9 files changed, 85 insertions, 54 deletions

diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index e34104d32637..c3441b3f086e 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1464,8 +1464,10 @@ static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
                         request_queue_t *q = disk->queue;
                         if (disk->flags & GENHD_FL_UP)
                                 del_gendisk(disk);
-                        if (q)  
+                        if (q) {
                                 blk_cleanup_queue(q);
+                                drv->queue = NULL;
+                        }
                 }
         }
 
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 03839ea31092..9f2b4efd0c7a 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1522,7 +1522,7 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 
         dev_priv->gart_size = init->gart_size;
         dev_priv->gart_vm_start = dev_priv->fb_location
-            + RADEON_READ(RADEON_CONFIG_APER_SIZE);
+            + RADEON_READ(RADEON_CONFIG_APER_SIZE) * 2;
 
 #if __OS_HAS_AGP
         if (!dev_priv->is_pci)
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 8b6e2a11e28d..00d683063c01 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -2280,7 +2280,7 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         }
 
         if (unlikely(skge->tx_avail < skb_shinfo(skb)->nr_frags +1)) {
-                if (!netif_stopped(dev)) {
+                if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
 
                         printk(KERN_WARNING PFX "%s: ring full when queue awake!\n",
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 665ae79e1fd6..d0a0fdbd0fc4 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -2443,7 +2443,7 @@ static void ata_sg_clean(struct ata_queued_cmd *qc)
                         struct scatterlist *psg = &qc->pad_sgent;
                         void *addr = kmap_atomic(psg->page, KM_IRQ0);
                         memcpy(addr + psg->offset, pad_buf, qc->pad_len);
-                        kunmap_atomic(psg->page, KM_IRQ0);
+                        kunmap_atomic(addr, KM_IRQ0);
                 }
         } else {
                 if (sg_dma_len(&sg[0]) > 0)
@@ -2717,7 +2717,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                 if (qc->tf.flags & ATA_TFLAG_WRITE) {
                         void *addr = kmap_atomic(psg->page, KM_IRQ0);
                         memcpy(pad_buf, addr + psg->offset, qc->pad_len);
-                        kunmap_atomic(psg->page, KM_IRQ0);
+                        kunmap_atomic(addr, KM_IRQ0);
                 }
 
                 sg_dma_address(psg) = ap->pad_dma + (qc->tag * ATA_DMA_PAD_SZ);
diff --git a/drivers/video/cfbcopyarea.c b/drivers/video/cfbcopyarea.c
index cdc71572cf35..74415325b016 100644
--- a/drivers/video/cfbcopyarea.c
+++ b/drivers/video/cfbcopyarea.c
@@ -64,8 +64,8 @@ bitcpy(unsigned long __iomem *dst, int dst_idx, const unsigned long __iomem *src
         int const shift = dst_idx-src_idx;
         int left, right;
 
-        first = ~0UL >> dst_idx;
-        last = ~(~0UL >> ((dst_idx+n) % bits));
+        first = FB_SHIFT_HIGH(~0UL, dst_idx);
+        last = ~(FB_SHIFT_HIGH(~0UL, (dst_idx+n) % bits));
 
         if (!shift) {
                 // Same alignment for source and dest
@@ -216,8 +216,8 @@ bitcpy_rev(unsigned long __iomem *dst, int dst_idx, const unsigned long __iomem
 
         shift = dst_idx-src_idx;
 
-        first = ~0UL << (bits - 1 - dst_idx);
-        last = ~(~0UL << (bits - 1 - ((dst_idx-n) % bits)));
+        first = FB_SHIFT_LOW(~0UL, bits - 1 - dst_idx);
+        last = ~(FB_SHIFT_LOW(~0UL, bits - 1 - ((dst_idx-n) % bits)));
 
         if (!shift) {
                 // Same alignment for source and dest
diff --git a/drivers/video/cfbfillrect.c b/drivers/video/cfbfillrect.c
index 167d9314e6eb..e5ff62e9cfb8 100644
--- a/drivers/video/cfbfillrect.c
+++ b/drivers/video/cfbfillrect.c
@@ -110,8 +110,8 @@ bitfill_aligned(unsigned long __iomem *dst, int dst_idx, unsigned long pat, unsi
         if (!n)
                 return;
 
