drivers/gpu/drm/drm_crtc.c

   1 /*
   2  * Copyright (c) 2006-2008 Intel Corporation
   3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
   4  * Copyright (c) 2008 Red Hat Inc.
   5  *
   6  * DRM core CRTC related functions
   7  *
   8  * Permission to use, copy, modify, distribute, and sell this software and its
   9  * documentation for any purpose is hereby granted without fee, provided that
  10  * the above copyright notice appear in all copies and that both that copyright
  11  * notice and this permission notice appear in supporting documentation, and
  12  * that the name of the copyright holders not be used in advertising or
  13  * publicity pertaining to distribution of the software without specific,
  14  * written prior permission.  The copyright holders make no representations
  15  * about the suitability of this software for any purpose.  It is provided "as
  16  * is" without express or implied warranty.
  17  *
  18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  24  * OF THIS SOFTWARE.
  25  *
  26  * Authors:
  27  *      Keith Packard
  28  *      Eric Anholt <eric@anholt.net>
  29  *      Dave Airlie <airlied@linux.ie>
  30  *      Jesse Barnes <jesse.barnes@intel.com>
  31  */
  32 #include <linux/ctype.h>
  33 #include <linux/list.h>
  34 #include <linux/slab.h>
  35 #include <linux/export.h>
  36 #include <linux/dma-fence.h>
  37 #include <drm/drmP.h>
  38 #include <drm/drm_crtc.h>
  39 #include <drm/drm_edid.h>
  40 #include <drm/drm_fourcc.h>
  41 #include <drm/drm_modeset_lock.h>
  42 #include <drm/drm_atomic.h>
  43 #include <drm/drm_auth.h>
  44 #include <drm/drm_debugfs_crc.h>
  45
  46 #include "drm_crtc_internal.h"
  47 #include "drm_internal.h"
  48
  49 /**
  50  * DOC: overview
  51  *
  52  * A CRTC represents the overall display pipeline. It receives pixel data from
  53  * &drm_plane and blends them together. The &drm_display_mode is also attached
  54  * to the CRTC, specifying display timings. On the output side the data is fed
  55  * to one or more &drm_encoder, which are then each connected to one
  56  * &drm_connector.
  57  *
  58  * To create a CRTC, a KMS drivers allocates and zeroes an instances of
  59  * &struct drm_crtc (possibly as part of a larger structure) and registers it
  60  * with a call to drm_crtc_init_with_planes().
  61  *
  62  * The CRTC is also the entry point for legacy modeset operations, see
  63  * &drm_crtc_funcs.set_config, legacy plane operations, see
  64  * &drm_crtc_funcs.page_flip and &drm_crtc_funcs.cursor_set2, and other legacy
  65  * operations like &drm_crtc_funcs.gamma_set. For atomic drivers all these
  66  * features are controlled through &drm_property and
  67  * &drm_mode_config_funcs.atomic_check and &drm_mode_config_funcs.atomic_check.
  68  */
  69
  70 /**
  71  * drm_crtc_from_index - find the registered CRTC at an index
  72  * @dev: DRM device
  73  * @idx: index of registered CRTC to find for
  74  *
  75  * Given a CRTC index, return the registered CRTC from DRM device's
  76  * list of CRTCs with matching index. This is the inverse of drm_crtc_index().
  77  * It's useful in the vblank callbacks (like &drm_driver.enable_vblank or
  78  * &drm_driver.disable_vblank), since that still deals with indices instead
  79  * of pointers to &struct drm_crtc."
  80  */
  81 struct drm_crtc *drm_crtc_from_index(struct drm_device *dev, int idx)
  82 {
  83         struct drm_crtc *crtc;
  84
  85         drm_for_each_crtc(crtc, dev)
  86                 if (idx == crtc->index)
  87                         return crtc;
  88
  89         return NULL;
  90 }
  91 EXPORT_SYMBOL(drm_crtc_from_index);
  92
  93 /**
  94  * drm_crtc_force_disable - Forcibly turn off a CRTC
  95  * @crtc: CRTC to turn off
  96  *
  97  * Returns:
  98  * Zero on success, error code on failure.
