xref: /openbmc/linux/drivers/gpu/drm/drm_crtc.c (revision 80483c3a)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 #include <drm/drm_auth.h>
43 
44 #include "drm_crtc_internal.h"
45 #include "drm_internal.h"
46 
47 static struct drm_framebuffer *
48 internal_framebuffer_create(struct drm_device *dev,
49 			    const struct drm_mode_fb_cmd2 *r,
50 			    struct drm_file *file_priv);
51 
52 /* Avoid boilerplate.  I'm tired of typing. */
53 #define DRM_ENUM_NAME_FN(fnname, list)				\
54 	const char *fnname(int val)				\
55 	{							\
56 		int i;						\
57 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
58 			if (list[i].type == val)		\
59 				return list[i].name;		\
60 		}						\
61 		return "(unknown)";				\
62 	}
63 
64 /*
65  * Global properties
66  */
67 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
68 	{ DRM_MODE_DPMS_ON, "On" },
69 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
70 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
71 	{ DRM_MODE_DPMS_OFF, "Off" }
72 };
73 
74 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
75 
76 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
77 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
78 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
79 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
80 };
81 
82 /*
83  * Optional properties
84  */
85 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
86 	{ DRM_MODE_SCALE_NONE, "None" },
87 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
88 	{ DRM_MODE_SCALE_CENTER, "Center" },
89 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
90 };
91 
92 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
93 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
94 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
95 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
96 };
97 
98 /*
99  * Non-global properties, but "required" for certain connectors.
100  */
101 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
102 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
103 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
104 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
105 };
106 
107 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
108 
109 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
110 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
111 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
112 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
113 };
114 
115 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
116 		 drm_dvi_i_subconnector_enum_list)
117 
118 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
119 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
123 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
124 };
125 
126 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
127 
128 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
129 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
133 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
134 };
135 
136 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
137 		 drm_tv_subconnector_enum_list)
138 
139 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
140 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
141 	{ DRM_MODE_DIRTY_ON,       "On"       },
142 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
143 };
144 
145 struct drm_conn_prop_enum_list {
146 	int type;
147 	const char *name;
148 	struct ida ida;
149 };
150 
151 /*
152  * Connector and encoder types.
153  */
154 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
155 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
156 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
157 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
158 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
159 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
160 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
161 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
162 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
163 	{ DRM_MODE_CONNECTOR_Component, "Component" },
164 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
165 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
166 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
167 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
168 	{ DRM_MODE_CONNECTOR_TV, "TV" },
169 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
170 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
171 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
172 	{ DRM_MODE_CONNECTOR_DPI, "DPI" },
173 };
174 
175 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
176 	{ DRM_MODE_ENCODER_NONE, "None" },
177 	{ DRM_MODE_ENCODER_DAC, "DAC" },
178 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
179 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
180 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
181 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
182 	{ DRM_MODE_ENCODER_DSI, "DSI" },
183 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
184 	{ DRM_MODE_ENCODER_DPI, "DPI" },
185 };
186 
187 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
188 	{ SubPixelUnknown, "Unknown" },
189 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
190 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
191 	{ SubPixelVerticalRGB, "Vertical RGB" },
192 	{ SubPixelVerticalBGR, "Vertical BGR" },
193 	{ SubPixelNone, "None" },
194 };
195 
196 void drm_connector_ida_init(void)
197 {
198 	int i;
199 
200 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
201 		ida_init(&drm_connector_enum_list[i].ida);
202 }
203 
204 void drm_connector_ida_destroy(void)
205 {
206 	int i;
207 
208 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
209 		ida_destroy(&drm_connector_enum_list[i].ida);
210 }
211 
212 /**
213  * drm_get_connector_status_name - return a string for connector status
214  * @status: connector status to compute name of
215  *
216  * In contrast to the other drm_get_*_name functions this one here returns a
217  * const pointer and hence is threadsafe.
218  */
219 const char *drm_get_connector_status_name(enum drm_connector_status status)
220 {
221 	if (status == connector_status_connected)
222 		return "connected";
223 	else if (status == connector_status_disconnected)
224 		return "disconnected";
225 	else
226 		return "unknown";
227 }
228 EXPORT_SYMBOL(drm_get_connector_status_name);
229 
230 /**
231  * drm_get_subpixel_order_name - return a string for a given subpixel enum
232  * @order: enum of subpixel_order
233  *
234  * Note you could abuse this and return something out of bounds, but that
235  * would be a caller error.  No unscrubbed user data should make it here.
236  */
237 const char *drm_get_subpixel_order_name(enum subpixel_order order)
238 {
239 	return drm_subpixel_enum_list[order].name;
240 }
241 EXPORT_SYMBOL(drm_get_subpixel_order_name);
242 
243 /*
244  * Internal function to assign a slot in the object idr and optionally
245  * register the object into the idr.
246  */
247 static int drm_mode_object_get_reg(struct drm_device *dev,
248 				   struct drm_mode_object *obj,
249 				   uint32_t obj_type,
250 				   bool register_obj,
251 				   void (*obj_free_cb)(struct kref *kref))
252 {
253 	int ret;
254 
255 	mutex_lock(&dev->mode_config.idr_mutex);
256 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
257 	if (ret >= 0) {
258 		/*
259 		 * Set up the object linking under the protection of the idr
260 		 * lock so that other users can't see inconsistent state.
261 		 */
262 		obj->id = ret;
263 		obj->type = obj_type;
264 		if (obj_free_cb) {
265 			obj->free_cb = obj_free_cb;
266 			kref_init(&obj->refcount);
267 		}
268 	}
269 	mutex_unlock(&dev->mode_config.idr_mutex);
270 
271 	return ret < 0 ? ret : 0;
272 }
273 
274 /**
275  * drm_mode_object_get - allocate a new modeset identifier
276  * @dev: DRM device
277  * @obj: object pointer, used to generate unique ID
278  * @obj_type: object type
279  *
280  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
281  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
282  * modeset identifiers are _not_ reference counted. Hence don't use this for
283  * reference counted modeset objects like framebuffers.
284  *
285  * Returns:
286  * Zero on success, error code on failure.
287  */
288 int drm_mode_object_get(struct drm_device *dev,
289 			struct drm_mode_object *obj, uint32_t obj_type)
290 {
291 	return drm_mode_object_get_reg(dev, obj, obj_type, true, NULL);
292 }
293 
294 static void drm_mode_object_register(struct drm_device *dev,
295 				     struct drm_mode_object *obj)
296 {
297 	mutex_lock(&dev->mode_config.idr_mutex);
298 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
299 	mutex_unlock(&dev->mode_config.idr_mutex);
300 }
301 
302 /**
303  * drm_mode_object_unregister - free a modeset identifer
304  * @dev: DRM device
305  * @object: object to free
306  *
307  * Free @id from @dev's unique identifier pool.
