1. 08 9月, 2015 2 次提交
  2. 12 8月, 2015 1 次提交
  3. 06 8月, 2015 1 次提交
  4. 27 7月, 2015 1 次提交
  5. 22 7月, 2015 6 次提交
  6. 07 7月, 2015 2 次提交
    • Z
      drm: add a check for x/y in drm_mode_setcrtc · 01447e9f
      Zhao Junwang 提交于
      legacy setcrtc ioctl does take a 32 bit value which might indeed
      overflow
      
      the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't
      needed any more with this
      
      v2: -polish the annotation according to Daniel's comment
      
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: NZhao Junwang <zhjwpku@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      01447e9f
    • D
      drm: Update plane->fb also for page_flip · 3cb43cc0
      Daniel Vetter 提交于
      The legacy page_flip driver entry point is the only one left which
      requires drivers to update plane->fb themselves. All the other entry
      hooks will patch things up for the driver as needed since no one seems
      to reliable get this right, see e.g. drm_mode_set_config_internal or
      the plane->fb/old_fb handling in drm_mode_atomic_ioctl.
      
      Therefore unify things, which allows us to ditch a TODO from
      drm_atomic_helper_page_flip.
      
      This should also help the atomic transition in i915 since we keep a
      bit of legacy cruft only around because of this special behaviour in
      ->page_flip.
      
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Reviewed-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Signed-off-by: NDaniel Vetter <daniel.vetter@intel.com>
      3cb43cc0
  7. 06 7月, 2015 1 次提交
  8. 04 7月, 2015 1 次提交
  9. 02 7月, 2015 1 次提交
  10. 12 6月, 2015 1 次提交
  11. 26 5月, 2015 3 次提交
  12. 22 5月, 2015 6 次提交
  13. 12 5月, 2015 1 次提交
  14. 08 5月, 2015 2 次提交
  15. 07 5月, 2015 1 次提交
  16. 14 4月, 2015 1 次提交
    • M
      drm: Make integer overflow checking cover universal cursor updates (v2) · 3968be94
      Matt Roper 提交于
      Our legacy SetPlane updates perform integer overflow checking on a
      plane's destination rectangle in drm_mode_setplane(), and atomic updates
      handled as part of a drm_atomic_state transaction do the same checking
      in drm_atomic_plane_check().  However legacy cursor updates that get
      routed through universal plane interfaces may bypass this overflow
      checking if the driver's .update_plane is serviced by the transitional
      plane helpers rather than the full atomic plane helpers.
      
      Move the check for destination rectangle integer overflow from the
      drm_mode_setplane() to __setplane_internal() so that it also covers
      cursor operations.
      
      This fixes an issue first noticed with i915 commit:
      
              commit ff42e093
              Author: Daniel Vetter <daniel.vetter@ffwll.ch>
              Date:   Mon Mar 2 16:35:20 2015 +0100
      
                  Revert "drm/i915: Switch planes from transitional helpers to full
                  atomic helpers"
      
      The above revert switched us from full atomic helpers back to the
      transitional helpers, and in doing so we lost the overflow checking here
      for universal cursor updates.  Even though such extreme cursor positions
      are unlikely to actually happen in the wild, we still don't want there
      to be a change of behavior when drivers switch from transitional helpers
      to full helpers.
      
      v2: Move check from setplane ioctl to setplane_internal rather than
          adding an additional copy of the checks to the transitional plane
          helpers.  (Daniel)
      
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Testcase: igt/kms_cursor_crc
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84269Signed-off-by: NMatt Roper <matthew.d.roper@intel.com>
      Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      3968be94
  17. 10 4月, 2015 1 次提交
  18. 08 4月, 2015 1 次提交
  19. 02 4月, 2015 1 次提交
  20. 24 3月, 2015 1 次提交
    • D
      drm: Fixup racy refcounting in plane_force_disable · 8218c3f4
      Daniel Vetter 提交于
      Originally it was impossible to be dropping the last refcount in this
      function since there was always one around still from the idr. But in
      
      commit 83f45fc3
      Author: Daniel Vetter <daniel.vetter@ffwll.ch>
      Date:   Wed Aug 6 09:10:18 2014 +0200
      
          drm: Don't grab an fb reference for the idr
      
      we've switched to weak references, broke that assumption but forgot to
      fix it up.
      
      Since we still force-disable planes it's only possible to hit this
      when racing multiple rmfb with fbdev restoring or similar evil things.
      As long as userspace is nice it's impossible to hit the BUG_ON.
      
      But the BUG_ON would most likely be hit from fbdev code, which usually
      invovles the console_lock besides all modeset locks. So very likely
      we'd never get the bug reports if this was hit in the wild, hence
      better be safe than sorry and backport.
      
      Spotted by Matt Roper while reviewing other patches.
      
      [airlied: pull this back into 4.0 - the oops happens there]
      
      Cc: stable@vger.kernel.org
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Reviewed-by: NMatt Roper <matthew.d.roper@intel.com>
      Signed-off-by: NDaniel Vetter <daniel.vetter@intel.com>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      8218c3f4
  21. 17 3月, 2015 1 次提交
  22. 10 3月, 2015 4 次提交