  99  */
 100 int drm_crtc_force_disable(struct drm_crtc *crtc)
 101 {
 102         struct drm_mode_set set = {
 103                 .crtc = crtc,
 104         };
 105
 106         return drm_mode_set_config_internal(&set);
 107 }
 108 EXPORT_SYMBOL(drm_crtc_force_disable);
 109
 110 /**
 111  * drm_crtc_force_disable_all - Forcibly turn off all enabled CRTCs
 112  * @dev: DRM device whose CRTCs to turn off
 113  *
 114  * Drivers may want to call this on unload to ensure that all displays are
 115  * unlit and the GPU is in a consistent, low power state. Takes modeset locks.
 116  *
 117  * Returns:
 118  * Zero on success, error code on failure.
 119  */
 120 int drm_crtc_force_disable_all(struct drm_device *dev)
 121 {
 122         struct drm_crtc *crtc;
 123         int ret = 0;
 124
 125         drm_modeset_lock_all(dev);
 126         drm_for_each_crtc(crtc, dev)
 127                 if (crtc->enabled) {
 128                         ret = drm_crtc_force_disable(crtc);
 129                         if (ret)
 130                                 goto out;
 131                 }
 132 out:
 133         drm_modeset_unlock_all(dev);
 134         return ret;
 135 }
 136 EXPORT_SYMBOL(drm_crtc_force_disable_all);
 137
 138 static unsigned int drm_num_crtcs(struct drm_device *dev)
 139 {
 140         unsigned int num = 0;
 141         struct drm_crtc *tmp;
 142
 143         drm_for_each_crtc(tmp, dev) {
 144                 num++;
 145         }
 146
 147         return num;
 148 }
 149
 150 int drm_crtc_register_all(struct drm_device *dev)
 151 {
 152         struct drm_crtc *crtc;
 153         int ret = 0;
 154
 155         drm_for_each_crtc(crtc, dev) {
 156                 if (drm_debugfs_crtc_add(crtc))
 157                         DRM_ERROR("Failed to initialize debugfs entry for CRTC '%s'.\n",
 158                                   crtc->name);
 159
 160                 if (crtc->funcs->late_register)
 161                         ret = crtc->funcs->late_register(crtc);
 162                 if (ret)
 163                         return ret;
 164         }
 165
 166         return 0;
 167 }
 168
 169 void drm_crtc_unregister_all(struct drm_device *dev)
 170 {
 171         struct drm_crtc *crtc;
 172
 173         drm_for_each_crtc(crtc, dev) {
 174                 if (crtc->funcs->early_unregister)
 175                         crtc->funcs->early_unregister(crtc);
 176                 drm_debugfs_crtc_remove(crtc);
 177         }
 178 }
 179
 180 static int drm_crtc_crc_init(struct drm_crtc *crtc)
 181 {
 182 #ifdef CONFIG_DEBUG_FS
 183         spin_lock_init(&crtc->crc.lock);
 184         init_waitqueue_head(&crtc->crc.wq);
 185         crtc->crc.source = kstrdup("auto", GFP_KERNEL);
 186         if (!crtc->crc.source)
 187                 return -ENOMEM;
 188 #endif
 189         return 0;
 190 }
 191
 192 static void drm_crtc_crc_fini(struct drm_crtc *crtc)
 193 {
 194 #ifdef CONFIG_DEBUG_FS
 195         kfree(crtc->crc.source);
 196 #endif
 197 }
 198
 199 static const struct dma_fence_ops drm_crtc_fence_ops;
 200
 201 static struct drm_crtc *fence_to_crtc(struct dma_fence *fence)
 202 {
 203         BUG_ON(fence->ops != &drm_crtc_fence_ops);
 204         return container_of(fence->lock, struct drm_crtc, fence_lock);
 205 }
 206
 207 static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence)
 208 {
 209         struct drm_crtc *crtc = fence_to_crtc(fence);
 210
 211         return crtc->dev->driver->name;
 212 }
 213
 214 static const char *drm_crtc_fence_get_timeline_name(struct dma_fence *fence)
 215 {
 216         struct drm_crtc *crtc = fence_to_crtc(fence);
 217
 218         return crtc->timeline_name;
 219 }
 220
 221 static bool drm_crtc_fence_enable_signaling(struct dma_fence *fence)
 222 {
 223         return true;
 224 }
 225
 226 static const struct dma_fence_ops drm_crtc_fence_ops = {
 227         .get_driver_name = drm_crtc_fence_get_driver_name,
 228         .get_timeline_name = drm_crtc_fence_get_timeline_name,
 229         .enable_signaling = drm_crtc_fence_enable_signaling,
 230         .wait = dma_fence_default_wait,
 231 };
 232
 233 struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc)
 234 {
 235         struct dma_fence *fence;
 236
 237         fence = kzalloc(sizeof(*fence), GFP_KERNEL);
 238         if (!fence)
 239                 return NULL;
 240
 241         dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock,
 242                        crtc->fence_context, ++crtc->fence_seqno);
 243
 244         return fence;
 245 }
 246
 247 /**
 248  * drm_crtc_init_with_planes - Initialise a new CRTC object with
 249  *    specified primary and cursor planes.