308  * This function can be called multiple times, and guards against
309  * multiple removals.
310  * These modeset identifiers are _not_ reference counted. Hence don't use this
311  * for reference counted modeset objects like framebuffers.
312  */
313 void drm_mode_object_unregister(struct drm_device *dev,
314 			 struct drm_mode_object *object)
315 {
316 	mutex_lock(&dev->mode_config.idr_mutex);
317 	if (object->id) {
318 		idr_remove(&dev->mode_config.crtc_idr, object->id);
319 		object->id = 0;
320 	}
321 	mutex_unlock(&dev->mode_config.idr_mutex);
322 }
323 
324 static struct drm_mode_object *_object_find(struct drm_device *dev,
325 		uint32_t id, uint32_t type)
326 {
327 	struct drm_mode_object *obj = NULL;
328 
329 	mutex_lock(&dev->mode_config.idr_mutex);
330 	obj = idr_find(&dev->mode_config.crtc_idr, id);
331 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
332 		obj = NULL;
333 	if (obj && obj->id != id)
334 		obj = NULL;
335 
336 	if (obj && obj->free_cb) {
337 		if (!kref_get_unless_zero(&obj->refcount))
338 			obj = NULL;
339 	}
340 	mutex_unlock(&dev->mode_config.idr_mutex);
341 
342 	return obj;
343 }
344 
345 /**
346  * drm_mode_object_find - look up a drm object with static lifetime
347  * @dev: drm device
348  * @id: id of the mode object
349  * @type: type of the mode object
350  *
351  * This function is used to look up a modeset object. It will acquire a
352  * reference for reference counted objects. This reference must be dropped again
353  * by callind drm_mode_object_unreference().
354  */
355 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
356 		uint32_t id, uint32_t type)
357 {
358 	struct drm_mode_object *obj = NULL;
359 
360 	obj = _object_find(dev, id, type);
361 	return obj;
362 }
363 EXPORT_SYMBOL(drm_mode_object_find);
364 
365 /**
366  * drm_mode_object_unreference - decr the object refcnt
367  * @obj: mode_object
368  *
369  * This functions decrements the object's refcount if it is a refcounted modeset
370  * object. It is a no-op on any other object. This is used to drop references
371  * acquired with drm_mode_object_reference().
372  */
373 void drm_mode_object_unreference(struct drm_mode_object *obj)
374 {
375 	if (obj->free_cb) {
376 		DRM_DEBUG("OBJ ID: %d (%d)\n", obj->id, atomic_read(&obj->refcount.refcount));
377 		kref_put(&obj->refcount, obj->free_cb);
378 	}
379 }
380 EXPORT_SYMBOL(drm_mode_object_unreference);
381 
382 /**
383  * drm_mode_object_reference - incr the object refcnt
384  * @obj: mode_object
385  *
386  * This functions increments the object's refcount if it is a refcounted modeset
387  * object. It is a no-op on any other object. References should be dropped again
388  * by calling drm_mode_object_unreference().
389  */
390 void drm_mode_object_reference(struct drm_mode_object *obj)
391 {
392 	if (obj->free_cb) {
393 		DRM_DEBUG("OBJ ID: %d (%d)\n", obj->id, atomic_read(&obj->refcount.refcount));
394 		kref_get(&obj->refcount);
395 	}
396 }
397 EXPORT_SYMBOL(drm_mode_object_reference);
398 
399 /**
400  * drm_crtc_force_disable - Forcibly turn off a CRTC
401  * @crtc: CRTC to turn off
402  *
403  * Returns:
404  * Zero on success, error code on failure.
405  */
406 int drm_crtc_force_disable(struct drm_crtc *crtc)
407 {
408 	struct drm_mode_set set = {
409 		.crtc = crtc,
410 	};
411 
412 	return drm_mode_set_config_internal(&set);
413 }
414 EXPORT_SYMBOL(drm_crtc_force_disable);
415 
416 /**
417  * drm_crtc_force_disable_all - Forcibly turn off all enabled CRTCs
418  * @dev: DRM device whose CRTCs to turn off
419  *
420  * Drivers may want to call this on unload to ensure that all displays are
421  * unlit and the GPU is in a consistent, low power state. Takes modeset locks.
422  *
423  * Returns:
424  * Zero on success, error code on failure.
425  */
426 int drm_crtc_force_disable_all(struct drm_device *dev)
427 {
428 	struct drm_crtc *crtc;
429 	int ret = 0;
430 
431 	drm_modeset_lock_all(dev);
432 	drm_for_each_crtc(crtc, dev)
433 		if (crtc->enabled) {
434 			ret = drm_crtc_force_disable(crtc);
435 			if (ret)
436 				goto out;
437 		}
438 out:
439 	drm_modeset_unlock_all(dev);
440 	return ret;
441 }
442 EXPORT_SYMBOL(drm_crtc_force_disable_all);
443 
444 static void drm_framebuffer_free(struct kref *kref)
445 {
446 	struct drm_framebuffer *fb =
447 			container_of(kref, struct drm_framebuffer, base.refcount);
448 	struct drm_device *dev = fb->dev;
449 
450 	/*
451 	 * The lookup idr holds a weak reference, which has not necessarily been
452 	 * removed at this point. Check for that.
453 	 */
454 	drm_mode_object_unregister(dev, &fb->base);
455 
456 	fb->funcs->destroy(fb);
457 }
458 
459 /**
460  * drm_framebuffer_init - initialize a framebuffer
461  * @dev: DRM device
462  * @fb: framebuffer to be initialized
463  * @funcs: ... with these functions
464  *
465  * Allocates an ID for the framebuffer's parent mode object, sets its mode
466  * functions & device file and adds it to the master fd list.
467  *
468  * IMPORTANT:
469  * This functions publishes the fb and makes it available for concurrent access
470  * by other users. Which means by this point the fb _must_ be fully set up -
471  * since all the fb attributes are invariant over its lifetime, no further
472  * locking but only correct reference counting is required.
473  *
474  * Returns:
475  * Zero on success, error code on failure.