-        first = ~0UL >> dst_idx;
-        last = ~(~0UL >> ((dst_idx+n) % bits));
+        first = FB_SHIFT_HIGH(~0UL, dst_idx);
+        last = ~(FB_SHIFT_HIGH(~0UL, (dst_idx+n) % bits));
 
         if (dst_idx+n <= bits) {
                 // Single word
@@ -167,8 +167,8 @@ bitfill_unaligned(unsigned long __iomem *dst, int dst_idx, unsigned long pat,
         if (!n)
                 return;
 
-        first = ~0UL >> dst_idx;
-        last = ~(~0UL >> ((dst_idx+n) % bits));
+        first = FB_SHIFT_HIGH(~0UL, dst_idx);
+        last = ~(FB_SHIFT_HIGH(~0UL, (dst_idx+n) % bits));
 
         if (dst_idx+n <= bits) {
                 // Single word
@@ -221,8 +221,8 @@ bitfill_aligned_rev(unsigned long __iomem *dst, int dst_idx, unsigned long pat,
         if (!n)
                 return;
 
-        first = ~0UL >> dst_idx;
-        last = ~(~0UL >> ((dst_idx+n) % bits));
+        first = FB_SHIFT_HIGH(~0UL, dst_idx);
+        last = ~(FB_SHIFT_HIGH(~0UL, (dst_idx+n) % bits));
 
         if (dst_idx+n <= bits) {
                 // Single word
@@ -290,8 +290,8 @@ bitfill_unaligned_rev(unsigned long __iomem *dst, int dst_idx, unsigned long pat
         if (!n)
                 return;
 
-        first = ~0UL >> dst_idx;
-        last = ~(~0UL >> ((dst_idx+n) % bits));
+        first = FB_SHIFT_HIGH(~0UL, dst_idx);
+        last = ~(FB_SHIFT_HIGH(~0UL, (dst_idx+n) % bits));
 
         if (dst_idx+n <= bits) {
                 // Single word
diff --git a/drivers/video/cfbimgblt.c b/drivers/video/cfbimgblt.c
index a7770c4f17d0..910e2338a27e 100644
--- a/drivers/video/cfbimgblt.c
+++ b/drivers/video/cfbimgblt.c
@@ -76,18 +76,6 @@ static u32 cfb_tab32[] = {
 #define FB_WRITEL fb_writel
 #define FB_READL  fb_readl
 
-#if defined (__BIG_ENDIAN)
-#define LEFT_POS(bpp)          (32 - bpp)
-#define SHIFT_HIGH(val, bits)  ((val) >> (bits))
-#define SHIFT_LOW(val, bits)   ((val) << (bits))
-#define BIT_NR(b)              (7 - (b))
-#else
-#define LEFT_POS(bpp)          (0)
-#define SHIFT_HIGH(val, bits)  ((val) << (bits))
-#define SHIFT_LOW(val, bits)   ((val) >> (bits))
-#define BIT_NR(b)              (b)
-#endif
-
 static inline void color_imageblit(const struct fb_image *image, 
                                    struct fb_info *p, u8 __iomem *dst1, 
                                    u32 start_index,
@@ -109,7 +97,7 @@ static inline void color_imageblit(const struct fb_image *image,
                 val = 0;
                 
                 if (start_index) {
-                        u32 start_mask = ~(SHIFT_HIGH(~(u32)0, start_index));
+                        u32 start_mask = ~(FB_SHIFT_HIGH(~(u32)0, start_index));
                         val = FB_READL(dst) & start_mask;
                         shift = start_index;
                 }
@@ -119,20 +107,20 @@ static inline void color_imageblit(const struct fb_image *image,
                                 color = palette[*src];
                         else
                                 color = *src;
-                        color <<= LEFT_POS(bpp);
-                        val |= SHIFT_HIGH(color, shift);
+                        color <<= FB_LEFT_POS(bpp);
+                        val |= FB_SHIFT_HIGH(color, shift);
                         if (shift >= null_bits) {
                                 FB_WRITEL(val, dst++);
         
