Merge tag 'drm-intel-next-fixes-2017-04-27' of git://anongit.freedesktop.org/git...
[sfrench/cifs-2.6.git] / drivers / gpu / drm / drm_crtc.c
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *      Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <linux/dma-fence.h>
37 #include <drm/drmP.h>
38 #include <drm/drm_crtc.h>
39 #include <drm/drm_edid.h>
40 #include <drm/drm_fourcc.h>
41 #include <drm/drm_modeset_lock.h>
42 #include <drm/drm_atomic.h>
43 #include <drm/drm_auth.h>
44 #include <drm/drm_debugfs_crc.h>
45
46 #include "drm_crtc_internal.h"
47 #include "drm_internal.h"
48
49 /**
50  * DOC: overview
51  *
52  * A CRTC represents the overall display pipeline. It receives pixel data from
53  * &drm_plane and blends them together. The &drm_display_mode is also attached
54  * to the CRTC, specifying display timings. On the output side the data is fed
55  * to one or more &drm_encoder, which are then each connected to one
56  * &drm_connector.
57  *
58  * To create a CRTC, a KMS drivers allocates and zeroes an instances of
59  * &struct drm_crtc (possibly as part of a larger structure) and registers it
60  * with a call to drm_crtc_init_with_planes().
61  *
62  * The CRTC is also the entry point for legacy modeset operations, see
63  * &drm_crtc_funcs.set_config, legacy plane operations, see
64  * &drm_crtc_funcs.page_flip and &drm_crtc_funcs.cursor_set2, and other legacy
65  * operations like &drm_crtc_funcs.gamma_set. For atomic drivers all these
66  * features are controlled through &drm_property and
67  * &drm_mode_config_funcs.atomic_check and &drm_mode_config_funcs.atomic_check.
68  */
69
70 /**
71  * drm_crtc_from_index - find the registered CRTC at an index
72  * @dev: DRM device
73  * @idx: index of registered CRTC to find for
74  *
75  * Given a CRTC index, return the registered CRTC from DRM device's
76  * list of CRTCs with matching index. This is the inverse of drm_crtc_index().
77  * It's useful in the vblank callbacks (like &drm_driver.enable_vblank or
78  * &drm_driver.disable_vblank), since that still deals with indices instead
79  * of pointers to &struct drm_crtc."
80  */
81 struct drm_crtc *drm_crtc_from_index(struct drm_device *dev, int idx)
82 {
83         struct drm_crtc *crtc;
84
85         drm_for_each_crtc(crtc, dev)
86                 if (idx == crtc->index)
87                         return crtc;
88
89         return NULL;
90 }
91 EXPORT_SYMBOL(drm_crtc_from_index);
92
93 /**
94  * drm_crtc_force_disable - Forcibly turn off a CRTC
95  * @crtc: CRTC to turn off
96  *
97  * Note: This should only be used by non-atomic legacy drivers.
98  *
99  * Returns:
100  * Zero on success, error code on failure.
101  */
102 int drm_crtc_force_disable(struct drm_crtc *crtc)
103 {
104         struct drm_mode_set set = {
105                 .crtc = crtc,
106         };
107
108         WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev));
109
110         return drm_mode_set_config_internal(&set);
111 }
112 EXPORT_SYMBOL(drm_crtc_force_disable);
113
114 /**
115  * drm_crtc_force_disable_all - Forcibly turn off all enabled CRTCs
116  * @dev: DRM device whose CRTCs to turn off
117  *
118  * Drivers may want to call this on unload to ensure that all displays are
119  * unlit and the GPU is in a consistent, low power state. Takes modeset locks.
120  *
121  * Note: This should only be used by non-atomic legacy drivers. For an atomic
122  * version look at drm_atomic_helper_shutdown().
123  *
124  * Returns:
125  * Zero on success, error code on failure.
