Re: [PATCH 07/11] drm/gma500: Use fbdev client helpers
On Tue, May 7, 2024 at 2:04 PM Thomas Zimmermann wrote:
>
> Implement struct drm_client_funcs with the respective helpers and
> remove the custom code from the emulation. The generic helpers are
> equivalent in functionality.
>
> Signed-off-by: Thomas Zimmermann
Acked-by: Patrik Jakobsson
> ---
> drivers/gpu/drm/gma500/fbdev.c | 58 ++
> 1 file changed, 3 insertions(+), 55 deletions(-)
>
> diff --git a/drivers/gpu/drm/gma500/fbdev.c b/drivers/gpu/drm/gma500/fbdev.c
> index 98b44974d42dd..8a6cb47e83f8f 100644
> --- a/drivers/gpu/drm/gma500/fbdev.c
> +++ b/drivers/gpu/drm/gma500/fbdev.c
> @@ -8,7 +8,6 @@
> #include
> #include
>
> -#include
> #include
> #include
> #include
> @@ -252,63 +251,12 @@ static const struct drm_fb_helper_funcs
> psb_fbdev_fb_helper_funcs = {
> };
>
> /*
> - * struct drm_client_funcs and setup code
> + * struct drm_client_funcs
> */
>
> -static void psb_fbdev_client_unregister(struct drm_client_dev *client)
> -{
> - struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
> -
> - if (fb_helper->info) {
> - drm_fb_helper_unregister_info(fb_helper);
> - } else {
> - drm_fb_helper_unprepare(fb_helper);
> - drm_client_release(&fb_helper->client);
> - kfree(fb_helper);
> - }
> -}
> -
> -static int psb_fbdev_client_restore(struct drm_client_dev *client)
> -{
> - drm_fb_helper_lastclose(client->dev);
> -
> - return 0;
> -}
> -
> -static int psb_fbdev_client_hotplug(struct drm_client_dev *client)
> -{
> - struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
> - struct drm_device *dev = client->dev;
> - int ret;
> -
> - if (dev->fb_helper)
> - return drm_fb_helper_hotplug_event(dev->fb_helper);
> -
> - ret = drm_fb_helper_init(dev, fb_helper);
> - if (ret)
> - goto err_drm_err;
> -
> - if (!drm_drv_uses_atomic_modeset(dev))
> - drm_helper_disable_unused_functions(dev);
> -
> - ret = drm_fb_helper_initial_config(fb_helper);
> - if (ret)
> - goto err_drm_fb_helper_fini;
> -
> - return 0;
> -
> -err_drm_fb_helper_fini:
> - drm_fb_helper_fini(fb_helper);
> -err_drm_err:
> - drm_err(dev, "Failed to setup gma500 fbdev emulation (ret=%d)\n",
> ret);
> - return ret;
> -}
> -
> static const struct drm_client_funcs psb_fbdev_client_funcs = {
> - .owner = THIS_MODULE,
> - .unregister = psb_fbdev_client_unregister,
> - .restore= psb_fbdev_client_restore,
> - .hotplug= psb_fbdev_client_hotplug,
> + .owner = THIS_MODULE,
> + DRM_FBDEV_HELPER_CLIENT_FUNCS,
> };
>
> void psb_fbdev_setup(struct drm_psb_private *dev_priv)
> --
> 2.44.0
>
Re: [PATCH] drm/amdgpu: fix out of bounds write
On Wed, Oct 13, 2021 at 10:41 PM Alex Deucher wrote:
>
> On Wed, Oct 13, 2021 at 4:04 PM T. Williams wrote:
> >
>
> The description and s-o-b should go here and the patch seems to be
> mangled. I've manually applied this. Please fix up your mailer in
> the future.
>
> Thanks for the fix.
Hi Thelford and Alex
There are several more instances of size being used instead of
wr_buf_size in amdgpu_dm_debugfs.c.
