1 /* $NetBSD: drm_crtc.c,v 1.19 2021/12/19 00:56:18 riastradh Exp $ */ 2 3 /* 4 * Copyright (c) 2006-2008 Intel Corporation 5 * Copyright (c) 2007 Dave Airlie <airlied (at) linux.ie> 6 * Copyright (c) 2008 Red Hat Inc. 7 * 8 * DRM core CRTC related functions 9 * 10 * Permission to use, copy, modify, distribute, and sell this software and its 11 * documentation for any purpose is hereby granted without fee, provided that 12 * the above copyright notice appear in all copies and that both that copyright 13 * notice and this permission notice appear in supporting documentation, and 14 * that the name of the copyright holders not be used in advertising or 15 * publicity pertaining to distribution of the software without specific, 16 * written prior permission. The copyright holders make no representations 17 * about the suitability of this software for any purpose. It is provided "as 18 * is" without express or implied warranty. 19 * 20 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 21 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 22 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR 23 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, 24 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 25 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE 26 * OF THIS SOFTWARE. 27 * 28 * Authors: 29 * Keith Packard 30 * Eric Anholt <eric (at) anholt.net> 31 * Dave Airlie <airlied (at) linux.ie> 32 * Jesse Barnes <jesse.barnes (at) intel.com> 33 */ 34 #include <sys/cdefs.h> 35 __KERNEL_RCSID(0, "$NetBSD: drm_crtc.c,v 1.19 2021/12/19 00:56:18 riastradh Exp $"); 36 37 #include <linux/ctype.h> 38 #include <linux/list.h> 39 #include <linux/slab.h> 40 #include <linux/export.h> 41 #include <linux/dma-fence.h> 42 #include <linux/uaccess.h> 43 #include <drm/drm_crtc.h> 44 #include <drm/drm_edid.h> 45 #include <drm/drm_fourcc.h> 46 #include <drm/drm_modeset_lock.h> 47 #include <drm/drm_atomic.h> 48 #include <drm/drm_auth.h> 49 #include <drm/drm_debugfs_crc.h> 50 #include <drm/drm_drv.h> 51 #include <drm/drm_print.h> 52 #include <drm/drm_file.h> 53 54 #include "drm_crtc_internal.h" 55 #include "drm_internal.h" 56 57 #include <linux/nbsd-namespace.h> 58 /** 59 * DOC: overview 60 * 61 * A CRTC represents the overall display pipeline. It receives pixel data from 62 * &drm_plane and blends them together. The &drm_display_mode is also attached 63 * to the CRTC, specifying display timings. On the output side the data is fed 64 * to one or more &drm_encoder, which are then each connected to one 65 * &drm_connector. 66 * 67 * To create a CRTC, a KMS drivers allocates and zeroes an instances of 68 * &struct drm_crtc (possibly as part of a larger structure) and registers it 69 * with a call to drm_crtc_init_with_planes(). 70 * 71 * The CRTC is also the entry point for legacy modeset operations, see 72 * &drm_crtc_funcs.set_config, legacy plane operations, see 73 * &drm_crtc_funcs.page_flip and &drm_crtc_funcs.cursor_set2, and other legacy 74 * operations like &drm_crtc_funcs.gamma_set. For atomic drivers all these 75 * features are controlled through &drm_property and 76 * &drm_mode_config_funcs.atomic_check and &drm_mode_config_funcs.atomic_check. 77 */ 78 79 /** 80 * drm_crtc_from_index - find the registered CRTC at an index 81 * @dev: DRM device 82 * @idx: index of registered CRTC to find for 83 * 84 * Given a CRTC index, return the registered CRTC from DRM device's 85 * list of CRTCs with matching index. This is the inverse of drm_crtc_index(). 