126  */
127 int drm_crtc_force_disable_all(struct drm_device *dev)
128 {
129         struct drm_crtc *crtc;
130         int ret = 0;
131
132         drm_modeset_lock_all(dev);
133         drm_for_each_crtc(crtc, dev)
134                 if (crtc->enabled) {
135                         ret = drm_crtc_force_disable(crtc);
136                         if (ret)
137                                 goto out;
138                 }
139 out:
140         drm_modeset_unlock_all(dev);
141         return ret;
142 }
143 EXPORT_SYMBOL(drm_crtc_force_disable_all);
144
145 static unsigned int drm_num_crtcs(struct drm_device *dev)
146 {
147         unsigned int num = 0;
148         struct drm_crtc *tmp;
149
150         drm_for_each_crtc(tmp, dev) {
151                 num++;
152         }
153
154         return num;
155 }
156
157 int drm_crtc_register_all(struct drm_device *dev)
158 {
159         struct drm_crtc *crtc;
160         int ret = 0;
161
162         drm_for_each_crtc(crtc, dev) {
163                 if (drm_debugfs_crtc_add(crtc))
164                         DRM_ERROR("Failed to initialize debugfs entry for CRTC '%s'.\n",
165                                   crtc->name);
166
167                 if (crtc->funcs->late_register)
168                         ret = crtc->funcs->late_register(crtc);
169                 if (ret)
170                         return ret;
171         }
172
173         return 0;
174 }
175
176 void drm_crtc_unregister_all(struct drm_device *dev)
177 {
178         struct drm_crtc *crtc;
179
180         drm_for_each_crtc(crtc, dev) {
181                 if (crtc->funcs->early_unregister)
182                         crtc->funcs->early_unregister(crtc);
183                 drm_debugfs_crtc_remove(crtc);
184         }
185 }
186
187 static int drm_crtc_crc_init(struct drm_crtc *crtc)
188 {
189 #ifdef CONFIG_DEBUG_FS
190         spin_lock_init(&crtc->crc.lock);
191         init_waitqueue_head(&crtc->crc.wq);
192         crtc->crc.source = kstrdup("auto", GFP_KERNEL);
193         if (!crtc->crc.source)
194                 return -ENOMEM;
195 #endif
196         return 0;
197 }
198
199 static void drm_crtc_crc_fini(struct drm_crtc *crtc)
200 {
201 #ifdef CONFIG_DEBUG_FS
202         kfree(crtc->crc.source);
203 #endif
204 }
205
206 static const struct dma_fence_ops drm_crtc_fence_ops;
207
208 static struct drm_crtc *fence_to_crtc(struct dma_fence *fence)
209 {
210         BUG_ON(fence->ops != &drm_crtc_fence_ops);
211         return container_of(fence->lock, struct drm_crtc, fence_lock);
212 }
213
214 static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence)
215 {
216         struct drm_crtc *crtc = fence_to_crtc(fence);
217
218         return crtc->dev->driver->name;
219 }
220
221 static const char *drm_crtc_fence_get_timeline_name(struct dma_fence *fence)
222 {
223         struct drm_crtc *crtc = fence_to_crtc(fence);
224
225         return crtc->timeline_name;
226 }
227
228 static bool drm_crtc_fence_enable_signaling(struct dma_fence *fence)
229 {
230         return true;
231 }
232
233 static const struct dma_fence_ops drm_crtc_fence_ops = {
234         .get_driver_name = drm_crtc_fence_get_driver_name,
235         .get_timeline_name = drm_crtc_fence_get_timeline_name,
236         .enable_signaling = drm_crtc_fence_enable_signaling,
237         .wait = dma_fence_default_wait,
238 };
239
240 struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc)
241 {
242         struct dma_fence *fence;
243
244         fence = kzalloc(sizeof(*fence), GFP_KERNEL);
245         if (!fence)
246                 return NULL;
247
248         dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock,
249                        crtc->fence_context, ++crtc->fence_seqno);
250
251         return fence;
252 }
253
254 /**
255  * drm_crtc_init_with_planes - Initialise a new CRTC object with
256  *    specified primary and cursor planes.
