
+             __glXDRIleaveServer(GL_FALSE);
+         evictedPixmaps = TRUE;
+         }
+    }
+
    pixmap = (PixmapPtr) glxPixmap->pDraw;

    if (screen->texOffsetStart && screen->driScreen.setTexOffset) {
diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 21d00aa..5c90492 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -374,6 +374,7 @@ ProcXvQueryAdaptors(ClientPtr client)
  xvAdaptorInfo ainfo;
  xvQueryAdaptorsReply rep;
  int totalSize, na, nf, rc;
+  int nameSize;
  XvAdaptorPtr pa;
  XvFormatPtr pf;
  WindowPtr pWin;
@@ -435,12 +436,12 @@ ProcXvQueryAdaptors(ClientPtr client)
      ainfo.base_id = pa->base_id;
      ainfo.num_ports = pa->nPorts;
      ainfo.type = pa->type;
-      ainfo.name_size = strlen(pa->name);
+      ainfo.name_size = nameSize = strlen(pa->name);
      ainfo.num_formats = pa->nFormats;

      _WriteAdaptorInfo(client, &ainfo);

-      WriteToClient(client, ainfo.name_size, pa->name);
+      WriteToClient(client, nameSize, pa->name);

      nf = pa->nFormats;
      pf = pa->pFormats;
@@ -466,6 +467,7 @@ ProcXvQueryEncodings(ClientPtr client)
  xvEncodingInfo einfo;
  xvQueryEncodingsReply rep;
  int totalSize;
+  int nameSize;
  XvPortPtr pPort;
  int ne;
  XvEncodingPtr pe;
@@ -510,13 +512,13 @@ ProcXvQueryEncodings(ClientPtr client)
  while (ne--)
    {
      einfo.encoding = pe->id;
-      einfo.name_size = strlen(pe->name);
+      einfo.name_size = nameSize = strlen(pe->name);
      einfo.width = pe->width;
      einfo.height = pe->height;
      einfo.rate.numerator = pe->rate.numerator;
      einfo.rate.denominator = pe->rate.denominator;
      _WriteEncodingInfo(client, &einfo);
-      WriteToClient(client, einfo.name_size, pe->name);
+      WriteToClient(client, nameSize, pe->name);
      pe++;
    }

@@ -994,18 +996,19 @@ ProcXvQueryPortAttributes(ClientPtr client)
  rep.text_size = 0;

  for(i = 0, pAtt = pPort->pAdaptor->pAttributes;
-      i < rep.num_attributes; i++, pAtt++)
+      i < pPort->pAdaptor->nAttributes; i++, pAtt++)
  {
      rep.text_size += (strlen(pAtt->name) + 1 + 3) & ~3L;
  }

-  rep.length = (rep.num_attributes * sz_xvAttributeInfo) + rep.text_size;
+  rep.length = rep.length = (pPort->pAdaptor->nAttributes * sz_xvAttributeInfo)
+      + rep.text_size;
  rep.length >>= 2;

  _WriteQueryPortAttributesReply(client, &rep);

  for(i = 0, pAtt = pPort->pAdaptor->pAttributes;
-      i < rep.num_attributes; i++, pAtt++)
+      i < pPort->pAdaptor->nAttributes; i++, pAtt++)
  {
      size = strlen(pAtt->name) + 1;  /* pass the NULL */
      Info.flags = pAtt->flags;
@@ -1216,6 +1219,7 @@ ProcXvQueryImageAttributes(ClientPtr client)
  XvPortPtr pPort;
  int *offsets;
  int *pitches;
+  int planeLength;
  REQUEST(xvQueryImageAttributesReq);

  REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
@@ -1255,7 +1259,7 @@ ProcXvQueryImageAttributes(ClientPtr client)

  rep.type = X_Reply;
  rep.sequenceNumber = client->sequence;
-  rep.length = num_planes << 1;
+  rep.length = planeLength = num_planes << 1;
  rep.num_planes = num_planes;
  rep.width = width;
  rep.height = height;
@@ -1263,8 +1267,8 @@ ProcXvQueryImageAttributes(ClientPtr client)

  _WriteQueryImageAttributesReply(client, &rep);
  if(client->swapped)
-    SwapLongs((CARD32*)offsets, rep.length);
-  WriteToClient(client, rep.length << 2, (char*)offsets);
+    SwapLongs((CARD32*)offsets, planeLength);
+  WriteToClient(client, planeLength << 2, (char*)offsets);

  xfree(offsets);

@@ -1292,13 +1296,13 @@ ProcXvListImageFormats(ClientPtr client)
  rep.type = X_Reply;
  rep.sequenceNumber = client->sequence;
  rep.num_formats = pPort->pAdaptor->nImages;
-  rep.length = rep.num_formats * sz_xvImageFormatInfo >> 2;
+  rep.length = pPort->pAdaptor->nImages * sz_xvImageFormatInfo >> 2;

  _WriteListImageFormatsReply(client, &rep);

  pImage = pPort->pAdaptor->pImages;

-  for(i = 0; i < rep.num_formats; i++, pImage++) {
+  for(i = 0; i < pPort->pAdaptor->nImages; i++, pImage++) {
     info.id = pImage->id;
     info.type = pImage->type;
     info.byte_order = pImage->byte_order;
@@ -1497,6 +1501,7 @@ SProcXvShmPutImage(ClientPtr client)
  swapl(&stuff->gc, n);
  swapl(&stuff->shmseg, n);
  swapl(&stuff->id, n);
+  swapl(&stuff->offset, n);
  swaps(&stuff->src_x, n);
  swaps(&stuff->src_y, n);
  swaps(&stuff->src_w, n);
@@ -1505,7 +1510,6 @@ SProcXvShmPutImage(ClientPtr client)
  swaps(&stuff->drw_y, n);
  swaps(&stuff->drw_w, n);
  swaps(&stuff->drw_h, n);
-  swaps(&stuff->offset, n);
  swaps(&stuff->width, n);
  swaps(&stuff->height, n);
  return ProcXvShmPutImage(client);
@@ -1552,6 +1556,7 @@ SProcXvSetPortAttribute(ClientPtr client)
  swaps(&stuff->length, n);
  swapl(&stuff->port, n);
  swapl(&stuff->attribute, n);
+  swapl(&stuff->value, n);
  return ProcXvSetPortAttribute(client);
}

@@ -1596,9 +1601,10 @@ SProcXvQueryImageAttributes(ClientPtr client)
  register char n;
  REQUEST(xvQueryImageAttributesReq);
  swaps(&stuff->length, n);
+  swapl(&stuff->port, n);
  swapl(&stuff->id, n);
  swaps(&stuff->width, n);
-  swaps(&stuff->width, n);
+  swaps(&stuff->height, n);
  return ProcXvQueryImageAttributes(client);
}

@@ -1625,7 +1631,7 @@ SWriteQueryExtensionReply(
  swaps(&rep->version, n);
  swaps(&rep->revision, n);

-  (void)WriteToClient(client, sz_xvQueryExtensionReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryExtensionReply, (char *)rep);

  return Success;
}
@@ -1641,7 +1647,7 @@ SWriteQueryAdaptorsReply(
  swapl(&rep->length, n);
  swaps(&rep->num_adaptors, n);

-  (void)WriteToClient(client, sz_xvQueryAdaptorsReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryAdaptorsReply, (char *)rep);

  return Success;
}
@@ -1657,7 +1663,7 @@ SWriteQueryEncodingsReply(
  swapl(&rep->length, n);
  swaps(&rep->num_encodings, n);

-  (void)WriteToClient(client, sz_xvQueryEncodingsReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryEncodingsReply, (char *)rep);

  return Success;
}
@@ -1764,7 +1770,7 @@ SWriteGrabPortReply(
  swaps(&rep->sequenceNumber, n);
  swapl(&rep->length, n);

-  (void)WriteToClient(client, sz_xvGrabPortReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvGrabPortReply, (char *)rep);

  return Success;
}
@@ -1780,7 +1786,7 @@ SWriteGetPortAttributeReply(
  swapl(&rep->length, n);
  swapl(&rep->value, n);

-  (void)WriteToClient(client, sz_xvGetPortAttributeReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvGetPortAttributeReply, (char *)rep);

  return Success;
}
@@ -1797,7 +1803,7 @@ SWriteQueryBestSizeReply(
  swaps(&rep->actual_width, n);
  swaps(&rep->actual_height, n);

-  (void)WriteToClient(client, sz_xvQueryBestSizeReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryBestSizeReply, (char *)rep);

  return Success;
}
@@ -1814,7 +1820,7 @@ SWriteQueryPortAttributesReply(
  swapl(&rep->num_attributes, n);
  swapl(&rep->text_size, n);

-  (void)WriteToClient(client, sz_xvQueryPortAttributesReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryPortAttributesReply, (char *)rep);

  return Success;
}
@@ -1833,7 +1839,7 @@ SWriteQueryImageAttributesReply(
  swaps(&rep->width, n);
  swaps(&rep->height, n);

-  (void)WriteToClient(client, sz_xvQueryImageAttributesReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvQueryImageAttributesReply, (char *)rep);

  return Success;
}
@@ -1850,7 +1856,7 @@ SWriteListImageFormatsReply(
  swapl(&rep->length, n);
  swapl(&rep->num_formats, n);

-  (void)WriteToClient(client, sz_xvListImageFormatsReply, (char *)&rep);
+  (void)WriteToClient(client, sz_xvListImageFormatsReply, (char *)rep);

  return Success;
}
diff --git a/composite/compwindow.c b/composite/compwindow.c
index 65f77cf..220e95c 100644
--- a/composite/compwindow.c
+++ b/composite/compwindow.c
@@ -595,12 +595,15 @@ compCopyWindow (WindowPtr pWin, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
    }
    else
    {
+       CompWindowPtr   cw = GetCompWindow (pWin);
+
       ptOldOrg.x -= dx;
       ptOldOrg.y -= dy;
       REGION_TRANSLATE (prgnSrc, prgnSrc,
                         pWin->drawable.x - ptOldOrg.x,
                         pWin->drawable.y - ptOldOrg.y);
-       DamageDamageRegion (&pWin->drawable, prgnSrc);
+       if (pWin->redirectDraw && cw->update == CompositeRedirectAutomatic)
+         DamageDamageRegion (&pWin->drawable, prgnSrc);
    }
    cs->CopyWindow = pScreen->CopyWindow;
    pScreen->CopyWindow = compCopyWindow;
@@ -679,7 +682,8 @@ compSetRedirectBorderClip (WindowPtr pWin, RegionPtr pRegion)
    /*
     * Report that as damaged so it will be redrawn
     */
-    DamageDamageRegion (&pWin->drawable, &damage);
+    if (cw->update == CompositeRedirectAutomatic)
+      DamageDamageRegion (&pWin->drawable, &damage);
    REGION_UNINIT (pScreen, &damage);
    /*
     * Save the new border clip region
diff --git a/config/dbus-core.c b/config/dbus-core.c
index 9cf1530..b349c6e 100644
--- a/config/dbus-core.c
+++ b/config/dbus-core.c
@@ -56,8 +56,9 @@ wakeup_handler(pointer data, int err, pointer read_mask)
    if (info->connection && FD_ISSET(info->fd, (fd_set *) read_mask)) {
        do {
            dbus_connection_read_write_dispatch(info->connection, 0);
-        } while (dbus_connection_get_dispatch_status(info->connection) ==
-                  DBUS_DISPATCH_DATA_REMAINS);
+        } while (info->connection &&
+                 dbus_connection_get_is_connected(info->connection) &&
+                 dbus_connection_get_dispatch_status(info->connection) == DBUS_DISPATCH_DATA_REMAINS);
    }
}

diff --git a/config/dbus.c b/config/dbus.c
index 6fe0618..cef8ed5 100644
--- a/config/dbus.c
+++ b/config/dbus.c
@@ -213,7 +213,7 @@ remove_device(DBusMessage *message, DBusMessage *reply, DBusError *error)
        MALFORMED_MESSAGE_ERROR();
    }

-    dev = LookupDeviceIntRec(deviceid);
+    dixLookupDevice(&dev, deviceid, serverClient, DixDestroyAccess);
    if (!dev) {
        DebugF("[config/dbus] bogus device id %d given\n", deviceid);
        ret = BadMatch;
@@ -396,9 +396,6 @@ err_start:
static void
disconnect_hook(void *data)
{
-    struct connection_info *info = data;
-
-    reset_info(info);
}