                                 val = (shift == null_bits) ? 0 : 
-                                        SHIFT_LOW(color, 32 - shift);
+                                        FB_SHIFT_LOW(color, 32 - shift);
                         }
                         shift += bpp;
                         shift &= (32 - 1);
                         src++;
                 }
                 if (shift) {
-                        u32 end_mask = SHIFT_HIGH(~(u32)0, shift);
+                        u32 end_mask = FB_SHIFT_HIGH(~(u32)0, shift);
 
                         FB_WRITEL((FB_READL(dst) & end_mask) | val, dst);
                 }
@@ -162,6 +150,8 @@ static inline void slow_imageblit(const struct fb_image *image, struct fb_info *
         u32 i, j, l;
         
         dst2 = (u32 __iomem *) dst1;
+        fgcolor <<= FB_LEFT_POS(bpp);
+        bgcolor <<= FB_LEFT_POS(bpp);
 
         for (i = image->height; i--; ) {
                 shift = val = 0;
@@ -172,22 +162,21 @@ static inline void slow_imageblit(const struct fb_image *image, struct fb_info *
 
                 /* write leading bits */
                 if (start_index) {
-                        u32 start_mask = ~(SHIFT_HIGH(~(u32)0, start_index));
+                        u32 start_mask = ~(FB_SHIFT_HIGH(~(u32)0,start_index));
                         val = FB_READL(dst) & start_mask;
                         shift = start_index;
                 }
 
                 while (j--) {
                         l--;
-                        color = (*s & 1 << (BIT_NR(l))) ? fgcolor : bgcolor;
-                        color <<= LEFT_POS(bpp);
-                        val |= SHIFT_HIGH(color, shift);
+                        color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
+                        val |= FB_SHIFT_HIGH(color, shift);
                         
                         /* Did the bitshift spill bits to the next long? */
                         if (shift >= null_bits) {
                                 FB_WRITEL(val, dst++);
                                 val = (shift == null_bits) ? 0 :
-                                         SHIFT_LOW(color,32 - shift);
+                                        FB_SHIFT_LOW(color,32 - shift);
                         }
                         shift += bpp;
                         shift &= (32 - 1);
@@ -196,7 +185,7 @@ static inline void slow_imageblit(const struct fb_image *image, struct fb_info *
 
                 /* write trailing bits */
                 if (shift) {
-                        u32 end_mask = SHIFT_HIGH(~(u32)0, shift);
+                        u32 end_mask = FB_SHIFT_HIGH(~(u32)0, shift);
 
                         FB_WRITEL((FB_READL(dst) & end_mask) | val, dst);
                 }
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index bcea87c3cc06..3660e51b2612 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2048,7 +2048,7 @@ static int fbcon_switch(struct vc_data *vc)
         struct fbcon_ops *ops;
         struct display *p = &fb_display[vc->vc_num];
         struct fb_var_screeninfo var;
-        int i, prev_console;
+        int i, prev_console, charcnt = 256;
 
         info = registered_fb[con2fb_map[vc->vc_num]];
         ops = info->fbcon_par;
@@ -2103,7 +2103,8 @@ static int fbcon_switch(struct vc_data *vc)
         fb_set_var(info, &var);
         ops->var = info->var;
 
