--- /dev/null
+From bd39a274fb7b43374c797bafdb7f506598f36f77 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Wed, 6 Apr 2011 20:40:31 +0200
+Subject: ath: add missing regdomain pair 0x5c mapping
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit bd39a274fb7b43374c797bafdb7f506598f36f77 upstream.
+
+Joe Culler reported a problem with his AR9170 device:
+
+> ath: EEPROM regdomain: 0x5c
+> ath: EEPROM indicates we should expect a direct regpair map
+> ath: invalid regulatory domain/country code 0x5c
+> ath: Invalid EEPROM contents
+
+It turned out that the regdomain 'APL7_FCCA' was not mapped yet.
+According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to
+FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch
+should be correct.
+
+Reported-by: Joe Culler <joe.culler@gmail.com>
+Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDo
+ {APL9_WORLD, CTL_ETSI, CTL_ETSI},
+
+ {APL3_FCCA, CTL_FCC, CTL_FCC},
++ {APL7_FCCA, CTL_FCC, CTL_FCC},
+ {APL1_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_APLD, CTL_FCC, NO_CTL},
--- /dev/null
+From 5882da02e9d9089b7e8c739f3e774aaeeff8b7ba Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 8 Apr 2011 20:13:18 +0200
+Subject: ath9k_hw: fix stopping rx DMA during resets
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 5882da02e9d9089b7e8c739f3e774aaeeff8b7ba upstream.
+
+During PHY errors, the MAC can sometimes fail to enter an idle state on older
+hardware (before AR9380) after an rx stop has been requested.
+
+This typically shows up in the kernel log with messages like these:
+
+ath: Could not stop RX, we could be confusing the DMA engine when we start RX up
+------------[ cut here ]------------
+WARNING: at drivers/net/wireless/ath/ath9k/recv.c:504 ath_stoprecv+0xcc/0xf0 [ath9k]()
+Call Trace:
+[<8023f0e8>] dump_stack+0x8/0x34
+[<80075050>] warn_slowpath_common+0x78/0xa4
+[<80075094>] warn_slowpath_null+0x18/0x24
+[<80d66d60>] ath_stoprecv+0xcc/0xf0 [ath9k]
+[<80d642cc>] ath_set_channel+0xbc/0x270 [ath9k]
+[<80d65254>] ath_radio_disable+0x4a4/0x7fc [ath9k]
+
+When this happens, the state that the MAC enters is easy to identify and
+does not result in bogus DMA traffic, however to ensure a working state
+after a channel change, the hardware should still be reset.
+
+This patch adds detection for this specific MAC state, after which the above
+warnings completely disappear in my tests.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Cc: Kyungwan Nam <Kyungwan.Nam@Atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 9 ---------
+ drivers/net/wireless/ath/ath9k/mac.c | 25 ++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath9k/mac.h | 2 +-
+ drivers/net/wireless/ath/ath9k/recv.c | 6 +++---
+ 4 files changed, 26 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1218,15 +1218,6 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+ ah->txchainmask = common->tx_chainmask;
+ ah->rxchainmask = common->rx_chainmask;
+
+- if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) {
+- ath9k_hw_abortpcurecv(ah);
+- if (!ath9k_hw_stopdmarecv(ah)) {
+- ath_dbg(common, ATH_DBG_XMIT,
+- "Failed to stop receive dma\n");
+- bChannelChange = false;
+- }
+- }
+-
+ if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
+ return -EIO;
+
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -770,28 +770,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw
+ }
+ EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
+
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
+ {
+ #define AH_RX_STOP_DMA_TIMEOUT 10000 /* usec */
+ #define AH_RX_TIME_QUANTUM 100 /* usec */
+ struct ath_common *common = ath9k_hw_common(ah);
++ u32 mac_status, last_mac_status = 0;
+ int i;
+
++ /* Enable access to the DMA observation bus */
++ REG_WRITE(ah, AR_MACMISC,
++ ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
++ (AR_MACMISC_MISC_OBS_BUS_1 <<
++ AR_MACMISC_MISC_OBS_BUS_MSB_S)));
++
+ REG_WRITE(ah, AR_CR, AR_CR_RXD);
+
+ /* Wait for rx enable bit to go low */
+ for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
+ if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
+ break;
++
++ if (!AR_SREV_9300_20_OR_LATER(ah)) {
++ mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0;
++ if (mac_status == 0x1c0 && mac_status == last_mac_status) {
++ *reset = true;
++ break;
++ }
++
++ last_mac_status = mac_status;
++ }
++
+ udelay(AH_TIME_QUANTUM);
+ }
+
+ if (i == 0) {
+ ath_err(common,
+- "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
++ "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
+ AH_RX_STOP_DMA_TIMEOUT / 1000,
+ REG_READ(ah, AR_CR),
+- REG_READ(ah, AR_DIAG_SW));
++ REG_READ(ah, AR_DIAG_SW),
++ REG_READ(ah, AR_DMADBG_7));
+ return false;
+ } else {
+ return true;
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -692,7 +692,7 @@ bool ath9k_hw_setrxabort(struct ath_hw *
+ void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
+ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
+ void ath9k_hw_abortpcurecv(struct ath_hw *ah);
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
+ int ath9k_hw_beaconq_setup(struct ath_hw *ah);
+
+ /* Interrupt Handling */
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -513,12 +513,12 @@ start_recv:
+ bool ath_stoprecv(struct ath_softc *sc)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+- bool stopped;
++ bool stopped, reset = false;
+
+ spin_lock_bh(&sc->rx.rxbuflock);
+ ath9k_hw_abortpcurecv(ah);
+ ath9k_hw_setrxfilter(ah, 0);
+- stopped = ath9k_hw_stopdmarecv(ah);
++ stopped = ath9k_hw_stopdmarecv(ah, &reset);
+
+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+ ath_edma_stop_recv(sc);
+@@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc)
+ "confusing the DMA engine when we start RX up\n");
+ ATH_DBG_WARN_ON_ONCE(!stopped);
+ }
+- return stopped;
++ return stopped || reset;
+ }
+
+ void ath_flushrecv(struct ath_softc *sc)
--- /dev/null
+From ed5302d3c25006a9edc7a7fbea97a30483f89ef7 Mon Sep 17 00:00:00 2001
+From: Liu Yuan <tailai.ly@taobao.com>
+Date: Tue, 19 Apr 2011 13:47:58 +0200
+Subject: block, blk-sysfs: Fix an err return path in blk_register_queue()
+
+From: Liu Yuan <tailai.ly@taobao.com>
+
+commit ed5302d3c25006a9edc7a7fbea97a30483f89ef7 upstream.
+
+We do not call blk_trace_remove_sysfs() in err return path
+if kobject_add() fails. This path fixes it.
+
+Signed-off-by: Liu Yuan <tailai.ly@taobao.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-sysfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -511,8 +511,10 @@ int blk_register_queue(struct gendisk *d
+ return ret;
+
+ ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+- if (ret < 0)
++ if (ret < 0) {
++ blk_trace_remove_sysfs(dev);
+ return ret;
++ }
+
+ kobject_uevent(&q->kobj, KOBJ_ADD);
+
--- /dev/null
+From f6e5b1603b8bb7131b6778d0d4e2e5dda120a379 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 12 Apr 2011 18:06:51 +0100
+Subject: drm/i915: Sanitize the output registers after resume
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit f6e5b1603b8bb7131b6778d0d4e2e5dda120a379 upstream.
+
+Similar to booting, we need to inspect the state left by the BIOS and
+remove any conflicting bits before we take over. The example reported by
+Seth Forshee is very similar to the bug we encountered with the state left
+by grub2, that the crtc pipe<->planning mapping was reversed from our
+expectations and so we failed to turn off the outputs when booting or,
+in this case, resuming. This may be in fact the same bug, but triggered
+at resume time.
+
+This patch rearranges the code we already have to clear up the
+conflicting state upon init and calls it from reset (which is called
+after we have lost control of the hardware, i.e. along both the boot and
+resume paths) instead.
+
+Reported-and-tested-by: Seth Forshee <seth.forshee@canonical.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=35796
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 68 ++++++++++++++++++-----------------
+ 1 file changed, 36 insertions(+), 32 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -5630,36 +5630,6 @@ cleanup_work:
+ return ret;
+ }
+
+-static void intel_crtc_reset(struct drm_crtc *crtc)
+-{
+- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+-
+- /* Reset flags back to the 'unknown' status so that they
+- * will be correctly set on the initial modeset.