257  * @dev: DRM device
258  * @crtc: CRTC object to init
259  * @primary: Primary plane for CRTC
260  * @cursor: Cursor plane for CRTC
261  * @funcs: callbacks for the new CRTC
262  * @name: printf style format string for the CRTC name, or NULL for default name
263  *
264  * Inits a new object created as base part of a driver crtc object. Drivers
265  * should use this function instead of drm_crtc_init(), which is only provided
266  * for backwards compatibility with drivers which do not yet support universal
267  * planes). For really simple hardware which has only 1 plane look at
268  * drm_simple_display_pipe_init() instead.
269  *
270  * Returns:
271  * Zero on success, error code on failure.
272  */
273 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
274                               struct drm_plane *primary,
275                               struct drm_plane *cursor,
276                               const struct drm_crtc_funcs *funcs,
277                               const char *name, ...)
278 {
279         struct drm_mode_config *config = &dev->mode_config;
280         int ret;
281
282         WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
283         WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
284
285         crtc->dev = dev;
286         crtc->funcs = funcs;
287
288         INIT_LIST_HEAD(&crtc->commit_list);
289         spin_lock_init(&crtc->commit_lock);
290
291         drm_modeset_lock_init(&crtc->mutex);
292         ret = drm_mode_object_add(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
293         if (ret)
294                 return ret;
295
296         if (name) {
297                 va_list ap;
298
299                 va_start(ap, name);
300                 crtc->name = kvasprintf(GFP_KERNEL, name, ap);
301                 va_end(ap);
302         } else {
303                 crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
304                                        drm_num_crtcs(dev));
305         }
306         if (!crtc->name) {
307                 drm_mode_object_unregister(dev, &crtc->base);
308                 return -ENOMEM;
309         }
310
311         crtc->fence_context = dma_fence_context_alloc(1);
312         spin_lock_init(&crtc->fence_lock);
313         snprintf(crtc->timeline_name, sizeof(crtc->timeline_name),
314                  "CRTC:%d-%s", crtc->base.id, crtc->name);
315
316         crtc->base.properties = &crtc->properties;
317
318         list_add_tail(&crtc->head, &config->crtc_list);
319         crtc->index = config->num_crtc++;
320
321         crtc->primary = primary;
322         crtc->cursor = cursor;
323         if (primary && !primary->possible_crtcs)
324                 primary->possible_crtcs = 1 << drm_crtc_index(crtc);
325         if (cursor && !cursor->possible_crtcs)
326                 cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
327
328         ret = drm_crtc_crc_init(crtc);
329         if (ret) {
330                 drm_mode_object_unregister(dev, &crtc->base);
331                 return ret;
332         }
333
334         if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
335                 drm_object_attach_property(&crtc->base, config->prop_active, 0);
336                 drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
337                 drm_object_attach_property(&crtc->base,
338                                            config->prop_out_fence_ptr, 0);
339         }
340
341         return 0;
342 }
343 EXPORT_SYMBOL(drm_crtc_init_with_planes);
344
345 /**
346  * drm_crtc_cleanup - Clean up the core crtc usage
347  * @crtc: CRTC to cleanup
348  *
349  * This function cleans up @crtc and removes it from the DRM mode setting
350  * core. Note that the function does *not* free the crtc structure itself,
351  * this is the responsibility of the caller.
352  */
353 void drm_crtc_cleanup(struct drm_crtc *crtc)
354 {
355         struct drm_device *dev = crtc->dev;
356
357         /* Note that the crtc_list is considered to be static; should we
358          * remove the drm_crtc at runtime we would have to decrement all
359          * the indices on the drm_crtc after us in the crtc_list.
360          */
361
362         drm_crtc_crc_fini(crtc);
363
364         kfree(crtc->gamma_store);
365         crtc->gamma_store = NULL;
366
367         drm_modeset_lock_fini(&crtc->mutex);
368
369         drm_mode_object_unregister(dev, &crtc->base);
370         list_del(&crtc->head);
371         dev->mode_config.num_crtc--;
372
373         WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
374         if (crtc->state && crtc->funcs->atomic_destroy_state)
375                 crtc->funcs->atomic_destroy_state(crtc, crtc->state);
376
377         kfree(crtc->name);
378
379         memset(crtc, 0, sizeof(*crtc));
380 }
381 EXPORT_SYMBOL(drm_crtc_cleanup);
382
383 /**
384  * drm_mode_getcrtc - get CRTC configuration
385  * @dev: drm device for the ioctl
386  * @data: data pointer for the ioctl
387  * @file_priv: drm file for the ioctl call
388  *
389  * Construct a CRTC configuration structure to return to the user.