-        if (old_info != NULL && old_info != info) {
+        if (old_info != NULL && (old_info != info ||
+                                 info->flags & FBINFO_MISC_ALWAYS_SETPAR)) {
                 if (info->fbops->fb_set_par)
                         info->fbops->fb_set_par(info);
                 fbcon_del_cursor_timer(old_info);
@@ -2120,6 +2121,13 @@ static int fbcon_switch(struct vc_data *vc)
 
         vc->vc_can_do_color = (fb_get_color_depth(&info->var, &info->fix)!=1);
         vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
+
+        if (p->userfont)
+                charcnt = FNTCHARCNT(vc->vc_font.data);
+
+        if (charcnt > 256)
+                vc->vc_complement_mask <<= 1;
+
         updatescrollmode(p, info, vc);
 
         switch (p->scrollmode) {
@@ -2139,8 +2147,12 @@ static int fbcon_switch(struct vc_data *vc)
 
         scrollback_max = 0;
         scrollback_current = 0;
-        ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
-        ops->update_start(info);
+
+        if (!fbcon_is_inactive(vc, info)) {
+            ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
+            ops->update_start(info);
+        }
+
         fbcon_set_palette(vc, color_table);     
         fbcon_clear_margins(vc, 0);
 
@@ -2184,11 +2196,14 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
                 ops->graphics = 1;
 
                 if (!blank) {
+                        if (info->fbops->fb_save_state)
+                                info->fbops->fb_save_state(info);
                         var.activate = FB_ACTIVATE_NOW | FB_ACTIVATE_FORCE;
                         fb_set_var(info, &var);
                         ops->graphics = 0;
                         ops->var = info->var;
-                }
+                } else if (info->fbops->fb_restore_state)
+                        info->fbops->fb_restore_state(info);
         }
 
         if (!fbcon_is_inactive(vc, info)) {
@@ -2736,8 +2751,12 @@ static void fbcon_modechanged(struct fb_info *info)
                 updatescrollmode(p, info, vc);
                 scrollback_max = 0;
                 scrollback_current = 0;
-                ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
-                ops->update_start(info);
+
+                if (!fbcon_is_inactive(vc, info)) {
+                    ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
+                    ops->update_start(info);
+                }
+
                 fbcon_set_palette(vc, color_table);
                 update_screen(vc);
                 if (softback_buf)
@@ -2774,8 +2793,13 @@ static void fbcon_set_all_vcs(struct fb_info *info)
                         updatescrollmode(p, info, vc);
                         scrollback_max = 0;
                         scrollback_current = 0;
-                        ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
-                        ops->update_start(info);
+
+                        if (!fbcon_is_inactive(vc, info)) {
+                            ops->var.xoffset = ops->var.yoffset =
+                                p->yscroll = 0;
+                            ops->update_start(info);
+                        }
+
                         fbcon_set_palette(vc, color_table);
                         update_screen(vc);
                         if (softback_buf)
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 6240aedb4154..10dfdf035264 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -722,14 +722,30 @@ static void try_to_load(int fb)
 int
 fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var)
 {
+        struct fb_fix_screeninfo *fix = &info->fix;
         int xoffset = var->xoffset;
         int yoffset = var->yoffset;
-        int err;
+        int err = 0, yres = info->var.yres;
+
+        if (var->yoffset > 0) {
+                if (var->vmode & FB_VMODE_YWRAP) {
+                        if (!fix->ywrapstep || (var->yoffset % fix->ywrapstep))
+                                err = -EINVAL;
+                        else
+                                yres = 0;
+                } else if (!fix->ypanstep || (var->yoffset % fix->ypanstep))
+                        err = -EINVAL;
+        }
+
+        if (var->xoffset > 0 && (!fix->xpanstep ||
+                                 (var->xoffset % fix->xpanstep)))
+                err = -EINVAL;
+
+        if (err || !info->fbops->fb_pan_display || xoffset < 0 ||
+            yoffset < 0 || var->yoffset + yres > info->var.yres_virtual ||
+            var->xoffset + info->var.xres > info->var.xres_virtual)
+                return -EINVAL;
 
-        if (xoffset < 0 || yoffset < 0 || !info->fbops->fb_pan_display ||
-            xoffset + info->var.xres > info->var.xres_virtual ||
-            yoffset + info->var.yres > info->var.yres_virtual)
-                return -EINVAL;
         if ((err = info->fbops->fb_pan_display(var, info)))
                 return err;
         info->var.xoffset = var->xoffset;