476  */
477 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
478 			 const struct drm_framebuffer_funcs *funcs)
479 {
480 	int ret;
481 
482 	INIT_LIST_HEAD(&fb->filp_head);
483 	fb->dev = dev;
484 	fb->funcs = funcs;
485 
486 	ret = drm_mode_object_get_reg(dev, &fb->base, DRM_MODE_OBJECT_FB,
487 				      false, drm_framebuffer_free);
488 	if (ret)
489 		goto out;
490 
491 	mutex_lock(&dev->mode_config.fb_lock);
492 	dev->mode_config.num_fb++;
493 	list_add(&fb->head, &dev->mode_config.fb_list);
494 	mutex_unlock(&dev->mode_config.fb_lock);
495 
496 	drm_mode_object_register(dev, &fb->base);
497 out:
498 	return ret;
499 }
500 EXPORT_SYMBOL(drm_framebuffer_init);
501 
502 /**
503  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
504  * @dev: drm device
505  * @id: id of the fb object
506  *
507  * If successful, this grabs an additional reference to the framebuffer -
508  * callers need to make sure to eventually unreference the returned framebuffer
509  * again, using @drm_framebuffer_unreference.
510  */
511 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
512 					       uint32_t id)
513 {
514 	struct drm_mode_object *obj;
515 	struct drm_framebuffer *fb = NULL;
516 
517 	obj = _object_find(dev, id, DRM_MODE_OBJECT_FB);
518 	if (obj)
519 		fb = obj_to_fb(obj);
520 	return fb;
521 }
522 EXPORT_SYMBOL(drm_framebuffer_lookup);
523 
524 /**
525  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
526  * @fb: fb to unregister
527  *
528  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
529  * those used for fbdev. Note that the caller must hold a reference of it's own,
530  * i.e. the object may not be destroyed through this call (since it'll lead to a
531  * locking inversion).
532  */
533 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
534 {
535 	struct drm_device *dev;
536 
537 	if (!fb)
538 		return;
539 
540 	dev = fb->dev;
541 
542 	/* Mark fb as reaped and drop idr ref. */
543 	drm_mode_object_unregister(dev, &fb->base);
544 }
545 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
546 
547 /**
548  * drm_framebuffer_cleanup - remove a framebuffer object
549  * @fb: framebuffer to remove
550  *
551  * Cleanup framebuffer. This function is intended to be used from the drivers
552  * ->destroy callback. It can also be used to clean up driver private
553  * framebuffers embedded into a larger structure.
554  *
555  * Note that this function does not remove the fb from active usuage - if it is
556  * still used anywhere, hilarity can ensue since userspace could call getfb on
557  * the id and get back -EINVAL. Obviously no concern at driver unload time.
558  *
559  * Also, the framebuffer will not be removed from the lookup idr - for
560  * user-created framebuffers this will happen in in the rmfb ioctl. For
561  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
562  * drm_framebuffer_unregister_private.
563  */
564 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
565 {
566 	struct drm_device *dev = fb->dev;
567 
568 	mutex_lock(&dev->mode_config.fb_lock);
569 	list_del(&fb->head);
570 	dev->mode_config.num_fb--;
571 	mutex_unlock(&dev->mode_config.fb_lock);
572 }
573 EXPORT_SYMBOL(drm_framebuffer_cleanup);
574 
575 /**
576  * drm_framebuffer_remove - remove and unreference a framebuffer object
577  * @fb: framebuffer to remove
578  *
579  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
580  * using @fb, removes it, setting it to NULL. Then drops the reference to the
581  * passed-in framebuffer. Might take the modeset locks.
582  *
583  * Note that this function optimizes the cleanup away if the caller holds the
584  * last reference to the framebuffer. It is also guaranteed to not take the
585  * modeset locks in this case.
586  */
587 void drm_framebuffer_remove(struct drm_framebuffer *fb)
588 {
589 	struct drm_device *dev;
590 	struct drm_crtc *crtc;
591 	struct drm_plane *plane;
592 
593 	if (!fb)
594 		return;
595 
596 	dev = fb->dev;
597 
598 	WARN_ON(!list_empty(&fb->filp_head));
599 
600 	/*
601 	 * drm ABI mandates that we remove any deleted framebuffers from active
602 	 * useage. But since most sane clients only remove framebuffers they no
603 	 * longer need, try to optimize this away.
604 	 *
605 	 * Since we're holding a reference ourselves, observing a refcount of 1
606 	 * means that we're the last holder and can skip it. Also, the refcount
607 	 * can never increase from 1 again, so we don't need any barriers or
608 	 * locks.
609 	 *
610 	 * Note that userspace could try to race with use and instate a new
611 	 * usage _after_ we've cleared all current ones. End result will be an
612 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
613 	 * in this manner.
614 	 */
615 	if (drm_framebuffer_read_refcount(fb) > 1) {
616 		drm_modeset_lock_all(dev);
617 		/* remove from any CRTC */
618 		drm_for_each_crtc(crtc, dev) {
619 			if (crtc->primary->fb == fb) {
620 				/* should turn off the crtc */
621 				if (drm_crtc_force_disable(crtc))
622 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
623 			}
624 		}
625 
626 		drm_for_each_plane(plane, dev) {
627 			if (plane->fb == fb)
628 				drm_plane_force_disable(plane);
629 		}
630 		drm_modeset_unlock_all(dev);
631 	}
632 
633 	drm_framebuffer_unreference(fb);
634 }
635 EXPORT_SYMBOL(drm_framebuffer_remove);
636 
637 DEFINE_WW_CLASS(crtc_ww_class);
638 
639 static unsigned int drm_num_crtcs(struct drm_device *dev)
640 {
641 	unsigned int num = 0;
642 	struct drm_crtc *tmp;
643 
644 	drm_for_each_crtc(tmp, dev) {
645 		num++;
646 	}
647 
648 	return num;
649 }
650 
651 static int drm_crtc_register_all(struct drm_device *dev)
652 {
653 	struct drm_crtc *crtc;
654 	int ret = 0;
655 
656 	drm_for_each_crtc(crtc, dev) {
657 		if (crtc->funcs->late_register)
658 			ret = crtc->funcs->late_register(crtc);
659 		if (ret)
660 			return ret;
661 	}
662 
663 	return 0;
664 }
665 
666 static void drm_crtc_unregister_all(struct drm_device *dev)
667 {
668 	struct drm_crtc *crtc;
669 
670 	drm_for_each_crtc(crtc, dev) {
671 		if (crtc->funcs->early_unregister)
672 			crtc->funcs->early_unregister(crtc);
673 	}
674 }
675 
676 /**
677  * drm_crtc_init_with_planes - Initialise a new CRTC object with
678  *    specified primary and cursor planes.