390  *
391  * Called by the user via ioctl.
392  *
393  * Returns:
394  * Zero on success, negative errno on failure.
395  */
396 int drm_mode_getcrtc(struct drm_device *dev,
397                      void *data, struct drm_file *file_priv)
398 {
399         struct drm_mode_crtc *crtc_resp = data;
400         struct drm_crtc *crtc;
401
402         if (!drm_core_check_feature(dev, DRIVER_MODESET))
403                 return -EINVAL;
404
405         crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
406         if (!crtc)
407                 return -ENOENT;
408
409         crtc_resp->gamma_size = crtc->gamma_size;
410
411         drm_modeset_lock(&crtc->primary->mutex, NULL);
412         if (crtc->primary->state && crtc->primary->state->fb)
413                 crtc_resp->fb_id = crtc->primary->state->fb->base.id;
414         else if (!crtc->primary->state && crtc->primary->fb)
415                 crtc_resp->fb_id = crtc->primary->fb->base.id;
416         else
417                 crtc_resp->fb_id = 0;
418
419         if (crtc->primary->state) {
420                 crtc_resp->x = crtc->primary->state->src_x >> 16;
421                 crtc_resp->y = crtc->primary->state->src_y >> 16;
422         }
423         drm_modeset_unlock(&crtc->primary->mutex);
424
425         drm_modeset_lock(&crtc->mutex, NULL);
426         if (crtc->state) {
427                 if (crtc->state->enable) {
428                         drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
429                         crtc_resp->mode_valid = 1;
430
431                 } else {
432                         crtc_resp->mode_valid = 0;
433                 }
434         } else {
435                 crtc_resp->x = crtc->x;
436                 crtc_resp->y = crtc->y;
437                 if (crtc->enabled) {
438                         drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
439                         crtc_resp->mode_valid = 1;
440
441                 } else {
442                         crtc_resp->mode_valid = 0;
443                 }
444         }
445         drm_modeset_unlock(&crtc->mutex);
446
447         return 0;
448 }
449
450 static int __drm_mode_set_config_internal(struct drm_mode_set *set,
451                                           struct drm_modeset_acquire_ctx *ctx)
452 {
453         struct drm_crtc *crtc = set->crtc;
454         struct drm_framebuffer *fb;
455         struct drm_crtc *tmp;
456         int ret;
457
458         /*
459          * NOTE: ->set_config can also disable other crtcs (if we steal all
460          * connectors from it), hence we need to refcount the fbs across all
461          * crtcs. Atomic modeset will have saner semantics ...
462          */
463         drm_for_each_crtc(tmp, crtc->dev)
464                 tmp->primary->old_fb = tmp->primary->fb;
465
466         fb = set->fb;
467
468         ret = crtc->funcs->set_config(set, ctx);
469         if (ret == 0) {
470                 crtc->primary->crtc = crtc;
471                 crtc->primary->fb = fb;
472         }
473
474         drm_for_each_crtc(tmp, crtc->dev) {
475                 if (tmp->primary->fb)
476                         drm_framebuffer_get(tmp->primary->fb);
477                 if (tmp->primary->old_fb)
478                         drm_framebuffer_put(tmp->primary->old_fb);
479                 tmp->primary->old_fb = NULL;
480         }
481
482         return ret;
483 }
484 /**
485  * drm_mode_set_config_internal - helper to call &drm_mode_config_funcs.set_config
486  * @set: modeset config to set
487  *
488  * This is a little helper to wrap internal calls to the
489  * &drm_mode_config_funcs.set_config driver interface. The only thing it adds is
490  * correct refcounting dance.