86 * It's useful in the vblank callbacks (like &drm_driver.enable_vblank or 87 * &drm_driver.disable_vblank), since that still deals with indices instead 88 * of pointers to &struct drm_crtc." 89 */ 90 struct drm_crtc *drm_crtc_from_index(struct drm_device *dev, int idx) 91 { 92 struct drm_crtc *crtc; 93 94 drm_for_each_crtc(crtc, dev) 95 if (idx == crtc->index) 96 return crtc; 97 98 return NULL; 99 } 100 EXPORT_SYMBOL(drm_crtc_from_index); 101 102 int drm_crtc_force_disable(struct drm_crtc *crtc) 103 { 104 struct drm_mode_set set = { 105 .crtc = crtc, 106 }; 107 108 WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev)); 109 110 return drm_mode_set_config_internal(&set); 111 } 112 113 static unsigned int drm_num_crtcs(struct drm_device *dev) 114 { 115 unsigned int num = 0; 116 struct drm_crtc *tmp; 117 118 drm_for_each_crtc(tmp, dev) { 119 num++; 120 } 121 122 return num; 123 } 124 125 int drm_crtc_register_all(struct drm_device *dev) 126 { 127 struct drm_crtc *crtc; 128 int ret = 0; 129 130 drm_for_each_crtc(crtc, dev) { 131 drm_debugfs_crtc_add(crtc); 132 133 if (crtc->funcs->late_register) 134 ret = crtc->funcs->late_register(crtc); 135 if (ret) 136 return ret; 137 } 138 139 return 0; 140 } 141 142 void drm_crtc_unregister_all(struct drm_device *dev) 143 { 144 struct drm_crtc *crtc; 145 146 drm_for_each_crtc(crtc, dev) { 147 if (crtc->funcs->early_unregister) 148 crtc->funcs->early_unregister(crtc); 149 drm_debugfs_crtc_remove(crtc); 150 } 151 } 152 153 static int drm_crtc_crc_init(struct drm_crtc *crtc) 154 { 155 #ifdef CONFIG_DEBUG_FS 156 spin_lock_init(&crtc->crc.lock); 157 init_waitqueue_head(&crtc->crc.wq); 158 crtc->crc.source = kstrdup("auto", GFP_KERNEL); 159 if (!crtc->crc.source) 160 return -ENOMEM; 161 #endif 162 return 0; 163 } 164 165 static void drm_crtc_crc_fini(struct drm_crtc *crtc) 166 { 167 #ifdef CONFIG_DEBUG_FS 168 kfree(crtc->crc.source); 169 #endif 170 } 171 172 static const struct dma_fence_ops drm_crtc_fence_ops; 173 174 static struct drm_crtc *fence_to_crtc(struct dma_fence *fence) 175 { 176 BUG_ON(fence->ops != &drm_crtc_fence_ops); 177 return container_of(fence->lock, struct drm_crtc, fence_lock); 178 } 179 180 static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence) 181 { 182 struct drm_crtc *crtc = fence_to_crtc(fence); 183 184 return crtc->dev->driver->name; 185 } 186 187 static const char *drm_crtc_fence_get_timeline_name(struct dma_fence *fence) 188 { 189 struct drm_crtc *crtc = fence_to_crtc(fence); 190 191 return crtc->timeline_name; 192 } 193 194 static const struct dma_fence_ops drm_crtc_fence_ops = { 195 .get_driver_name = drm_crtc_fence_get_driver_name, 196 .get_timeline_name = drm_crtc_fence_get_timeline_name, 197 }; 198 199 struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc) 200 { 201 struct dma_fence *fence; 202 203 fence = kzalloc(sizeof(*fence), GFP_KERNEL); 204 if (!fence) 205 return NULL; 206 207 dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock, 208 crtc->fence_context, ++crtc->fence_seqno); 209 210 return fence; 211 } 212 213 /** 214 * drm_crtc_init_with_planes - Initialise a new CRTC object with 215 * specified primary and cursor planes. 216 * @dev: DRM device 217 * @crtc: CRTC object to init 218 * @primary: Primary plane for CRTC 219 * @cursor: Cursor plane for CRTC 220 * @funcs: callbacks for the new CRTC 221 * @name: printf style format string for the CRTC name, or NULL for default name 222 * 223 * Inits a new object created as base part of a driver crtc object. Drivers 224 * should use this function instead of drm_crtc_init(), which is only provided 225 * for backwards compatibility with drivers which do not yet support universal 226 * planes). For really simple hardware which has only 1 plane look at 227 * drm_simple_display_pipe_init() instead. 