679  * @dev: DRM device
680  * @crtc: CRTC object to init
681  * @primary: Primary plane for CRTC
682  * @cursor: Cursor plane for CRTC
683  * @funcs: callbacks for the new CRTC
684  * @name: printf style format string for the CRTC name, or NULL for default name
685  *
686  * Inits a new object created as base part of a driver crtc object.
687  *
688  * Returns:
689  * Zero on success, error code on failure.
690  */
691 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
692 			      struct drm_plane *primary,
693 			      struct drm_plane *cursor,
694 			      const struct drm_crtc_funcs *funcs,
695 			      const char *name, ...)
696 {
697 	struct drm_mode_config *config = &dev->mode_config;
698 	int ret;
699 
700 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
701 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
702 
703 	crtc->dev = dev;
704 	crtc->funcs = funcs;
705 
706 	INIT_LIST_HEAD(&crtc->commit_list);
707 	spin_lock_init(&crtc->commit_lock);
708 
709 	drm_modeset_lock_init(&crtc->mutex);
710 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
711 	if (ret)
712 		return ret;
713 
714 	if (name) {
715 		va_list ap;
716 
717 		va_start(ap, name);
718 		crtc->name = kvasprintf(GFP_KERNEL, name, ap);
719 		va_end(ap);
720 	} else {
721 		crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
722 				       drm_num_crtcs(dev));
723 	}
724 	if (!crtc->name) {
725 		drm_mode_object_unregister(dev, &crtc->base);
726 		return -ENOMEM;
727 	}
728 
729 	crtc->base.properties = &crtc->properties;
730 
731 	list_add_tail(&crtc->head, &config->crtc_list);
732 	crtc->index = config->num_crtc++;
733 
734 	crtc->primary = primary;
735 	crtc->cursor = cursor;
736 	if (primary)
737 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
738 	if (cursor)
739 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
740 
741 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
742 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
743 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
744 	}
745 
746 	return 0;
747 }
748 EXPORT_SYMBOL(drm_crtc_init_with_planes);
749 
750 /**
751  * drm_crtc_cleanup - Clean up the core crtc usage
752  * @crtc: CRTC to cleanup
753  *
754  * This function cleans up @crtc and removes it from the DRM mode setting
755  * core. Note that the function does *not* free the crtc structure itself,
756  * this is the responsibility of the caller.
757  */
758 void drm_crtc_cleanup(struct drm_crtc *crtc)
759 {
760 	struct drm_device *dev = crtc->dev;
761 
762 	/* Note that the crtc_list is considered to be static; should we
763 	 * remove the drm_crtc at runtime we would have to decrement all
764 	 * the indices on the drm_crtc after us in the crtc_list.
765 	 */
766 
767 	kfree(crtc->gamma_store);
768 	crtc->gamma_store = NULL;
769 
770 	drm_modeset_lock_fini(&crtc->mutex);
771 
772 	drm_mode_object_unregister(dev, &crtc->base);
773 	list_del(&crtc->head);
774 	dev->mode_config.num_crtc--;
775 
776 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
777 	if (crtc->state && crtc->funcs->atomic_destroy_state)
778 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
779 
780 	kfree(crtc->name);
781 
782 	memset(crtc, 0, sizeof(*crtc));
783 }
784 EXPORT_SYMBOL(drm_crtc_cleanup);
785 
786 /*
787  * drm_mode_remove - remove and free a mode
788  * @connector: connector list to modify
789  * @mode: mode to remove
790  *
791  * Remove @mode from @connector's mode list, then free it.
792  */
793 static void drm_mode_remove(struct drm_connector *connector,
794 			    struct drm_display_mode *mode)
795 {
796 	list_del(&mode->head);
797 	drm_mode_destroy(connector->dev, mode);
798 }
799 
800 /**
801  * drm_display_info_set_bus_formats - set the supported bus formats
802  * @info: display info to store bus formats in
803  * @formats: array containing the supported bus formats
804  * @num_formats: the number of entries in the fmts array
805  *
806  * Store the supported bus formats in display info structure.
807  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
808  * a full list of available formats.
809  */
810 int drm_display_info_set_bus_formats(struct drm_display_info *info,
811 				     const u32 *formats,
812 				     unsigned int num_formats)
813 {
814 	u32 *fmts = NULL;
815 
816 	if (!formats && num_formats)
817 		return -EINVAL;
818 
819 	if (formats && num_formats) {
820 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
821 			       GFP_KERNEL);
822 		if (!fmts)
823 			return -ENOMEM;
824 	}
825 
826 	kfree(info->bus_formats);
827 	info->bus_formats = fmts;
828 	info->num_bus_formats = num_formats;
829 
830 	return 0;
831 }
832 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
833 
834 /**
835  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
836  * @connector: connector to quwery
837  *
838  * The kernel supports per-connector configration of its consoles through
839  * use of the video= parameter. This function parses that option and
840  * extracts the user's specified mode (or enable/disable status) for a
841  * particular connector. This is typically only used during the early fbdev
842  * setup.
843  */
844 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
845 {
846 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
847 	char *option = NULL;
848 
849 	if (fb_get_options(connector->name, &option))
850 		return;
851 
852 	if (!drm_mode_parse_command_line_for_connector(option,
853 						       connector,
854 						       mode))
855 		return;
856 
857 	if (mode->force) {
858 		const char *s;
859 
860 		switch (mode->force) {
861 		case DRM_FORCE_OFF:
862 			s = "OFF";
863 			break;
864 		case DRM_FORCE_ON_DIGITAL:
865 			s = "ON - dig";
866 			break;
867 		default:
868 		case DRM_FORCE_ON:
869 			s = "ON";
870 			break;
871 		}
872 
873 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
874 		connector->force = mode->force;
875 	}
876 
877 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
878 		      connector->name,
879 		      mode->xres, mode->yres,
880 		      mode->refresh_specified ? mode->refresh : 60,
881 		      mode->rb ? " reduced blanking" : "",
882 		      mode->margins ? " with margins" : "",
883 		      mode->interlace ?  " interlaced" : "");
884 }
885 
886 static void drm_connector_free(struct kref *kref)
887 {
888 	struct drm_connector *connector =
889 		container_of(kref, struct drm_connector, base.refcount);
890 	struct drm_device *dev = connector->dev;
891 
892 	drm_mode_object_unregister(dev, &connector->base);
893 	connector->funcs->destroy(connector);
894 }
895 
896 /**
897  * drm_connector_init - Init a preallocated connector
898  * @dev: DRM device
899  * @connector: the connector to init
900  * @funcs: callbacks for this connector
901  * @connector_type: user visible type of the connector
902  *
903  * Initialises a preallocated connector. Connectors should be
904  * subclassed as part of driver connector objects.
