commit 30f69f3fb2 upstream.
Typo in in flush leaded to no flush of the RS600 tlb which
ultimately leaded to massive system ram corruption, with
this patch everythings seems to work properly.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 08d075116d upstream.
On systems with the tv dac shared between DVI and TV,
we can only use the dac for one of the connectors.
However, when using a digital monitor on the DVI port,
you can use the dac for the TV connector just fine.
Check the use_digital status when resolving the conflict.
Fixes fdo bug 27649, possibly others.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit d3a67a43b0 upstream.
Switching between TV and VGA caused VGA to break on some systems
since the TV encoder was left enabled when VGA was used.
fixes fdo bug 25520.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 15f7207761 upstream.
Based on ddx patch by Andrzej Hajda.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 97f23b3d85 upstream.
We can get this if the user moves the mouse when we are waiting to move
some stuff around in the validate. Don't fail.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit c8c15ff1e9 upstream
This patch workaround a possible security issue which can allow
user to abuse drm on r6xx/r7xx hw to access any system ram memory.
This patch doesn't break userspace, it detect "valid" old use of
CB_COLOR[0-7]_FRAG & CB_COLOR[0-7]_TILE registers and overwritte
the address these registers are pointing to with the one of the
last color buffer. This workaround will work for old mesa &
xf86-video-ati and any old user which did use similar register
programming pattern as those (we expect that there is no others
user of those ioctl except possibly a malicious one). This patch
add a warning if it detects such usage, warning encourage people
to update their mesa & xf86-video-ati. New userspace will submit
proper relocation.
Fix for xf86-video-ati / mesa (this kernel patch is enough to
prevent abuse, fix for userspace are to set proper cs stream and
avoid kernel warning) :
http://cgit.freedesktop.org/xorg/driver/xf86-video-ati/commit/?id=95d63e408cc88b6934bec84a0b1ef94dfe8bee7bhttp://cgit.freedesktop.org/mesa/mesa/commit/?id=46dc6fd3ed5ef96cda53641a97bc68c3bc104a9f
Abusing this register to perform system ram memory is not easy,
here is outline on how it could be achieve. First attacker must
have access to the drm device and be able to submit command stream
throught cs ioctl. Then attacker must build a proper command stream
for r6xx/r7xx hw which will abuse the FRAG or TILE buffer to
overwrite the GPU GART which is in VRAM. To achieve so attacker
as to setup CB_COLOR[0-7]_FRAG or CB_COLOR[0-7]_TILE to point
to the GPU GART, then it has to find a way to write predictable
value into those buffer (with little cleverness i believe this
can be done but this is an hard task). Once attacker have such
program it can overwritte GPU GART to program GPU gart to point
anywhere in system memory. It then can reusse same method as he
used to reprogram GART to overwritte the system ram through the
GART mapping. In the process the attacker has to be carefull to
not overwritte any sensitive area of the GART table, like ring
or IB gart entry as it will more then likely lead to GPU lockup.
Bottom line is that i think it's very hard to use this flaw
to get system ram access but in theory one can achieve so.
Side note: I am not aware of anyone ever using the GPU as an
attack vector, nevertheless we take great care in the opensource
driver to try to detect and forbid malicious use of GPU. I don't
think the closed source driver are as cautious as we are.
[bwh: Adjusted context for 2.6.32]
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit db96380ea2 upstream
If ib initialization failed don't try to test ib as it will result
in an oops (accessing NULL ib buffer ptr).
[bwh: Adjusted context for 2.6.32]
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 7e71c9e2e7 upstream.
This will avoid oops if at later point the fb is use. Trying to create
a framebuffer with no valid GEM object is bogus and should be forbidden
as this patch does.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 01d4503968 upstream.
For usec delays use udelay instead of scheduling, this should
allow reclocking to happen faster. This also was the cause
of reported 33s delays at bootup on certain systems.
fixes: freedesktop.org bug 25506
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In 2.6.32.2 r600 had no IRQ support, however the patch in
500b758725 to fix vblanks on avivo
cards, needs irqs.
So check for an R600 card and avoid this path if so.
This is a stable only patch for 2.6.32.2 as 2.6.33 has IRQs for r600.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 794f3141a1 upstream.
drivers/gpu/drm/radeon/radeon_test.c:45: undefined reference to `__udivdi3'
Reported-by: Mr. James W. Laferriere <babydr@baby-dragons.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 722f29434e upstream.
also fix up rs690 mem width.
should fix fdo bug 25408
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 4e3f9b78ff upstream.
Board is DVI+VGA, not DVI+DVI
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On broken EDID we were reporting vga connector to be disconnected
even if ddc probe did found a monitor. This patch report that the
connector is connected on such case. This allow drm to add a fail
safe mode (800x600 at the time of this patch) thus user can boot
and later add a mode which match its monitor capabilities.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
RS400,RC410,RS480 chipset seems to report a lot of false positive
with load detect on TV output. We haven't yet found a way to make
load detect reliable on those chipset, thus just disable it for TV
output. Would avoid user to experience phantom screen because X
believe there is a monitor connected to the TV output.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This fixes RH bugzilla #527874.
On resume the atom posting wasn't working, however vbe posting was
going fine, after 2 weeks over irc, and 8 hrs with the hardware,
I tracked it down to the memory device table and it access the MC
registers via IIO, it appears the rv515 atom iio table might not
be fully functional, so adding a readback before doing a write
either provides enough delay to make things resume correctly.
Thanks to Peng Huang at Red Hat for coming to Brisbane.
Signed-off-by: Dave Airlie <airlied@redhat.com>
An rv515 laptop I got wouldn't startup with a montior plugged in,
found the proper bug hopefully with us not turning off D2VGA
here when we should.