IMO the proper fix here would be to revert
918698d5c2b50433714d2042f55b55b090faa167
-Patrik
>
> Alex
>
>
> > ---
> > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > index 87daa78a32b8..17f2756a64dc 100644
> > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > @@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f,
> > const char __user *buf,
> > if (!wr_buf)
> > return -ENOSPC;
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> >(long *)param, buf,
> >max_param_num,
> >¶m_nums)) {
> > --
> >
> > Size can be any value and is user controlled resulting in overwriting the
> > 40 byte array wr_buf with an arbitrary length of data from buf.
> >
> > Signed-off-by: Thelford Williams
[PATCH] drm/amdgpu: Fix even more out of bound writes from debugfs
CVE-2021-42327 was fixed by:
commit f23750b5b3d98653b31d4469592935ef6364ad67
Author: Thelford Williams
Date: Wed Oct 13 16:04:13 2021 -0400
drm/amdgpu: fix out of bounds write
but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.
Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than
allocated")
Signed-off-by: Patrik Jakobsson
---
.../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c| 16
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 1a68a674913c..33bdf15febc6 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -491,7 +491,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const
char __user *buf,
if (!wr_buf)
return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -643,7 +643,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct
file *f, const char __us
if (!wr_buf)
return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -918,7 +918,7 @@ static ssize_t dp_dsc_passthrough_set(struct file *f, const
char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
¶m, buf,
max_param_num,
¶m_nums)) {
@@ -1215,7 +1215,7 @@ static ssize_t trigger_hotplug(struct file *f, const char
__user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1400,7 +1400,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1585,7 +1585,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1770,7 +1770,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1948,7 +1948,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file
*f, const char __user *bu
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
--
2.33.0
Re: [PATCH] drm/amdgpu: fix out of bounds write
On Wed, Oct 27, 2021 at 12:08 PM Patrik Jakobsson
wrote:
>
> On Wed, Oct 13, 2021 at 10:41 PM Alex Deucher wrote:
> >
> > On Wed, Oct 13, 2021 at 4:04 PM T. Williams wrote:
> > >
> >
> > The description and s-o-b should go here and the patch seems to be
> > mangled. I've manually applied this. Please fix up your mailer in
> > the future.
> >
> > Thanks for the fix.
>
> Hi Thelford and Alex
>
> There are several more instances of size being used instead of
> wr_buf_size in amdgpu_dm_debugfs.c.
>
> IMO the proper fix here would be to revert
> 918698d5c2b50433714d2042f55b55b090faa167
Actually, there's one instance that a revert doesn't cover. Instead I
sent out a patch to fix the remaining ones.
>
> -Patrik
>
> >
> > Alex
> >
> >
> > > ---
> > > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > index 87daa78a32b8..17f2756a64dc 100644
> > > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > @@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f,
> > > const char __user *buf,
> > > if (!wr_buf)
> > > return -ENOSPC;
> > >
> > > - if (parse_write_buffer_into_params(wr_buf, size,
> > > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > >(long *)param, buf,
> > >max_param_num,
> > >¶m_nums)) {
> > > --
> > >
> > > Size can be any value and is user controlled resulting in overwriting the
> > > 40 byte array wr_buf with an arbitrary length of data from buf.
> > >
> > > Signed-off-by: Thelford Williams
Re: [PATCH] drm/amdgpu: Fix even more out of bound writes from debugfs
On Wed, Oct 27, 2021 at 3:47 PM Harry Wentland wrote:
>
>
>
> On 2021-10-27 09:03, Patrik Jakobsson wrote:
> > CVE-2021-42327 was fixed by:
> >
> > commit f23750b5b3d98653b31d4469592935ef6364ad67
> > Author: Thelford Williams
> > Date: Wed Oct 13 16:04:13 2021 -0400
> >
> > drm/amdgpu: fix out of bounds write
> >
> > but amdgpu_dm_debugfs.c contains more of the same issue so fix the
> > remaining ones.
