1/*
2 * Copyright (c) 2006-2008 Intel Corporation
3 * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4 * Copyright (c) 2008 Red Hat Inc.
5 *
6 * DRM core CRTC related functions
7 *
8 * Permission to use, copy, modify, distribute, and sell this software and its
9 * documentation for any purpose is hereby granted without fee, provided that
10 * the above copyright notice appear in all copies and that both that copyright
11 * notice and this permission notice appear in supporting documentation, and
12 * that the name of the copyright holders not be used in advertising or
13 * publicity pertaining to distribution of the software without specific,
14 * written prior permission.  The copyright holders make no representations
15 * about the suitability of this software for any purpose.  It is provided "as
16 * is" without express or implied warranty.
17 *
18 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24 * OF THIS SOFTWARE.
25 *
26 * Authors:
27 *      Keith Packard
28 *	Eric Anholt <eric@anholt.net>
29 *      Dave Airlie <airlied@linux.ie>
30 *      Jesse Barnes <jesse.barnes@intel.com>
31 */
32#include <linux/ctype.h>
33#include <linux/list.h>
34#include <linux/slab.h>
35#include <linux/export.h>
36#include <linux/dma-fence.h>
37#include <linux/uaccess.h>
38#include <drm/drm_crtc.h>
39#include <drm/drm_edid.h>
40#include <drm/drm_fourcc.h>
41#include <drm/drm_modeset_lock.h>
42#include <drm/drm_atomic.h>
43#include <drm/drm_auth.h>
44#include <drm/drm_debugfs_crc.h>
45#include <drm/drm_drv.h>
46#include <drm/drm_print.h>
47#include <drm/drm_file.h>
48
49#include "drm_crtc_internal.h"
50#include "drm_internal.h"
51
52/**
53 * DOC: overview
54 *
55 * A CRTC represents the overall display pipeline. It receives pixel data from
56 * &drm_plane and blends them together. The &drm_display_mode is also attached
57 * to the CRTC, specifying display timings. On the output side the data is fed
58 * to one or more &drm_encoder, which are then each connected to one
59 * &drm_connector.
60 *
61 * To create a CRTC, a KMS drivers allocates and zeroes an instances of
62 * &struct drm_crtc (possibly as part of a larger structure) and registers it
63 * with a call to drm_crtc_init_with_planes().
64 *
65 * The CRTC is also the entry point for legacy modeset operations, see
66 * &drm_crtc_funcs.set_config, legacy plane operations, see
67 * &drm_crtc_funcs.page_flip and &drm_crtc_funcs.cursor_set2, and other legacy
68 * operations like &drm_crtc_funcs.gamma_set. For atomic drivers all these
69 * features are controlled through &drm_property and
70 * &drm_mode_config_funcs.atomic_check and &drm_mode_config_funcs.atomic_check.
71 */
72
73/**
74 * drm_crtc_from_index - find the registered CRTC at an index
75 * @dev: DRM device
76 * @idx: index of registered CRTC to find for
77 *
78 * Given a CRTC index, return the registered CRTC from DRM device's
79 * list of CRTCs with matching index. This is the inverse of drm_crtc_index().
80 * It's useful in the vblank callbacks (like &drm_driver.enable_vblank or
81 * &drm_driver.disable_vblank), since that still deals with indices instead
82 * of pointers to &struct drm_crtc."