Signed-off-by: Dave Airlie <airlied@redhat.com>
AGP resume was broken since we moved to the new init path,
because we never re-enabled AGP on these systems at resume time.
This patch just calls the AGP resume call which just does the reinit
at resume time like the old path did.
Since AGP is pretty much gpu independant I did it outside
the gpu specific code.
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'hostprogs-wmissing-prototypes' of git://git.kernel.org/pub/scm/linux/kernel/git/josh/linux-misc:
Makefile: Add -Wmising-prototypes to HOSTCFLAGS
oss: Mark loadhex static in hex2hex.c
dtc: Mark various internal functions static
dtc: Set "noinput" in the lexer to avoid an unused function
drm: radeon: Mark several functions static in mkregtable
arch/sparc/boot/*.c: Mark various internal functions static
arch/powerpc/boot/addRamDisk.c: Mark several internal functions static
arch/alpha/boot/tools/objstrip.c: Mark "usage" static
Documentation/vm/page-types.c: Declare checked_open static
genksyms: Mark is_reserved_word static
kconfig: Mark various internal functions static
kconfig: Make zconf.y work with current bison
* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (52 commits)
drm/kms: Init the CRTC info fields for modes forced from the command line.
drm/radeon/r600: CS parser updates
drm/radeon/kms: add debugfs for power management for AtomBIOS devices
drm/radeon/kms: initial mode validation support
drm/radeon/kms/atom/dce3: call transmitter init on mode set
drm/radeon/kms: store detailed connector info
drm/radeon/kms/atom/dce3: fix up usPixelClock calculation for Transmitter tables
drm/radeon/kms/r600: fix rs880 support v2
drm/radeon/kms/r700: fix some typos in chip init
drm/radeon/kms: remove some misleading debugging output
drm/radeon/kms: stop putting VRAM at 0 in MC space on r600s.
drm/radeon/kms: disable D1VGA and D2VGA if enabled
drm/radeon/kms: Don't RMW CP_RB_CNTL
drm/radeon/kms: fix coherency issues on AGP cards.
drm/radeon/kms: fix rc410 suspend/resume.
drm/radeon/kms: add quirk for hp dc5750
drm/radeon/kms/atom: fix potential oops in spread spectrum code
drm/kms: typo fix
drm/radeon/kms/atom: Make card_info per device
drm/radeon/kms/atom: Fix DVO support
...
Generally this is done at post, but might not always be done
with softboot or for connectors on docking stations.
Could probably be done once when the driver loads/resumes
rather than on each mode set.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This will be useful for mode validation and certain
atom tables.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Lots of cases were wrong or missing.
v2: rebased against drm-next
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Noticed by Andre on IRC.
Also fix up some minor whitespace issues.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
The Lenovo W500 laptop hangs inside an SMI on brightness changes,
I thought it just needed the VGA disable but it turned out to require
slightly more work, setting the MC locations up just like the IGP
chip requirements seems to make it all happy again and I can boot
and play with brightness.
We should probably just do this for all chips and give up the VRAM
at 0x0 idea, it never seems to buy us anything but pain.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Once kms is enabled we don't need these, and it causes a problem
with the Lenovo W500 ACPI brightness implementation, it hangs
in a loop inside an SMI.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Immediate readback seems faulty on some chips. I
suspect it takes a while to get through the fifo
to the actual register backbone. There's no need
to read it back, so, just write the driver's copy
of the register's value directly.
Should fix bug 24535 and possibly 24218
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
When we are evicting from VRAM->RAM we allocate the ttm object,
but we don't set the caching policy on it before blitting into it.
This means on AGP we end up blitting into cached pages, and
the CPU later flushes out on top of them. This was mostly seen as
font corruption.
The other question is why we don't evict VRAM->GTT in a lot of cases,
this would save us some cache transitions since a lot of objects
that are evicted from VRAM will probably end up being pulled back in
a few operations later, and evicting them to system memory involves
2 unnecessary cache transitions.
Signed-off-by: Dave Airlie <airlied@redhat.com>
This fixes suspend/resume on my rc410 motherboard, it restores
the memory controller setup before posting the GPU, since it seems
to need the MC_FB_LOCATION setup correctly.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Make sure we have an LVDS encoder before casting enc_priv.
[airlied: also fix two missing cpu_to_le16 casts we noticed on irc]
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Make the struct card_info, which is a per struct radeon_device dataset, a
struct member of the radeon device instead of a static per kernel module
value. This should avoid potential problems with two radeon cards installed in
one system.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
DVO in 12 bit mode (which seems to be the most common
config) requires 2x ppll.
Fixes fdo bug 21857.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Limiting the pll output range is a good thing generally as
it limits the number of possible pll combinations for a given
frequency presumably to the ones that work best on each card.
That's why the limits are in the bios tables. However, certain
duallink DVI monitors seem to like pll combinations that would
be limited by this at least on pre-DCE 3.0 r6xx hardware. This
might need to be adjusted per family or per clock range in the
future.
See fdo bug 24727.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Since we register all radeon devices, and the arbiter only cares about
VGA class ones, we will fail to startup on display controller class devices.
We don't gain anything by using the return value here.
this helps kms on sparc64 get started.
Reported-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Spread spectrum is a periodic disturbance added
to the feedback divider to change the pixel clock
periodically to reduce interference.
Only enabled on LVDS.
v2: add support for r4xx and fix DCE 3
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
The *_HIGH regs are reversed. The secondary ones are in the
primary block and vice versa.
We currently only use a 32 bit internal address, so these are
0 for now.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This patch only changes this is the swap path, where it doesn't loop.
Signed-off-by: Robert Noland <rnoland@2hip.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