+- */
+- intel_crtc->dpms_mode = -1;
+-}
+-
+-static struct drm_crtc_helper_funcs intel_helper_funcs = {
+- .dpms = intel_crtc_dpms,
+- .mode_fixup = intel_crtc_mode_fixup,
+- .mode_set = intel_crtc_mode_set,
+- .mode_set_base = intel_pipe_set_base,
+- .mode_set_base_atomic = intel_pipe_set_base_atomic,
+- .load_lut = intel_crtc_load_lut,
+- .disable = intel_crtc_disable,
+-};
+-
+-static const struct drm_crtc_funcs intel_crtc_funcs = {
+- .reset = intel_crtc_reset,
+- .cursor_set = intel_crtc_cursor_set,
+- .cursor_move = intel_crtc_cursor_move,
+- .gamma_set = intel_crtc_gamma_set,
+- .set_config = drm_crtc_helper_set_config,
+- .destroy = intel_crtc_destroy,
+- .page_flip = intel_crtc_page_flip,
+-};
+-
+ static void intel_sanitize_modesetting(struct drm_device *dev,
+ int pipe, int plane)
+ {
+@@ -5710,6 +5680,42 @@ static void intel_sanitize_modesetting(s
+ }
+ }
+
++static void intel_crtc_reset(struct drm_crtc *crtc)
++{
++ struct drm_device *dev = crtc->dev;
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++
++ /* Reset flags back to the 'unknown' status so that they
++ * will be correctly set on the initial modeset.
++ */
++ intel_crtc->dpms_mode = -1;
++
++ /* We need to fix up any BIOS configuration that conflicts with
++ * our expectations.
++ */
++ intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
++}
++
++static struct drm_crtc_helper_funcs intel_helper_funcs = {
++ .dpms = intel_crtc_dpms,
++ .mode_fixup = intel_crtc_mode_fixup,
++ .mode_set = intel_crtc_mode_set,
++ .mode_set_base = intel_pipe_set_base,
++ .mode_set_base_atomic = intel_pipe_set_base_atomic,
++ .load_lut = intel_crtc_load_lut,
++ .disable = intel_crtc_disable,
++};
++
++static const struct drm_crtc_funcs intel_crtc_funcs = {
++ .reset = intel_crtc_reset,
++ .cursor_set = intel_crtc_cursor_set,
++ .cursor_move = intel_crtc_cursor_move,
++ .gamma_set = intel_crtc_gamma_set,
++ .set_config = drm_crtc_helper_set_config,
++ .destroy = intel_crtc_destroy,
++ .page_flip = intel_crtc_page_flip,
++};
++
+ static void intel_crtc_init(struct drm_device *dev, int pipe)
+ {
+ drm_i915_private_t *dev_priv = dev->dev_private;
+@@ -5759,8 +5765,6 @@ static void intel_crtc_init(struct drm_d
+
+ setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
+ (unsigned long)intel_crtc);
+-
+- intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
+ }
+
+ int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
--- /dev/null
+From d5627663f2088fa4be447fdcfd52bcb233448d85 Mon Sep 17 00:00:00 2001
+From: Mathew McKernan <matmckernan@rauland.com.au>
+Date: Tue, 12 Apr 2011 06:51:37 +0100
+Subject: drm/i915/tv: Remember the detected TV type
+
+From: Mathew McKernan <matmckernan@rauland.com.au>
+
+commit d5627663f2088fa4be447fdcfd52bcb233448d85 upstream.
+
+During detect() we would probe the connection bits to determine if
+there was a TV attached, and what video input type (Component, S-Video,
+Composite, etc) to use. However, we promptly discarded this vital bit of
+information and never propagated it to where it was used to determine
+the correct modes and setup the control registers. Fix it!
+
+This fixes a regression from 7b334fcb45b757ffb093696ca3de1b0c8b4a33f1.