83 */
84struct drm_crtc *drm_crtc_from_index(struct drm_device *dev, int idx)
85{
86	struct drm_crtc *crtc;
87
88	drm_for_each_crtc(crtc, dev)
89		if (idx == crtc->index)
90			return crtc;
91
92	return NULL;
93}
94EXPORT_SYMBOL(drm_crtc_from_index);
95
96int drm_crtc_force_disable(struct drm_crtc *crtc)
97{
98	struct drm_mode_set set = {
99		.crtc = crtc,
100	};
101
102	WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev));
103
104	return drm_mode_set_config_internal(&set);
105}
106
107static unsigned int drm_num_crtcs(struct drm_device *dev)
108{
109	unsigned int num = 0;
110	struct drm_crtc *tmp;
111
112	drm_for_each_crtc(tmp, dev) {
113		num++;
114	}
115
116	return num;
117}
118
119int drm_crtc_register_all(struct drm_device *dev)
120{
121	struct drm_crtc *crtc;
122	int ret = 0;
123
124	drm_for_each_crtc(crtc, dev) {
125		drm_debugfs_crtc_add(crtc);
126
127		if (crtc->funcs->late_register)
128			ret = crtc->funcs->late_register(crtc);
129		if (ret)
130			return ret;
131	}
132
133	return 0;
134}
135
136void drm_crtc_unregister_all(struct drm_device *dev)
137{
138	struct drm_crtc *crtc;
139
140	drm_for_each_crtc(crtc, dev) {
141		if (crtc->funcs->early_unregister)
142			crtc->funcs->early_unregister(crtc);
143		drm_debugfs_crtc_remove(crtc);
144	}
145}
146
147static int drm_crtc_crc_init(struct drm_crtc *crtc)
148{
149#ifdef CONFIG_DEBUG_FS
150	spin_lock_init(&crtc->crc.lock);
151	init_waitqueue_head(&crtc->crc.wq);
152	crtc->crc.source = kstrdup("auto", GFP_KERNEL);
153	if (!crtc->crc.source)
154		return -ENOMEM;
155#endif
156	return 0;
157}
158
159static void drm_crtc_crc_fini(struct drm_crtc *crtc)
160{
161#ifdef CONFIG_DEBUG_FS
162	kfree(crtc->crc.source);
163#endif
164}
165
166static const struct dma_fence_ops drm_crtc_fence_ops;
167
168static struct drm_crtc *fence_to_crtc(struct dma_fence *fence)
169{
170	BUG_ON(fence->ops != &drm_crtc_fence_ops);
171	return container_of(fence->lock, struct drm_crtc, fence_lock);
172}
173
174static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence)
175{
176	struct drm_crtc *crtc = fence_to_crtc(fence);
177
178	return crtc->dev->driver->name;
179}
180
181static const char *drm_crtc_fence_get_timeline_name(struct dma_fence *fence)
182{
183	struct drm_crtc *crtc = fence_to_crtc(fence);
184
185	return crtc->timeline_name;
186}
187
188static const struct dma_fence_ops drm_crtc_fence_ops = {
189	.get_driver_name = drm_crtc_fence_get_driver_name,
190	.get_timeline_name = drm_crtc_fence_get_timeline_name,
191};
192
193struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc)
194{
195	struct dma_fence *fence;
196
197	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
198	if (!fence)
199		return NULL;
200
201	dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock,
202		       crtc->fence_context, ++crtc->fence_seqno);
203
204	return fence;
205}
206
207/**
208 * DOC: standard CRTC properties
209 *
210 * DRM CRTCs have a few standardized properties:
211 *
212 * ACTIVE:
213 * 	Atomic property for setting the power state of the CRTC. When set to 1
214 * 	the CRTC will actively display content. When set to 0 the CRTC will be
215 * 	powered off. There is no expectation that user-space will reset CRTC
216 * 	resources like the mode and planes when setting ACTIVE to 0.
217 *
218 * 	User-space can rely on an ACTIVE change to 1 to never fail an atomic
219 * 	test as long as no other property has changed. If a change to ACTIVE
220 * 	fails an atomic test, this is a driver bug. For this reason setting
221 * 	ACTIVE to 0 must not release internal resources (like reserved memory
222 * 	bandwidth or clock generators).
223 *
224 * 	Note that the legacy DPMS property on connectors is internally routed
225 * 	to control this property for atomic drivers.
226 * MODE_ID:
227 * 	Atomic property for setting the CRTC display timings. The value is the
228 * 	ID of a blob containing the DRM mode info. To disable the CRTC,
229 * 	user-space must set this property to 0.
230 *
231 * 	Setting MODE_ID to 0 will release reserved resources for the CRTC.
232 */
233
234/**
235 * drm_crtc_init_with_planes - Initialise a new CRTC object with
236 *    specified primary and cursor planes.
237 * @dev: DRM device
238 * @crtc: CRTC object to init
239 * @primary: Primary plane for CRTC
240 * @cursor: Cursor plane for CRTC
241 * @funcs: callbacks for the new CRTC
242 * @name: printf style format string for the CRTC name, or NULL for default name
243 *
244 * Inits a new object created as base part of a driver crtc object. Drivers
245 * should use this function instead of drm_crtc_init(), which is only provided
246 * for backwards compatibility with drivers which do not yet support universal
247 * planes). For really simple hardware which has only 1 plane look at
248 * drm_simple_display_pipe_init() instead.
