Cursors need to be in the GTT domain when being accessed by the GPU.
Previously this was a fortuitous byproduct of userspace using pwrite()
to upload the image data into the cursor. The redundant clflush was
removed in commit 9b8c4a and so the image was no longer being flushed
out of the caches into main memory. One could also devise a scenario
where the cursor was rendered by the GPU, prior to being attached as the
cursor, resulting in similar corruption due to the missing MI_FLUSH.

Fixes:

  Bug 28335 - Cursor corruption caused by commit 9b8c4a0b21
  https://bugs.freedesktop.org/show_bug.cgi?id=28335

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com>
Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Andy Isaacson <adi@hexapodia.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits)
  X25: remove duplicated #include
  tcp: use correct net ns in cookie_v4_check()
  rps: tcp: fix rps_sock_flow_table table updates
  ppp_generic: fix multilink fragment sizes
  syncookies: remove Kconfig text line about disabled-by-default
  ixgbe: only check pfc bits in hang logic if pfc is enabled
  net: check for refcount if pop a stacked dst_entry
  ixgbe: return IXGBE_ERR_RAR_INDEX when out of range
  act_pedit: access skb->data safely
  sfc: Store port number in net_device::dev_id
  epic100: Test __BIG_ENDIAN instead of (non-existent) CONFIG_BIG_ENDIAN
  tehuti: return -EFAULT on copy_to_user errors
  isdn/kcapi: return -EFAULT on copy_from_user errors
  e1000e: change logical negate to bitwise
  sfc: Get port number from CS_PORT_NUM, not PCI function number
  cls_u32: use skb_header_pointer() to dereference data safely
  TCP: tcp_hybla: Fix integer overflow in slow start increment
  act_nat: fix the wrong checksum when addr isn't in old_addr/mask
  net/fec: fix pm to survive to suspend/resume
  korina: count RX DMA OVR as rx_fifo_error
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  Minix: Clean up left over label
  fix truncate inode time modification breakage
  fix setattr error handling in sysfs, configfs
  fcntl: return -EFAULT if copy_to_user fails
  wrong type for 'magic' argument in simple_fill_super()
  fix the deadlock in qib_fs
  mqueue doesn't need make_bad_inode()

Remove duplicated #include('s) in drivers/net/wan/x25_asy.c

Signed-off-by: Huang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix bug in multilink fragment size calculation introduced by
commit 9c705260feea6ae329bc6b6d5f6d2ef0227eda0a
"ppp: ppp_mp_explode() redesign"

Signed-off-by: Ben McKeegan <ben@netservers.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

Only check pfc bits in hang logic if PFC is enabled.  Previously,
if DCB was enabled but PFC was disabled the incorrect pause
bits would be checked.

Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: Don Skidmore <donald.c.skidmore@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: wacom - add Cintiq 21UX2 and Intuos4 WL
  Input: ads7846 - fix compiler warning in ads7846_probe()
  Input: tps6507x-ts - a couple work queue cleanups
  Input: s3c2410_ts - tone down logging
  Input: s3c2410_ts - fix build error due to ADC Kconfig rename

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (23 commits)
  sh: Make intc messages consistent via pr_fmt.
  sh: make sure static declaration on ms7724se
  sh: make sure static declaration on mach-migor
  sh: make sure static declaration on mach-ecovec24
  sh: make sure static declaration on mach-ap325rxa
  clocksource: sh_cmt: compute mult and shift before registration
  clocksource: sh_tmu: compute mult and shift before registration
  sh: PIO disabling for x3proto and urquell.
  sh: mach-sdk7786: conditionally disable PIO support.
  sh: support for platforms without PIO.
  usb: r8a66597-hcd pio to mmio accessor conversion.
  usb: gadget: r8a66597-udc pio to mmio accessor conversion.
  usb: gadget: m66592-udc pio to mmio accessor conversion.
  sh: add romImage MMCIF boot for sh7724 and Ecovec V2
  sh: add boot code to MMCIF driver header
  sh: prepare MMCIF driver header file
  sh: allow romImage data between head.S and the zero page
  sh: Add support MMCIF for ecovec
  sh: remove duplicated #include
  input: serio: disable i8042 for non-cayman sh platforms.
  ...

* 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core: (83 commits)
  i7core_edac: Better describe the supported devices
  Add support for Westmere to i7core_edac driver
  i7core_edac: don't free on success
  i7core_edac: Add support for X5670
  Always call i7core_[ur]dimm_check_mc_ecc_err
  i7core_edac: fix memory leak of i7core_dev
  EDAC: add __init to i7core_xeon_pci_fixup
  i7core_edac: Fix wrong device id for channel 1 devices
  i7core: add support for Lynnfield alternate address
  i7core_edac: Add initial support for Lynnfield
  i7core_edac: do not export static functions
  edac: fix i7core build
  edac: i7core_edac produces undefined behaviour on 32bit
  i7core_edac: Use a more generic approach for probing PCI devices
  i7core_edac: PCI device is called NONCORE, instead of NOCORE
  i7core_edac: Fix ringbuffer maxsize
  i7core_edac: First store, then increment
  i7core_edac: Better parse "any" addrmask
  i7core_edac: Use a lockless ringbuffer
  edac: Create an unique instance for each kobj
  ...

* 'v4l_for_2.6.35' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (87 commits)
  V4L/DVB: ivtv: Timing tweaks and code re-order to try and improve stability
  V4L/DVB: ivtv: Avoid accidental video standard change
  V4L/DVB: ivtvfb : Module load / unload fixes
  V4L/DVB: cx2341x: Report correct temporal setting for log-status
  V4L/DVB: cx18, cx23885, v4l2 doc, MAINTAINERS: Update Andy Walls' email address
  V4L/DVB: drivers/media: Eliminate a NULL pointer dereference
  V4L/DVB: dvb-core: Fix ULE decapsulation bug
  V4L/DVB: Bug fix: make IR work again for dm1105
  V4L/DVB: media/IR: nec-decoder needs to select BITREV
  V4L/DVB: video/saa7134: change dprintk() to i2cdprintk()
  V4L/DVB: video/saa7134: remove duplicate break
  V4L/DVB: IR/imon: add auto-config for 0xffdc rf device
  V4L/DVB: IR/imon: clean up usage of bools
  V4L/DVB: em28xx: remove unneeded null checks
  V4L/DVB: ngene: remove unused #include <linux/version.h>
  V4L/DVB: ak881x needs slab.h
  V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing
  V4L/DVB: Technotrend S2-3200 ships with a TT 1500 remote
  V4L/DVB: drivers/media: Use kzalloc
  V4L/DVB: m920x: Select simple tuner
  ...