+
+Reported-and-tested-by: Mathew McKernan <matmckernan@rauland.com.au>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=35977
+Signed-off-by: Mathew McKernan <matmckernan@rauland.com.au>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_tv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1380,7 +1380,9 @@ intel_tv_detect(struct drm_connector *co
+ if (type < 0)
+ return connector_status_disconnected;
+
++ intel_tv->type = type;
+ intel_tv_find_better_format(connector);
++
+ return connector_status_connected;
+ }
+
--- /dev/null
+From a18d89ca026140eb8ac4459bf70a01c571dd9a32 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Tue, 19 Apr 2011 23:50:48 +0200
+Subject: drm/nouveau: fix notifier memory corruption bug
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit a18d89ca026140eb8ac4459bf70a01c571dd9a32 upstream.
+
+nouveau_bo_wr32 expects offset to be in words, but we pass value in bytes,
+so after commit 73412c3854c877e5f37ad944ee8977addde4d35a ("drm/nouveau: allocate
+kernel's notifier object at end of block") we started to overwrite some memory
+after notifier buffer object (previously m2mf_ntfy was always 0, so it didn't
+matter it was a value in bytes).
+
+Reported-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Reported-by: Nigel Cunningham <lkml@nigelcunningham.com.au>
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Pekka Paalanen <pq@iki.fi>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
+ OUT_RING (chan, 0);
+ }
+
+- nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
++ nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
+ FIRE_RING(chan);
+ mutex_unlock(&chan->mutex);
+
+ ret = -EBUSY;
+ for (i = 0; i < 100000; i++) {
+- if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
++ if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
+ ret = 0;
+ break;
+ }
--- /dev/null
+From 8e461123f28e6b17456225e70eb834b3b30d28bb Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 14 Apr 2011 11:19:50 -0400
+Subject: drm/radeon/kms: fix bad shift in atom iio table parser
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream.
+
+Noticed by Patrick Lowry.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -135,7 +135,7 @@ static uint32_t atom_iio_execute(struct
+ case ATOM_IIO_MOVE_INDEX:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((index >> CU8(base + 2)) &
+ (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -145,7 +145,7 @@ static uint32_t atom_iio_execute(struct
+ case ATOM_IIO_MOVE_DATA:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((data >> CU8(base + 2)) &
+ (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -155,7 +155,7 @@ static uint32_t atom_iio_execute(struct
+ case ATOM_IIO_MOVE_ATTR:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((ctx->
+ io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
--- /dev/null
+From 5785e53ffa73f77fb19e378c899027afc07272bc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 19 Apr 2011 15:24:59 -0400
+Subject: drm/radeon/kms: pll tweaks for r7xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 5785e53ffa73f77fb19e378c899027afc07272bc upstream.
+
+Prefer min m to max p only on pre-r7xx asics.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=36197
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -532,10 +532,7 @@ static u32 atombios_adjust_pll(struct dr
+ else
+ pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+- if ((rdev->family == CHIP_R600) ||
+- (rdev->family == CHIP_RV610) ||
+- (rdev->family == CHIP_RV630) ||
+- (rdev->family == CHIP_RV670))
++ if (rdev->family < CHIP_RV770)
+ pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ } else {
+ pll->flags |= RADEON_PLL_LEGACY;
+@@ -565,7 +562,6 @@ static u32 atombios_adjust_pll(struct dr
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+ if (ss_enabled) {
+ if (ss->refdiv) {
+- pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ pll->flags |= RADEON_PLL_USE_REF_DIV;
+ pll->reference_div = ss->refdiv;
+ if (ASIC_IS_AVIVO(rdev))
--- /dev/null
+From 2fe9723df8e45fd247782adea244a5e653c30bf4 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 4 Mar 2011 14:52:30 -0700
+Subject: intel-iommu: Fix get_domain_for_dev() error path
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 2fe9723df8e45fd247782adea244a5e653c30bf4 upstream.
+
+If we run out of domain_ids and fail iommu_attach_domain(), we
+fall into domain_exit() without having setup enough of the
+domain structure for this to do anything useful. In fact, it
+typically runs off into the weeds walking the bogus domain->devices
+list. Just free the domain.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Donald Dutile <ddutile@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1835,7 +1835,7 @@ static struct dmar_domain *get_domain_fo
+
+ ret = iommu_attach_domain(domain, iommu);
+ if (ret) {
+- domain_exit(domain);
++ free_domain_mem(domain);
+ goto error;
+ }
+
--- /dev/null
+From 7a6610139a1e1d9297dd1c5d178022eac36839cb Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Tue, 2 Nov 2010 08:05:51 +0100
+Subject: intel-iommu: Fix use after release during device attach
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+commit 7a6610139a1e1d9297dd1c5d178022eac36839cb upstream.