#if 0
@@ -440,4 +437,6 @@ void
config_dbus_fini(void)
{
    config_dbus_core_remove_hook(&core_hook);
+    connection_data.busname[0] = '\0';
+    connection_data.busobject[0] = '\0';
}
diff --git a/configure.ac b/configure.ac
index f75fc61..60bb922 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2074,7 +2074,6 @@ hw/xfree86/utils/gtf/Makefile
hw/xfree86/utils/ioport/Makefile
hw/xfree86/utils/kbd_mode/Makefile
hw/xfree86/utils/pcitweak/Makefile
-hw/xfree86/utils/scanpci/Makefile
hw/xfree86/utils/xorgcfg/Makefile
hw/xfree86/utils/xorgconfig/Makefile
hw/dmx/config/Makefile
diff --git a/dix/colormap.c b/dix/colormap.c
index 73b6669..8836737 100644
--- a/dix/colormap.c
+++ b/dix/colormap.c
@@ -1013,6 +1013,7 @@ FakeAllocColor (ColormapPtr pmap, xColorItem *item)
    switch (class) {
    case GrayScale:
    case PseudoColor:
+       temp = 0;
       item->pixel = 0;
       if (FindColor(pmap, pmap->red, entries, &rgb, &temp, PSEUDOMAP,
                     -1, AllComp) == Success) {
diff --git a/dix/devices.c b/dix/devices.c
index f6f3c8e..8a6b0ba 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -533,6 +533,7 @@ CloseDevice(DeviceIntPtr dev)
       xfree(dev->key->curKeySyms.map);
       xfree(dev->key->modifierKeyMap);
       xfree(dev->key);
+        dev->key = NULL;
    }

    if (dev->valuator) {
diff --git a/dix/pixmap.c b/dix/pixmap.c
index c280a3b..9c25b8e 100644
--- a/dix/pixmap.c
+++ b/dix/pixmap.c
@@ -118,7 +118,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
    if (pScreen->totalPixmapSize > ((size_t)-1) - pixDataSize)
       return NullPixmap;

-    pPixmap = (PixmapPtr)xalloc(pScreen->totalPixmapSize + pixDataSize);
+    pPixmap = (PixmapPtr)xcalloc(1, pScreen->totalPixmapSize + pixDataSize);
    if (!pPixmap)
       return NullPixmap;
    ppriv = (DevUnion *)(pPixmap + 1);
diff --git a/dix/window.c b/dix/window.c
index 961c02a..0340165 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -138,8 +138,8 @@ Equipment Corporation.
 *
 ******/

-static unsigned char _back_lsb[4] = {0x88, 0x22, 0x44, 0x11};
-static unsigned char _back_msb[4] = {0x11, 0x44, 0x22, 0x88};
+static unsigned char _back_lsb[4] = {0x00, 0x00, 0x00, 0x00};
+static unsigned char _back_msb[4] = {0x00, 0x00, 0x00, 0x00};

_X_EXPORT int screenIsSaved = SCREEN_SAVER_OFF;

diff --git a/fb/fbblt.c b/fb/fbblt.c
index 837c3a2..1602edd 100644
--- a/fb/fbblt.c
+++ b/fb/fbblt.c
@@ -76,6 +76,11 @@ fbBlt (FbBits   *srcLine,
    }
#endif

+/*
+ * Disable optimization (introduced by ajax) due to a general vesa
+ * driver crash later in memcpy
+*/
+#if 0
    if (alu == GXcopy && pm == FB_ALLONES && !reverse &&
            !(srcX & 7) && !(dstX & 7) && !(width & 7)) {
        int i;
@@ -97,6 +102,7 @@ fbBlt (FbBits   *srcLine,

        return;
    }
+#endif

    FbInitializeMergeRop(alu, pm);
    destInvarient = FbDestInvarientMergeRop();
diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
index ca7dda1..1e7443e 100644
--- a/hw/xfree86/Makefile.am
+++ b/hw/xfree86/Makefile.am
@@ -53,7 +53,7 @@ XORG_LIBS = \
            loader/libloader.a \
            libosandcommon.la \
           rac/librac.a \
-            parser/libxf86config.a \
+            parser/libxf86config.la \
           dixmods/libdixmods.la \
           modes/libxf86modes.a \
           ramdac/libramdac.a \
diff --git a/hw/xfree86/common/Makefile.am b/hw/xfree86/common/Makefile.am
index d15e99a..f5780e7 100644
--- a/hw/xfree86/common/Makefile.am
+++ b/hw/xfree86/common/Makefile.am
@@ -31,7 +31,7 @@ BUILT_SOURCES = xf86DefModeSet.c
AM_LDFLAGS = -r
libcommon_la_SOURCES = xf86Configure.c xf86Bus.c xf86Config.c \
                      xf86Cursor.c xf86cvt.c xf86DGA.c xf86DPMS.c \
-                      xf86DoProbe.c xf86DoScanPci.c xf86Events.c \
+                      xf86DoProbe.c xf86Events.c \
                      xf86Globals.c xf86AutoConfig.c \
                      xf86MiscExt.c xf86Option.c \
                      xf86VidMode.c xf86fbman.c xf86cmap.c \
diff --git a/hw/xfree86/common/extramodes b/hw/xfree86/common/extramodes
index 1d72861..31e22fc 100644
--- a/hw/xfree86/common/extramodes
+++ b/hw/xfree86/common/extramodes
@@ -3,21 +3,162 @@
//
// $XFree86: xc/programs/Xserver/hw/xfree86/etc/extramodes,v 1.5 2002/06/05 19:43:05 dawes Exp $
//
+// NOTE:  Please keep all video modes sorted in order of X res, then Y res for
+//        ease of maintenance and readability.

# 832x624 @ 75Hz (74.55Hz) (fix if the official/Apple spec is different) hsync: 49.725kHz
ModeLine "832x624" 57.284 832  864  928 1152  624  625  628  667 -Hsync -Vsync

+# Disable the 848x480 modes for now.  They're quite rare, and they screw up
+# the autosizing logic.  They're panel modes anyway, and EDID injection
+# should cover that now. - ajax, 2006-07-28
+
+# 848x480 @ 60.00 Hz (GTF) hsync: 29.82 kHz; pclk: 31.49 MHz
+# Modeline "848x480"  31.49  848 864 952 1056  480 481 484 497  -HSync +Vsync
+
+# 848x480 @ 70.00 Hz (GTF) hsync: 35.00 kHz; pclk: 37.52 MHz
+# Modeline "848x480"  37.52  848 872 960 1072  480 481 484 500  -HSync +Vsync
+
+# 848x480 @ 75.00 Hz (GTF) hsync: 37.65 kHz; pclk: 40.96 MHz
+# Modeline "848x480"  40.96  848 880 968 1088  480 481 484 502  -HSync +Vsync
+
+# 848x480 @ 85.00 Hz (GTF) hsync: 42.92 kHz; pclk: 47.39 MHz
+# Modeline "848x480"  47.39  848 888 976 1104  480 481 484 505  -HSync +Vsync
+
# 1152x768 @ 54.8Hz (Titanium PowerBook) hsync: 44.2kHz
ModeLine "1152x768"   64.995 1152 1178 1314 1472  768  771  777  806 +hsync +vsync

+# 1152x864 @ 60.00 Hz (GTF) hsync: 53.70 kHz; pclk: 81.62 MHz
+Modeline "1152x864"  81.62  1152 1216 1336 1520  864 865 868 895  -HSync +Vsync
+
+# 1152x864 @ 70.00 Hz (GTF) hsync: 63.00 kHz; pclk: 96.77 MHz
+Modeline "1152x864"  96.77  1152 1224 1344 1536  864 865 868 900  -HSync +Vsync
+
+# 1152x864 @ 75.00 Hz (GTF) hsync: 67.65 kHz; pclk: 104.99 MHz
+Modeline "1152x864"  104.99  1152 1224 1352 1552  864 865 868 902  -HSync +Vsync
+
+# 1152x864 @ 85.00 Hz (GTF) hsync: 77.10 kHz; pclk: 119.65 MHz
+Modeline "1152x864"  119.65  1152 1224 1352 1552  864 865 868 907  -HSync +Vsync
+
+# 1152x864 @ 85Hz (Red Hat custom modeline)
+ModeLine "1152x864"  121.5 1152 1216 1344 1568    864  865  868  911 +hsync -vsync
+
+# 1152x864 @ 100.00 Hz (GTF) hsync: 91.50 kHz; pclk: 143.47 MHz
+Modeline "1152x864"  143.47  1152 1232 1360 1568  864 865 868 915  -HSync +Vsync
+
+# 1280x720 @ 60.00 Hz (GTF) hsync: 44.76 kHz; pclk: 74.48 MHz
+Modeline "1280x720"  74.48  1280 1336 1472 1664  720 721 724 746  -HSync +Vsync
+
+# 1280x720 @ 70.00 Hz (GTF) hsync: 52.50 kHz; pclk: 89.04 MHz
+Modeline "1280x720"  89.04  1280 1352 1488 1696  720 721 724 750  -HSync +Vsync
+
+# 1280x720 @ 75.00 Hz (GTF) hsync: 56.40 kHz; pclk: 95.65 MHz
+Modeline "1280x720"  95.65  1280 1352 1488 1696  720 721 724 752  -HSync +Vsync
+
+# 1280x720 @ 85.00 Hz (GTF) hsync: 64.26 kHz; pclk: 110.01 MHz
+Modeline "1280x720"  110.01  1280 1360 1496 1712  720 721 724 756  -HSync +Vsync
+
+# 1280x800 @ 60.00 Hz (GTF) hsync: 49.68 kHz; pclk: 83.46 MHz
+Modeline "1280x800"  83.46  1280 1344 1480 1680  800 801 804 828  -HSync +Vsync
+
+# 1280x800 @ 70.00 Hz (GTF) hsync: 58.31 kHz; pclk: 98.89 MHz
+Modeline "1280x800"  98.89  1280 1352 1488 1696  800 801 804 833  -HSync +Vsync
+
+# 1280x800 @ 75.00 Hz (GTF) hsync: 62.62 kHz; pclk: 107.21 MHz
+Modeline "1280x800"  107.21  1280 1360 1496 1712  800 801 804 835  -HSync +Vsync
+
+# 1280x800 @ 85.00 Hz (GTF) hsync: 71.40 kHz; pclk: 123.38 MHz
+Modeline "1280x800"  123.38  1280 1368 1504 1728  800 801 804 840  -HSync +Vsync
+
+# 1280x768 @ 60.00 Hz (GTF) hsync: 47.70 kHz; pclk: 80.14 MHz
+Modeline "1280x768"  80.14  1280 1344 1480 1680  768 769 772 795  -HSync +Vsync
+
+# 1280x768 @ 70.00 Hz (GTF) hsync: 56.00 kHz; pclk: 94.98 MHz
+Modeline "1280x768"  94.98  1280 1352 1488 1696  768 769 772 800  -HSync +Vsync
+
+# 1280x768 @ 75.00 Hz (GTF) hsync: 60.15 kHz; pclk: 102.98 MHz
+Modeline "1280x768"  102.98  1280 1360 1496 1712  768 769 772 802  -HSync +Vsync
+
+# 1280x768 @ 85.00 Hz (GTF) hsync: 68.60 kHz; pclk: 118.53 MHz
+Modeline "1280x768"  118.53  1280 1368 1504 1728  768 769 772 807  -HSync +Vsync
+
+# 1360x768 59.96 Hz (CVT) hsync: 47.37 kHz; pclk: 72.00 MHz
+#Modeline "1360x768"   72.00  1360 1408 1440 1520  768 771 781 790 +hsync -vsync
+
+# 1360x768 59.80 Hz (CVT) hsync: 47.72 kHz; pclk: 84.75 MHz
+#Modeline "1360x768"   84.75  1360 1432 1568 1776  768 771 781 798 -hsync +vsync
+
# 1400x1050 @ 60Hz (VESA GTF) hsync: 65.5kHz
ModeLine "1400x1050" 122.0 1400 1488 1640 1880   1050 1052 1064 1082 +hsync +vsync

+# 1400x1050 @ 70.00 Hz (GTF) hsync: 76.51 kHz; pclk: 145.06 MHz
+Modeline "1400x1050"  145.06  1400 1496 1648 1896  1050 1051 1054 1093  -HSync +Vsync
+
+# 1400x1050 @ 70Hz (Red Hat custom modeline) hsync: 76.8kHz
+ModeLine "1400x1050" 151.0 1400 1464 1656 1960   1050 1051 1054 1100 +hsync +vsync
+
# 1400x1050 @ 75Hz (VESA GTF) hsync: 82.2kHz
ModeLine "1400x1050" 155.8 1400 1464 1784 1912   1050 1052 1064 1090 +hsync +vsync

