Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-fixes-2018-10-20-1' of git://anongit.freedesktop.org/drm/drm
Dave writes:
"drm fixes for 4.19 final (part 2)
Looked like two stragglers snuck in, one very urgent the pageflipping
was missing a reference that could result in a GPF on non-i915
drivers, the other is an overflow in the sun4i dotclock calcs
resulting in a mode not getting set."
* tag 'drm-fixes-2018-10-20-1' of git://anongit.freedesktop.org/drm/drm:
drm/sun4i: Fix an ulong overflow in the dotclock driver
drm: Get ref on CRTC commit object when waiting for flip_done
+35
-5
+5
drivers/gpu/drm/drm_atomic.c
+5
drivers/gpu/drm/drm_atomic.c
···
174
174
state->crtcs[i].state = NULL;
175
175
state->crtcs[i].old_state = NULL;
176
176
state->crtcs[i].new_state = NULL;
177
+
178
+
if (state->crtcs[i].commit) {
179
+
drm_crtc_commit_put(state->crtcs[i].commit);
180
+
state->crtcs[i].commit = NULL;
181
+
}
177
182
}
178
183
179
184
for (i = 0; i < config->num_total_plane; i++) {
+8
-4
drivers/gpu/drm/drm_atomic_helper.c
+8
-4
drivers/gpu/drm/drm_atomic_helper.c
···
1408
1408
void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
1409
1409
struct drm_atomic_state *old_state)
1410
1410
{
1411
-
struct drm_crtc_state *new_crtc_state;
1412
1411
struct drm_crtc *crtc;
1413
1412
int i;
1414
1413
1415
-
for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {
1416
-
struct drm_crtc_commit *commit = new_crtc_state->commit;
1414
+
for (i = 0; i < dev->mode_config.num_crtc; i++) {
1415
+
struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
1417
1416
int ret;
1418
1417
1419
-
if (!commit)
1418
+
crtc = old_state->crtcs[i].ptr;
1419
+
1420
+
if (!crtc || !commit)
1420
1421
continue;
1421
1422
1422
1423
ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ);
···
1935
1934
drm_crtc_commit_get(commit);
1936
1935
1937
1936
commit->abort_completion = true;
1937
+
1938
+
state->crtcs[i].commit = commit;
1939
+
drm_crtc_commit_get(commit);
1938
1940
}
1939
1941
1940
1942
for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
+11
-1
drivers/gpu/drm/sun4i/sun4i_dotclock.c
+11
-1
drivers/gpu/drm/sun4i/sun4i_dotclock.c
···
81
81
int i;
82
82
83
83
for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) {
84
-
unsigned long ideal = rate * i;
84
+
u64 ideal = (u64)rate * i;
85
85
unsigned long rounded;
86
+
87
+
/*
88
+
* ideal has overflowed the max value that can be stored in an
89
+
* unsigned long, and every clk operation we might do on a
90
+
* truncated u64 value will give us incorrect results.
91
+
* Let's just stop there since bigger dividers will result in
92
+
* the same overflow issue.
93
+
*/
94
+
if (ideal > ULONG_MAX)
95
+
goto out;
86
96
87
97
rounded = clk_hw_round_rate(clk_hw_get_parent(hw),
88
98
ideal);
+11
include/drm/drm_atomic.h
+11
include/drm/drm_atomic.h
···
153
153
struct __drm_crtcs_state {
154
154
struct drm_crtc *ptr;
155
155
struct drm_crtc_state *state, *old_state, *new_state;
156
+
157
+
/**
158
+
* @commit:
159
+
*
160
+
* A reference to the CRTC commit object that is kept for use by
161
+
* drm_atomic_helper_wait_for_flip_done() after
162
+
* drm_atomic_helper_commit_hw_done() is called. This ensures that a
163
+
* concurrent commit won't free a commit object that is still in use.
164
+
*/
165
+
struct drm_crtc_commit *commit;
166
+
156
167
s32 __user *out_fence_ptr;
157
168
u64 last_vblank_count;
158
169
};