+
+Obtain the new pgd pointer before releasing the page containing this
+value.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Sheng Yang <sheng@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3627,9 +3627,9 @@ static int intel_iommu_attach_device(str
+
+ pte = dmar_domain->pgd;
+ if (dma_pte_present(pte)) {
+- free_pgtable_page(dmar_domain->pgd);
+ dmar_domain->pgd = (struct dma_pte *)
+ phys_to_virt(dma_pte_addr(pte));
++ free_pgtable_page(pte);
+ }
+ dmar_domain->agaw--;
+ }
--- /dev/null
+From a97590e56d0d58e1dd262353f7cbd84e81d8e600 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 4 Mar 2011 14:52:16 -0700
+Subject: intel-iommu: Unlink domain from iommu
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit a97590e56d0d58e1dd262353f7cbd84e81d8e600 upstream.
+
+When we remove a device, we unlink the iommu from the domain, but
+we never do the reverse unlinking of the domain from the iommu.
+This means that we never clear iommu->domain_ids, eventually leading
+to resource exhaustion if we repeatedly bind and unbind a device
+to a driver. Also free empty domains to avoid a resource leak.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Donald Dutile <ddutile@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3260,9 +3260,15 @@ static int device_notifier(struct notifi
+ if (!domain)
+ return 0;
+
+- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
++ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
+ domain_remove_one_dev_info(domain, pdev);
+
++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
++ list_empty(&domain->devices))
++ domain_exit(domain);
++ }
++
+ return 0;
+ }
+
+@@ -3411,6 +3417,11 @@ static void domain_remove_one_dev_info(s
+ domain->iommu_count--;
+ domain_update_iommu_cap(domain);
+ spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
++
++ spin_lock_irqsave(&iommu->lock, tmp_flags);
++ clear_bit(domain->id, iommu->domain_ids);
++ iommu->domains[domain->id] = NULL;
++ spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+ }
+
+ spin_unlock_irqrestore(&device_domain_lock, flags);
--- /dev/null
+From c968bdf6912cad6d0fc63d7037cc1c870604a808 Mon Sep 17 00:00:00 2001
+From: amit salecha <amit.salecha@qlogic.com>
+Date: Mon, 11 Apr 2011 02:10:22 +0000
+Subject: netxen: limit skb frags for non tso packet
+
+From: amit salecha <amit.salecha@qlogic.com>
+
+commit c968bdf6912cad6d0fc63d7037cc1c870604a808 upstream.
+
+Machines are getting deadlock in four node cluster environment.
+All nodes are accessing (find /gfs2 -depth -print|cpio -ocv > /dev/null)
+200 GB storage on a GFS2 filesystem.
+This result in memory fragmentation and driver receives 18 frags for
+1448 byte packets.
+For non tso packet, fw drops the tx request, if it has >14 frags.
+
+Fixing it by pulling extra frags.
