leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Second pull request for v4.19:

Browse Source 
- Fix ulong overflow in sun4i
 - Fix a serious GPF in waiting for flip_done from commit_tail().
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAlvJuE0ACgkQ/lWMcqZw
 E8MnTRAAoiDloL0T7Otx3Hdz0h0g5sDhyZ8Fssk1qAWiQrYTODK2AVZilQK8K2D9
 BU2vjzTZRMEtgBEJ8pIyxfRQ1zakaX0ENGIUNOt4jHWY04v3ZCdx913Gc5PlVyMu
 HBz0mGRKeBaRmDjwTVvULAcGsit3QjSEm0r//i4J6i7FpTPkQr/s/JiBggAPXgDy
 dz/YAPh/sjO+L7rbTNSYC8k56PixhhSQQbM61/73PtEeNtyME/13bj6jCTm/uj6H
 1wq3owjfSTvHSAx+bSxJG4VDjHW4qFZ9PGW6JvKlzKc6hAcPxPDRAe2kEsADcC4p
 odu39tWkozOkqEF/Th0pYNCbgih9nymevt8lSoO7jfB25uneoJPcXm/4xRY5Uy+7
 +MNPUQACUlBxP30wYkncK65G/6bP6J336mpfFsunbXFql63WSko9gv9xbgB/iw3H
 CmQJqL+wswYeaYq8nPduUhAsrZlNjaIgR/cWCauvnSnJEVG09+qsnYi07P4gLb3k
 do22Yh79d/mYoGgtxUxFpljZsITtcOmk3isWZLRjpkb/XJVNWcgekUpCMRkC9wkw
 0nTTlysbBTHU0yreRkcB6MkwL8T3UgOn/pE06lCWUvwSvLfkYjyLeInfEo7+8IBl
 xHqEfYGr7WwVvkDlgoqQzzUduGYvHNBlCW9/fnhj5c+6eAinWf8=
 =3i14
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2018-10-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Second pull request for v4.19:
- Fix ulong overflow in sun4i
- Fix a serious GPF in waiting for flip_done from commit_tail().

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/97d1ed42-1d99-fcc5-291e-cd1dc29a4252@linux.intel.com
This commit is contained in:
Dave Airlie 2018-10-20 07:18:12 +10:00
commit fe7acd1e30
4 changed files with 35 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/gpu/drm/drm_atomic.c
View File

@ -174,6 +174,11 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
state->crtcs[i].state = NULL;
state->crtcs[i].old_state = NULL;
state->crtcs[i].new_state = NULL;
if (state->crtcs[i].commit) {
drm_crtc_commit_put(state->crtcs[i].commit);
state->crtcs[i].commit = NULL;
}
}
for (i = 0; i < config->num_total_plane; i++) {

12
drivers/gpu/drm/drm_atomic_helper.c
View File

@ -1408,15 +1408,16 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_vblanks);
void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
struct drm_atomic_state *old_state)
{
struct drm_crtc_state *new_crtc_state;
struct drm_crtc *crtc;
int i;
for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {
struct drm_crtc_commit *commit = new_crtc_state->commit;
for (i = 0; i < dev->mode_config.num_crtc; i++) {
struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
int ret;
if (!commit)
crtc = old_state->crtcs[i].ptr;
if (!crtc || !commit)
continue;
ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ);
@ -1934,6 +1935,9 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,
drm_crtc_commit_get(commit);
commit->abort_completion = true;
state->crtcs[i].commit = commit;
drm_crtc_commit_get(commit);
}
for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {

12
drivers/gpu/drm/sun4i/sun4i_dotclock.c
View File

@ -81,9 +81,19 @@ static long sun4i_dclk_round_rate(struct clk_hw *hw, unsigned long rate,
int i;
for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) {
unsigned long ideal = rate * i;
u64 ideal = (u64)rate * i;
unsigned long rounded;
/*
* ideal has overflowed the max value that can be stored in an
* unsigned long, and every clk operation we might do on a
* truncated u64 value will give us incorrect results.
* Let's just stop there since bigger dividers will result in
* the same overflow issue.
*/
if (ideal > ULONG_MAX)
goto out;
rounded = clk_hw_round_rate(clk_hw_get_parent(hw),
ideal);

11
include/drm/drm_atomic.h
View File

@ -153,6 +153,17 @@ struct __drm_planes_state {
struct __drm_crtcs_state {
struct drm_crtc *ptr;
struct drm_crtc_state *state, *old_state, *new_state;
/**
* @commit:
*
* A reference to the CRTC commit object that is kept for use by
* drm_atomic_helper_wait_for_flip_done() after
* drm_atomic_helper_commit_hw_done() is called. This ensures that a
* concurrent commit won't free a commit object that is still in use.
*/
struct drm_crtc_commit *commit;
s32 __user *out_fence_ptr;
u64 last_vblank_count;
};