-# 1600x1024 @ 60Hz (SGI 1600SW) hsync: 64.0kHz
-Modeline "1600x1024" 106.910 1600 1620 1640 1670 1024 1027 1030 1067 -hsync -vsync
+# 1400x1050 @ 85.00 Hz (GTF) hsync: 93.76 kHz; pclk: 179.26 MHz
+Modeline "1400x1050"  179.26  1400 1504 1656 1912  1050 1051 1054 1103  -HSync +Vsync
+
+# 1400x1050 @ 85Hz (Red Hat custom modeline) hsync: 93.2 kHz
+ModeLine "1400x1050" 184.0 1400 1464 1656 1960   1050 1051 1054 1100 +hsync +vsync
+
+# 1440x900 @ 60.00 Hz (CVT) field rate 59.89 Hz; hsync: 55.93 kHz; pclk: 106.50 MHz
+Modeline "1440x900"  106.50  1440 1520 1672 1904  900 903 909 934  -HSync +Vsync
+
+# 1600x1024 for SGI 1600 SW
+ModeLine "1600x1024" 103.125 1600 1600 1656 1664 1024 1024 1029 1030 +Hsync +Vsync
+
+# 1680x1050 59.88 Hz (CVT 1.76MA-R) hsync: 64.67 kHz; pclk: 119.00 MHz
+Modeline "1680x1050"  119.00  1680 1728 1760 1840  1050 1053 1059 1080 +hsync -vsync
+
+# 1680x1050 59.95 Hz (CVT 1.76MA) hsync: 65.29 kHz; pclk: 146.25 MHz
+Modeline "1680x1050"  146.25  1680 1784 1960 2240  1050 1053 1059 1089 -hsync +vsync
+
+# 1680x1050 69.88 Hz (CVT) hsync: 76.58 kHz; pclk: 174.00 MHz
+Modeline "1680x1050"  174.00  1680 1800 1976 2272  1050 1053 1059 1096 -hsync +vsync
+
+# 1680x1050 74.89 Hz (CVT 1.76MA) hsync: 82.31 kHz; pclk: 187.00 MHz
+Modeline "1680x1050"  187.00  1680 1800 1976 2272  1050 1053 1059 1099 -hsync +vsync
+
+# 1680x1050 84.94 Hz (CVT 1.76MA) hsync: 93.86 kHz; pclk: 214.75 MHz
+Modeline "1680x1050"  214.75  1680 1808 1984 2288  1050 1053 1059 1105 -hsync +vsync
+
+# 1920x1080 59.93 Hz (CVT 2.07M9-R) hsync: 66.59 kHz; pclk: 138.50 MHz
+Modeline "1920x1080"  138.50  1920 1968 2000 2080  1080 1083 1088 1111 +hsync -vsync
+
+# 1920x1080 59.96 Hz (CVT 2.07M9) hsync: 67.16 kHz; pclk: 173.00 MHz
+Modeline "1920x1080"  173.00  1920 2048 2248 2576  1080 1083 1088 1120 -hsync +vsync
+
+# 1920x1080 69.92 Hz (CVT) hsync: 78.80 kHz; pclk: 204.25 MHz
+Modeline "1920x1080"  204.25  1920 2056 2256 2592  1080 1083 1088 1127 -hsync +vsync
+
+# 1920x1080 74.91 Hz (CVT 2.07M9) hsync: 84.64 kHz; pclk: 220.75 MHz
+Modeline "1920x1080"  220.75  1920 2064 2264 2608  1080 1083 1088 1130 -hsync +vsync
+
+# 1920x1080 84.88 Hz (CVT 2.07M9) hsync: 96.51 kHz; pclk: 253.25 MHz
+Modeline "1920x1080"  253.25  1920 2064 2272 2624  1080 1083 1088 1137 -hsync +vsync
+
+# 1920x1200 59.95 Hz (CVT 2.30MA-R) hsync: 74.04 kHz; pclk: 154.00 MHz
+Modeline "1920x1200"  154.00  1920 1968 2000 2080  1200 1203 1209 1235 +hsync -vsync
+
+# 1920x1200 @ 60.00 Hz (GTF) hsync: 74.52 kHz; pclk: 193.16 MHz
+Modeline "1920x1200"  193.16  1920 2048 2256 2592  1200 1201 1204 1242  -HSync +Vsync
+
+# 1920x1200 @ 70.00 Hz (GTF) hsync: 87.43 kHz; pclk: 228.02 MHz
+Modeline "1920x1200"  228.02  1920 2056 2264 2608  1200 1201 1204 1249  -HSync +Vsync
+
+# 1920x1200 @ 70Hz (Red Hat custom modeline - bugzilla #53364) hsync: 87.50 KHz
+Modeline "1920x1200" 230.0   1920 1936 2096 2528  1200 1201 1204 1250 -HSync -VSync
+
+# 1920x1200 @ 75.00 Hz (GTF) hsync: 93.97 kHz; pclk: 246.59 MHz
+Modeline "1920x1200"  246.59  1920 2064 2272 2624  1200 1201 1204 1253  -HSync +Vsync
+
+# 1920x1200 @ 85.00 Hz (GTF) hsync: 107.10 kHz; pclk: 282.74 MHz
+Modeline "1920x1200"  282.74  1920 2072 2280 2640  1200 1201 1204 1260  -HSync +Vsync

# 1920x1440 @ 85Hz (VESA GTF) hsync: 128.5kHz
Modeline "1920x1440" 341.35  1920 2072 2288 2656  1440 1441 1444 1512 -hsync +vsync
@@ -31,3 +172,5 @@ Modeline "2048x1536" 340.48  2048 2216 2440 2832  1536 1537 1540 1603 -hsync +vs
# 2048x1536 @ 85Hz (VESA GTF) hsync: 137.0kHz
Modeline "2048x1536" 388.04  2048 2216 2440 2832  1536 1537 1540 1612 -hsync +vsync

+# 2560x1600 @ 60.00 Hz (GTF) hsync: 99.36 kHz; pclk: 348.16 MHz
+Modeline "2560x1600"  348.16  2560 2752 3032 3504  1600 1601 1604 1656  -HSync +Vsync
diff --git a/hw/xfree86/common/xf86AutoConfig.c b/hw/xfree86/common/xf86AutoConfig.c
index 703d156..2b5968e 100644
--- a/hw/xfree86/common/xf86AutoConfig.c
+++ b/hw/xfree86/common/xf86AutoConfig.c
@@ -48,8 +48,6 @@
       "\tLoad\t\"dbe\"\n" \
       "\tLoad\t\"glx\"\n" \
       "\tLoad\t\"freetype\"\n" \
-       "\tLoad\t\"type1\"\n" \
-       "\tLoad\t\"record\"\n" \
       "\tLoad\t\"dri\"\n" \
       "EndSection\n\n"

@@ -99,9 +97,7 @@
static const char **builtinConfig = NULL;
static int builtinLines = 0;
static const char *deviceList[] = {
-       "fbdev",
       "vesa",
-       "vga",
       NULL
};

@@ -168,7 +164,7 @@ videoPtrToDriverName(pciVideoPtr info)
    {
       case 0x1022:
               if (info->chipType == 0x2081)
-                       return "amd";
+                       return "geode";
               else
                       return NULL;
       case 0x1142:                return "apm";
@@ -208,7 +204,7 @@ videoPtrToDriverName(pciVideoPtr info)
       case 0x3d3d:                return "glint";
       case 0x1023:                return "trident";
       case 0x100c:                return "tseng";
-       case 0x1106:                return "via";
+       case 0x1106:                return "openchrome";
       case 0x15ad:                return "vmware";
       default: break;
    }
diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
index 3c29497..01aca5b 100644
--- a/hw/xfree86/common/xf86Config.c
+++ b/hw/xfree86/common/xf86Config.c
@@ -800,7 +800,7 @@ static OptionInfoRec FlagOptions[] = {
  { FLAG_MODINDEVALLOWNONLOCAL,        "AllowNonLocalModInDev",        OPTV_BOOLEAN,
       {0}, FALSE },
  { FLAG_ALLOWMOUSEOPENFAIL,   "AllowMouseOpenFail",           OPTV_BOOLEAN,
-       {0}, FALSE },
+       {0}, TRUE },
  { FLAG_VTINIT,               "VTInit",                       OPTV_STRING,
       {0}, FALSE },
  { FLAG_VTSYSREQ,             "VTSysReq",                     OPTV_BOOLEAN,
@@ -834,7 +834,7 @@ static OptionInfoRec FlagOptions[] = {
  { FLAG_ESTIMATE_SIZES_AGGRESSIVELY,"EstimateSizesAggressively",OPTV_INTEGER,
       {0}, FALSE },
  { FLAG_NOPM,                 "NoPM",                         OPTV_BOOLEAN,
-       {0}, FALSE },
+       {0}, TRUE },
  { FLAG_XINERAMA,             "Xinerama",                     OPTV_BOOLEAN,
       {0}, FALSE },
  { FLAG_ALLOW_DEACTIVATE_GRABS,"AllowDeactivateGrabs",                OPTV_BOOLEAN,
@@ -852,13 +852,13 @@ static OptionInfoRec FlagOptions[] = {
  { FLAG_AIGLX,                        "AIGLX",                        OPTV_BOOLEAN,
       {0}, FALSE },
  { FLAG_ALLOW_EMPTY_INPUT,     "AllowEmptyInput",              OPTV_BOOLEAN,
-        {0}, FALSE },
+        {0}, TRUE },
  { FLAG_IGNORE_ABI,                   "IgnoreABI",                    OPTV_BOOLEAN,
       {0}, FALSE },
  { FLAG_USE_DEFAULT_FONT_PATH,  "UseDefaultFontPath",                 OPTV_BOOLEAN,
       {0}, FALSE },
  { FLAG_AUTO_ADD_DEVICES,       "AutoAddDevices",                      OPTV_BOOLEAN,
-        {0}, TRUE },
+        {0}, FALSE },
  { FLAG_AUTO_ENABLE_DEVICES,    "AutoEnableDevices",                   OPTV_BOOLEAN,
        {0}, TRUE },
  { -1,                                NULL,                           OPTV_NONE,
@@ -930,7 +930,7 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
        from = X_CONFIG;
    }
    else {
-        xf86Info.autoAddDevices = TRUE;
+        xf86Info.autoAddDevices = FALSE;
        from = X_DEFAULT;
    }
    xf86Msg(from, "%sutomatically adding devices\n",
@@ -967,6 +967,7 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
       xf86Info.miscModInDevAllowNonLocal = value;
#endif

+    xf86Info.allowMouseOpenFail = TRUE;
    if (xf86GetOptValBool(FlagOptions, FLAG_ALLOWMOUSEOPENFAIL, &value))
       xf86Info.allowMouseOpenFail = value;

@@ -1005,7 +1006,7 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
    if (xf86IsOptionSet(FlagOptions, FLAG_PCIFORCENONE))
       xf86Info.pciFlags = PCIForceNone;

-    xf86Info.pmFlag = TRUE;
+    xf86Info.pmFlag = FALSE;
    if (xf86GetOptValBool(FlagOptions, FLAG_NOPM, &value))
       xf86Info.pmFlag = !value;
    {
@@ -1074,16 +1075,16 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
    else
       xf86Info.estimateSizesAggressively = 0;

-    xf86Info.aiglx = TRUE;
+    xf86Info.aiglx = FALSE;
    xf86Info.aiglxFrom = X_DEFAULT;
    if (xf86GetOptValBool(FlagOptions, FLAG_AIGLX, &value)) {
       xf86Info.aiglx = value;
       xf86Info.aiglxFrom = X_CONFIG;
    }

-    xf86Info.allowEmptyInput = FALSE;
+    xf86Info.allowEmptyInput = TRUE;
    if (xf86GetOptValBool(FlagOptions, FLAG_ALLOW_EMPTY_INPUT, &value))
-        xf86Info.allowEmptyInput = TRUE;
+        xf86Info.allowEmptyInput = value;

    xf86Info.useDefaultFontPath = TRUE;
    xf86Info.useDefaultFontPathFrom = X_DEFAULT;
diff --git a/hw/xfree86/common/xf86Config.h b/hw/xfree86/common/xf86Config.h
index 7fc161d..5225641 100644
--- a/hw/xfree86/common/xf86Config.h
+++ b/hw/xfree86/common/xf86Config.h
@@ -59,8 +59,6 @@ static ModuleDefault ModuleDefaults[] = {
    {.name = "dbe",      .toLoad = TRUE,    .load_opt=NULL},
    {.name = "glx",      .toLoad = TRUE,    .load_opt=NULL},
    {.name = "freetype", .toLoad = TRUE,    .load_opt=NULL},
-    {.name = "type1",    .toLoad = TRUE,    .load_opt=NULL},
-    {.name = "record",   .toLoad = TRUE,    .load_opt=NULL},
    {.name = "dri",      .toLoad = TRUE,    .load_opt=NULL},
    {.name = NULL,       .toLoad = FALSE,   .load_opt=NULL}
};
diff --git a/hw/xfree86/common/xf86Globals.c b/hw/xfree86/common/xf86Globals.c
index b41fe6e..9541ac5 100644
--- a/hw/xfree86/common/xf86Globals.c
+++ b/hw/xfree86/common/xf86Globals.c
@@ -127,7 +127,7 @@ xf86InfoRec xf86Info = {
#if defined(i386) || defined(__i386__)
       FALSE,          /* pc98 */
#endif
-       TRUE,           /* pmFlag */
+       FALSE,          /* pmFlag */
       LogNone,        /* syncLog */
       0,              /* estimateSizesAggressively */
       FALSE,          /* kbdCustomKeycodes */
diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
index 4636af4..0d2b9c6 100644
--- a/hw/xfree86/common/xf86Helper.c
+++ b/hw/xfree86/common/xf86Helper.c
@@ -1399,7 +1399,7 @@ xf86ErrorF(const char *format, ...)
void
xf86LogInit()
{
-    char *lf;
+    char *lf = NULL;