905  *
906  * Returns:
907  * Zero on success, error code on failure.
908  */
909 int drm_connector_init(struct drm_device *dev,
910 		       struct drm_connector *connector,
911 		       const struct drm_connector_funcs *funcs,
912 		       int connector_type)
913 {
914 	struct drm_mode_config *config = &dev->mode_config;
915 	int ret;
916 	struct ida *connector_ida =
917 		&drm_connector_enum_list[connector_type].ida;
918 
919 	drm_modeset_lock_all(dev);
920 
921 	ret = drm_mode_object_get_reg(dev, &connector->base,
922 				      DRM_MODE_OBJECT_CONNECTOR,
923 				      false, drm_connector_free);
924 	if (ret)
925 		goto out_unlock;
926 
927 	connector->base.properties = &connector->properties;
928 	connector->dev = dev;
929 	connector->funcs = funcs;
930 
931 	ret = ida_simple_get(&config->connector_ida, 0, 0, GFP_KERNEL);
932 	if (ret < 0)
933 		goto out_put;
934 	connector->index = ret;
935 	ret = 0;
936 
937 	connector->connector_type = connector_type;
938 	connector->connector_type_id =
939 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
940 	if (connector->connector_type_id < 0) {
941 		ret = connector->connector_type_id;
942 		goto out_put_id;
943 	}
944 	connector->name =
945 		kasprintf(GFP_KERNEL, "%s-%d",
946 			  drm_connector_enum_list[connector_type].name,
947 			  connector->connector_type_id);
948 	if (!connector->name) {
949 		ret = -ENOMEM;
950 		goto out_put_type_id;
951 	}
952 
953 	INIT_LIST_HEAD(&connector->probed_modes);
954 	INIT_LIST_HEAD(&connector->modes);
955 	connector->edid_blob_ptr = NULL;
956 	connector->status = connector_status_unknown;
957 
958 	drm_connector_get_cmdline_mode(connector);
959 
960 	/* We should add connectors at the end to avoid upsetting the connector
961 	 * index too much. */
962 	list_add_tail(&connector->head, &config->connector_list);
963 	config->num_connector++;
964 
965 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
966 		drm_object_attach_property(&connector->base,
967 					      config->edid_property,
968 					      0);
969 
970 	drm_object_attach_property(&connector->base,
971 				      config->dpms_property, 0);
972 
973 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
974 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
975 	}
976 
977 	connector->debugfs_entry = NULL;
978 out_put_type_id:
979 	if (ret)
980 		ida_remove(connector_ida, connector->connector_type_id);
981 out_put_id:
982 	if (ret)
983 		ida_remove(&config->connector_ida, connector->index);
984 out_put:
985 	if (ret)
986 		drm_mode_object_unregister(dev, &connector->base);
987 
988 out_unlock:
989 	drm_modeset_unlock_all(dev);
990 
991 	return ret;
992 }
993 EXPORT_SYMBOL(drm_connector_init);
994 
995 /**
996  * drm_connector_cleanup - cleans up an initialised connector
997  * @connector: connector to cleanup
998  *
999  * Cleans up the connector but doesn't free the object.
1000  */
1001 void drm_connector_cleanup(struct drm_connector *connector)
1002 {
1003 	struct drm_device *dev = connector->dev;
1004 	struct drm_display_mode *mode, *t;
1005 
1006 	/* The connector should have been removed from userspace long before
1007 	 * it is finally destroyed.
1008 	 */
1009 	if (WARN_ON(connector->registered))
1010 		drm_connector_unregister(connector);
1011 
1012 	if (connector->tile_group) {
1013 		drm_mode_put_tile_group(dev, connector->tile_group);
1014 		connector->tile_group = NULL;
1015 	}
1016 
1017 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
1018 		drm_mode_remove(connector, mode);
1019 
1020 	list_for_each_entry_safe(mode, t, &connector->modes, head)
1021 		drm_mode_remove(connector, mode);
1022 
1023 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
1024 		   connector->connector_type_id);
1025 
1026 	ida_remove(&dev->mode_config.connector_ida,
1027 		   connector->index);
1028 
1029 	kfree(connector->display_info.bus_formats);
1030 	drm_mode_object_unregister(dev, &connector->base);
1031 	kfree(connector->name);
1032 	connector->name = NULL;
1033 	list_del(&connector->head);
1034 	dev->mode_config.num_connector--;
1035 
1036 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
1037 	if (connector->state && connector->funcs->atomic_destroy_state)
1038 		connector->funcs->atomic_destroy_state(connector,
1039 						       connector->state);
1040 
1041 	memset(connector, 0, sizeof(*connector));
1042 }
1043 EXPORT_SYMBOL(drm_connector_cleanup);
1044 
1045 /**
1046  * drm_connector_register - register a connector
1047  * @connector: the connector to register
1048  *
1049  * Register userspace interfaces for a connector
1050  *
1051  * Returns:
1052  * Zero on success, error code on failure.