 250  * @dev: DRM device
 251  * @crtc: CRTC object to init
 252  * @primary: Primary plane for CRTC
 253  * @cursor: Cursor plane for CRTC
 254  * @funcs: callbacks for the new CRTC
 255  * @name: printf style format string for the CRTC name, or NULL for default name
 256  *
 257  * Inits a new object created as base part of a driver crtc object. Drivers
 258  * should use this function instead of drm_crtc_init(), which is only provided
 259  * for backwards compatibility with drivers which do not yet support universal
 260  * planes). For really simple hardware which has only 1 plane look at
 261  * drm_simple_display_pipe_init() instead.
 262  *
 263  * Returns:
 264  * Zero on success, error code on failure.
 265  */
 266 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
 267                               struct drm_plane *primary,
 268                               struct drm_plane *cursor,
 269                               const struct drm_crtc_funcs *funcs,
 270                               const char *name, ...)
 271 {
 272         struct drm_mode_config *config = &dev->mode_config;
 273         int ret;
 274
 275         WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
 276         WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
 277
 278         crtc->dev = dev;
 279         crtc->funcs = funcs;
 280
 281         INIT_LIST_HEAD(&crtc->commit_list);
 282         spin_lock_init(&crtc->commit_lock);
 283
 284         drm_modeset_lock_init(&crtc->mutex);
 285         ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
 286         if (ret)
 287                 return ret;
 288
 289         if (name) {
 290                 va_list ap;
 291
 292                 va_start(ap, name);
 293                 crtc->name = kvasprintf(GFP_KERNEL, name, ap);
 294                 va_end(ap);
 295         } else {
 296                 crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
 297                                        drm_num_crtcs(dev));
 298         }
 299         if (!crtc->name) {
 300                 drm_mode_object_unregister(dev, &crtc->base);
 301                 return -ENOMEM;
 302         }
 303
 304         crtc->fence_context = dma_fence_context_alloc(1);
 305         spin_lock_init(&crtc->fence_lock);
 306         snprintf(crtc->timeline_name, sizeof(crtc->timeline_name),
 307                  "CRTC:%d-%s", crtc->base.id, crtc->name);
 308
 309         crtc->base.properties = &crtc->properties;
 310
 311         list_add_tail(&crtc->head, &config->crtc_list);
 312         crtc->index = config->num_crtc++;
 313
 314         crtc->primary = primary;
 315         crtc->cursor = cursor;
 316         if (primary && !primary->possible_crtcs)
 317                 primary->possible_crtcs = 1 << drm_crtc_index(crtc);
 318         if (cursor && !cursor->possible_crtcs)
 319                 cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
 320
 321         ret = drm_crtc_crc_init(crtc);
 322         if (ret) {
 323                 drm_mode_object_unregister(dev, &crtc->base);
 324                 return ret;
 325         }
 326
 327         if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
 328                 drm_object_attach_property(&crtc->base, config->prop_active, 0);
 329                 drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
 330                 drm_object_attach_property(&crtc->base,
 331                                            config->prop_out_fence_ptr, 0);
 332         }
 333
 334         return 0;
 335 }
 336 EXPORT_SYMBOL(drm_crtc_init_with_planes);
 337
 338 /**
 339  * drm_crtc_cleanup - Clean up the core crtc usage
 340  * @crtc: CRTC to cleanup
 341  *
 342  * This function cleans up @crtc and removes it from the DRM mode setting
 343  * core. Note that the function does *not* free the crtc structure itself,
 344  * this is the responsibility of the caller.