#define LOGSUFFIX ".log"
#define LOGOLDSUFFIX ".old"
@@ -1423,6 +1423,8 @@ xf86LogInit()

#undef LOGSUFFIX
#undef LOGOLDSUFFIX
+
+    free(lf);
}

void
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 0c9cbd4..26013a7 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -1474,10 +1474,6 @@ ddxProcessArgument(int argc, char **argv, int i)
    return 1;
  }
#endif
-  if (!strcmp(argv[i], "-scanpci"))
-  {
-    DoScanPci(argc, argv, i);
-  }
  if (!strcmp(argv[i], "-probe"))
  {
    xf86DoProbe = TRUE;
@@ -1539,7 +1535,6 @@ ddxUseMsg()
  ErrorF("-config file           specify a configuration file, relative to the\n");
  ErrorF("                       "__XCONFIGFILE__" search path, only root can use absolute\n");
  ErrorF("-probeonly             probe for devices, then exit\n");
-  ErrorF("-scanpci               execute the scanpci module and exit\n");
  ErrorF("-verbose [n]           verbose startup messages\n");
  ErrorF("-logverbose [n]        verbose log messages\n");
  ErrorF("-quiet                 minimal startup messages\n");
@@ -1593,7 +1588,7 @@ ddxUseMsg()
static void
xf86PrintBanner()
{
-#if PRE_RELEASE
+#if 0
  ErrorF("\n"
    "This is a pre-release version of the X server from " XVENDORNAME ".\n"
    "It is not supported in any way.\n"
diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index ca2be5c..c67ba18 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -134,6 +134,11 @@ xf86ProcessCommonOptions(LocalDevicePtr local,

    /* Backwards compatibility. */
    local->history_size = GetMotionHistorySize();
+    /* Preallocate xEvent store */
+    if (!xf86Events)
+        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
+    if (!xf86Events)
+        FatalError("Couldn't allocate event store\n");
}

/***********************************************************************
@@ -462,6 +467,8 @@ DeleteInputDeviceRequest(DeviceIntPtr pDev)
 * convenient functions to post events
 */

+#define MAX_VALUATORS 36 /* XXX from comment in dix/getevents.c */
+
_X_EXPORT void
xf86PostMotionEvent(DeviceIntPtr       device,
                    int                        is_absolute,
@@ -471,17 +478,12 @@ xf86PostMotionEvent(DeviceIntPtr  device,
{
    va_list var;
    int i = 0;
-    static int *valuators = NULL;
-    static int n_valuators = 0;
-
-    if (num_valuators > n_valuators) {
-       xfree (valuators);
-       valuators = NULL;
-    }
+    static int valuators[MAX_VALUATORS];

-    if (!valuators) {
-       valuators = xcalloc(sizeof(int), num_valuators);
-       n_valuators = num_valuators;
+    if (num_valuators > MAX_VALUATORS) {
+       xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+           " is greater than MAX_VALUATORS\n", num_valuators);
+       return;
    }

    va_start(var, num_valuators);
@@ -506,6 +508,12 @@ xf86PostMotionEventP(DeviceIntPtr  device,
    int index;
    int flags = 0;

+    if (num_valuators > MAX_VALUATORS) {
+       xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+           " is greater than MAX_VALUATORS\n", num_valuators);
+       return;
+    }
+
    if (is_absolute)
        flags = POINTER_ABSOLUTE;
    else
@@ -530,9 +538,7 @@ xf86PostMotionEventP(DeviceIntPtr   device,
#endif

    if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");

    nevents = GetPointerEvents(xf86Events, device, MotionNotify, 0,
                               flags, first_valuator, num_valuators,
@@ -556,9 +562,15 @@ xf86PostProximityEvent(DeviceIntPtr        device,
                       ...)
{
    va_list var;
-    int i, nevents, *valuators = NULL;
+    int i, nevents;
+    int valuators[MAX_VALUATORS];

-    valuators = xcalloc(sizeof(int), num_valuators);
+
+    if (num_valuators > MAX_VALUATORS) {
+       xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+           " is greater than MAX_VALUATORS\n", num_valuators);
+       return;
+    }

    va_start(var, num_valuators);
    for (i = 0; i < num_valuators; i++)
@@ -566,9 +578,7 @@ xf86PostProximityEvent(DeviceIntPtr device,
    va_end(var);

    if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");

    nevents = GetProximityEvents(xf86Events, device,
                                 is_in ? ProximityIn : ProximityOut,
@@ -576,7 +586,6 @@ xf86PostProximityEvent(DeviceIntPtr device,
    for (i = 0; i < nevents; i++)
        mieqEnqueue(device, xf86Events + i);

-    xfree(valuators);
}

_X_EXPORT void
@@ -589,7 +598,7 @@ xf86PostButtonEvent(DeviceIntPtr    device,
                    ...)
{
    va_list var;
-    int *valuators = NULL;
+    int valuators[MAX_VALUATORS];
    int i = 0, nevents = 0;
    int index;

@@ -600,18 +609,19 @@ xf86PostButtonEvent(DeviceIntPtr  device,
            return;
    }
#endif
+    if (num_valuators > MAX_VALUATORS) {
+       xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+           " is greater than MAX_VALUATORS\n", num_valuators);
+       return;
+    }

-    valuators = xcalloc(sizeof(int), num_valuators);
-
    va_start(var, num_valuators);
    for (i = 0; i < num_valuators; i++)
        valuators[i] = va_arg(var, int);
    va_end(var);

    if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");

    nevents = GetPointerEvents(xf86Events, device,
                               is_down ? ButtonPress : ButtonRelease, button,
@@ -621,8 +631,6 @@ xf86PostButtonEvent(DeviceIntPtr    device,

    for (i = 0; i < nevents; i++)
        mieqEnqueue(device, xf86Events + i);
-
-    xfree(valuators);
}

_X_EXPORT void
@@ -635,20 +643,24 @@ xf86PostKeyEvent(DeviceIntPtr     device,
                 ...)
{
    va_list var;
-    int i = 0, nevents = 0, *valuators = NULL;
+    int i = 0, nevents = 0;
+    static int valuators[MAX_VALUATORS];

    /* instil confidence in the user */
    DebugF("this function has never been tested properly.  if things go quite "
           "badly south after this message, then xf86PostKeyEvent is "
           "broken.\n");

+    if (num_valuators > MAX_VALUATORS) {
+       xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+           " is greater than MAX_VALUATORS\n", num_valuators);
+       return;
+    }
+
    if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");

    if (is_absolute) {
-        valuators = xcalloc(sizeof(int), num_valuators);
        va_start(var, num_valuators);
        for (i = 0; i < num_valuators; i++)
            valuators[i] = va_arg(var, int);
@@ -658,7 +670,6 @@ xf86PostKeyEvent(DeviceIntPtr       device,
                                            is_down ? KeyPress : KeyRelease,
                                            key_code, first_valuator,
                                            num_valuators, valuators);
-        xfree(valuators);
    }
    else {
        nevents = GetKeyboardEvents(xf86Events, device,
@@ -687,9 +698,7 @@ xf86PostKeyboardEvent(DeviceIntPtr      device,
#endif

    if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");

    nevents = GetKeyboardEvents(xf86Events, device,
                                is_down ? KeyPress : KeyRelease, key_code);
diff --git a/hw/xfree86/common/xf86str.h b/hw/xfree86/common/xf86str.h
index 086d2bf..31b6343 100644
--- a/hw/xfree86/common/xf86str.h
+++ b/hw/xfree86/common/xf86str.h
@@ -132,6 +132,7 @@ typedef enum {
# define M_T_DEFAULT 0x10      /* (VESA) default modes */
# define M_T_USERDEF 0x20      /* One of the modes from the config file */
# define M_T_DRIVER  0x40      /* Supplied by the driver (EDID, etc) */
+# define M_T_USERPREF 0x80     /* mode preferred by the user config */

/* Video mode */
typedef struct _DisplayModeRec {
diff --git a/hw/xfree86/dixmods/Makefile.am b/hw/xfree86/dixmods/Makefile.am
index 06e6d40..6645b69 100644
--- a/hw/xfree86/dixmods/Makefile.am
+++ b/hw/xfree86/dixmods/Makefile.am
@@ -40,8 +40,7 @@ extsmodule_LTLIBRARIES = librecord.la \
                         $(XTRAPMOD)

fontsmoduledir = $(moduledir)/fonts
-fontsmodule_LTLIBRARIES = libfreetype.la \
-                          libtype1.la
+fontsmodule_LTLIBRARIES = libfreetype.la

AM_CFLAGS = @XORG_CFLAGS@ @DIX_CFLAGS@
INCLUDES = @XORG_INCS@ \
@@ -104,9 +103,6 @@ libshadow_la_SOURCES = shmodule.c
libfreetype_la_LDFLAGS = -avoid-version
libfreetype_la_SOURCES = ftmodule.c

-libtype1_la_LDFLAGS = -avoid-version
-libtype1_la_SOURCES = type1mod.c
-
libdixmods_la_SOURCES = $(top_srcdir)/mi/miinitext.c
libdixmods_la_CFLAGS = -DXFree86LOADER $(AM_CFLAGS)

diff --git a/hw/xfree86/dixmods/extmod/xf86misc.c b/hw/xfree86/dixmods/extmod/xf86misc.c
index 3a6f83e..65b00d8 100644
--- a/hw/xfree86/dixmods/extmod/xf86misc.c
+++ b/hw/xfree86/dixmods/extmod/xf86misc.c
@@ -262,6 +262,7 @@ ProcXF86MiscGetMouseSettings(client)
    char *devname;
    pointer mouse;
    register int n;
+    int devnamelen;

    DEBUG_P("XF86MiscGetMouseSettings");

@@ -281,7 +282,7 @@ ProcXF86MiscGetMouseSettings(client)
    rep.emulate3timeout = MiscExtGetMouseValue(mouse, MISC_MSE_EM3TIMEOUT);
    rep.chordmiddle =    MiscExtGetMouseValue(mouse, MISC_MSE_CHORDMIDDLE);
    rep.flags =                  MiscExtGetMouseValue(mouse, MISC_MSE_FLAGS);
-    rep.devnamelen = (devname? strlen(devname): 0);
+    devnamelen = rep.devnamelen = (devname? strlen(devname): 0);
    rep.length = (sizeof(xXF86MiscGetMouseSettingsReply) -
                 sizeof(xGenericReply) + ((rep.devnamelen+3) & ~3)) >> 2;

@@ -301,8 +302,8 @@ ProcXF86MiscGetMouseSettings(client)
    WriteToClient(client, SIZEOF(xXF86MiscGetMouseSettingsReply), (char *)&rep);
    MiscExtDestroyStruct(mouse, MISC_POINTER);

-    if (rep.devnamelen)
-        WriteToClient(client, rep.devnamelen, devname);
+    if (devnamelen)
+        WriteToClient(client, devnamelen, devname);
    return (client->noClientException);
}

@@ -520,6 +521,7 @@ ProcXF86MiscGetFilePaths(client)
    const char *modulepath;
    const char *logfile;
    register int n;
+    int configlen, modulelen, loglen;

    DEBUG_P("XF86MiscGetFilePaths");

@@ -530,9 +532,9 @@ ProcXF86MiscGetFilePaths(client)
    if (!MiscExtGetFilePaths(&configfile, &modulepath, &logfile))
       return BadValue;

-    rep.configlen = (configfile? strlen(configfile): 0);
-    rep.modulelen = (modulepath? strlen(modulepath): 0);
-    rep.loglen = (logfile? strlen(logfile): 0);
+    configlen = rep.configlen = (configfile? strlen(configfile): 0);
+    modulelen = rep.modulelen = (modulepath? strlen(modulepath): 0);
+    loglen = rep.loglen = (logfile? strlen(logfile): 0);
    rep.length = (SIZEOF(xXF86MiscGetFilePathsReply) - SIZEOF(xGenericReply) +
                 ((rep.configlen + 3) & ~3) +
                 ((rep.modulelen + 3) & ~3) +
@@ -547,12 +549,12 @@ ProcXF86MiscGetFilePaths(client)
    }
    WriteToClient(client, SIZEOF(xXF86MiscGetFilePathsReply), (char *)&rep);