249 *
250 * Returns:
251 * Zero on success, error code on failure.
252 */
253int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
254			      struct drm_plane *primary,
255			      struct drm_plane *cursor,
256			      const struct drm_crtc_funcs *funcs,
257			      const char *name, ...)
258{
259	struct drm_mode_config *config = &dev->mode_config;
260	int ret;
261
262	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
263	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
264
265	/* crtc index is used with 32bit bitmasks */
266	if (WARN_ON(config->num_crtc >= 32))
267		return -EINVAL;
268
269	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
270		(!funcs->atomic_destroy_state ||
271		 !funcs->atomic_duplicate_state));
272
273	crtc->dev = dev;
274	crtc->funcs = funcs;
275
276	INIT_LIST_HEAD(&crtc->commit_list);
277	spin_lock_init(&crtc->commit_lock);
278
279	drm_modeset_lock_init(&crtc->mutex);
280	ret = drm_mode_object_add(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
281	if (ret)
282		return ret;
283
284	if (name) {
285		va_list ap;
286
287		va_start(ap, name);
288		crtc->name = kvasprintf(GFP_KERNEL, name, ap);
289		va_end(ap);
290	} else {
291		crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
292				       drm_num_crtcs(dev));
293	}
294	if (!crtc->name) {
295		drm_mode_object_unregister(dev, &crtc->base);
296		return -ENOMEM;
297	}
298
299	crtc->fence_context = dma_fence_context_alloc(1);
300	spin_lock_init(&crtc->fence_lock);
301	snprintf(crtc->timeline_name, sizeof(crtc->timeline_name),
302		 "CRTC:%d-%s", crtc->base.id, crtc->name);
303
304	crtc->base.properties = &crtc->properties;
305
306	list_add_tail(&crtc->head, &config->crtc_list);
307	crtc->index = config->num_crtc++;
308
309	crtc->primary = primary;
310	crtc->cursor = cursor;
311	if (primary && !primary->possible_crtcs)
312		primary->possible_crtcs = drm_crtc_mask(crtc);
313	if (cursor && !cursor->possible_crtcs)
314		cursor->possible_crtcs = drm_crtc_mask(crtc);
315
316	ret = drm_crtc_crc_init(crtc);
317	if (ret) {
318		drm_mode_object_unregister(dev, &crtc->base);
319		return ret;
320	}
321
322	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
323		drm_object_attach_property(&crtc->base, config->prop_active, 0);
324		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
325		drm_object_attach_property(&crtc->base,
326					   config->prop_out_fence_ptr, 0);
327		drm_object_attach_property(&crtc->base,
328					   config->prop_vrr_enabled, 0);
329	}
330
331	return 0;
332}
333EXPORT_SYMBOL(drm_crtc_init_with_planes);
334
335/**
336 * drm_crtc_cleanup - Clean up the core crtc usage
337 * @crtc: CRTC to cleanup
338 *
339 * This function cleans up @crtc and removes it from the DRM mode setting
340 * core. Note that the function does *not* free the crtc structure itself,
341 * this is the responsibility of the caller.
342 */
343void drm_crtc_cleanup(struct drm_crtc *crtc)
344{
345	struct drm_device *dev = crtc->dev;
346
347	/* Note that the crtc_list is considered to be static; should we
348	 * remove the drm_crtc at runtime we would have to decrement all
349	 * the indices on the drm_crtc after us in the crtc_list.
350	 */
351
352	drm_crtc_crc_fini(crtc);
353
354	kfree(crtc->gamma_store);
355	crtc->gamma_store = NULL;
356
357	drm_modeset_lock_fini(&crtc->mutex);
358
359	drm_mode_object_unregister(dev, &crtc->base);
360	list_del(&crtc->head);
361	dev->mode_config.num_crtc--;
362
363	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
364	if (crtc->state && crtc->funcs->atomic_destroy_state)
365		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
366
367	kfree(crtc->name);
368
369	memset(crtc, 0, sizeof(*crtc));
370}
371EXPORT_SYMBOL(drm_crtc_cleanup);
372
373/**
374 * drm_mode_getcrtc - get CRTC configuration
375 * @dev: drm device for the ioctl
376 * @data: data pointer for the ioctl
377 * @file_priv: drm file for the ioctl call
378 *
379 * Construct a CRTC configuration structure to return to the user.