228 * 229 * Returns: 230 * Zero on success, error code on failure. 231 */ 232 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc, 233 struct drm_plane *primary, 234 struct drm_plane *cursor, 235 const struct drm_crtc_funcs *funcs, 236 const char *name, ...) 237 { 238 struct drm_mode_config *config = &dev->mode_config; 239 int ret; 240 241 WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY); 242 WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR); 243 244 /* crtc index is used with 32bit bitmasks */ 245 if (WARN_ON(config->num_crtc >= 32)) 246 return -EINVAL; 247 248 WARN_ON(drm_drv_uses_atomic_modeset(dev) && 249 (!funcs->atomic_destroy_state || 250 !funcs->atomic_duplicate_state)); 251 252 crtc->dev = dev; 253 crtc->funcs = funcs; 254 255 INIT_LIST_HEAD(&crtc->commit_list); 256 spin_lock_init(&crtc->commit_lock); 257 258 drm_modeset_lock_init(&crtc->mutex); 259 ret = drm_mode_object_add(dev, &crtc->base, DRM_MODE_OBJECT_CRTC); 260 if (ret) 261 return ret; 262 263 if (name) { 264 va_list ap; 265 266 va_start(ap, name); 267 crtc->name = kvasprintf(GFP_KERNEL, name, ap); 268 va_end(ap); 269 } else { 270 crtc->name = kasprintf(GFP_KERNEL, "crtc-%d", 271 drm_num_crtcs(dev)); 272 } 273 if (!crtc->name) { 274 drm_mode_object_unregister(dev, &crtc->base); 275 return -ENOMEM; 276 } 277 278 crtc->fence_context = dma_fence_context_alloc(1); 279 spin_lock_init(&crtc->fence_lock); 280 snprintf(crtc->timeline_name, sizeof(crtc->timeline_name), 281 "CRTC:%d-%s", crtc->base.id, crtc->name); 282 283 crtc->base.properties = &crtc->properties; 284 285 list_add_tail(&crtc->head, &config->crtc_list); 286 crtc->index = config->num_crtc++; 287 288 crtc->primary = primary; 289 crtc->cursor = cursor; 290 if (primary && !primary->possible_crtcs) 291 primary->possible_crtcs = drm_crtc_mask(crtc); 292 if (cursor && !cursor->possible_crtcs) 293 cursor->possible_crtcs = drm_crtc_mask(crtc); 294 295 ret = drm_crtc_crc_init(crtc); 296 if (ret) { 297 drm_mode_object_unregister(dev, &crtc->base); 298 return ret; 299 } 300 301 if (drm_core_check_feature(dev, DRIVER_ATOMIC)) { 302 drm_object_attach_property(&crtc->base, config->prop_active, 0); 303 drm_object_attach_property(&crtc->base, config->prop_mode_id, 0); 304 drm_object_attach_property(&crtc->base, 305 config->prop_out_fence_ptr, 0); 306 drm_object_attach_property(&crtc->base, 307 config->prop_vrr_enabled, 0); 308 } 309 310 return 0; 311 } 312 EXPORT_SYMBOL(drm_crtc_init_with_planes); 313 314 /** 315 * drm_crtc_cleanup - Clean up the core crtc usage 316 * @crtc: CRTC to cleanup 317 * 318 * This function cleans up @crtc and removes it from the DRM mode setting 319 * core. Note that the function does *not* free the crtc structure itself, 320 * this is the responsibility of the caller. 321 */ 322 void drm_crtc_cleanup(struct drm_crtc *crtc) 323 { 324 struct drm_device *dev = crtc->dev; 325 326 /* Note that the crtc_list is considered to be static; should we 327 * remove the drm_crtc at runtime we would have to decrement all 328 * the indices on the drm_crtc after us in the crtc_list. 329 */ 330 331 drm_crtc_crc_fini(crtc); 332 333 kfree(crtc->gamma_store); 334 crtc->gamma_store = NULL; 335 336 drm_modeset_lock_fini(&crtc->mutex); 337 338 drm_mode_object_unregister(dev, &crtc->base); 339 list_del(&crtc->head); 340 dev->mode_config.num_crtc--; 341 342 WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state); 343 if (crtc->state && crtc->funcs->atomic_destroy_state) 344 crtc->funcs->atomic_destroy_state(crtc, crtc->state); 345 346 kfree(crtc->name); 347 348 memset(crtc, 0, sizeof(*crtc)); 349 } 350 EXPORT_SYMBOL(drm_crtc_cleanup); 351 352 /** 353 * drm_mode_getcrtc - get CRTC configuration 354 * @dev: drm device for the ioctl 355 * @data: data pointer for the ioctl 356 * @file_priv: drm file for the ioctl call 357 * 358 * Construct a CRTC configuration structure to return to the user. 359 * 360 * Called by the user via ioctl. 