> >
> > Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed
> > than allocated")
> > Signed-off-by: Patrik Jakobsson
> > ---
> > .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c| 16
> > 1 file changed, 8 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > index 1a68a674913c..33bdf15febc6 100644
> > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > @@ -491,7 +491,7 @@ static ssize_t dp_phy_settings_write(struct file *f,
> > const char __user *buf,
> > if (!wr_buf)
> > return -ENOSPC;
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -643,7 +643,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct
> > file *f, const char __us
> > if (!wr_buf)
> > return -ENOSPC;
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -918,7 +918,7 @@ static ssize_t dp_dsc_passthrough_set(struct file *f,
> > const char __user *buf,
> > return -ENOSPC;
> > }
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > ¶m, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -1215,7 +1215,7 @@ static ssize_t trigger_hotplug(struct file *f, const
> > char __user *buf,
> > return -ENOSPC;
> > }
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -1400,7 +1400,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f,
> > const char __user *buf,
> > return -ENOSPC;
> > }
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -1585,7 +1585,7 @@ static ssize_t dp_dsc_slice_width_write(struct file
> > *f, const char __user *buf,
> > return -ENOSPC;
> > }
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -1770,7 +1770,7 @@ static ssize_t dp_dsc_slice_height_write(struct file
> > *f, const char __user *buf,
> > return -ENOSPC;
> > }
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > @@ -1948,7 +1948,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct
> > file *f, const char
[PATCH v2] drm/amdgpu: Fix even more out of bound writes from debugfs
CVE-2021-42327 was fixed by:
commit f23750b5b3d98653b31d4469592935ef6364ad67
Author: Thelford Williams
Date: Wed Oct 13 16:04:13 2021 -0400
drm/amdgpu: fix out of bounds write
but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.
v2:
* Add missing fix in dp_max_bpc_write (Harry Wentland)
Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than
allocated")
Signed-off-by: Patrik Jakobsson
---
.../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 18 +-
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 1a68a674913c..3655663e079b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -491,7 +491,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const
char __user *buf,
if (!wr_buf)
return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -643,7 +643,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct
file *f, const char __us
if (!wr_buf)
return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -918,7 +918,7 @@ static ssize_t dp_dsc_passthrough_set(struct file *f, const
char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
¶m, buf,
max_param_num,
¶m_nums)) {
@@ -1215,7 +1215,7 @@ static ssize_t trigger_hotplug(struct file *f, const char
__user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1400,7 +1400,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1585,7 +1585,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1770,7 +1770,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f,
const char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -1948,7 +1948,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file
*f, const char __user *bu
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
@@ -2386,7 +2386,7 @@ static ssize_t dp_max_bpc_write(struct file *f, const
char __user *buf,
return -ENOSPC;
}
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
--
2.33.0
Re: [PATCH v3 06/22] drm/gma500: Convert to CRTC VBLANK callbacks
On Mon, Jan 20, 2020 at 9:23 AM Thomas Zimmermann wrote:
>
> VBLANK callbacks in struct drm_driver are deprecated in favor of
> their equivalents in struct drm_crtc_funcs. Convert gma500 over.
>
> Signed-off-by: Thomas Zimmermann
Looks good. For this patch:
Acked-by: Patrik Jakobsson
> ---