 345  */
 346 void drm_crtc_cleanup(struct drm_crtc *crtc)
 347 {
 348         struct drm_device *dev = crtc->dev;
 349
 350         /* Note that the crtc_list is considered to be static; should we
 351          * remove the drm_crtc at runtime we would have to decrement all
 352          * the indices on the drm_crtc after us in the crtc_list.
 353          */
 354
 355         drm_crtc_crc_fini(crtc);
 356
 357         kfree(crtc->gamma_store);
 358         crtc->gamma_store = NULL;
 359
 360         drm_modeset_lock_fini(&crtc->mutex);
 361
 362         drm_mode_object_unregister(dev, &crtc->base);
 363         list_del(&crtc->head);
 364         dev->mode_config.num_crtc--;
 365
 366         WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
 367         if (crtc->state && crtc->funcs->atomic_destroy_state)
 368                 crtc->funcs->atomic_destroy_state(crtc, crtc->state);
 369
 370         kfree(crtc->name);
 371
 372         memset(crtc, 0, sizeof(*crtc));
 373 }
 374 EXPORT_SYMBOL(drm_crtc_cleanup);
 375
 376 /**
 377  * drm_mode_getcrtc - get CRTC configuration
 378  * @dev: drm device for the ioctl
 379  * @data: data pointer for the ioctl
 380  * @file_priv: drm file for the ioctl call
 381  *
 382  * Construct a CRTC configuration structure to return to the user.
 383  *
 384  * Called by the user via ioctl.
 385  *
 386  * Returns:
 387  * Zero on success, negative errno on failure.
 388  */
 389 int drm_mode_getcrtc(struct drm_device *dev,
 390                      void *data, struct drm_file *file_priv)
 391 {
 392         struct drm_mode_crtc *crtc_resp = data;
 393         struct drm_crtc *crtc;
 394
 395         if (!drm_core_check_feature(dev, DRIVER_MODESET))
 396                 return -EINVAL;
 397
 398         crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
 399         if (!crtc)
 400                 return -ENOENT;
 401
 402         drm_modeset_lock_crtc(crtc, crtc->primary);
 403         crtc_resp->gamma_size = crtc->gamma_size;
 404
 405         if (crtc->primary->state && crtc->primary->state->fb)
 406                 crtc_resp->fb_id = crtc->primary->state->fb->base.id;
 407         else if (!crtc->primary->state && crtc->primary->fb)
 408                 crtc_resp->fb_id = crtc->primary->fb->base.id;
 409         else
 410                 crtc_resp->fb_id = 0;
 411
 412         if (crtc->state) {
 413                 crtc_resp->x = crtc->primary->state->src_x >> 16;
 414                 crtc_resp->y = crtc->primary->state->src_y >> 16;
 415                 if (crtc->state->enable) {
 416                         drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
 417                         crtc_resp->mode_valid = 1;
 418
 419                 } else {
 420                         crtc_resp->mode_valid = 0;
 421                 }
 422         } else {
 423                 crtc_resp->x = crtc->x;
 424                 crtc_resp->y = crtc->y;
 425                 if (crtc->enabled) {
 426                         drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
 427                         crtc_resp->mode_valid = 1;
 428
 429                 } else {
 430                         crtc_resp->mode_valid = 0;
 431                 }
 432         }
 433         drm_modeset_unlock_crtc(crtc);
 434
 435         return 0;
 436 }
 437
 438 /**
 439  * drm_mode_set_config_internal - helper to call &drm_mode_config_funcs.set_config
 440  * @set: modeset config to set
 441  *
 442  * This is a little helper to wrap internal calls to the
 443  * &drm_mode_config_funcs.set_config driver interface. The only thing it adds is
 444  * correct refcounting dance.
 445  *
 446  * Returns:
 447  * Zero on success, negative errno on failure.
 448  */
 449 int drm_mode_set_config_internal(struct drm_mode_set *set)
 450 {
 451         struct drm_crtc *crtc = set->crtc;
 452         struct drm_framebuffer *fb;
 453         struct drm_crtc *tmp;
 454         int ret;
 455
 456         /*
 457          * NOTE: ->set_config can also disable other crtcs (if we steal all
 458          * connectors from it), hence we need to refcount the fbs across all
 459          * crtcs. Atomic modeset will have saner semantics ...