380 *
381 * Called by the user via ioctl.
382 *
383 * Returns:
384 * Zero on success, negative errno on failure.
385 */
386int drm_mode_getcrtc(struct drm_device *dev,
387		     void *data, struct drm_file *file_priv)
388{
389	struct drm_mode_crtc *crtc_resp = data;
390	struct drm_crtc *crtc;
391	struct drm_plane *plane;
392
393	if (!drm_core_check_feature(dev, DRIVER_MODESET))
394		return -EOPNOTSUPP;
395
396	crtc = drm_crtc_find(dev, file_priv, crtc_resp->crtc_id);
397	if (!crtc)
398		return -ENOENT;
399
400	plane = crtc->primary;
401
402	crtc_resp->gamma_size = crtc->gamma_size;
403
404	drm_modeset_lock(&plane->mutex, NULL);
405	if (plane->state && plane->state->fb)
406		crtc_resp->fb_id = plane->state->fb->base.id;
407	else if (!plane->state && plane->fb)
408		crtc_resp->fb_id = plane->fb->base.id;
409	else
410		crtc_resp->fb_id = 0;
411
412	if (plane->state) {
413		crtc_resp->x = plane->state->src_x >> 16;
414		crtc_resp->y = plane->state->src_y >> 16;
415	}
416	drm_modeset_unlock(&plane->mutex);
417
418	drm_modeset_lock(&crtc->mutex, NULL);
419	if (crtc->state) {
420		if (crtc->state->enable) {
421			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
422			crtc_resp->mode_valid = 1;
423		} else {
424			crtc_resp->mode_valid = 0;
425		}
426	} else {
427		crtc_resp->x = crtc->x;
428		crtc_resp->y = crtc->y;
429
430		if (crtc->enabled) {
431			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
432			crtc_resp->mode_valid = 1;
433
434		} else {
435			crtc_resp->mode_valid = 0;
436		}
437	}
438	if (!file_priv->aspect_ratio_allowed)
439		crtc_resp->mode.flags &= ~DRM_MODE_FLAG_PIC_AR_MASK;
440	drm_modeset_unlock(&crtc->mutex);
441
442	return 0;
443}
444
445static int __drm_mode_set_config_internal(struct drm_mode_set *set,
446					  struct drm_modeset_acquire_ctx *ctx)
447{
448	struct drm_crtc *crtc = set->crtc;
449	struct drm_framebuffer *fb;
450	struct drm_crtc *tmp;
451	int ret;
452
453	WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev));
454
455	/*
456	 * NOTE: ->set_config can also disable other crtcs (if we steal all
457	 * connectors from it), hence we need to refcount the fbs across all
458	 * crtcs. Atomic modeset will have saner semantics ...
459	 */
460	drm_for_each_crtc(tmp, crtc->dev) {
461		struct drm_plane *plane = tmp->primary;
462
463		plane->old_fb = plane->fb;
464	}
465
466	fb = set->fb;
467
468	ret = crtc->funcs->set_config(set, ctx);
469	if (ret == 0) {
470		struct drm_plane *plane = crtc->primary;
471
472		plane->crtc = fb ? crtc : NULL;
473		plane->fb = fb;
474	}
475
476	drm_for_each_crtc(tmp, crtc->dev) {
477		struct drm_plane *plane = tmp->primary;
478
479		if (plane->fb)
480			drm_framebuffer_get(plane->fb);
481		if (plane->old_fb)
482			drm_framebuffer_put(plane->old_fb);
483		plane->old_fb = NULL;
484	}
485
486	return ret;
487}
488
489/**
490 * drm_mode_set_config_internal - helper to call &drm_mode_config_funcs.set_config
491 * @set: modeset config to set
492 *
493 * This is a little helper to wrap internal calls to the
494 * &drm_mode_config_funcs.set_config driver interface. The only thing it adds is
495 * correct refcounting dance.
496 *
497 * This should only be used by non-atomic legacy drivers.
498 *
499 * Returns:
500 * Zero on success, negative errno on failure.