> drivers/gpu/drm/gma500/cdv_intel_display.c | 3 +++
> drivers/gpu/drm/gma500/psb_drv.c | 4
> drivers/gpu/drm/gma500/psb_drv.h | 6 +++---
> drivers/gpu/drm/gma500/psb_intel_display.c | 3 +++
> drivers/gpu/drm/gma500/psb_irq.c | 12 +---
> drivers/gpu/drm/gma500/psb_irq.h | 7 ---
> 6 files changed, 22 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c
> b/drivers/gpu/drm/gma500/cdv_intel_display.c
> index 1ed854f498b7..686385a66167 100644
> --- a/drivers/gpu/drm/gma500/cdv_intel_display.c
> +++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
> @@ -977,6 +977,9 @@ const struct drm_crtc_funcs cdv_intel_crtc_funcs = {
> .set_config = gma_crtc_set_config,
> .destroy = gma_crtc_destroy,
> .page_flip = gma_crtc_page_flip,
> + .enable_vblank = psb_enable_vblank,
> + .disable_vblank = psb_disable_vblank,
> + .get_vblank_counter = psb_get_vblank_counter,
> };
>
> const struct gma_clock_funcs cdv_clock_funcs = {
> diff --git a/drivers/gpu/drm/gma500/psb_drv.c
> b/drivers/gpu/drm/gma500/psb_drv.c
> index 52591416f8fe..36cb292fdebe 100644
> --- a/drivers/gpu/drm/gma500/psb_drv.c
> +++ b/drivers/gpu/drm/gma500/psb_drv.c
> @@ -363,7 +363,6 @@ static int psb_driver_load(struct drm_device *dev,
> unsigned long flags)
> drm_irq_install(dev, dev->pdev->irq);
>
> dev->max_vblank_count = 0xff; /* only 24 bits of frame count */
> - dev->driver->get_vblank_counter = psb_get_vblank_counter;
>
> psb_modeset_init(dev);
> psb_fbdev_init(dev);
> @@ -507,9 +506,6 @@ static struct drm_driver driver = {
> .irq_postinstall = psb_irq_postinstall,
> .irq_uninstall = psb_irq_uninstall,
> .irq_handler = psb_irq_handler,
> - .enable_vblank = psb_enable_vblank,
> - .disable_vblank = psb_disable_vblank,
> - .get_vblank_counter = psb_get_vblank_counter,
>
> .gem_free_object = psb_gem_free_object,
> .gem_vm_ops = &psb_gem_vm_ops,
> diff --git a/drivers/gpu/drm/gma500/psb_drv.h
> b/drivers/gpu/drm/gma500/psb_drv.h
> index 3d4ef3071d45..956926341316 100644
> --- a/drivers/gpu/drm/gma500/psb_drv.h
> +++ b/drivers/gpu/drm/gma500/psb_drv.h
> @@ -681,15 +681,15 @@ extern void psb_irq_turn_off_dpst(struct drm_device
> *dev);
> extern void psb_irq_uninstall_islands(struct drm_device *dev, int
> hw_islands);
> extern int psb_vblank_wait2(struct drm_device *dev, unsigned int *sequence);
> extern int psb_vblank_wait(struct drm_device *dev, unsigned int *sequence);
> -extern int psb_enable_vblank(struct drm_device *dev, unsigned int pipe);
> -extern void psb_disable_vblank(struct drm_device *dev, unsigned int pipe);
> +extern int psb_enable_vblank(struct drm_crtc *crtc);
> +extern void psb_disable_vblank(struct drm_crtc *crtc);
> void
> psb_enable_pipestat(struct drm_psb_private *dev_priv, int pipe, u32 mask);
>
> void
> psb_disable_pipestat(struct drm_psb_private *dev_priv, int pipe, u32 mask);
>
> -extern u32 psb_get_vblank_counter(struct drm_device *dev, unsigned int pipe);
> +extern u32 psb_get_vblank_counter(struct drm_crtc *crtc);
>
> /* framebuffer.c */
> extern int psbfb_probed(struct drm_device *dev);
> diff --git a/drivers/gpu/drm/gma500/psb_intel_display.c
> b/drivers/gpu/drm/gma500/psb_intel_display.c
> index fed3b563e62e..531c5485be17 100644
> --- a/drivers/gpu/drm/gma500/psb_intel_display.c
> +++ b/drivers/gpu/drm/gma500/psb_intel_display.c
> @@ -433,6 +433,9 @@ const struct drm_crtc_funcs psb_intel_crtc_funcs = {
> .set_config = gma_crtc_set_config,
> .destroy = gma_crtc_destroy,
> .page_flip = gma_crtc_page_flip,
> + .enable_vblank = psb_enable_vblank,
> + .disable_vblank = psb_disable_vblank,
> + .get_vblank_counter = psb_get_vblank_counter,
> };
>
> const struct gma_clock_funcs psb_clock_funcs = {
> diff --git a/drivers/gpu/drm/gma500/psb_irq.c
> b/drivers/gpu/drm/gma500/psb_irq.c
> index 91f90016dba9..15eb3770d817 100644
> --- a/drivers/gpu/drm/gma500/psb_irq.c
> +++ b/drivers/gpu/drm/gma500/psb_irq.c
> @@ -506,8 +506,10 @@ int psb_irq_disable_dpst(struct drm_device *dev)
> /*
> * It is used to enable VBLANK interrupt
> */
> -int psb_enable_vblank(struct drm_device *dev, unsigned int pipe)
> +int psb_enable_vbl