 460          */
 461         drm_for_each_crtc(tmp, crtc->dev)
 462                 tmp->primary->old_fb = tmp->primary->fb;
 463
 464         fb = set->fb;
 465
 466         ret = crtc->funcs->set_config(set);
 467         if (ret == 0) {
 468                 crtc->primary->crtc = crtc;
 469                 crtc->primary->fb = fb;
 470         }
 471
 472         drm_for_each_crtc(tmp, crtc->dev) {
 473                 if (tmp->primary->fb)
 474                         drm_framebuffer_reference(tmp->primary->fb);
 475                 if (tmp->primary->old_fb)
 476                         drm_framebuffer_unreference(tmp->primary->old_fb);
 477                 tmp->primary->old_fb = NULL;
 478         }
 479
 480         return ret;
 481 }
 482 EXPORT_SYMBOL(drm_mode_set_config_internal);
 483
 484 /**
 485  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
 486  *     CRTC viewport
 487  * @crtc: CRTC that framebuffer will be displayed on
 488  * @x: x panning
 489  * @y: y panning
 490  * @mode: mode that framebuffer will be displayed under
 491  * @fb: framebuffer to check size of
 492  */
 493 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
 494                             int x, int y,
 495                             const struct drm_display_mode *mode,
 496                             const struct drm_framebuffer *fb)
 497
 498 {
 499         int hdisplay, vdisplay;
 500
 501         drm_mode_get_hv_timing(mode, &hdisplay, &vdisplay);
 502
 503         if (crtc->state &&
 504             drm_rotation_90_or_270(crtc->primary->state->rotation))
 505                 swap(hdisplay, vdisplay);
 506
 507         return drm_framebuffer_check_src_coords(x << 16, y << 16,
 508                                                 hdisplay << 16, vdisplay << 16,
 509                                                 fb);
 510 }
 511 EXPORT_SYMBOL(drm_crtc_check_viewport);
 512
 513 /**
 514  * drm_mode_setcrtc - set CRTC configuration
 515  * @dev: drm device for the ioctl
 516  * @data: data pointer for the ioctl
 517  * @file_priv: drm file for the ioctl call
 518  *
 519  * Build a new CRTC configuration based on user request.
 520  *
 521  * Called by the user via ioctl.
 522  *
 523  * Returns:
 524  * Zero on success, negative errno on failure.
 525  */
 526 int drm_mode_setcrtc(struct drm_device *dev, void *data,
 527                      struct drm_file *file_priv)
 528 {
 529         struct drm_mode_config *config = &dev->mode_config;
 530         struct drm_mode_crtc *crtc_req = data;
 531         struct drm_crtc *crtc;
 532         struct drm_connector **connector_set = NULL, *connector;
 533         struct drm_framebuffer *fb = NULL;
 534         struct drm_display_mode *mode = NULL;
 535         struct drm_mode_set set;
 536         uint32_t __user *set_connectors_ptr;
 537         int ret;
 538         int i;
 539
 540         if (!drm_core_check_feature(dev, DRIVER_MODESET))
 541                 return -EINVAL;
 542
 543         /*
 544          * Universal plane src offsets are only 16.16, prevent havoc for
 545          * drivers using universal plane code internally.
 546          */
 547         if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
 548                 return -ERANGE;
 549
 550         drm_modeset_lock_all(dev);
 551         crtc = drm_crtc_find(dev, crtc_req->crtc_id);
 552         if (!crtc) {
 553                 DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
 554                 ret = -ENOENT;
 555                 goto out;
 556         }
 557         DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
 558
 559         if (crtc_req->mode_valid) {
 560                 /* If we have a mode we need a framebuffer. */
 561                 /* If we pass -1, set the mode with the currently bound fb */
 562                 if (crtc_req->fb_id == -1) {
 563                         if (!crtc->primary->fb) {
 564                                 DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
 565                                 ret = -EINVAL;
 566                                 goto out;
 567                         }
 568                         fb = crtc->primary->fb;
 569                         /* Make refcounting symmetric with the lookup path. */
 570                         drm_framebuffer_reference(fb);
 571                 } else {
 572                         fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
 573                         if (!fb) {
 574                                 DRM_DEBUG_KMS("Unknown FB ID%d\n",
 575                                                 crtc_req->fb_id);
 576                                 ret = -ENOENT;
 577                                 goto out;
 578                         }
 579                 }
 580
 581                 mode = drm_mode_create(dev);
 582                 if (!mode) {
 583                         ret = -ENOMEM;
 584                         goto out;
 585                 }
 586
 587                 ret = drm_mode_convert_umode(mode, &crtc_req->mode);
 588                 if (ret) {
 589                         DRM_DEBUG_KMS("Invalid mode\n");
 590                         goto out;
 591                 }
 592
 593                 /*
 594                  * Check whether the primary plane supports the fb pixel format.