361 * 362 * Returns: 363 * Zero on success, negative errno on failure. 364 */ 365 int drm_mode_getcrtc(struct drm_device *dev, 366 void *data, struct drm_file *file_priv) 367 { 368 struct drm_mode_crtc *crtc_resp = data; 369 struct drm_crtc *crtc; 370 struct drm_plane *plane; 371 372 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 373 return -EOPNOTSUPP; 374 375 crtc = drm_crtc_find(dev, file_priv, crtc_resp->crtc_id); 376 if (!crtc) 377 return -ENOENT; 378 379 plane = crtc->primary; 380 381 crtc_resp->gamma_size = crtc->gamma_size; 382 383 drm_modeset_lock(&plane->mutex, NULL); 384 if (plane->state && plane->state->fb) 385 crtc_resp->fb_id = plane->state->fb->base.id; 386 else if (!plane->state && plane->fb) 387 crtc_resp->fb_id = plane->fb->base.id; 388 else 389 crtc_resp->fb_id = 0; 390 391 if (plane->state) { 392 crtc_resp->x = plane->state->src_x >> 16; 393 crtc_resp->y = plane->state->src_y >> 16; 394 } 395 drm_modeset_unlock(&plane->mutex); 396 397 drm_modeset_lock(&crtc->mutex, NULL); 398 if (crtc->state) { 399 if (crtc->state->enable) { 400 drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode); 401 crtc_resp->mode_valid = 1; 402 } else { 403 crtc_resp->mode_valid = 0; 404 } 405 } else { 406 crtc_resp->x = crtc->x; 407 crtc_resp->y = crtc->y; 408 409 if (crtc->enabled) { 410 drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode); 411 crtc_resp->mode_valid = 1; 412 413 } else { 414 crtc_resp->mode_valid = 0; 415 } 416 } 417 if (!file_priv->aspect_ratio_allowed) 418 crtc_resp->mode.flags &= ~DRM_MODE_FLAG_PIC_AR_MASK; 419 drm_modeset_unlock(&crtc->mutex); 420 421 return 0; 422 } 423 424 static int __drm_mode_set_config_internal(struct drm_mode_set *set, 425 struct drm_modeset_acquire_ctx *ctx) 426 { 427 struct drm_crtc *crtc = set->crtc; 428 struct drm_framebuffer *fb; 429 struct drm_crtc *tmp; 430 int ret; 431 432 WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev)); 433 434 /* 435 * NOTE: ->set_config can also disable other crtcs (if we steal all 436 * connectors from it), hence we need to refcount the fbs across all 437 * crtcs. Atomic modeset will have saner semantics ... 438 */ 439 drm_for_each_crtc(tmp, crtc->dev) { 440 struct drm_plane *plane = tmp->primary; 441 442 plane->old_fb = plane->fb; 443 } 444 445 fb = set->fb; 446 447 ret = crtc->funcs->set_config(set, ctx); 448 if (ret == 0) { 449 struct drm_plane *plane = crtc->primary; 450 451 plane->crtc = fb ? crtc : NULL; 452 plane->fb = fb; 453 } 454 455 drm_for_each_crtc(tmp, crtc->dev) { 456 struct drm_plane *plane = tmp->primary; 457 458 if (plane->fb) 459 drm_framebuffer_get(plane->fb); 460 if (plane->old_fb) 461 drm_framebuffer_put(plane->old_fb); 462 plane->old_fb = NULL; 463 } 464 465 return ret; 466 } 467 468 /** 469 * drm_mode_set_config_internal - helper to call &drm_mode_config_funcs.set_config 470 * @set: modeset config to set 471 * 472 * This is a little helper to wrap internal calls to the 473 * &drm_mode_config_funcs.set_config driver interface. The only thing it adds is 474 * correct refcounting dance. 475 * 476 * This should only be used by non-atomic legacy drivers. 477 * 478 * Returns: 479 * Zero on success, negative errno on failure. 