From 24d01805ca652434e1ba7b83a1370cb42b618954 Mon Sep 17 00:00:00 2001 From: Daniel Drake Date: Thu, 27 Feb 2014 09:19:30 -0600 Subject: [PATCH 1/5] drm/edid: request HDMI underscan by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Working with HDMI TVs is a real pain as they tend to overscan by default, meaning that the pixels around the edge of the framebuffer are not displayed. This is well explained here: http://mjg59.dreamwidth.org/8705.html There is a bit in the HDMI info frame that can request that the remote display shows the full pixel data ("underscan"). For the remote display, the HDMI spec states that this is optional - it doesn't have to listen. That means that most TVs will probably ignore this. But, maybe there are a handful of TVs for which this would help the situation. As we live in a digital world, ask the remote display not to overscan by default. Signed-off-by: Daniel Drake Reviewed-by: Ville Syrjälä Reviewed-by: Damien Lespiau Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_edid.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index b924306b8477..f8d8a1de9573 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -3599,6 +3599,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE; frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE; + frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN; return 0; } From 366d48070008a0846a099b23efef297451b05640 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Wed, 26 Feb 2014 22:16:03 +0200 Subject: [PATCH 2/5] drm/fb-helper: Use drm_fb_helper_restore_fbdev_mode() in drm_fb_helper_set_par() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use drm_fb_helper_restore_fbdev_mode() in drm_fb_helper_set_par() to make sure extra planes get disabled whenever fbcon takes over. Otherwise the code in drm_fb_helper_set_par() was already doing the exact same thing as drm_fb_helper_restore_fbdev_mode(), so this doesn't change the behaviour in any other way. Signed-off-by: Ville Syrjälä Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_fb_helper.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index 98a03639b413..e5208e072ac7 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -809,8 +809,6 @@ int drm_fb_helper_set_par(struct fb_info *info) struct drm_fb_helper *fb_helper = info->par; struct drm_device *dev = fb_helper->dev; struct fb_var_screeninfo *var = &info->var; - int ret; - int i; if (var->pixclock != 0) { DRM_ERROR("PIXEL CLOCK SET\n"); @@ -818,13 +816,7 @@ int drm_fb_helper_set_par(struct fb_info *info) } drm_modeset_lock_all(dev); - for (i = 0; i < fb_helper->crtc_count; i++) { - ret = drm_mode_set_config_internal(&fb_helper->crtc_info[i].mode_set); - if (ret) { - drm_modeset_unlock_all(dev); - return ret; - } - } + drm_fb_helper_restore_fbdev_mode(fb_helper); drm_modeset_unlock_all(dev); if (fb_helper->delayed_hotplug) { From 409bbf1e3da29aaf57b520e29f904db9c7c2475e Mon Sep 17 00:00:00 2001 From: Damien Lespiau Date: Mon, 3 Mar 2014 23:59:07 +0000 Subject: [PATCH 3/5] drm: Check if the allocation has succeeded before dereferencing newmode We allocate memory in drm_display_mode_from_vic_index() and use it without checking the pointer is valid. Fix that. Signed-off-by: Damien Lespiau Reviewed-by: Alex Deucher Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_edid.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f8d8a1de9573..f3cde90c1d98 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -2580,6 +2580,9 @@ drm_display_mode_from_vic_index(struct drm_connector *connector, return NULL; newmode = drm_mode_duplicate(dev, &edid_cea_modes[cea_mode]); + if (!newmode) + return NULL; + newmode->vrefresh = 0; return newmode; From 04cfe97eb11c28848d14ba8c88124da31a9f881c Mon Sep 17 00:00:00 2001 From: Xiubo Li Date: Mon, 10 Mar 2014 09:33:58 +0800 Subject: [PATCH 4/5] drm/fb-helper: Do the 'max_conn_count' zero check Since we cannot make sure the 'max_conn_count' will always be none zero from the users, and then if max_conn_count equals to zero, the kcalloc() will return ZERO_SIZE_PTR, which equals to ((void *)16). So this patch fix this with just doing the 'max_conn_count' zero check in the front of drm_fb_helper_init(). Signed-off-by: Xiubo Li CC: Jani Nikula Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_fb_helper.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index e5208e072ac7..89382dce1d59 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -516,6 +516,9 @@ int drm_fb_helper_init(struct drm_device *dev, struct drm_crtc *crtc; int i; + if (!max_conn_count) + return -EINVAL; + fb_helper->dev = dev; INIT_LIST_HEAD(&fb_helper->kernel_fb_list); From c94adc4a65c67a79f0d19285bf5c32fe4c00176f Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Thu, 30 Jan 2014 17:58:38 +0100 Subject: [PATCH 5/5] drm: Fix use-after-free in the shadow-attache exit code This regression has been introduced in commit b3f2333de8e81b089262b26d52272911523e605f Author: Daniel Vetter Date: Wed Dec 11 11:34:31 2013 +0100 drm: restrict the device list for shadow attached drivers Reported-by: Dave Jones Cc: Dave Jones Cc: Dave Airlie Cc: David Herrmann Signed-off-by: Daniel Vetter Reviewed-by: David Herrmann --- drivers/gpu/drm/drm_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c index 5736aaa7e86c..f7af69bcf3f4 100644 --- a/drivers/gpu/drm/drm_pci.c +++ b/drivers/gpu/drm/drm_pci.c @@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver) } else { list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list, legacy_dev_list) { - drm_put_dev(dev); list_del(&dev->legacy_dev_list); + drm_put_dev(dev); } } DRM_INFO("Module unloaded\n");