Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/ttm: Read buffer overflow
  drm/radeon: Read buffer overflow
  drm/ttm: Fix a sync object leak.
  drm/radeon/kms: fix memory leak in radeon_driver_load_kms
  drm/radeon/kms: fix nomodeset.
  drm/ttm: Fix a potential comparison of structs.
  drm/radeon/kms: fix rv515 VRAM initialisation.
  drm/radeon: add some new r7xx pci ids
  drm: Catch stop possible NULL pointer reference
  drm: Small logic fix in drm_mode_setcrtc

9 files changed, 33 insertions, 18 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 8fab7890a363..33be210d6723 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1461,7 +1461,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                 goto out;
         }
 
-        if (crtc_req->count_connectors > 0 && !mode && !fb) {
+        if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
                 DRM_DEBUG("Count connectors is %d but no mode or fb set\n",
                           crtc_req->count_connectors);
                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 3da9cfa31848..6aaa2cb23365 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -706,8 +706,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         struct drm_encoder **save_encoders, *new_encoder;
         struct drm_framebuffer *old_fb = NULL;
         bool save_enabled;
-        bool mode_changed = false;
-        bool fb_changed = false;
+        bool mode_changed = false; /* if true do a full mode set */
+        bool fb_changed = false; /* if true and !mode_changed just do a flip */
         struct drm_connector *connector;
         int count = 0, ro, fail = 0;
         struct drm_crtc_helper_funcs *crtc_funcs;
@@ -758,6 +758,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 if (set->crtc->fb == NULL) {
                         DRM_DEBUG("crtc has no fb, full mode set\n");
                         mode_changed = true;
+                } else if (set->fb == NULL) {
+                        mode_changed = true;
                 } else if ((set->fb->bits_per_pixel !=
                          set->crtc->fb->bits_per_pixel) ||
                          set->fb->depth != set->crtc->fb->depth)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 05a44896dffb..f1ba8ff41130 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
                          unsigned idx)
 {
         struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-        uint32_t header = ib_chunk->kdata[idx];
+        uint32_t header;
 
         if (idx >= ib_chunk->length_dw) {
                 DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
                           idx, ib_chunk->length_dw);
                 return -EINVAL;
         }
+        header = ib_chunk->kdata[idx];
         pkt->idx = idx;
         pkt->type = CP_PACKET_GET_TYPE(header);
         pkt->count = CP_PACKET_GET_COUNT(header);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 3cfcee17dc56..0bd5879a4957 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -318,6 +318,14 @@ static int __init radeon_init(void)
         driver = &driver_old;
         driver->num_ioctls = radeon_max_ioctl;
 #if defined(CONFIG_DRM_RADEON_KMS)
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && radeon_modeset == -1) {
+                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
+                driver = &driver_old;
+                driver->driver_features &= ~DRIVER_MODESET;
+                radeon_modeset = 0;
+        }
+#endif
         /* if enabled by default */
         if (radeon_modeset == -1) {
                 DRM_INFO("radeon default to kernel modesetting.\n");
@@ -329,17 +337,8 @@ static int __init radeon_init(void)
                 driver->driver_features |= DRIVER_MODESET;
                 driver->num_ioctls = radeon_max_kms_ioctl;
         }
-
         /* if the vga console setting is enabled still
          * let modprobe override it */
-#ifdef CONFIG_VGA_CONSOLE
-        if (vgacon_text_force() && radeon_modeset == -1) {
-                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
-                driver = &driver_old;
-                driver->driver_features &= ~DRIVER_MODESET;
-                radeon_modeset = 0;
-        }
-#endif
 #endif
         return drm_init(driver);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 937a2f1cdb46..3357110e30ce 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -58,6 +58,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         if (r) {
                 DRM_ERROR("Failed to initialize radeon, disabling IOCTL\n");
                 radeon_device_fini(rdev);
+                kfree(rdev);
+                dev->dev_private = NULL;
                 return r;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 551e608702e4..fd8f3ca716ea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -370,6 +370,7 @@ void rv515_vram_info(struct radeon_device *rdev)
 
         rv515_vram_get_type(rdev);
 
+        r100_vram_init_sizes(rdev);
         /* FIXME: we should enforce default clock in case GPU is not in
          * default setup
          */
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 6538d4236989..c2b0d710d10f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
 
 int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 {
-        struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+        struct ttm_mem_type_manager *man;
         int ret = -EINVAL;
 
         if (mem_type >= TTM_NUM_MEM_TYPES) {
                 printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
                 return ret;
         }
+        man = &bdev->man[mem_type];
 
         if (!man->has_type) {
                 printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "
@@ -1575,6 +1576,10 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
                         driver->sync_obj_unref(&sync_obj);
                         driver->sync_obj_unref(&tmp_obj);
                         spin_lock(&bo->lock);
+                } else {
+                        spin_unlock(&bo->lock);
+                        driver->sync_obj_unref(&sync_obj);
+                        spin_lock(&bo->lock);
                 }
         }
         return 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ce2e6f38ea01..ad4ada07c6cf 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -150,7 +150,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
         dst = kmap_atomic_prot(d, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                 dst = vmap(&d, 1, 0, prot);
         else
                 dst = kmap(d);
@@ -163,7 +163,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
         kunmap_atomic(dst, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                 vunmap(dst);
         else
                 kunmap(d);
@@ -186,7 +186,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
         src = kmap_atomic_prot(s, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                 src = vmap(&s, 1, 0, prot);
         else
                 src = kmap(s);
@@ -199,7 +199,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
         kunmap_atomic(src, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                 vunmap(src);
         else
                 kunmap(s);
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 7174818c2c13..9d4c00491547 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -257,9 +257,12 @@
         {0x1002, 0x940F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9441, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9442, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
@@ -288,6 +291,7 @@
         {0x1002, 0x948F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9490, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9491, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9495, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9498, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x949C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x949E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
@@ -325,6 +329,7 @@
         {0x1002, 0x9552, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9553, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9555, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9557, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9580, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9581, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9583, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \