diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec
index 1054223..ecf934e 100644
--- a/xorg-x11-server.spec
+++ b/xorg-x11-server.spec
@@ -9,7 +9,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.2.99.905
-Release:   2%{?dist}
+Release:   3%{?dist}
 URL:       http://www.x.org
 License:   MIT/X11
 Group:     User Interface/X
@@ -29,6 +29,7 @@ Patch12:   xorg-x11-server-1.1.1-graphics-expose.patch
 Patch15:   xorg-x11-server-1.1.1-automake-1.10-fixes.patch
 Patch18:   xorg-x11-server-1.1.1-glcore-visual-matching.patch
 Patch19:   xserver-1.3.0-xnest-exposures.patch
+Patch20:   xserver-1.3.0-x86emu-imul-int64.patch
 
 # OpenGL compositing manager feature/optimization patches.
 Patch100:  xorg-x11-server-1.1.0-no-move-damage.patch
@@ -61,6 +62,7 @@ Patch2500:  xorg-x11-server-1.2.99-unbreak-domain.patch
 Patch2501:  xserver-1.3.0-pci-bus-count.patch
 Patch2502:  xserver-1.3.0-mmap-failure-check.patch
 Patch2503:  xserver-1.3.0-rom-search.patch
+Patch2504:  xserver-1.3.0-domain-obiwan.patch
 
 %define moduledir	%{_libdir}/xorg/modules
 %define drimoduledir	%{_libdir}/dri
@@ -261,6 +263,7 @@ Xserver source code needed to build VNC server (Xvnc)
 %patch15 -p1 -b .automake-1.10
 %patch18 -p1 -b .glcore-visual
 %patch19 -p1 -b .xnest-expose
+%patch20 -p1 -b .x86emu-imul
 
 %patch100 -p0 -b .no-move-damage
 %patch101 -p0 -b .dont-backfill-bg-none
@@ -289,6 +292,7 @@ Xserver source code needed to build VNC server (Xvnc)
 %patch2501 -p1 -b .pci-bus-count
 %patch2502 -p1 -b .mmap-check
 %patch2503 -p1 -b .rom-search
+%patch2504 -p1 -b .domain-obiwan
 
 %build
 
@@ -547,6 +551,10 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Tue Apr 10 2007 Adam Jackson <ajax@redhat.com> 1.2.99.905-3
+- xserver-1.3.0-domain-obiwan.patch: Fix a PCI domain off-by-one. (#235861)
+- xserver-1.3.0-x86emu-imul-int64.patch: Fix imul in x86emu. (#235861)
+
 * Mon Apr 09 2007 Adam Jackson <ajax@redhat.com> 1.2.99.905-2
 - xserver-1.3.0-pci-bus-count.patch: Allocate the PCI bus array dynamically,
   so as not to run off the end of it.
diff --git a/xserver-1.3.0-domain-obiwan.patch b/xserver-1.3.0-domain-obiwan.patch
new file mode 100644
index 0000000..f74c226
--- /dev/null
+++ b/xserver-1.3.0-domain-obiwan.patch
@@ -0,0 +1,19 @@
+commit 1b94c117e0f294ef2f89bf24d45ba7a8e45efe35
+Author: Matthias Hopf <mhopf@suse.de>
+Date:   Tue Oct 10 19:37:22 2006 +0200
+
+    Fixing probably long-standing bug in domain support.
+
+diff --git a/hw/xfree86/os-support/bus/linuxPci.c b/hw/xfree86/os-support/bus/linuxPci.c
+index c6dad1f..7d220d0 100644
+--- a/hw/xfree86/os-support/bus/linuxPci.c
++++ b/hw/xfree86/os-support/bus/linuxPci.c
+@@ -498,7 +498,7 @@ xf86GetPciDomain(PCITAG Tag)
+     pPCI = xf86GetPciHostConfigFromTag(Tag);
+ 
+     if (pPCI && (result = PCI_DOM_FROM_BUS(pPCI->busnum)))
+-	return result;
++	return result + 1;
+ 
+     if (!pPCI || pPCI->fakeDevice)
+ 	return 1;		/* Domain 0 is reserved */
diff --git a/xserver-1.3.0-x86emu-imul-int64.patch b/xserver-1.3.0-x86emu-imul-int64.patch
new file mode 100644
index 0000000..7cdb3c4
--- /dev/null
+++ b/xserver-1.3.0-x86emu-imul-int64.patch
@@ -0,0 +1,28 @@
+commit 2fe74ef339c3a4902ae8214f5a0454662895422c
+Author: Matthias Hopf <mhopf@suse.de>
+Date:   Thu Mar 15 16:56:01 2007 +0100
+
+    Fix calculations in x86 emulator for the long long case (Andreas Schwab).
+
+diff --git a/hw/xfree86/x86emu/prim_ops.c b/hw/xfree86/x86emu/prim_ops.c
+index 461e09e..b9e7257 100644
+--- a/hw/xfree86/x86emu/prim_ops.c
++++ b/hw/xfree86/x86emu/prim_ops.c
+@@ -2082,7 +2082,7 @@ Implements the IMUL instruction and side effects.
+ void imul_long_direct(u32 *res_lo, u32* res_hi,u32 d, u32 s)
+ {
+ #ifdef	__HAS_LONG_LONG__
+-	s64 res = (s32)d * (s32)s;
++	s64 res = (s64)(s32)d * (s32)s;
+ 
+ 	*res_lo = (u32)res;
+ 	*res_hi = (u32)(res >> 32);
+@@ -2174,7 +2174,7 @@ Implements the MUL instruction and side effects.
+ void mul_long(u32 s)
+ {
+ #ifdef	__HAS_LONG_LONG__
+-	u64 res = (u32)M.x86.R_EAX * (u32)s;
++	u64 res = (u64)M.x86.R_EAX * s;
+ 
+ 	M.x86.R_EAX = (u32)res;
+ 	M.x86.R_EDX = (u32)(res >> 32);