480 */ 481 int drm_mode_set_config_internal(struct drm_mode_set *set) 482 { 483 WARN_ON(drm_drv_uses_atomic_modeset(set->crtc->dev)); 484 485 return __drm_mode_set_config_internal(set, NULL); 486 } 487 EXPORT_SYMBOL(drm_mode_set_config_internal); 488 489 /** 490 * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the 491 * CRTC viewport 492 * @crtc: CRTC that framebuffer will be displayed on 493 * @x: x panning 494 * @y: y panning 495 * @mode: mode that framebuffer will be displayed under 496 * @fb: framebuffer to check size of 497 */ 498 int drm_crtc_check_viewport(const struct drm_crtc *crtc, 499 int x, int y, 500 const struct drm_display_mode *mode, 501 const struct drm_framebuffer *fb) 502 503 { 504 int hdisplay, vdisplay; 505 506 drm_mode_get_hv_timing(mode, &hdisplay, &vdisplay); 507 508 if (crtc->state && 509 drm_rotation_90_or_270(crtc->primary->state->rotation)) 510 swap(hdisplay, vdisplay); 511 512 return drm_framebuffer_check_src_coords(x << 16, y << 16, 513 hdisplay << 16, vdisplay << 16, 514 fb); 515 } 516 EXPORT_SYMBOL(drm_crtc_check_viewport); 517 518 /** 519 * drm_mode_setcrtc - set CRTC configuration 520 * @dev: drm device for the ioctl 521 * @data: data pointer for the ioctl 522 * @file_priv: drm file for the ioctl call 523 * 524 * Build a new CRTC configuration based on user request. 525 * 526 * Called by the user via ioctl. 527 * 528 * Returns: 529 * Zero on success, negative errno on failure. 530 */ 531 int drm_mode_setcrtc(struct drm_device *dev, void *data, 532 struct drm_file *file_priv) 533 { 534 struct drm_mode_config *config = &dev->mode_config; 535 struct drm_mode_crtc *crtc_req = data; 536 struct drm_crtc *crtc; 537 struct drm_plane *plane; 538 struct drm_connector **connector_set = NULL, *connector; 539 struct drm_framebuffer *fb = NULL; 540 struct drm_display_mode *mode = NULL; 541 struct drm_mode_set set; 542 uint32_t __user *set_connectors_ptr; 543 struct drm_modeset_acquire_ctx ctx; 544 int ret; 545 int i; 546 547 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 548 return -EOPNOTSUPP; 549 550 /* 551 * Universal plane src offsets are only 16.16, prevent havoc for 552 * drivers using universal plane code internally. 553 */ 554 if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) 555 return -ERANGE; 556 557 crtc = drm_crtc_find(dev, file_priv, crtc_req->crtc_id); 558 if (!crtc) { 559 DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id); 560 return -ENOENT; 561 } 562 DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name); 563 564 plane = crtc->primary; 565 566 /* allow disabling with the primary plane leased */ 567 if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id)) 568 return -EACCES; 569 570 mutex_lock(&crtc->dev->mode_config.mutex); 571 DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx, 572 DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret); 573 574 if (crtc_req->mode_valid) { 575 /* If we have a mode we need a framebuffer. */ 576 /* If we pass -1, set the mode with the currently bound fb */ 577 if (crtc_req->fb_id == -1) { 578 struct drm_framebuffer *old_fb; 579 580 if (plane->state) 581 old_fb = plane->state->fb; 582 else 583 old_fb = plane->fb; 584 585 if (!old_fb) { 586 DRM_DEBUG_KMS("CRTC doesn't have current FB\n"); 587 ret = -EINVAL; 588 goto out; 589 } 590 591 fb = old_fb; 592 /* Make refcounting symmetric with the lookup path. */ 593 drm_framebuffer_get(fb); 594 } else { 595 fb = drm_framebuffer_lookup(dev, file_priv, crtc_req->fb_id); 596 if (!fb) { 597 DRM_DEBUG_KMS("Unknown FB ID%d\n", 598 crtc_req->fb_id); 599 ret = -ENOENT; 600 goto out; 601 } 602 } 603 604 mode = drm_mode_create(dev); 605 if (!mode) { 606 ret = -ENOMEM; 607 goto out; 608 } 609 if (!file_priv->aspect_ratio_allowed && 610 (crtc_req->mode.flags & DRM_MODE_FLAG_PIC_AR_MASK) != DRM_MODE_FLAG_PIC_AR_NONE) { 611 DRM_DEBUG_KMS("Unexpected aspect-ratio flag bits\n"); 612 ret = -EINVAL; 613 goto out; 614 } 615 616 617 ret = drm_mode_convert_umode(dev, mode, &crtc_req->mode); 618 if (ret) { 619 DRM_DEBUG_KMS("Invalid mode (ret=%d, status=%s)\n", 620 ret, drm_get_mode_status_name(mode->status)); 621 drm_mode_debug_printmodeline(mode); 622 goto out; 623 } 624 625 /* 626 * Check whether the primary plane supports the fb pixel format. 