-    if (rep.configlen)
-        WriteToClient(client, rep.configlen, (char *)configfile);
-    if (rep.modulelen)
-        WriteToClient(client, rep.modulelen, (char *)modulepath);
-    if (rep.loglen)
-        WriteToClient(client, rep.loglen, (char *)logfile);
+    if (configlen)
+        WriteToClient(client, configlen, (char *)configfile);
+    if (modulelen)
+        WriteToClient(client, modulelen, (char *)modulepath);
+    if (loglen)
+        WriteToClient(client, loglen, (char *)logfile);

    return (client->noClientException);
}
@@ -565,6 +567,7 @@ ProcXF86MiscPassMessage(client)
    char *msgtype, *msgval, *retstr;
    int retval, size;
    register int n;
+    int mesglen;

    REQUEST(xXF86MiscPassMessageReq);

@@ -601,7 +604,7 @@ ProcXF86MiscPassMessage(client)

    rep.type = X_Reply;
    rep.sequenceNumber = client->sequence;
-    rep.mesglen = (retstr? strlen(retstr): 0);
+    mesglen = rep.mesglen = (retstr? strlen(retstr): 0);
    rep.length = (SIZEOF(xXF86MiscPassMessageReply) - SIZEOF(xGenericReply) +
                 ((rep.mesglen + 3) & ~3)) >> 2;
    rep.status = 0;
@@ -613,8 +616,8 @@ ProcXF86MiscPassMessage(client)
    }
    WriteToClient(client, SIZEOF(xXF86MiscPassMessageReply), (char *)&rep);

-    if (rep.mesglen)
-        WriteToClient(client, rep.mesglen, (char *)retstr);
+    if (mesglen)
+        WriteToClient(client, mesglen, (char *)retstr);

    xfree(msgtype);
    xfree(msgval);
diff --git a/hw/xfree86/doc/man/xorg.conf.man.pre b/hw/xfree86/doc/man/xorg.conf.man.pre
index 3ff5776..1038dcc 100644
--- a/hw/xfree86/doc/man/xorg.conf.man.pre
+++ b/hw/xfree86/doc/man/xorg.conf.man.pre
@@ -484,7 +484,7 @@ Default: off.
.BI "Option \*qAllowMouseOpenFail\*q  \*q" boolean \*q
This allows the server to start up even if the mouse device can't be
opened/initialised.
-Default: false.
+Default: true.
.TP 7
.BI "Option \*qVTInit\*q  \*q" command \*q
Runs
@@ -610,7 +610,7 @@ Default: 0.
.TP 7
.BI "Option \*qNoPM\*q  \*q" boolean \*q
Disables something to do with power management events.
-Default: PM enabled on platforms that support it.
+Default: PM disabled on platforms that support it.
.TP 7
.BI "Option \*qXinerama\*q  \*q" boolean \*q
enable or disable XINERAMA extension.
@@ -662,7 +662,7 @@ action and, if found, use XKEYBOARD for processing actions, otherwise
the builtin handler will be used.
.TP 7
.BI "Option \*qAIGLX\*q \*q" boolean \*q
-enable or disable AIGLX. AIGLX is enabled by default.
+enable or disable AIGLX. AIGLX is disabled by default.
.TP 7
.BI "Option \*qUseDefaultFontPath\*q \*q" boolean \*q
Include the default font path even if other paths are specified in
@@ -672,6 +672,20 @@ default.
.BI "Option \*qIgnoreABI\*q \*q" boolean \*q
Allow modules built for a different, potentially incompatible version of
the X server to load. Disabled by default.
+.TP 7
+.BI "Option \*qAllowEmptyInput\*q \*q" boolean \*q
+If enabled, don't add the standard keyboard and mouse drivers, if there are no
+input devices in the config file.  Enabled by default.
+.TP 7
+.BI "Option \*qAutoAddDevices\*q \*q" boolean \*q
+If this option is disabled, then no devices will be added from HAL events.
+Disabled by default.
+.TP 7
+.BI "Option \*qAutoEnableDevices\*q \*q" boolean \*q
+If this option is disabled, then the devices will be added (and the
+DevicePresenceNotify event sent), but not enabled, thus leaving policy up
+to the client.
+Enabled by default.
.SH "MODULE SECTION"
The
.B Module
@@ -700,10 +714,10 @@ The standard name is case\-sensitive, and does not include the \(lqlib\(rq
prefix, or the \(lq.a\(rq, \(lq.o\(rq, or \(lq.so\(rq suffixes.
.PP
.RS 7
-Example: the Type 1 font rasteriser can be loaded with the following entry:
+Example: the FreeType font rasteriser can be loaded with the following entry:
.PP
.RS 4
-.B "Load \*qtype1\*q"
+.B "Load \*qfreetype\*q"
.RE
.RE
.TP 7
diff --git a/hw/xfree86/int10/helper_exec.c b/hw/xfree86/int10/helper_exec.c
index a12a9a0..58e5116 100644
--- a/hw/xfree86/int10/helper_exec.c
+++ b/hw/xfree86/int10/helper_exec.c
@@ -21,6 +21,8 @@
#define PRINT_PORT 0

#include <unistd.h>
+#include <sys/types.h>
+#include <signal.h>

#include <X11/Xos.h>
#include "xf86.h"
@@ -210,6 +212,72 @@ stack_trace(xf86Int10InfoPtr pInt)
       xf86ErrorFVerb(3, "\n");
}

+enum port_action_e {
+       PORT_ACTION_PERMIT,
+       PORT_ACTION_WARN,
+       PORT_ACTION_BAIL,
+       PORT_ACTION_MAX
+};
+
+static const struct port_range {
+       CARD16 start, end;
+       enum port_action_e access;
+} port_range_table[] = {
+       // NOTE: port ranges are non overlapping and sorted
+       { 0x00, 0x1f, PORT_ACTION_BAIL },       // DMA
+       { 0x20, 0x21, PORT_ACTION_BAIL },       // PIC
+       { 0x40, 0x47, PORT_ACTION_BAIL },       // PIT 1&2
+       { 0x50, 0x53, PORT_ACTION_BAIL },
+       { 0x70, 0x77, PORT_ACTION_BAIL },       // CMOS/RTC
+       { 0x81, 0x8f, PORT_ACTION_BAIL },       // DIAG REGS
+       { 0xa0, 0xa1, PORT_ACTION_BAIL },       // PIC2
+       { 0xc0, 0xdf, PORT_ACTION_BAIL },       // DMA
+};
+#define ARRAY_SIZE(X) (sizeof((X)) / (sizeof(*(X))))
+#define ARRAY_END(X)  (&((X)[ARRAY_SIZE(X)]))
+
+static void assert_port_access_allowed (CARD16 port, CARD16 width)
+{
+       CARD16 access_start, access_end;
+       const struct port_range *pr, *pr_start, *pr_end;
+
+       access_start = port;
+       access_end = port + width - 1;
+
+       // TODO: if the list gets too long we should do a binary search
+       //        or convert the port list to a bitmap representation
+       pr_start = port_range_table;
+       pr_end   = ARRAY_END(port_range_table);
+
+       for (pr = pr_start; pr < pr_end; pr++) {
+               if (access_end < pr->start)
+                       continue;
+               if (access_start > pr->end)
+                       break;
+
+               // we are in the pr range now
+               switch (pr->access) {
+               default:
+                       continue;
+               case PORT_ACTION_BAIL:
+               case PORT_ACTION_WARN:
+                       break;
+               }
+
+               ErrorF("Emulator asked to make a suspect %saccess to "
+                               "port %u (0x%04x)%s\n",
+                               (width == 1) ? "byte " :
+                               (width == 2) ? "word " :
+                               (width == 4) ? "long " : "",
+                               port, port,
+                               (pr->access == PORT_ACTION_BAIL)
+                               ? "; terminating." : "ignoring.");
+
+               if (pr->access == PORT_ACTION_BAIL)
+                       kill(getpid(), SIGSEGV);
+       }
+}
+
int
port_rep_inb(xf86Int10InfoPtr pInt,
            CARD16 port, CARD32 base, int d_f, CARD32 count)
@@ -328,6 +396,8 @@ x_inb(CARD16 port)
       }
#endif /* __NOT_YET__ */
    } else if (!pciCfg1inb(port, &val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       val = inb(Int10Current->ioBase + port);
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" inb(%#x) = %2.2x\n", port, val);
@@ -350,6 +420,8 @@ x_inw(CARD16 port)
       X_GETTIMEOFDAY(&tv);
       val = (CARD16)(tv.tv_usec / 3);
    } else if (!pciCfg1inw(port, &val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       val = inw(Int10Current->ioBase + port);
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" inw(%#x) = %4.4x\n", port, val);
@@ -382,6 +454,8 @@ x_outb(CARD16 port, CARD8 val)
       }
#endif /* __NOT_YET__ */
    } else if (!pciCfg1outb(port, val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" outb(%#x, %2.2x)\n", port, val);
       outb(Int10Current->ioBase + port, val);
@@ -393,6 +467,8 @@ x_outw(CARD16 port, CARD16 val)
{

    if (!pciCfg1outw(port, val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" outw(%#x, %4.4x)\n", port, val);
       outw(Int10Current->ioBase + port, val);
@@ -405,6 +481,8 @@ x_inl(CARD16 port)
    CARD32 val;

    if (!pciCfg1in(port, &val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       val = inl(Int10Current->ioBase + port);
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" inl(%#x) = %8.8x\n", port, val);
@@ -416,6 +494,8 @@ void
x_outl(CARD16 port, CARD32 val)
{
    if (!pciCfg1out(port, val)) {
+       assert_port_access_allowed (port, sizeof(val));
+
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" outl(%#x, %8.8x)\n", port, val);
       outl(Int10Current->ioBase + port, val);
@@ -460,7 +540,8 @@ Mem_wl(CARD32 addr, CARD32 val)

static CARD32 PciCfg1Addr = 0;

-#define OFFSET(Cfg1Addr) (Cfg1Addr & 0xff)
+#define PCI_OFFSET(x) ((x) & 0x000000ff)
+#define PCI_TAG(x)    ((x) & 0x00ffff00)

static int
pciCfg1in(CARD16 addr, CARD32 *val)
@@ -470,7 +551,7 @@ pciCfg1in(CARD16 addr, CARD32 *val)
       return 1;
    }
    if (addr == 0xCFC) {
-       *val = pciReadLong(Int10Current->Tag, OFFSET(PciCfg1Addr));
+       *val = pciReadLong(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr));
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_inl(%#x) = %8.8x\n", PciCfg1Addr, *val);
       return 1;
@@ -488,7 +569,7 @@ pciCfg1out(CARD16 addr, CARD32 val)
    if (addr == 0xCFC) {
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_outl(%#x, %8.8x)\n", PciCfg1Addr, val);
-       pciWriteLong(Int10Current->Tag, OFFSET(PciCfg1Addr), val);
+       pciWriteLong(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr), val);
       return 1;
    }
    return 0;
@@ -506,7 +587,7 @@ pciCfg1inw(CARD16 addr, CARD16 *val)
    }
    if ((addr >= 0xCFC) && (addr <= 0xCFF)) {
       offset = addr - 0xCFC;
-       *val = pciReadWord(Int10Current->Tag, OFFSET(PciCfg1Addr) + offset);
+       *val = pciReadWord(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr) + offset);
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_inw(%#x) = %4.4x\n", PciCfg1Addr + offset, *val);
       return 1;
@@ -529,7 +610,7 @@ pciCfg1outw(CARD16 addr, CARD16 val)
       offset = addr - 0xCFC;
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_outw(%#x, %4.4x)\n", PciCfg1Addr + offset, val);
-       pciWriteWord(Int10Current->Tag, OFFSET(PciCfg1Addr) + offset, val);
+       pciWriteWord(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr) + offset, val);
       return 1;
    }
    return 0;
@@ -547,7 +628,7 @@ pciCfg1inb(CARD16 addr, CARD8 *val)
    }
    if ((addr >= 0xCFC) && (addr <= 0xCFF)) {
       offset = addr - 0xCFC;
-       *val = pciReadByte(Int10Current->Tag, OFFSET(PciCfg1Addr) + offset);
+       *val = pciReadByte(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr) + offset);
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_inb(%#x) = %2.2x\n", PciCfg1Addr + offset, *val);
       return 1;
@@ -570,7 +651,7 @@ pciCfg1outb(CARD16 addr, CARD8 val)
       offset = addr - 0xCFC;
       if (PRINT_PORT && DEBUG_IO_TRACE())
           ErrorF(" cfg_outb(%#x, %2.2x)\n", PciCfg1Addr + offset, val);
-       pciWriteByte(Int10Current->Tag, OFFSET(PciCfg1Addr) + offset, val);
+       pciWriteByte(PCI_TAG(PciCfg1Addr), PCI_OFFSET(PciCfg1Addr) + offset, val);
       return 1;
    }
    return 0;
diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
index 1b5c717..ee43a09 100644
--- a/hw/xfree86/loader/loadmod.c
+++ b/hw/xfree86/loader/loadmod.c
@@ -177,6 +177,7 @@ InitPathList(const char *path)
    }
    if (list)
       list[n] = NULL;
+    xfree(fullpath);
    return list;
}

@@ -864,7 +865,7 @@ doLoadModule(const char *module, const char *path, const char **subdirlist,
    for (cim = compiled_in_modules; *cim; cim++)
       if (!strcmp (module, *cim))
       {
-           xf86MsgVerb(X_INFO, 0, "Module \"%s\" already built-in\n", module);
+           xf86MsgVerb(X_INFO, 3, "Module \"%s\" already built-in\n", module);
           return (ModuleDescPtr) 1;
       }

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index d375da8..da4f83f 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -36,6 +36,7 @@
#include "xf86DDC.h"
#include "xf86Crtc.h"
#include "xf86Modes.h"
+#include "xf86Priv.h"
#include "xf86RandR12.h"
#include "X11/extensions/render.h"
#define DPMS_SERVER
@@ -259,6 +260,30 @@ xf86CrtcSetMode (xf86CrtcPtr crtc, DisplayModePtr mode, Rotation rotation,
    crtc->y = y;
    crtc->rotation = rotation;

+    /* Shift offsets that move us out of virtual size */
+    if (x + mode->HDisplay > xf86_config->maxWidth ||
+       y + mode->VDisplay > xf86_config->maxHeight)
+    {
+       if (x + mode->HDisplay > xf86_config->maxWidth)
+           crtc->x = xf86_config->maxWidth - mode->HDisplay;
+       if (y + mode->VDisplay > xf86_config->maxHeight)
+           crtc->y = xf86_config->maxHeight - mode->VDisplay;
+       if (crtc->x < 0 || crtc->y < 0)
+       {
+           xf86DrvMsg (scrn->scrnIndex, X_ERROR,
+                       "Mode %dx%d does not fit virtual size %dx%d - "
+                       "internal error\n", mode->HDisplay, mode->VDisplay,
+                       xf86_config->maxWidth, xf86_config->maxHeight);
+           goto done;
+       }
+       xf86DrvMsg (scrn->scrnIndex, X_ERROR,
+                   "Mode %dx%d+%d+%d does not fit virtual size %dx%d - "
+                   "offset updated to +%d+%d\n",
+                   mode->HDisplay, mode->VDisplay, x, y,
+                   xf86_config->maxWidth, xf86_config->maxHeight,
+                   crtc->x, crtc->y);
+    }
+
    /* XXX short-circuit changes to base location only */

    /* Pass our mode to the outputs and the CRTC to give them a chance to
@@ -300,7 +325,7 @@ xf86CrtcSetMode (xf86CrtcPtr crtc, DisplayModePtr mode, Rotation rotation,
    /* Set up the DPLL and any output state that needs to adjust or depend
     * on the DPLL.
     */
-    crtc->funcs->mode_set(crtc, mode, adjusted_mode, x, y);
+    crtc->funcs->mode_set(crtc, mode, adjusted_mode, crtc->x, crtc->y);
    for (i = 0; i < xf86_config->num_output; i++)
    {
       xf86OutputPtr output = xf86_config->output[i];
@@ -704,14 +729,15 @@ xf86DefaultMode (xf86OutputPtr output, int width, int height)

    mm_height = output->mm_height;
    if (!mm_height)
-       mm_height = 203;        /* 768 pixels at 96dpi */
+       mm_height = (768 * 25.4) / DEFAULT_DPI;
    /*
-     * Pick a mode closest to 96dpi
+     * Pick a mode closest to DEFAULT_DPI
     */
    for (mode = output->probed_modes; mode; mode = mode->next)
    {
       int         dpi;
-       int         preferred = (mode->type & M_T_PREFERRED) != 0;
+       int         preferred = (((mode->type & M_T_PREFERRED) != 0) +
+                                ((mode->type & M_T_USERPREF) != 0));
       int         diff;

       if (xf86ModeWidth (mode, output->initial_rotation) > width ||
@@ -720,7 +746,7 @@ xf86DefaultMode (xf86OutputPtr output, int width, int height)

       /* yes, use VDisplay here, not xf86ModeHeight */
       dpi = (mode->VDisplay * 254) / (mm_height * 10);
-       diff = dpi - 96;
+       diff = dpi - DEFAULT_DPI;
       diff = diff < 0 ? -diff : diff;
       if (target_mode == NULL || (preferred > target_preferred) ||
           (preferred == target_preferred && diff < target_diff))
@@ -1053,6 +1079,16 @@ xf86InitialOutputPositions (ScrnInfoPtr scrn, DisplayModePtr *modes)
                   any_set = TRUE;
                   continue;
               }
+               if (!modes[or])
+               {
+                   xf86DrvMsg (scrn->scrnIndex, X_ERROR,
+                               "Cannot position output %s relative to output %s without modes\n",
+                               output->name, relative_name);
+                   output->initial_x = 0;
+                   output->initial_y = 0;
+                   any_set = TRUE;
+                   continue;
+               }
               if (relative->initial_x == POSITION_UNSET)
               {
                   keep_going = TRUE;
@@ -1068,10 +1104,10 @@ xf86InitialOutputPositions (ScrnInfoPtr scrn, DisplayModePtr *modes)
                   output->initial_x += xf86ModeWidth (modes[or], relative->initial_rotation);
                   break;
               case OPTION_ABOVE:
-                   output->initial_y -= xf86ModeHeight (modes[or], relative->initial_rotation);
+                   output->initial_y -= xf86ModeHeight (modes[o], relative->initial_rotation);
                   break;
               case OPTION_LEFT_OF:
-                   output->initial_x -= xf86ModeWidth (modes[or], relative->initial_rotation);
+                   output->initial_x -= xf86ModeWidth (modes[o], relative->initial_rotation);
                   break;
               default:
                   break;
@@ -1214,6 +1250,23 @@ xf86SortModes (DisplayModePtr input)
    return output;
}

+static char *
+preferredMode(ScrnInfoPtr pScrn, xf86OutputPtr output)
+{
+    char *preferred_mode = NULL;
+
+    /* Check for a configured preference for a particular mode */
+    preferred_mode = xf86GetOptValString (output->options,
+                                         OPTION_PREFERRED_MODE);
+    if (preferred_mode)
+       return preferred_mode;
+
+    if (pScrn->display->modes && *pScrn->display->modes)
+       preferred_mode = *pScrn->display->modes;
+
+    return preferred_mode;
+}
+
_X_EXPORT void
xf86ProbeOutputModes (ScrnInfoPtr scrn, int maxX, int maxY)
{
@@ -1395,8 +1448,7 @@ xf86ProbeOutputModes (ScrnInfoPtr scrn, int maxX, int maxY)
       output->probed_modes = xf86SortModes (output->probed_modes);

       /* Check for a configured preference for a particular mode */
-       preferred_mode = xf86GetOptValString (output->options,
-                                             OPTION_PREFERRED_MODE);
+       preferred_mode = preferredMode(scrn, output);

       if (preferred_mode)
       {
@@ -1415,10 +1467,9 @@ xf86ProbeOutputModes (ScrnInfoPtr scrn, int maxX, int maxY)
                       mode->prev = NULL;
                       output->probed_modes = mode;
                   }
-                   mode->type |= M_T_PREFERRED;
+                   mode->type |= (M_T_PREFERRED|M_T_USERPREF);
+                   break;
               }
-               else
-                   mode->type &= ~M_T_PREFERRED;
           }
       }

@@ -1532,6 +1583,7 @@ xf86InitialConfiguration (ScrnInfoPtr scrn, Bool canGrow)
    xf86CrtcConfigPtr  config = XF86_CRTC_CONFIG_PTR(scrn);
    int                        o, c;
    DisplayModePtr     target_mode = NULL;
+    int                        target_preferred = 0;
    Rotation           target_rotation = RR_Rotate_0;
    xf86CrtcPtr                *crtcs;
    DisplayModePtr     *modes;
@@ -1572,43 +1624,34 @@ xf86InitialConfiguration (ScrnInfoPtr scrn, Bool canGrow)
    }

    /*
-     * Let outputs with preferred modes drive screen size
+     * User preferred > preferred > other modes
     */
    for (o = 0; o < config->num_output; o++)
    {
-       xf86OutputPtr output = config->output[o];
+       xf86OutputPtr   output = config->output[o];
+       DisplayModePtr  default_mode;
+       int             default_preferred;

-       if (enabled[o] &&
-           xf86OutputHasPreferredMode (output, width, height))
+       if (!enabled[o])
+           continue;
+       default_mode = xf86DefaultMode (output, width, height);
+       if (!default_mode)
+           continue;
+       default_preferred = (((default_mode->type & M_T_PREFERRED) != 0) +
+                            ((default_mode->type & M_T_USERPREF) != 0));
+       if (default_preferred > target_preferred || !target_mode)
       {
-           target_mode = xf86DefaultMode (output, width, height);
+           target_mode = default_mode;
+           target_preferred = default_preferred;
           target_rotation = output->initial_rotation;
-           if (target_mode)
-           {
-               modes[o] = target_mode;
-               config->compat_output = o;
-               break;
-           }
-       }
-    }
-    if (!target_mode)
-    {
-       for (o = 0; o < config->num_output; o++)
-       {
-           xf86OutputPtr output = config->output[o];
-           if (enabled[o])
-           {
-               target_mode = xf86DefaultMode (output, width, height);
-               target_rotation = output->initial_rotation;
-               if (target_mode)
-               {
-                   modes[o] = target_mode;
-                   config->compat_output = o;
-                   break;
-               }
-           }
+           config->compat_output = o;
       }
    }
+    if (target_mode)
+       modes[config->compat_output] = target_mode;
+    /*
+     * Fill in other output modes
+     */
    for (o = 0; o < config->num_output; o++)
    {
       xf86OutputPtr output = config->output[o];
diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
index 9693e12..4c843cd 100644
--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
@@ -39,6 +39,9 @@
#ifndef M_T_DRIVER
#define M_T_DRIVER     0x40
#endif
+#ifndef M_T_USERPREF
+#define M_T_USERPREF   0x80
+#endif
#ifndef HARDWARE_CURSOR_ARGB
#define HARDWARE_CURSOR_ARGB                           0x00004000
#endif
diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index e2ae665..96d3d67 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -407,8 +407,10 @@ xf86DDCMonitorSet(int scrnIndex, MonPtr Monitor, xf86MonPtr DDC)

    Monitor->DDC = DDC;

-    Monitor->widthmm = 10 * DDC->features.hsize;
-    Monitor->heightmm = 10 * DDC->features.vsize;
+    if (Monitor->widthmm <= 0 && Monitor->heightmm <= 0) {
+       Monitor->widthmm = 10 * DDC->features.hsize;
+       Monitor->heightmm = 10 * DDC->features.vsize;
+    }

    /* If this is a digital display, then we can use reduced blanking */
    if (DDC->features.input_type)
diff --git a/hw/xfree86/modes/xf86RandR12.c b/hw/xfree86/modes/xf86RandR12.c
index 7169f74..5b8c639 100644
--- a/hw/xfree86/modes/xf86RandR12.c
+++ b/hw/xfree86/modes/xf86RandR12.c
@@ -450,10 +450,10 @@ xf86RandR12CreateScreenResources (ScreenPtr pScreen)
           else
           {
               /*
-                * Otherwise, just set the screen to 96dpi
+                * Otherwise, just set the screen to DEFAULT_DPI
                */
-               mmWidth = width * 25.4 / 96;
-               mmHeight = height * 25.4 / 96;
+               mmWidth = width * 25.4 / DEFAULT_DPI;
+               mmHeight = height * 25.4 / DEFAULT_DPI;
           }
       }
       xf86DrvMsg(pScrn->scrnIndex, X_INFO,
@@ -683,11 +683,8 @@ xf86RandRModeConvert (ScrnInfoPtr  scrn,
                     RRModePtr         randr_mode,
                     DisplayModePtr    mode)
{
-    mode->prev = NULL;
-    mode->next = NULL;
-    mode->name = NULL;
+    memset(mode, 0, sizeof(DisplayModeRec));
    mode->status = MODE_OK;
-    mode->type = 0;

    mode->Clock = randr_mode->mode.dotClock / 1000;

diff --git a/hw/xfree86/modes/xf86Rotate.c b/hw/xfree86/modes/xf86Rotate.c
index dd0e659..e2d6295 100644
--- a/hw/xfree86/modes/xf86Rotate.c
+++ b/hw/xfree86/modes/xf86Rotate.c
@@ -494,7 +494,8 @@ xf86CrtcRotate (xf86CrtcPtr crtc, DisplayModePtr mode, Rotation rotation)
{
    ScrnInfoPtr                pScrn = crtc->scrn;
    xf86CrtcConfigPtr   xf86_config = XF86_CRTC_CONFIG_PTR(pScrn);
-    ScreenPtr          pScreen = pScrn->pScreen;
+    /* if this is called during ScreenInit() we don't have pScrn->pScreen yet */
+    ScreenPtr          pScreen = screenInfo.screens[pScrn->scrnIndex];
    PictTransform      crtc_to_fb, fb_to_crtc;

