5 files changed, 36 insertions, 9 deletions

diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e88c64417a8a..14cc88aaf3a7 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -277,7 +277,12 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
         case ATOM_ARG_FB:
                 idx = U8(*ptr);
                 (*ptr)++;
-                val = gctx->scratch[((gctx->fb_base + idx) / 4)];
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                        val = 0;
+                } else
+                        val = gctx->scratch[(gctx->fb_base / 4) + idx];
                 if (print)
                         DEBUG("FB[0x%02X]", idx);
                 break;
@@ -531,7 +536,11 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
         case ATOM_ARG_FB:
                 idx = U8(*ptr);
                 (*ptr)++;
-                gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                } else
+                        gctx->scratch[(gctx->fb_base / 4) + idx] = val;
                 DEBUG("FB[0x%02X]", idx);
                 break;
         case ATOM_ARG_PLL:
@@ -1370,11 +1379,13 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
 
                 usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
         }
+        ctx->scratch_size_bytes = 0;
         if (usage_bytes == 0)
                 usage_bytes = 20 * 1024;
         /* allocate some scratch memory */
         ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
         if (!ctx->scratch)
                 return -ENOMEM;
+        ctx->scratch_size_bytes = usage_bytes;
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index a589a55b223e..93cfe2086ba0 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -137,6 +137,7 @@ struct atom_context {
         int cs_equal, cs_above;
         int io_mode;
         uint32_t *scratch;
+        int scratch_size_bytes;
 };
 
 extern int atom_debug;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c742944d3805..a515b2a09d85 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -466,7 +466,7 @@ static void atombios_crtc_program_ss(struct drm_crtc *crtc,
                         return;
                 }
                 args.v2.ucEnable = enable;
-                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK))
+                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK) || ASIC_IS_DCE41(rdev))
                         args.v2.ucEnable = ATOM_DISABLE;
         } else if (ASIC_IS_DCE3(rdev)) {
                 args.v1.usSpreadSpectrumPercentage = cpu_to_le16(ss->percentage);
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 8a171b21b453..eb3f6dc6df83 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1638,7 +1638,17 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                         break;
                 case 2:
                         args.v2.ucCRTC = radeon_crtc->crtc_id;
-                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        if (radeon_encoder_is_dp_bridge(encoder)) {
+                                struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
+                                if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
+                                else if (connector->connector_type == DRM_MODE_CONNECTOR_VGA)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
+                                else
+                                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        } else
+                                args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
                         switch (radeon_encoder->encoder_id) {
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
@@ -1756,10 +1766,15 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
         if (ASIC_IS_DCE4(rdev)) {
                 dig = radeon_encoder->enc_priv;
                 if (ASIC_IS_DCE41(rdev)) {
-                        if (dig->linkb)
-                                return 1;
-                        else
-                                return 0;
+                        /* ontario follows DCE4 */
+                        if (rdev->family == CHIP_PALM) {
+                                if (dig->linkb)
+                                        return 1;
+                                else
+                                        return 0;
+                        } else
+                                /* llano follows DCE3.2 */
+                                return radeon_crtc->crtc_id;
                 } else {
                         switch (radeon_encoder->encoder_id) {
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ae3c6f5dd2b7..082fcaea583f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -321,7 +321,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
         struct ttm_mem_type_manager *man = &bdev->man[new_mem->mem_type];
         struct ttm_tt *ttm = bo->ttm;
         struct ttm_mem_reg *old_mem = &bo->mem;
-        struct ttm_mem_reg old_copy;
+        struct ttm_mem_reg old_copy = *old_mem;
         void *old_iomap;
         void *new_iomap;
         int ret;