491  *
492  * This should only be used by non-atomic legacy drivers.
493  *
494  * Returns:
495  * Zero on success, negative errno on failure.
496  */
497 int drm_mode_set_config_internal(struct drm_mode_set *set)
498 {
499         WARN_ON(drm_drv_uses_atomic_modeset(set->crtc->dev));
500
501         return __drm_mode_set_config_internal(set, NULL);
502 }
503 EXPORT_SYMBOL(drm_mode_set_config_internal);
504
505 /**
506  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
507  *     CRTC viewport
508  * @crtc: CRTC that framebuffer will be displayed on
509  * @x: x panning
510  * @y: y panning
511  * @mode: mode that framebuffer will be displayed under
512  * @fb: framebuffer to check size of
513  */
514 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
515                             int x, int y,
516                             const struct drm_display_mode *mode,
517                             const struct drm_framebuffer *fb)
518
519 {
520         int hdisplay, vdisplay;
521
522         drm_mode_get_hv_timing(mode, &hdisplay, &vdisplay);
523
524         if (crtc->state &&
525             drm_rotation_90_or_270(crtc->primary->state->rotation))
526                 swap(hdisplay, vdisplay);
527
528         return drm_framebuffer_check_src_coords(x << 16, y << 16,
529                                                 hdisplay << 16, vdisplay << 16,
530                                                 fb);
531 }
532 EXPORT_SYMBOL(drm_crtc_check_viewport);
533
534 /**
535  * drm_mode_setcrtc - set CRTC configuration
536  * @dev: drm device for the ioctl
537  * @data: data pointer for the ioctl
538  * @file_priv: drm file for the ioctl call
539  *
540  * Build a new CRTC configuration based on user request.
541  *
542  * Called by the user via ioctl.
543  *
544  * Returns:
545  * Zero on success, negative errno on failure.
546  */
547 int drm_mode_setcrtc(struct drm_device *dev, void *data,
548                      struct drm_file *file_priv)
549 {
550         struct drm_mode_config *config = &dev->mode_config;
551         struct drm_mode_crtc *crtc_req = data;
552         struct drm_crtc *crtc;
553         struct drm_connector **connector_set = NULL, *connector;
554         struct drm_framebuffer *fb = NULL;
555         struct drm_display_mode *mode = NULL;
556         struct drm_mode_set set;
557         uint32_t __user *set_connectors_ptr;
558         struct drm_modeset_acquire_ctx ctx;
559         int ret;
560         int i;
561
562         if (!drm_core_check_feature(dev, DRIVER_MODESET))
563                 return -EINVAL;
564
565         /*
566          * Universal plane src offsets are only 16.16, prevent havoc for
567          * drivers using universal plane code internally.
568          */
569         if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
570                 return -ERANGE;
571
572         crtc = drm_crtc_find(dev, crtc_req->crtc_id);
573         if (!crtc) {
574                 DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
575                 return -ENOENT;
576         }
577         DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
578
579         mutex_lock(&crtc->dev->mode_config.mutex);
580         drm_modeset_acquire_init(&ctx, 0);
581 retry:
582         ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx);
583         if (ret)
584                 goto out;
585         if (crtc_req->mode_valid) {
586                 /* If we have a mode we need a framebuffer. */
587                 /* If we pass -1, set the mode with the currently bound fb */
588                 if (crtc_req->fb_id == -1) {
589                         if (!crtc->primary->fb) {
590                                 DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
591                                 ret = -EINVAL;
592                                 goto out;
593                         }
594                         fb = crtc->primary->fb;
595                         /* Make refcounting symmetric with the lookup path. */
596                         drm_framebuffer_get(fb);
597                 } else {
598                         fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
599                         if (!fb) {
600                                 DRM_DEBUG_KMS("Unknown FB ID%d\n",
601                                                 crtc_req->fb_id);
602                                 ret = -ENOENT;
603                                 goto out;
604                         }
605                 }
606
607                 mode = drm_mode_create(dev);
608                 if (!mode) {
609                         ret = -ENOMEM;
610                         goto out;
611                 }
612
613                 ret = drm_mode_convert_umode(mode, &crtc_req->mode);
614                 if (ret) {
615                         DRM_DEBUG_KMS("Invalid mode\n");
616                         goto out;
617                 }
618
619                 /*
620                  * Check whether the primary plane supports the fb pixel format.