501 */
502int drm_mode_set_config_internal(struct drm_mode_set *set)
503{
504	WARN_ON(drm_drv_uses_atomic_modeset(set->crtc->dev));
505
506	return __drm_mode_set_config_internal(set, NULL);
507}
508EXPORT_SYMBOL(drm_mode_set_config_internal);
509
510/**
511 * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
512 *     CRTC viewport
513 * @crtc: CRTC that framebuffer will be displayed on
514 * @x: x panning
515 * @y: y panning
516 * @mode: mode that framebuffer will be displayed under
517 * @fb: framebuffer to check size of
518 */
519int drm_crtc_check_viewport(const struct drm_crtc *crtc,
520			    int x, int y,
521			    const struct drm_display_mode *mode,
522			    const struct drm_framebuffer *fb)
523
524{
525	int hdisplay, vdisplay;
526
527	drm_mode_get_hv_timing(mode, &hdisplay, &vdisplay);
528
529	if (crtc->state &&
530	    drm_rotation_90_or_270(crtc->primary->state->rotation))
531		swap(hdisplay, vdisplay);
532
533	return drm_framebuffer_check_src_coords(x << 16, y << 16,
534						hdisplay << 16, vdisplay << 16,
535						fb);
536}
537EXPORT_SYMBOL(drm_crtc_check_viewport);
538
539/**
540 * drm_mode_setcrtc - set CRTC configuration
541 * @dev: drm device for the ioctl
542 * @data: data pointer for the ioctl
543 * @file_priv: drm file for the ioctl call
544 *
545 * Build a new CRTC configuration based on user request.
546 *
547 * Called by the user via ioctl.
548 *
549 * Returns:
550 * Zero on success, negative errno on failure.
551 */
552int drm_mode_setcrtc(struct drm_device *dev, void *data,
553		     struct drm_file *file_priv)
554{
555	struct drm_mode_config *config = &dev->mode_config;
556	struct drm_mode_crtc *crtc_req = data;
557	struct drm_crtc *crtc;
558	struct drm_plane *plane;
559	struct drm_connector **connector_set = NULL, *connector;
560	struct drm_framebuffer *fb = NULL;
561	struct drm_display_mode *mode = NULL;
562	struct drm_mode_set set;
563	uint32_t __user *set_connectors_ptr;
564	struct drm_modeset_acquire_ctx ctx;
565	int ret, i, num_connectors = 0;
566
567	if (!drm_core_check_feature(dev, DRIVER_MODESET))
568		return -EOPNOTSUPP;
569
570	/*
571	 * Universal plane src offsets are only 16.16, prevent havoc for
572	 * drivers using universal plane code internally.
573	 */
574	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
575		return -ERANGE;
576
577	crtc = drm_crtc_find(dev, file_priv, crtc_req->crtc_id);
578	if (!crtc) {
579		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
580		return -ENOENT;
581	}
582	DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
583
584	plane = crtc->primary;
585
586	/* allow disabling with the primary plane leased */
587	if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id))
588		return -EACCES;
589
590	DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx,
591				   DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);
592
593	if (crtc_req->mode_valid) {
594		/* If we have a mode we need a framebuffer. */
595		/* If we pass -1, set the mode with the currently bound fb */
596		if (crtc_req->fb_id == -1) {
597			struct drm_framebuffer *old_fb;
598
599			if (plane->state)
600				old_fb = plane->state->fb;
601			else
602				old_fb = plane->fb;
603
604			if (!old_fb) {
605				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
606				ret = -EINVAL;
607				goto out;
608			}
609
610			fb = old_fb;
611			/* Make refcounting symmetric with the lookup path. */
612			drm_framebuffer_get(fb);
613		} else {
614			fb = drm_framebuffer_lookup(dev, file_priv, crtc_req->fb_id);
615			if (!fb) {
616				DRM_DEBUG_KMS("Unknown FB ID%d\n",
617						crtc_req->fb_id);
618				ret = -ENOENT;
619				goto out;
620			}
621		}
622
623		mode = drm_mode_create(dev);
624		if (!mode) {
625			ret = -ENOMEM;
626			goto out;
627		}
628		if (!file_priv->aspect_ratio_allowed &&
629		    (crtc_req->mode.flags & DRM_MODE_FLAG_PIC_AR_MASK) != DRM_MODE_FLAG_PIC_AR_NONE) {
630			DRM_DEBUG_KMS("Unexpected aspect-ratio flag bits\n");
631			ret = -EINVAL;
632			goto out;
633		}
634
635
636		ret = drm_mode_convert_umode(dev, mode, &crtc_req->mode);
637		if (ret) {
638			DRM_DEBUG_KMS("Invalid mode (ret=%d, status=%s)\n",
639				      ret, drm_get_mode_status_name(mode->status));
640			drm_mode_debug_printmodeline(mode);
641			goto out;
642		}
643
644		/*
645		 * Check whether the primary plane supports the fb pixel format.