    PictureTransformIdentity (&crtc_to_fb);
diff --git a/hw/xfree86/os-support/linux/lnx_acpi.c b/hw/xfree86/os-support/linux/lnx_acpi.c
index 024e6ef..898678e 100644
--- a/hw/xfree86/os-support/linux/lnx_acpi.c
+++ b/hw/xfree86/os-support/linux/lnx_acpi.c
@@ -69,9 +69,11 @@ lnxACPIGetEventFromOs(int fd, pmEvent *events, int num)
       TimerSet(NULL, 0, ACPI_REOPEN_DELAY, lnxACPIReopen, NULL);
       return 0;
    }
+    /* FIXME: this only processes the first read ACPI event & might break
+     * with interrupted reads. */

    /* Check that we have a video event */
-    if (strstr(ev, "video") == ev) {
+    if (!strncmp(ev, "video", 5)) {
       char *video = NULL;
       char *GFX = NULL;
       char *notify = NULL;
@@ -97,26 +99,19 @@ lnxACPIGetEventFromOs(int fd, pmEvent *events, int num)
       ErrorF("data: 0x%lx\n",data_l);
#endif

-       /* We currently don't differentiate between any event */
+       /* Differentiate between events */
       switch (notify_l) {
               case ACPI_VIDEO_NOTIFY_SWITCH:
-                       break;
-               case ACPI_VIDEO_NOTIFY_PROBE:
-                       break;
               case ACPI_VIDEO_NOTIFY_CYCLE:
-                       break;
               case ACPI_VIDEO_NOTIFY_NEXT_OUTPUT:
-                       break;
               case ACPI_VIDEO_NOTIFY_PREV_OUTPUT:
-                       break;
+                   events[0] = XF86_APM_CAPABILITY_CHANGED;
+                   return 1;
+               case ACPI_VIDEO_NOTIFY_PROBE:
+                   return 0;
               default:
-                       break;
+                   return 0;
       }
-
-       /* Deal with all ACPI events as a capability change */
-        events[0] = XF86_APM_CAPABILITY_CHANGED;
-
-       return 1;
    }

    return 0;
diff --git a/hw/xfree86/os-support/linux/lnx_video.c b/hw/xfree86/os-support/linux/lnx_video.c
index b3494a7..410ae0d 100644
--- a/hw/xfree86/os-support/linux/lnx_video.c
+++ b/hw/xfree86/os-support/linux/lnx_video.c
@@ -142,17 +142,8 @@ mtrr_open(int verbosity)
       /* Only report absence of /proc/mtrr once. */
       static Bool warned = FALSE;

-       char **fn;
-       static char *mtrr_files[] = {
-               "/dev/cpu/mtrr",        /* Possible future name */
-               "/proc/mtrr",           /* Current name */
-               NULL
-       };
-
       if (mtrr_fd == MTRR_FD_UNOPENED) {
-               /* So open it. */
-               for (fn = mtrr_files; mtrr_fd < 0 && *fn; fn++)
-                       mtrr_fd = open(*fn, O_WRONLY);
+               mtrr_fd = open("/proc/mtrr", O_WRONLY);

               if (mtrr_fd < 0)
                       mtrr_fd = MTRR_FD_PROBLEM;
diff --git a/hw/xfree86/parser/Makefile.am b/hw/xfree86/parser/Makefile.am
index 849ee8b..9786711 100644
--- a/hw/xfree86/parser/Makefile.am
+++ b/hw/xfree86/parser/Makefile.am
@@ -1,13 +1,11 @@
-if INSTALL_LIBXF86CONFIG
-lib_LIBRARIES = libxf86config.a
+lib_LTLIBRARIES = libxf86config.la
LIBHEADERS = \
       xf86Optrec.h \
       xf86Parser.h
-else
-noinst_LIBRARIES = libxf86config.a
-endif

-libxf86config_a_SOURCES = \
+libxf86config_la_LDFLAGS = -version-number 6:9:99
+libxf86config_la_LIBADD = $(XF86CONFIG_LIBS) -lm
+libxf86config_la_SOURCES = \
       Device.c \
       Files.c \
       Flags.c \
@@ -23,7 +21,8 @@ libxf86config_a_SOURCES = \
       scan.c \
       write.c \
       DRI.c \
-       Extensions.c
+       Extensions.c \
+       error.c

AM_CFLAGS = $(DIX_CFLAGS) $(XORG_CFLAGS)

@@ -35,7 +34,5 @@ EXTRA_DIST = \
       xf86tokens.h \
       cpconfig.c

-sdk_HEADERS = \
-       $(LIBHEADERS) \
-       xf86Parser.h \
-       xf86Optrec.h
+xf86configincludedir=$(includedir)/xorg
+xf86configinclude_HEADERS = $(LIBHEADERS)
diff --git a/hw/xfree86/parser/Module.c b/hw/xfree86/parser/Module.c
index 2012ce6..b62bf62 100644
--- a/hw/xfree86/parser/Module.c
+++ b/hw/xfree86/parser/Module.c
@@ -225,6 +225,19 @@ xf86printModuleSection (FILE * cf, XF86ConfModulePtr ptr)
#endif
               }
       }
+       for (lptr = ptr->mod_disable_lst; lptr; lptr = lptr->list.next)
+       {
+               switch (lptr->load_type)
+               {
+               case XF86_DISABLE_MODULE:
+                       fprintf (cf, "\tDisable  \"%s\"", lptr->load_name);
+                               if (lptr->load_comment)
+                                       fprintf(cf, "%s", lptr->load_comment);
+                               else
+                                       fputc('\n', cf);
+                       break;
+               }
+       }
}

XF86LoadPtr
diff --git a/hw/xfree86/parser/Monitor.c b/hw/xfree86/parser/Monitor.c
index 4bff4b2..9d53312 100644
--- a/hw/xfree86/parser/Monitor.c
+++ b/hw/xfree86/parser/Monitor.c
@@ -688,8 +688,6 @@ xf86printMonitorSection (FILE * cf, XF86ConfMonitorPtr ptr)
                       fprintf (cf, "\tDisplaySize  %d\t%d\n",
                                        ptr->mon_width,
                                        ptr->mon_height);
-               if ( ptr->mon_n_hsync || ptr->mon_n_vrefresh )
-                   fprintf(cf," ### Comment all HorizSync and VertRefresh values to use DDC:\n");
               for (i = 0; i < ptr->mon_n_hsync; i++)
               {
                       fprintf (cf, "\tHorizSync    %2.1f - %2.1f\n",
diff --git a/hw/xfree86/parser/cpconfig.c b/hw/xfree86/parser/cpconfig.c
index 46a5a8b..d284ecd 100644
--- a/hw/xfree86/parser/cpconfig.c
+++ b/hw/xfree86/parser/cpconfig.c
@@ -102,21 +102,3 @@ main (int argc, char *argv[])
       }
       exit(0);
}
-
-/* Functions that the parser requires */
-
-_X_EXPORT void
-VErrorF(const char *f, va_list args)
-{
-       vfprintf(stderr, f, args);
-}
-
-_X_EXPORT void
-ErrorF(const char *f, ...)
-{
-       va_list args;
-
-       va_start(args, f);
-       vfprintf(stderr, f, args);
-       va_end(args);
-}
diff --git a/hw/xfree86/parser/error.c b/hw/xfree86/parser/error.c
new file mode 100644
index 0000000..b00b380
--- /dev/null
+++ b/hw/xfree86/parser/error.c
@@ -0,0 +1,20 @@
+#include <stdio.h>
+#include <stdarg.h>
+#include "xf86Parser.h"
+
+/* Functions that the parser requires */
+
+void
+VErrorF(const char *f, va_list args)
+{
+        vfprintf(stderr, f, args);
+}
+
+void
+ErrorF(const char *f, ...)
+{
+        va_list args;
+        va_start(args, f);
+        vfprintf(stderr, f, args);
+        va_end(args);
+}
diff --git a/hw/xfree86/scanpci/Makefile.am b/hw/xfree86/scanpci/Makefile.am
index d4d9da2..81e2a4b 100644
--- a/hw/xfree86/scanpci/Makefile.am
+++ b/hw/xfree86/scanpci/Makefile.am
@@ -1,10 +1,8 @@
-module_LTLIBRARIES = libscanpci.la libpcidata.la
+module_LTLIBRARIES = libpcidata.la

libpcidata_la_LDFLAGS = -avoid-version
-libscanpci_la_LDFLAGS = -avoid-version

libpcidata_la_SOURCES = xf86PciData.c
-libscanpci_la_SOURCES = xf86ScanPci.c

INCLUDES = $(XORG_INCS)

diff --git a/hw/xfree86/utils/Makefile.am b/hw/xfree86/utils/Makefile.am
index 38f90b4..5516715 100644
--- a/hw/xfree86/utils/Makefile.am
+++ b/hw/xfree86/utils/Makefile.am
@@ -4,6 +4,5 @@ SUBDIRS = \
       ioport \
       kbd_mode \
       pcitweak \
-       scanpci \
       xorgcfg \
       xorgconfig
diff --git a/hw/xfree86/utils/xorgcfg/Makefile.am b/hw/xfree86/utils/xorgcfg/Makefile.am
index 309ed5c..f0e3e61 100644
--- a/hw/xfree86/utils/xorgcfg/Makefile.am
+++ b/hw/xfree86/utils/xorgcfg/Makefile.am
@@ -31,12 +31,12 @@ bin_PROGRAMS = xorgcfg

INCLUDES = $(XORG_INCS) -I$(top_srcdir)/hw/xfree86/parser

-OPTIONSPATH=$(libdir)/X11
+OPTIONSPATH=$(libdir)/X11

xorgcfg_CFLAGS = $(XORG_CFLAGS) $(CURSESDEFINES) \
       $(XORGCFG_DEP_CFLAGS) -DXKB_RULES_DIR=\"$(XKB_BASE_DIRECTORY)/rules\" \
       -DPROJECT_ROOT=\"$(PROJECTROOT)\" -DOPTIONSPATH=\"$(OPTIONSPATH)\"
-xorgcfg_LDADD = $(XORGCFG_DEP_LIBS) ../../parser/libxf86config.a $(LOADERLIB) \
+xorgcfg_LDADD = $(XORGCFG_DEP_LIBS) ../../parser/libxf86config.la $(LOADERLIB) \
       ../../os-support/libxorgos.la ../../dummylib/libdummy-nonserver.a \
       ${SYS_LIBS}

diff --git a/hw/xfree86/vbe/vbe.c b/hw/xfree86/vbe/vbe.c
index 06559bb..8af1727 100644
--- a/hw/xfree86/vbe/vbe.c
+++ b/hw/xfree86/vbe/vbe.c
@@ -1019,7 +1019,7 @@ VBEGetPixelClock(vbeInfoPtr pVbe, int mode, int clock)
    /*
    Input:
       AX := 4F0Bh VBE Get Pixel Clock
-       BL := 01h Get Pixel Clock
+       BL := 00h Get Pixel Clock
       ECX := pixel clock in units of Hz
        DX := mode number

@@ -1030,7 +1030,7 @@ VBEGetPixelClock(vbeInfoPtr pVbe, int mode, int clock)

    pVbe->pInt10->num = 0x10;
    pVbe->pInt10->ax = 0x4f0b;
-    pVbe->pInt10->bx = 0x01;
+    pVbe->pInt10->bx = 0x00;
    pVbe->pInt10->cx = clock;
    pVbe->pInt10->dx = mode;
    xf86ExecX86int10(pVbe->pInt10);
diff --git a/hw/xfree86/x86emu/ops2.c b/hw/xfree86/x86emu/ops2.c
index 8c6c535..324de8a 100644
--- a/hw/xfree86/x86emu/ops2.c
+++ b/hw/xfree86/x86emu/ops2.c
@@ -328,6 +328,20 @@ static void x86emuOp2_pop_FS(u8 X86EMU_UNUSED(op2))
}