+
+Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/netxen/netxen_nic.h | 4 ++--
+ drivers/net/netxen/netxen_nic_main.c | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -174,7 +174,7 @@
+
+ #define MAX_NUM_CARDS 4
+
+-#define MAX_BUFFERS_PER_CMD 32
++#define NETXEN_MAX_FRAGS_PER_TX 14
+ #define MAX_TSO_HEADER_DESC 2
+ #define MGMT_CMD_DESC_RESV 4
+ #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+@@ -558,7 +558,7 @@ struct netxen_recv_crb {
+ */
+ struct netxen_cmd_buffer {
+ struct sk_buff *skb;
+- struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1];
++ struct netxen_skb_frag frag_array[MAX_SKB_FRAGS + 1];
+ u32 frag_count;
+ };
+
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -1841,6 +1841,8 @@ netxen_nic_xmit_frame(struct sk_buff *sk
+ struct cmd_desc_type0 *hwdesc, *first_desc;
+ struct pci_dev *pdev;
+ int i, k;
++ int delta = 0;
++ struct skb_frag_struct *frag;
+
+ u32 producer;
+ int frag_count, no_of_desc;
+@@ -1848,6 +1850,21 @@ netxen_nic_xmit_frame(struct sk_buff *sk
+
+ frag_count = skb_shinfo(skb)->nr_frags + 1;
+
++ /* 14 frags supported for normal packet and
++ * 32 frags supported for TSO packet
++ */
++ if (!skb_is_gso(skb) && frag_count > NETXEN_MAX_FRAGS_PER_TX) {
++
++ for (i = 0; i < (frag_count - NETXEN_MAX_FRAGS_PER_TX); i++) {
++ frag = &skb_shinfo(skb)->frags[i];
++ delta += frag->size;
++ }
++
++ if (!__pskb_pull_tail(skb, delta))
++ goto drop_packet;
++
++ frag_count = 1 + skb_shinfo(skb)->nr_frags;
++ }
+ /* 4 fragments per cmd des */
+ no_of_desc = (frag_count + 3) >> 2;
+
--- /dev/null
+From a96e5b90804be8b540d30f4a1453fc87f95b3149 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Mon, 18 Apr 2011 11:48:55 -0400
+Subject: nfsd4: Fix filp leak
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit a96e5b90804be8b540d30f4a1453fc87f95b3149 upstream.
+
+23fcf2ec93fb8573a653408316af599939ff9a8e (nfsd4: fix oops on lock failure)
+
+The above patch breaks free path for stp->st_file. If stp was inserted
+into sop->so_stateids, we have to free stp->st_file refcount. Because
+stp->st_file refcount itself is taken whether or not any refcounts are
+taken on the stp->st_file->fi_fds[].
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -403,8 +403,8 @@ static void free_generic_stateid(struct
+ if (stp->st_access_bmap) {
+ oflag = nfs4_access_bmap_to_omode(stp);
+ nfs4_file_put_access(stp->st_file, oflag);
+- put_nfs4_file(stp->st_file);
+ }
++ put_nfs4_file(stp->st_file);
+ kmem_cache_free(stateid_slab, stp);
+ }
+
--- /dev/null
+From 4ee63624fd927376b97ead3a8d00728d437bc8e8 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@redhat.com>
+Date: Fri, 15 Apr 2011 18:08:26 -0400
+Subject: nfsd4: fix struct file leak on delegation
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 4ee63624fd927376b97ead3a8d00728d437bc8e8 upstream.
+
+Introduced by acfdf5c383b38f7f4dddae41b97c97f1ae058f49.
+
+Reported-by: Gerhard Heift <ml-nfs-linux-20110412-ef47@gheift.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -258,6 +258,7 @@ static void nfs4_put_deleg_lease(struct
+ if (atomic_dec_and_test(&fp->fi_delegees)) {
+ vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
+ fp->fi_lease = NULL;
++ fput(fp->fi_deleg_file);
+ fp->fi_deleg_file = NULL;
+ }
+ }
--- /dev/null
+From a6756da9eace8b4af73e9dea43f1fc2889224c94 Mon Sep 17 00:00:00 2001
+From: Jason Conti <jason.conti@gmail.com>
+Date: Thu, 7 Apr 2011 21:09:57 +0200
+Subject: p54: Initialize extra_len in p54_tx_80211
+
+From: Jason Conti <jason.conti@gmail.com>
+
+commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream.
+
+This patch fixes a very serious off-by-one bug in
+the driver, which could leave the device in an
+unresponsive state.
+
+The problem was that the extra_len variable [used to
+reserve extra scratch buffer space for the firmware]
+was left uninitialized. Because p54_assign_address
+later needs the value to reserve additional space,
+the resulting frame could be to big for the small
+device's memory window and everything would
+immediately come to a grinding halt.
+
+Reference: https://bugs.launchpad.net/bugs/722185
+
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Jason Conti <jason.conti@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -705,7 +705,7 @@ int p54_tx_80211(struct ieee80211_hw *de
+ struct p54_tx_info *p54info;
+ struct p54_hdr *hdr;
+ struct p54_tx_data *txhdr;
+- unsigned int padding, len, extra_len;
++ unsigned int padding, len, extra_len = 0;
+ int i, j, ridx;
+ u16 hdr_flags = 0, aid = 0;
+ u8 rate, queue = 0, crypt_offset = 0;
--- /dev/null
+From 91a403caf0f26c71ce4407fd235b2d6fb225fba9 Mon Sep 17 00:00:00 2001
+From: Amit Kumar Salecha <amit.salecha@qlogic.com>
+Date: Tue, 12 Apr 2011 17:05:55 +0000
+Subject: qlcnic: limit skb frags for non tso packet
+
+From: Amit Kumar Salecha <amit.salecha@qlogic.com>
+
+commit 91a403caf0f26c71ce4407fd235b2d6fb225fba9 upstream.