646		 * Drivers not implementing the universal planes API use a
647		 * default formats list provided by the DRM core which doesn't
648		 * match real hardware capabilities. Skip the check in that
649		 * case.
650		 */
651		if (!plane->format_default) {
652			ret = drm_plane_check_pixel_format(plane,
653							   fb->format->format,
654							   fb->modifier);
655			if (ret) {
656				struct drm_format_name_buf format_name;
657
658				DRM_DEBUG_KMS("Invalid pixel format %s, modifier 0x%llx\n",
659					      drm_get_format_name(fb->format->format,
660								  &format_name),
661					      fb->modifier);
662				goto out;
663			}
664		}
665
666		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
667					      mode, fb);
668		if (ret)
669			goto out;
670
671	}
672
673	if (crtc_req->count_connectors == 0 && mode) {
674		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
675		ret = -EINVAL;
676		goto out;
677	}
678
679	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
680		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
681			  crtc_req->count_connectors);
682		ret = -EINVAL;
683		goto out;
684	}
685
686	if (crtc_req->count_connectors > 0) {
687		u32 out_id;
688
689		/* Avoid unbounded kernel memory allocation */
690		if (crtc_req->count_connectors > config->num_connector) {
691			ret = -EINVAL;
692			goto out;
693		}
694
695		connector_set = kmalloc_array(crtc_req->count_connectors,
696					      sizeof(struct drm_connector *),
697					      GFP_KERNEL);
698		if (!connector_set) {
699			ret = -ENOMEM;
700			goto out;
701		}
702
703		for (i = 0; i < crtc_req->count_connectors; i++) {
704			connector_set[i] = NULL;
705			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
706			if (get_user(out_id, &set_connectors_ptr[i])) {
707				ret = -EFAULT;
708				goto out;
709			}
710
711			connector = drm_connector_lookup(dev, file_priv, out_id);
712			if (!connector) {
713				DRM_DEBUG_KMS("Connector id %d unknown\n",
714						out_id);
715				ret = -ENOENT;
716				goto out;
717			}
718			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
719					connector->base.id,
720					connector->name);
721
722			connector_set[i] = connector;
723			num_connectors++;
724		}
725	}
726
727	set.crtc = crtc;
728	set.x = crtc_req->x;
729	set.y = crtc_req->y;
730	set.mode = mode;
731	set.connectors = connector_set;
732	set.num_connectors = num_connectors;
733	set.fb = fb;
734
735	if (drm_drv_uses_atomic_modeset(dev))
736		ret = crtc->funcs->set_config(&set, &ctx);
737	else
738		ret = __drm_mode_set_config_internal(&set, &ctx);
739
740out:
741	if (fb)
742		drm_framebuffer_put(fb);
743
744	if (connector_set) {
745		for (i = 0; i < num_connectors; i++) {
746			if (connector_set[i])
747				drm_connector_put(connector_set[i]);
748		}
749	}
750	kfree(connector_set);
751	drm_mode_destroy(dev, mode);
752
753	/* In case we need to retry... */
754	connector_set = NULL;
755	fb = NULL;
756	mode = NULL;
757
758	DRM_MODESET_LOCK_ALL_END(dev, ctx, ret);
759
760	return ret;
761}
762
763int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
764			       struct drm_property *property,
765			       uint64_t value)
766{
767	int ret = -EINVAL;
768	struct drm_crtc *crtc = obj_to_crtc(obj);
769
770	if (crtc->funcs->set_property)
771		ret = crtc->funcs->set_property(crtc, property, value);
772	if (!ret)
773		drm_object_property_set_value(obj, property, value);
774
775	return ret;
776}
777