/****************************************************************************
+REMARKS: CPUID takes EAX/ECX as inputs, writes EAX/EBX/ECX/EDX as output
+Handles opcode 0x0f,0xa2
+****************************************************************************/
+static void x86emuOp2_cpuid(u8 X86EMU_UNUSED(op2))
+{
+    START_OF_INSTR();
+    DECODE_PRINTF("CPUID\n");
+    TRACE_AND_STEP();
+    cpuid();
+    DECODE_CLEAR_SEGOVR();
+    END_OF_INSTR();
+}
+
+/****************************************************************************
REMARKS:
Handles opcode 0x0f,0xa3
****************************************************************************/
@@ -2734,7 +2748,7 @@ void (*x86emu_optab2[256])(u8) =

/*  0xa0 */ x86emuOp2_push_FS,
/*  0xa1 */ x86emuOp2_pop_FS,
-/*  0xa2 */ x86emuOp2_illegal_op,
+/*  0xa2 */ x86emuOp2_cpuid,
/*  0xa3 */ x86emuOp2_bt_R,
/*  0xa4 */ x86emuOp2_shld_IMM,
/*  0xa5 */ x86emuOp2_shld_CL,
diff --git a/hw/xfree86/x86emu/prim_ops.c b/hw/xfree86/x86emu/prim_ops.c
index b9e7257..b42cdc0 100644
--- a/hw/xfree86/x86emu/prim_ops.c
+++ b/hw/xfree86/x86emu/prim_ops.c
@@ -102,6 +102,12 @@
#define        PRIM_OPS_NO_REDEFINE_ASM
#include "x86emu/x86emui.h"

+#if defined(__GNUC__)
+# if defined (__i386__) || defined(__i386) || defined(__AMD64__) || defined(__x86_64__) || defined(__amd64__)
+#  include "x86emu/prim_x86_gcc.h"
+# endif
+#endif
+
/*------------------------- Global Variables ------------------------------*/

static u32 x86emu_parity_tab[8] =
@@ -2654,3 +2660,63 @@ DB(      if (CHECK_SP_ACCESS())
    return res;
}

+/****************************************************************************
+REMARKS:
+CPUID takes EAX/ECX as inputs, writes EAX/EBX/ECX/EDX as output
+****************************************************************************/
+void cpuid (void)
+{
+    u32 feature = M.x86.R_EAX;
+
+#ifdef X86EMU_HAS_HW_CPUID
+    /* If the platform allows it, we will base our values on the real
+     * results from the CPUID instruction.  We limit support to the
+     * first two features, and the results of those are sanitized.
+     */
+    if (feature <= 1)
+       hw_cpuid(&M.x86.R_EAX, &M.x86.R_EBX, &M.x86.R_ECX, &M.x86.R_EDX);
+#endif
+
+    switch (feature) {
+    case 0:
+        /* Regardless if we have real data from the hardware, the emulator
+        * will only support upto feature 1, which we set in register EAX.
+        * Registers EBX:EDX:ECX contain a string identifying the CPU.
+        */
+        M.x86.R_EAX = 1;
+#ifndef X86EMU_HAS_HW_CPUID
+        /* EBX:EDX:ECX = "GenuineIntel" */
+        M.x86.R_EBX = 0x756e6547;
+        M.x86.R_EDX = 0x49656e69;
+        M.x86.R_ECX = 0x6c65746e;
+#endif
+        break;
+    case 1:
+#ifndef X86EMU_HAS_HW_CPUID
+        /* If we don't have x86 compatible hardware, we return values from an
+        * Intel 486dx4; which was one of the first processors to have CPUID.
+        */
+        M.x86.R_EAX = 0x00000480;
+        M.x86.R_EBX = 0x00000000;
+        M.x86.R_ECX = 0x00000000;
+        M.x86.R_EDX = 0x00000002;      /* VME */
+#else
+        /* In the case that we have hardware CPUID instruction, we make sure
+        * that the features reported are limited to TSC and VME.
+        */
+        M.x86.R_EDX &= 0x00000012;
+#endif
+        break;
+    default:
+        /* Finally, we don't support any additional features.  Most CPUs
+        * return all zeros when queried for invalid or unsupported feature
+        * numbers.
+        */
+        M.x86.R_EAX = 0;
+        M.x86.R_EBX = 0;
+        M.x86.R_ECX = 0;
+        M.x86.R_EDX = 0;
+        break;
+    }
+}
+
diff --git a/hw/xfree86/x86emu/x86emu/prim_ops.h b/hw/xfree86/x86emu/x86emu/prim_ops.h
index bea8357..6ac2a29 100644
--- a/hw/xfree86/x86emu/x86emu/prim_ops.h
+++ b/hw/xfree86/x86emu/x86emu/prim_ops.h
@@ -133,6 +133,7 @@ void    push_word (u16 w);
void    push_long (u32 w);
u16     pop_word (void);
u32            pop_long (void);
+void    cpuid (void);

#ifdef  __cplusplus
}                                              /* End of "C" linkage for C++           */
diff --git a/hw/xfree86/x86emu/x86emu/prim_x86_gcc.h b/hw/xfree86/x86emu/x86emu/prim_x86_gcc.h
new file mode 100644
index 0000000..af61e20
--- /dev/null
+++ b/hw/xfree86/x86emu/x86emu/prim_x86_gcc.h
@@ -0,0 +1,79 @@
+/****************************************************************************
+*
+* Inline helpers for x86emu
+*
+* Copyright (C) 2008 Bart Trojanowski, Symbio Technologies, LLC
+*
+*  ========================================================================
+*
+*  Permission to use, copy, modify, distribute, and sell this software and
+*  its documentation for any purpose is hereby granted without fee,
+*  provided that the above copyright notice appear in all copies and that
+*  both that copyright notice and this permission notice appear in
+*  supporting documentation, and that the name of the authors not be used
+*  in advertising or publicity pertaining to distribution of the software
+*  without specific, written prior permission.  The authors makes no
+*  representations about the suitability of this software for any purpose.
+*  It is provided "as is" without express or implied warranty.
+*
+*  THE AUTHORS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+*  INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+*  EVENT SHALL THE AUTHORS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+*  CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
+*  USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+*  OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+*  PERFORMANCE OF THIS SOFTWARE.
+*
+*  ========================================================================
+*
+* Language:     GNU C
+* Environment:  GCC on i386 or x86-64
+* Developer:    Bart Trojanowski
+*
+* Description:  This file defines a few x86 macros that can be used by the
+*               emulator to execute native instructions.
+*
+*               For PIC vs non-PIC code refer to:
+*               http://sam.zoy.org/blog/2007-04-13-shlib-with-non-pic-code-have-inline-assembly-and-pic-mix-well
+*
+****************************************************************************/
+#ifndef __X86EMU_PRIM_X86_GCC_H
+#define __X86EMU_PRIM_X86_GCC_H
+
+#include "x86emu/types.h"
+
+#if !defined(__GNUC__) || !(defined (__i386__) || defined(__i386) || defined(__AMD64__) || defined(__x86_64__) || defined(__amd64__))
+#error This file is intended to be used by gcc on i386 or x86-64 system
+#endif
+
+#if defined(__PIC__) && defined(__i386__)
+
+#define X86EMU_HAS_HW_CPUID 1
+static inline void hw_cpuid (u32 *a, u32 *b, u32 *c, u32 *d)
+{
+    __asm__ __volatile__ ("pushl %%ebx      \n\t"
+                          "cpuid            \n\t"
+                          "movl %%ebx, %1   \n\t"
+                          "popl %%ebx       \n\t"
+                          : "=a" (*a), "=r" (*b),
+                            "=c" (*c), "=d" (*d)
+                          : "a" (*a), "c" (*c)
+                          : "cc");
+}
+
+#else // ! (__PIC__ && __i386__)
+
+#define x86EMU_HAS_HW_CPUID 1
+static inline void hw_cpuid (u32 *a, u32 *b, u32 *c, u32 *d)
+{
+    __asm__ __volatile__ ("cpuid"
+                          : "=a" (*a), "=b" (*b),
+                            "=c" (*c), "=d" (*d)
+                          : "a" (*a), "c" (*c)
+                          : "cc");
+}
+
+#endif // __PIC__ && __i386__
+
+
+#endif // __X86EMU_PRIM_X86_GCC_H
diff --git a/hw/xfree86/xaa/xaaInit.c b/hw/xfree86/xaa/xaaInit.c
index 529dbd1..7b45ade 100644
--- a/hw/xfree86/xaa/xaaInit.c
+++ b/hw/xfree86/xaa/xaaInit.c
@@ -92,6 +92,30 @@ XAADestroyInfoRec(XAAInfoRecPtr infoRec)
    xfree(infoRec);
}

+void
+XAAEvictPixmaps(void)
+{
+    XAAScreenPtr pScreenPriv;
+    XAAInfoRecPtr infoRec;
+    ScreenPtr pScreen;
+    int i;
+
+    xf86MsgVerb(X_INFO, 3, "XAA: Evicting pixmaps\n");
+
+    for (i = 0; i < screenInfo.numScreens; i++) {
+       pScreen = screenInfo.screens[i];
+       infoRec = GET_XAAINFORECPTR_FROM_SCREEN(pScreen);
+
+       pScreenPriv = pScreen->devPrivates[XAAScreenIndex].ptr;
+       infoRec = pScreenPriv->AccelInfoRec;
+
+       infoRec->offscreenDepths = 0;
+       infoRec->Flags &= ~OFFSCREEN_PIXMAPS;
+
+       XAAMoveOutOffscreenPixmaps(pScreen);
+       XAAInvalidatePixmapCache(pScreen);
+    }
+}

Bool
XAAInit(ScreenPtr pScreen, XAAInfoRecPtr infoRec)
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index db5007e..43cfb29 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -150,7 +150,8 @@ RRCrtcNotify (RRCrtcPtr         crtc,
               break;
       if (i == numOutputs)
       {
-           crtc->outputs[j]->crtc = NULL;
+           if (crtc->outputs[j]->crtc == crtc)
+               crtc->outputs[j]->crtc = NULL;
           RROutputChanged (crtc->outputs[j], FALSE);
           RRCrtcChanged (crtc, FALSE);
       }
diff --git a/render/glyph.c b/render/glyph.c
index 42ae65d..a2e1074 100644
--- a/render/glyph.c
+++ b/render/glyph.c
@@ -449,7 +449,7 @@ FindGlyphRef (GlyphHashPtr hash, CARD32 signature, Bool match, GlyphPtr compare)
       }
       else if (s == signature &&
                (!match ||
-                 memcmp (&compare->info, &glyph->info, compare->size) == 0))
+                 memcmp (&compare->info, &glyph->info, glyph->size < compare->size ? glyph->size : compare->size) == 0))
       {
           break;
       }
diff --git a/render/miindex.c b/render/miindex.c
index 0e12dca..4e0cf00 100644
--- a/render/miindex.c
+++ b/render/miindex.c
@@ -147,6 +147,7 @@ miBuildRenderColormap (ColormapPtr  pColormap, Pixel *pixels, int *nump)
       for (g = 0; g < cube; g++)
           for (b = 0; b < cube; b++)
           {
+               pixel = 0;
               red = (r * 65535 + (cube-1)/2) / (cube - 1);
               green = (g * 65535 + (cube-1)/2) / (cube - 1);
               blue = (b * 65535 + (cube-1)/2) / (cube - 1);
@@ -157,6 +158,7 @@ miBuildRenderColormap (ColormapPtr  pColormap, Pixel *pixels, int *nump)
           }
    for (g = 0; g < gray; g++)
    {
+       pixel = 0;
       red = green = blue = (g * 65535 + (gray-1)/2) / (gray - 1);
       if (AllocColor (pColormap, &red, &green, &blue, &pixel, 0) != Success)
           return FALSE;
diff --git a/render/picture.c b/render/picture.c
index 5ddd68c..01cf5d5 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -68,9 +68,11 @@ AllocatePicturePrivateIndex (void)
Bool
AllocatePicturePrivate (ScreenPtr pScreen, int index2, unsigned int amount)
{
-    PictureScreenPtr   ps = GetPictureScreen(pScreen);
+    PictureScreenPtr   ps = GetPictureScreenIfSet(pScreen);
    unsigned int       oldamount;

+    if (!ps) return TRUE;
+
    /* Round up sizes for proper alignment */
    amount = ((amount + (sizeof(long) - 1)) / sizeof(long)) * sizeof(long);

diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index ce4df4c..0ecef6f 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -1784,6 +1784,7 @@ XkbCopyKeymap(XkbDescPtr src, XkbDescPtr dst, Bool sendNotifies)
                        return FALSE;
                    dsection->rows = tmp;
                }
+                dsection->num_rows = ssection->num_rows;
                for (j = 0, srow = ssection->rows, drow = dsection->rows;
                     j < ssection->num_rows;
                     j++, srow++, drow++) {