1053  */
1054 int drm_connector_register(struct drm_connector *connector)
1055 {
1056 	int ret;
1057 
1058 	if (connector->registered)
1059 		return 0;
1060 
1061 	ret = drm_sysfs_connector_add(connector);
1062 	if (ret)
1063 		return ret;
1064 
1065 	ret = drm_debugfs_connector_add(connector);
1066 	if (ret) {
1067 		goto err_sysfs;
1068 	}
1069 
1070 	if (connector->funcs->late_register) {
1071 		ret = connector->funcs->late_register(connector);
1072 		if (ret)
1073 			goto err_debugfs;
1074 	}
1075 
1076 	drm_mode_object_register(connector->dev, &connector->base);
1077 
1078 	connector->registered = true;
1079 	return 0;
1080 
1081 err_debugfs:
1082 	drm_debugfs_connector_remove(connector);
1083 err_sysfs:
1084 	drm_sysfs_connector_remove(connector);
1085 	return ret;
1086 }
1087 EXPORT_SYMBOL(drm_connector_register);
1088 
1089 /**
1090  * drm_connector_unregister - unregister a connector
1091  * @connector: the connector to unregister
1092  *
1093  * Unregister userspace interfaces for a connector
1094  */
1095 void drm_connector_unregister(struct drm_connector *connector)
1096 {
1097 	if (!connector->registered)
1098 		return;
1099 
1100 	if (connector->funcs->early_unregister)
1101 		connector->funcs->early_unregister(connector);
1102 
1103 	drm_sysfs_connector_remove(connector);
1104 	drm_debugfs_connector_remove(connector);
1105 
1106 	connector->registered = false;
1107 }
1108 EXPORT_SYMBOL(drm_connector_unregister);
1109 
1110 static void drm_connector_unregister_all(struct drm_device *dev)
1111 {
1112 	struct drm_connector *connector;
1113 
1114 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1115 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1116 		drm_connector_unregister(connector);
1117 }
1118 
1119 static int drm_connector_register_all(struct drm_device *dev)
1120 {
1121 	struct drm_connector *connector;
1122 	int ret;
1123 
1124 	mutex_lock(&dev->mode_config.mutex);
1125 
1126 	drm_for_each_connector(connector, dev) {
1127 		ret = drm_connector_register(connector);
1128 		if (ret)
1129 			goto err;
1130 	}
1131 
1132 	mutex_unlock(&dev->mode_config.mutex);
1133 
1134 	return 0;
1135 
1136 err:
1137 	mutex_unlock(&dev->mode_config.mutex);
1138 	drm_connector_unregister_all(dev);
1139 	return ret;
1140 }
1141 
1142 static int drm_encoder_register_all(struct drm_device *dev)
1143 {
1144 	struct drm_encoder *encoder;
1145 	int ret = 0;
1146 
1147 	drm_for_each_encoder(encoder, dev) {
1148 		if (encoder->funcs->late_register)
1149 			ret = encoder->funcs->late_register(encoder);
1150 		if (ret)
1151 			return ret;
1152 	}
1153 
1154 	return 0;
1155 }
1156 
1157 static void drm_encoder_unregister_all(struct drm_device *dev)
1158 {
1159 	struct drm_encoder *encoder;
1160 
1161 	drm_for_each_encoder(encoder, dev) {
1162 		if (encoder->funcs->early_unregister)
1163 			encoder->funcs->early_unregister(encoder);
1164 	}
1165 }
1166 
1167 /**
1168  * drm_encoder_init - Init a preallocated encoder
1169  * @dev: drm device
1170  * @encoder: the encoder to init
1171  * @funcs: callbacks for this encoder
1172  * @encoder_type: user visible type of the encoder
1173  * @name: printf style format string for the encoder name, or NULL for default name
1174  *
1175  * Initialises a preallocated encoder. Encoder should be
1176  * subclassed as part of driver encoder objects.
1177  *
1178  * Returns:
1179  * Zero on success, error code on failure.
1180  */
1181 int drm_encoder_init(struct drm_device *dev,
1182 		      struct drm_encoder *encoder,
1183 		      const struct drm_encoder_funcs *funcs,
1184 		      int encoder_type, const char *name, ...)
1185 {
1186 	int ret;
1187 
1188 	drm_modeset_lock_all(dev);
1189 
1190 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1191 	if (ret)
1192 		goto out_unlock;
1193 
1194 	encoder->dev = dev;
1195 	encoder->encoder_type = encoder_type;
1196 	encoder->funcs = funcs;
1197 	if (name) {
1198 		va_list ap;
1199 
1200 		va_start(ap, name);
1201 		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
1202 		va_end(ap);
1203 	} else {
1204 		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1205 					  drm_encoder_enum_list[encoder_type].name,
1206 					  encoder->base.id);
1207 	}
1208 	if (!encoder->name) {
1209 		ret = -ENOMEM;
1210 		goto out_put;
1211 	}
1212 
1213 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1214 	encoder->index = dev->mode_config.num_encoder++;
1215 
1216 out_put:
1217 	if (ret)
1218 		drm_mode_object_unregister(dev, &encoder->base);
1219 
1220 out_unlock:
1221 	drm_modeset_unlock_all(dev);
1222 
1223 	return ret;
1224 }
1225 EXPORT_SYMBOL(drm_encoder_init);
1226 
1227 /**
1228  * drm_encoder_cleanup - cleans up an initialised encoder
1229  * @encoder: encoder to cleanup
1230  *
1231  * Cleans up the encoder but doesn't free the object.
1232  */
1233 void drm_encoder_cleanup(struct drm_encoder *encoder)
1234 {
1235 	struct drm_device *dev = encoder->dev;
1236 
1237 	/* Note that the encoder_list is considered to be static; should we
1238 	 * remove the drm_encoder at runtime we would have to decrement all
1239 	 * the indices on the drm_encoder after us in the encoder_list.
1240 	 */
1241 
1242 	drm_modeset_lock_all(dev);
1243 	drm_mode_object_unregister(dev, &encoder->base);
1244 	kfree(encoder->name);
1245 	list_del(&encoder->head);
1246 	dev->mode_config.num_encoder--;
1247 	drm_modeset_unlock_all(dev);
1248 
1249 	memset(encoder, 0, sizeof(*encoder));
1250 }
1251 EXPORT_SYMBOL(drm_encoder_cleanup);
1252 
1253 static unsigned int drm_num_planes(struct drm_device *dev)
1254 {
1255 	unsigned int num = 0;
1256 	struct drm_plane *tmp;
1257 
1258 	drm_for_each_plane(tmp, dev) {
1259 		num++;
1260 	}
1261 
1262 	return num;
1263 }
1264 
1265 /**
1266  * drm_universal_plane_init - Initialize a new universal plane object
1267  * @dev: DRM device
1268  * @plane: plane object to init
1269  * @possible_crtcs: bitmask of possible CRTCs
1270  * @funcs: callbacks for the new plane
1271  * @formats: array of supported formats (%DRM_FORMAT_*)
1272  * @format_count: number of elements in @formats
1273  * @type: type of plane (overlay, primary, cursor)
1274  * @name: printf style format string for the plane name, or NULL for default name
1275  *
1276  * Initializes a plane object of type @type.
1277  *
1278  * Returns:
1279  * Zero on success, error code on failure.
1280  */
1281 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1282 			     unsigned long possible_crtcs,
1283 			     const struct drm_plane_funcs *funcs,
1284 			     const uint32_t *formats, unsigned int format_count,
1285 			     enum drm_plane_type type,
1286 			     const char *name, ...)