621                  * Drivers not implementing the universal planes API use a
622                  * default formats list provided by the DRM core which doesn't
623                  * match real hardware capabilities. Skip the check in that
624                  * case.
625                  */
626                 if (!crtc->primary->format_default) {
627                         ret = drm_plane_check_pixel_format(crtc->primary,
628                                                            fb->format->format);
629                         if (ret) {
630                                 struct drm_format_name_buf format_name;
631                                 DRM_DEBUG_KMS("Invalid pixel format %s\n",
632                                               drm_get_format_name(fb->format->format,
633                                                                   &format_name));
634                                 goto out;
635                         }
636                 }
637
638                 ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
639                                               mode, fb);
640                 if (ret)
641                         goto out;
642
643         }
644
645         if (crtc_req->count_connectors == 0 && mode) {
646                 DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
647                 ret = -EINVAL;
648                 goto out;
649         }
650
651         if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
652                 DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
653                           crtc_req->count_connectors);
654                 ret = -EINVAL;
655                 goto out;
656         }
657
658         if (crtc_req->count_connectors > 0) {
659                 u32 out_id;
660
661                 /* Avoid unbounded kernel memory allocation */
662                 if (crtc_req->count_connectors > config->num_connector) {
663                         ret = -EINVAL;
664                         goto out;
665                 }
666
667                 connector_set = kmalloc_array(crtc_req->count_connectors,
668                                               sizeof(struct drm_connector *),
669                                               GFP_KERNEL);
670                 if (!connector_set) {
671                         ret = -ENOMEM;
672                         goto out;
673                 }
674
675                 for (i = 0; i < crtc_req->count_connectors; i++) {
676                         connector_set[i] = NULL;
677                         set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
678                         if (get_user(out_id, &set_connectors_ptr[i])) {
679                                 ret = -EFAULT;
680                                 goto out;
681                         }
682
683                         connector = drm_connector_lookup(dev, out_id);
684                         if (!connector) {
685                                 DRM_DEBUG_KMS("Connector id %d unknown\n",
686                                                 out_id);
687                                 ret = -ENOENT;
688                                 goto out;
689                         }
690                         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
691                                         connector->base.id,
692                                         connector->name);
693
694                         connector_set[i] = connector;
695                 }
696         }
697
698         set.crtc = crtc;
699         set.x = crtc_req->x;
700         set.y = crtc_req->y;
701         set.mode = mode;
702         set.connectors = connector_set;
703         set.num_connectors = crtc_req->count_connectors;
704         set.fb = fb;
705         ret = __drm_mode_set_config_internal(&set, &ctx);
706
707 out:
708         if (fb)
709                 drm_framebuffer_put(fb);
710
711         if (connector_set) {
712                 for (i = 0; i < crtc_req->count_connectors; i++) {
713                         if (connector_set[i])
714                                 drm_connector_put(connector_set[i]);
715                 }
716         }
717         kfree(connector_set);
718         drm_mode_destroy(dev, mode);
719         if (ret == -EDEADLK) {
720                 drm_modeset_backoff(&ctx);
721                 goto retry;
722         }
723         drm_modeset_drop_locks(&ctx);
724         drm_modeset_acquire_fini(&ctx);
725         mutex_unlock(&crtc->dev->mode_config.mutex);
726
727         return ret;
728 }
729
730 int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
731                                struct drm_property *property,
732                                uint64_t value)
733 {
734         int ret = -EINVAL;
735         struct drm_crtc *crtc = obj_to_crtc(obj);
736
737         if (crtc->funcs->set_property)
738                 ret = crtc->funcs->set_property(crtc, property, value);
739         if (!ret)
740                 drm_object_property_set_value(obj, property, value);
741
742         return ret;
743 }