 595                  * Drivers not implementing the universal planes API use a
 596                  * default formats list provided by the DRM core which doesn't
 597                  * match real hardware capabilities. Skip the check in that
 598                  * case.
 599                  */
 600                 if (!crtc->primary->format_default) {
 601                         ret = drm_plane_check_pixel_format(crtc->primary,
 602                                                            fb->format->format);
 603                         if (ret) {
 604                                 struct drm_format_name_buf format_name;
 605                                 DRM_DEBUG_KMS("Invalid pixel format %s\n",
 606                                               drm_get_format_name(fb->format->format,
 607                                                                   &format_name));
 608                                 goto out;
 609                         }
 610                 }
 611
 612                 ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
 613                                               mode, fb);
 614                 if (ret)
 615                         goto out;
 616
 617         }
 618
 619         if (crtc_req->count_connectors == 0 && mode) {
 620                 DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
 621                 ret = -EINVAL;
 622                 goto out;
 623         }
 624
 625         if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
 626                 DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
 627                           crtc_req->count_connectors);
 628                 ret = -EINVAL;
 629                 goto out;
 630         }
 631
 632         if (crtc_req->count_connectors > 0) {
 633                 u32 out_id;
 634
 635                 /* Avoid unbounded kernel memory allocation */
 636                 if (crtc_req->count_connectors > config->num_connector) {
 637                         ret = -EINVAL;
 638                         goto out;
 639                 }
 640
 641                 connector_set = kmalloc_array(crtc_req->count_connectors,
 642                                               sizeof(struct drm_connector *),
 643                                               GFP_KERNEL);
 644                 if (!connector_set) {
 645                         ret = -ENOMEM;
 646                         goto out;
 647                 }
 648
 649                 for (i = 0; i < crtc_req->count_connectors; i++) {
 650                         connector_set[i] = NULL;
 651                         set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
 652                         if (get_user(out_id, &set_connectors_ptr[i])) {
 653                                 ret = -EFAULT;
 654                                 goto out;
 655                         }
 656
 657                         connector = drm_connector_lookup(dev, out_id);
 658                         if (!connector) {
 659                                 DRM_DEBUG_KMS("Connector id %d unknown\n",
 660                                                 out_id);
 661                                 ret = -ENOENT;
 662                                 goto out;
 663                         }
 664                         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
 665                                         connector->base.id,
 666                                         connector->name);
 667
 668                         connector_set[i] = connector;
 669                 }
 670         }
 671
 672         set.crtc = crtc;
 673         set.x = crtc_req->x;
 674         set.y = crtc_req->y;
 675         set.mode = mode;
 676         set.connectors = connector_set;
 677         set.num_connectors = crtc_req->count_connectors;
 678         set.fb = fb;
 679         ret = drm_mode_set_config_internal(&set);
 680
 681 out:
 682         if (fb)
 683                 drm_framebuffer_unreference(fb);
 684
 685         if (connector_set) {
 686                 for (i = 0; i < crtc_req->count_connectors; i++) {
 687                         if (connector_set[i])
 688                                 drm_connector_unreference(connector_set[i]);
 689                 }
 690         }
 691         kfree(connector_set);
 692         drm_mode_destroy(dev, mode);
 693         drm_modeset_unlock_all(dev);
 694         return ret;
 695 }
 696
 697 int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
 698                                struct drm_property *property,
 699                                uint64_t value)
 700 {
 701         int ret = -EINVAL;
 702         struct drm_crtc *crtc = obj_to_crtc(obj);
 703
 704         if (crtc->funcs->set_property)
 705                 ret = crtc->funcs->set_property(crtc, property, value);
 706         if (!ret)
 707                 drm_object_property_set_value(obj, property, value);
 708
 709         return ret;
 710 }