1287 {
1288 	struct drm_mode_config *config = &dev->mode_config;
1289 	int ret;
1290 
1291 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1292 	if (ret)
1293 		return ret;
1294 
1295 	drm_modeset_lock_init(&plane->mutex);
1296 
1297 	plane->base.properties = &plane->properties;
1298 	plane->dev = dev;
1299 	plane->funcs = funcs;
1300 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1301 					    GFP_KERNEL);
1302 	if (!plane->format_types) {
1303 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1304 		drm_mode_object_unregister(dev, &plane->base);
1305 		return -ENOMEM;
1306 	}
1307 
1308 	if (name) {
1309 		va_list ap;
1310 
1311 		va_start(ap, name);
1312 		plane->name = kvasprintf(GFP_KERNEL, name, ap);
1313 		va_end(ap);
1314 	} else {
1315 		plane->name = kasprintf(GFP_KERNEL, "plane-%d",
1316 					drm_num_planes(dev));
1317 	}
1318 	if (!plane->name) {
1319 		kfree(plane->format_types);
1320 		drm_mode_object_unregister(dev, &plane->base);
1321 		return -ENOMEM;
1322 	}
1323 
1324 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1325 	plane->format_count = format_count;
1326 	plane->possible_crtcs = possible_crtcs;
1327 	plane->type = type;
1328 
1329 	list_add_tail(&plane->head, &config->plane_list);
1330 	plane->index = config->num_total_plane++;
1331 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1332 		config->num_overlay_plane++;
1333 
1334 	drm_object_attach_property(&plane->base,
1335 				   config->plane_type_property,
1336 				   plane->type);
1337 
1338 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1339 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1340 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1341 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1342 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1343 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1344 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1345 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1346 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1347 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1348 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1349 	}
1350 
1351 	return 0;
1352 }
1353 EXPORT_SYMBOL(drm_universal_plane_init);
1354 
1355 static int drm_plane_register_all(struct drm_device *dev)
1356 {
1357 	struct drm_plane *plane;
1358 	int ret = 0;
1359 
1360 	drm_for_each_plane(plane, dev) {
1361 		if (plane->funcs->late_register)
1362 			ret = plane->funcs->late_register(plane);
1363 		if (ret)
1364 			return ret;
1365 	}
1366 
1367 	return 0;
1368 }
1369 
1370 static void drm_plane_unregister_all(struct drm_device *dev)
1371 {
1372 	struct drm_plane *plane;
1373 
1374 	drm_for_each_plane(plane, dev) {
1375 		if (plane->funcs->early_unregister)
1376 			plane->funcs->early_unregister(plane);
1377 	}
1378 }
1379 
1380 /**
1381  * drm_plane_init - Initialize a legacy plane
1382  * @dev: DRM device
1383  * @plane: plane object to init
1384  * @possible_crtcs: bitmask of possible CRTCs
1385  * @funcs: callbacks for the new plane
1386  * @formats: array of supported formats (%DRM_FORMAT_*)
1387  * @format_count: number of elements in @formats
1388  * @is_primary: plane type (primary vs overlay)
1389  *
1390  * Legacy API to initialize a DRM plane.
1391  *
1392  * New drivers should call drm_universal_plane_init() instead.
1393  *
1394  * Returns:
1395  * Zero on success, error code on failure.
1396  */
1397 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1398 		   unsigned long possible_crtcs,
1399 		   const struct drm_plane_funcs *funcs,
1400 		   const uint32_t *formats, unsigned int format_count,
1401 		   bool is_primary)
1402 {
1403 	enum drm_plane_type type;
1404 
1405 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1406 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1407 					formats, format_count, type, NULL);
1408 }
1409 EXPORT_SYMBOL(drm_plane_init);
1410 
1411 /**
1412  * drm_plane_cleanup - Clean up the core plane usage
1413  * @plane: plane to cleanup
1414  *
1415  * This function cleans up @plane and removes it from the DRM mode setting
1416  * core. Note that the function does *not* free the plane structure itself,
1417  * this is the responsibility of the caller.
1418  */
1419 void drm_plane_cleanup(struct drm_plane *plane)
1420 {
1421 	struct drm_device *dev = plane->dev;
1422 
1423 	drm_modeset_lock_all(dev);
1424 	kfree(plane->format_types);
1425 	drm_mode_object_unregister(dev, &plane->base);
1426 
1427 	BUG_ON(list_empty(&plane->head));
1428 
1429 	/* Note that the plane_list is considered to be static; should we
1430 	 * remove the drm_plane at runtime we would have to decrement all
1431 	 * the indices on the drm_plane after us in the plane_list.
1432 	 */
1433 
1434 	list_del(&plane->head);
1435 	dev->mode_config.num_total_plane--;
1436 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1437 		dev->mode_config.num_overlay_plane--;
1438 	drm_modeset_unlock_all(dev);
1439 
1440 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1441 	if (plane->state && plane->funcs->atomic_destroy_state)
1442 		plane->funcs->atomic_destroy_state(plane, plane->state);
1443 
1444 	kfree(plane->name);
1445 
1446 	memset(plane, 0, sizeof(*plane));
1447 }
1448 EXPORT_SYMBOL(drm_plane_cleanup);
1449 
1450 /**
1451  * drm_plane_from_index - find the registered plane at an index
1452  * @dev: DRM device
1453  * @idx: index of registered plane to find for
1454  *
1455  * Given a plane index, return the registered plane from DRM device's
1456  * list of planes with matching index.
1457  */
1458 struct drm_plane *
1459 drm_plane_from_index(struct drm_device *dev, int idx)
1460 {
1461 	struct drm_plane *plane;
1462 
1463 	drm_for_each_plane(plane, dev)
1464 		if (idx == plane->index)
1465 			return plane;
1466 
1467 	return NULL;
1468 }
1469 EXPORT_SYMBOL(drm_plane_from_index);
1470 
1471 /**
1472  * drm_plane_force_disable - Forcibly disable a plane
1473  * @plane: plane to disable
1474  *
1475  * Forces the plane to be disabled.
1476  *
1477  * Used when the plane's current framebuffer is destroyed,
1478  * and when restoring fbdev mode.