+
+Machines are getting deadlock in four node cluster environment.
+All nodes are accessing (find /gfs2 -depth -print|cpio -ocv > /dev/null)
+200 GB storage on a GFS2 filesystem.
+This result in memory fragmentation and driver receives 18 frags for
+1448 byte packets.
+For non tso packet, fw drops the tx request, if it has >14 frags.
+
+Fixing it by pulling extra frags.
+
+Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/qlcnic/qlcnic.h | 1 +
+ drivers/net/qlcnic/qlcnic_main.c | 14 ++++++++++++++
+ 2 files changed, 15 insertions(+)
+
+--- a/drivers/net/qlcnic/qlcnic.h
++++ b/drivers/net/qlcnic/qlcnic.h
+@@ -99,6 +99,7 @@
+ #define TX_UDPV6_PKT 0x0c
+
+ /* Tx defines */
++#define QLCNIC_MAX_FRAGS_PER_TX 14
+ #define MAX_TSO_HEADER_DESC 2
+ #define MGMT_CMD_DESC_RESV 4
+ #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+--- a/drivers/net/qlcnic/qlcnic_main.c
++++ b/drivers/net/qlcnic/qlcnic_main.c
+@@ -2099,6 +2099,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, s
+ struct cmd_desc_type0 *hwdesc, *first_desc;
+ struct pci_dev *pdev;
+ struct ethhdr *phdr;
++ int delta = 0;
+ int i, k;
+
+ u32 producer;
+@@ -2118,6 +2119,19 @@ qlcnic_xmit_frame(struct sk_buff *skb, s
+ }
+
+ frag_count = skb_shinfo(skb)->nr_frags + 1;
++ /* 14 frags supported for normal packet and
++ * 32 frags supported for TSO packet
++ */
++ if (!skb_is_gso(skb) && frag_count > QLCNIC_MAX_FRAGS_PER_TX) {
++
++ for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++)
++ delta += skb_shinfo(skb)->frags[i].size;
++
++ if (!__pskb_pull_tail(skb, delta))
++ goto drop_packet;
++
++ frag_count = 1 + skb_shinfo(skb)->nr_frags;
++ }
+
+ /* 4 fragments per cmd des */
+ no_of_desc = (frag_count + 3) >> 2;
--- /dev/null
+ath9k_hw-fix-stopping-rx-dma-during-resets.patch
+netxen-limit-skb-frags-for-non-tso-packet.patch
+ath-add-missing-regdomain-pair-0x5c-mapping.patch
+block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch
+p54-initialize-extra_len-in-p54_tx_80211.patch
+qlcnic-limit-skb-frags-for-non-tso-packet.patch
+nfsd4-fix-struct-file-leak-on-delegation.patch
+nfsd4-fix-filp-leak.patch
+virtio-decrement-avail-idx-on-buffer-detach.patch
+x86-gart-set-distlbwalkprb-bit-always.patch
+x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch
+intel-iommu-fix-use-after-release-during-device-attach.patch
+intel-iommu-unlink-domain-from-iommu.patch
+intel-iommu-fix-get_domain_for_dev-error-path.patch
+drm-radeon-kms-pll-tweaks-for-r7xx.patch
+drm-nouveau-fix-notifier-memory-corruption-bug.patch
+drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch
+drm-i915-sanitize-the-output-registers-after-resume.patch
+drm-i915-tv-remember-the-detected-tv-type.patch
--- /dev/null
+From b3258ff1d6086bd2b9eeb556844a868ad7d49bc8 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Wed, 16 Mar 2011 19:12:10 +0530
+Subject: virtio: Decrement avail idx on buffer detach
+
+From: Amit Shah <amit.shah@redhat.com>
+
+commit b3258ff1d6086bd2b9eeb556844a868ad7d49bc8 upstream.
+
+When detaching a buffer from a vq, the avail.idx value should be
+decremented as well.
+
+This was noticed by hot-unplugging a virtio console port and then
+plugging in a new one on the same number (re-using the vqs which were
+just 'disowned'). qemu reported
+
+ 'Guest moved used index from 0 to 256'
+
+when any IO was attempted on the new port.
+
+Reported-by: juzhang <juzhang@redhat.com>
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_ring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct
+ /* detach_buf clears data, so grab it now. */
+ buf = vq->data[i];
+ detach_buf(vq, i);
++ vq->vring.avail->idx--;
+ END_USE(vq);
+ return buf;
+ }
--- /dev/null
+From 665d3e2af83c8fbd149534db8f57d82fa6fa6753 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 18 Apr 2011 15:45:46 +0200
+Subject: x86, gart: Make sure GART does not map physmem above 1TB
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 665d3e2af83c8fbd149534db8f57d82fa6fa6753 upstream.
+
+The GART can only map physical memory below 1TB. Make sure
+the gart driver in the kernel does not try to map memory
+above 1TB.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Link: http://lkml.kernel.org/r/1303134346-5805-5-git-send-email-joerg.roedel@amd.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-gart_64.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -81,6 +81,9 @@ static u32 gart_unmapped_entry;
+ #define AGPEXTERN
+ #endif
+
++/* GART can only remap to physical addresses < 1TB */
++#define GART_MAX_PHYS_ADDR (1ULL << 40)
++
+ /* backdoor interface to AGP driver */
+ AGPEXTERN int agp_memory_reserved;
+ AGPEXTERN __u32 *agp_gatt_table;
+@@ -212,9 +215,13 @@ static dma_addr_t dma_map_area(struct de
+ size_t size, int dir, unsigned long align_mask)
+ {
+ unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE);
+- unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
++ unsigned long iommu_page;
+ int i;
+
++ if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR))
++ return bad_dma_addr;
++
++ iommu_page = alloc_iommu(dev, npages, align_mask);
+ if (iommu_page == -1) {
+ if (!nonforced_iommu(dev, phys_mem, size))
+ return phys_mem;
--- /dev/null
+From c34151a742d84ae65db2088ea30495063f697fbe Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 18 Apr 2011 15:45:45 +0200
+Subject: x86, gart: Set DISTLBWALKPRB bit always
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit c34151a742d84ae65db2088ea30495063f697fbe upstream.
+
+The DISTLBWALKPRB bit must be set for the GART because the
+gatt table is mapped UC. But the current code does not set
+the bit at boot when the BIOS setup the aperture correctly.
+Fix that by setting this bit when enabling the GART instead
+of the other places.
+
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Link: http://lkml.kernel.org/r/1303134346-5805-4-git-send-email-joerg.roedel@amd.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/gart.h | 4 ++--
+ arch/x86/kernel/aperture_64.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/include/asm/gart.h
++++ b/arch/x86/include/asm/gart.h
+@@ -66,7 +66,7 @@ static inline void gart_set_size_and_ena
+ * Don't enable translation but enable GART IO and CPU accesses.
+ * Also, set DISTLBWALKPRB since GART tables memory is UC.
+ */
+- ctl = DISTLBWALKPRB | order << 1;
++ ctl = order << 1;
+
+ pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+@@ -83,7 +83,7 @@ static inline void enable_gart_translati
+
+ /* Enable GART translation for this hammer. */
+ pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl);
+- ctl |= GARTEN;
++ ctl |= GARTEN | DISTLBWALKPRB;
+ ctl &= ~(DISGARTCPU | DISGARTIO);
+ pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -500,7 +500,7 @@ out:
+ * Don't enable translation yet but enable GART IO and CPU
+ * accesses and set DISTLBWALKPRB since GART table memory is UC.
+ */
+- u32 ctl = DISTLBWALKPRB | aper_order << 1;
++ u32 ctl = aper_order << 1;
+
+ bus = amd_nb_bus_dev_ranges[i].bus;
+ dev_base = amd_nb_bus_dev_ranges[i].dev_base;
projects / thirdparty / kernel / stable-queue.git / commitdiff