627 * Drivers not implementing the universal planes API use a 628 * default formats list provided by the DRM core which doesn't 629 * match real hardware capabilities. Skip the check in that 630 * case. 631 */ 632 if (!plane->format_default) { 633 ret = drm_plane_check_pixel_format(plane, 634 fb->format->format, 635 fb->modifier); 636 if (ret) { 637 struct drm_format_name_buf format_name; 638 DRM_DEBUG_KMS("Invalid pixel format %s, modifier 0x%"PRIx64"\n", 639 drm_get_format_name(fb->format->format, 640 &format_name), 641 fb->modifier); 642 goto out; 643 } 644 } 645 646 ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y, 647 mode, fb); 648 if (ret) 649 goto out; 650 651 } 652 653 if (crtc_req->count_connectors == 0 && mode) { 654 DRM_DEBUG_KMS("Count connectors is 0 but mode set\n"); 655 ret = -EINVAL; 656 goto out; 657 } 658 659 if (crtc_req->count_connectors > 0 && (!mode || !fb)) { 660 DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n", 661 crtc_req->count_connectors); 662 ret = -EINVAL; 663 goto out; 664 } 665 666 if (crtc_req->count_connectors > 0) { 667 u32 out_id; 668 669 /* Avoid unbounded kernel memory allocation */ 670 if (crtc_req->count_connectors > config->num_connector) { 671 ret = -EINVAL; 672 goto out; 673 } 674 675 connector_set = kmalloc_array(crtc_req->count_connectors, 676 sizeof(struct drm_connector *), 677 GFP_KERNEL); 678 if (!connector_set) { 679 ret = -ENOMEM; 680 goto out; 681 } 682 683 for (i = 0; i < crtc_req->count_connectors; i++) { 684 connector_set[i] = NULL; 685 set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; 686 if (get_user(out_id, &set_connectors_ptr[i])) { 687 ret = -EFAULT; 688 goto out; 689 } 690 691 connector = drm_connector_lookup(dev, file_priv, out_id); 692 if (!connector) { 693 DRM_DEBUG_KMS("Connector id %d unknown\n", 694 out_id); 695 ret = -ENOENT; 696 goto out; 697 } 698 DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", 699 connector->base.id, 700 connector->name); 701 702 connector_set[i] = connector; 703 } 704 } 705 706 set.crtc = crtc; 707 set.x = crtc_req->x; 708 set.y = crtc_req->y; 709 set.mode = mode; 710 set.connectors = connector_set; 711 set.num_connectors = crtc_req->count_connectors; 712 set.fb = fb; 713 714 if (drm_drv_uses_atomic_modeset(dev)) 715 ret = crtc->funcs->set_config(&set, &ctx); 716 else 717 ret = __drm_mode_set_config_internal(&set, &ctx); 718 719 out: 720 if (fb) 721 drm_framebuffer_put(fb); 722 723 if (connector_set) { 724 for (i = 0; i < crtc_req->count_connectors; i++) { 725 if (connector_set[i]) 726 drm_connector_put(connector_set[i]); 727 } 728 } 729 kfree(connector_set); 730 drm_mode_destroy(dev, mode); 731 732 /* In case we need to retry... */ 733 connector_set = NULL; 734 fb = NULL; 735 mode = NULL; 736 737 DRM_MODESET_LOCK_ALL_END(ctx, ret); 738 mutex_unlock(&crtc->dev->mode_config.mutex); 739 740 return ret; 741 } 742 743 int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj, 744 struct drm_property *property, 745 uint64_t value) 746 { 747 int ret = -EINVAL; 748 struct drm_crtc *crtc = obj_to_crtc(obj); 749 750 if (crtc->funcs->set_property) 751 ret = crtc->funcs->set_property(crtc, property, value); 752 if (!ret) 753 drm_object_property_set_value(obj, property, value); 754 755 return ret; 756 } 757
Indexes created Sat Sep 20 22:09:52 GMT 2025