1479  */
1480 void drm_plane_force_disable(struct drm_plane *plane)
1481 {
1482 	int ret;
1483 
1484 	if (!plane->fb)
1485 		return;
1486 
1487 	plane->old_fb = plane->fb;
1488 	ret = plane->funcs->disable_plane(plane);
1489 	if (ret) {
1490 		DRM_ERROR("failed to disable plane with busy fb\n");
1491 		plane->old_fb = NULL;
1492 		return;
1493 	}
1494 	/* disconnect the plane from the fb and crtc: */
1495 	drm_framebuffer_unreference(plane->old_fb);
1496 	plane->old_fb = NULL;
1497 	plane->fb = NULL;
1498 	plane->crtc = NULL;
1499 }
1500 EXPORT_SYMBOL(drm_plane_force_disable);
1501 
1502 int drm_modeset_register_all(struct drm_device *dev)
1503 {
1504 	int ret;
1505 
1506 	ret = drm_plane_register_all(dev);
1507 	if (ret)
1508 		goto err_plane;
1509 
1510 	ret = drm_crtc_register_all(dev);
1511 	if  (ret)
1512 		goto err_crtc;
1513 
1514 	ret = drm_encoder_register_all(dev);
1515 	if (ret)
1516 		goto err_encoder;
1517 
1518 	ret = drm_connector_register_all(dev);
1519 	if (ret)
1520 		goto err_connector;
1521 
1522 	return 0;
1523 
1524 err_connector:
1525 	drm_encoder_unregister_all(dev);
1526 err_encoder:
1527 	drm_crtc_unregister_all(dev);
1528 err_crtc:
1529 	drm_plane_unregister_all(dev);
1530 err_plane:
1531 	return ret;
1532 }
1533 
1534 void drm_modeset_unregister_all(struct drm_device *dev)
1535 {
1536 	drm_connector_unregister_all(dev);
1537 	drm_encoder_unregister_all(dev);
1538 	drm_crtc_unregister_all(dev);
1539 	drm_plane_unregister_all(dev);
1540 }
1541 
1542 static int drm_mode_create_standard_properties(struct drm_device *dev)
1543 {
1544 	struct drm_property *prop;
1545 
1546 	/*
1547 	 * Standard properties (apply to all connectors)
1548 	 */
1549 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1550 				   DRM_MODE_PROP_IMMUTABLE,
1551 				   "EDID", 0);
1552 	if (!prop)
1553 		return -ENOMEM;
1554 	dev->mode_config.edid_property = prop;
1555 
1556 	prop = drm_property_create_enum(dev, 0,
1557 				   "DPMS", drm_dpms_enum_list,
1558 				   ARRAY_SIZE(drm_dpms_enum_list));
1559 	if (!prop)
1560 		return -ENOMEM;
1561 	dev->mode_config.dpms_property = prop;
1562 
1563 	prop = drm_property_create(dev,
1564 				   DRM_MODE_PROP_BLOB |
1565 				   DRM_MODE_PROP_IMMUTABLE,
1566 				   "PATH", 0);
1567 	if (!prop)
1568 		return -ENOMEM;
1569 	dev->mode_config.path_property = prop;
1570 
1571 	prop = drm_property_create(dev,
1572 				   DRM_MODE_PROP_BLOB |
1573 				   DRM_MODE_PROP_IMMUTABLE,
1574 				   "TILE", 0);
1575 	if (!prop)
1576 		return -ENOMEM;
1577 	dev->mode_config.tile_property = prop;
1578 
1579 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1580 					"type", drm_plane_type_enum_list,
1581 					ARRAY_SIZE(drm_plane_type_enum_list));
1582 	if (!prop)
1583 		return -ENOMEM;
1584 	dev->mode_config.plane_type_property = prop;
1585 
1586 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1587 			"SRC_X", 0, UINT_MAX);
1588 	if (!prop)
1589 		return -ENOMEM;
1590 	dev->mode_config.prop_src_x = prop;
1591 
1592 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1593 			"SRC_Y", 0, UINT_MAX);
1594 	if (!prop)
1595 		return -ENOMEM;
1596 	dev->mode_config.prop_src_y = prop;
1597 
1598 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1599 			"SRC_W", 0, UINT_MAX);
1600 	if (!prop)
1601 		return -ENOMEM;
1602 	dev->mode_config.prop_src_w = prop;
1603 
1604 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1605 			"SRC_H", 0, UINT_MAX);
1606 	if (!prop)
1607 		return -ENOMEM;
1608 	dev->mode_config.prop_src_h = prop;
1609 
1610 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1611 			"CRTC_X", INT_MIN, INT_MAX);
1612 	if (!prop)
1613 		return -ENOMEM;
1614 	dev->mode_config.prop_crtc_x = prop;
1615 
1616 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1617 			"CRTC_Y", INT_MIN, INT_MAX);
1618 	if (!prop)
1619 		return -ENOMEM;
1620 	dev->mode_config.prop_crtc_y = prop;
1621 
1622 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1623 			"CRTC_W", 0, INT_MAX);
1624 	if (!prop)
1625 		return -ENOMEM;
1626 	dev->mode_config.prop_crtc_w = prop;
1627 
1628 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1629 			"CRTC_H", 0, INT_MAX);
1630 	if (!prop)
1631 		return -ENOMEM;
1632 	dev->mode_config.prop_crtc_h = prop;
1633 
1634 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1635 			"FB_ID", DRM_MODE_OBJECT_FB);
1636 	if (!prop)
1637 		return -ENOMEM;
1638 	dev->mode_config.prop_fb_id = prop;
1639 
1640 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1641 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1642 	if (!prop)
1643 		return -ENOMEM;
1644 	dev->mode_config.prop_crtc_id = prop;
1645 
1646 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1647 			"ACTIVE");
1648 	if (!prop)
1649 		return -ENOMEM;
1650 	dev->mode_config.prop_active = prop;
1651 
1652 	prop = drm_property_create(dev,
1653 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1654 			"MODE_ID", 0);
1655 	if (!prop)
1656 		return -ENOMEM;
1657 	dev->mode_config.prop_mode_id = prop;
1658 
1659 	prop = drm_property_create(dev,
1660 			DRM_MODE_PROP_BLOB,
1661 			"DEGAMMA_LUT", 0);
1662 	if (!prop)
1663 		return -ENOMEM;
1664 	dev->mode_config.degamma_lut_property = prop;
1665 
1666 	prop = drm_property_create_range(dev,
1667 			DRM_MODE_PROP_IMMUTABLE,
1668 			"DEGAMMA_LUT_SIZE", 0, UINT_MAX);
1669 	if (!prop)
1670 		return -ENOMEM;
1671 	dev->mode_config.degamma_lut_size_property = prop;
1672 
1673 	prop = drm_property_create(dev,
1674 			DRM_MODE_PROP_BLOB,
1675 			"CTM", 0);
1676 	if (!prop)
1677 		return -ENOMEM;
1678 	dev->mode_config.ctm_property = prop;
1679 
1680 	prop = drm_property_create(dev,
1681 			DRM_MODE_PROP_BLOB,
1682 			"GAMMA_LUT", 0);
1683 	if (!prop)
1684 		return -ENOMEM;
1685 	dev->mode_config.gamma_lut_property = prop;
1686 
1687 	prop = drm_property_create_range(dev,
1688 			DRM_MODE_PROP_IMMUTABLE,
1689 			"GAMMA_LUT_SIZE", 0, UINT_MAX);
1690 	if (!prop)
1691 		return -ENOMEM;
1692 	dev->mode_config.gamma_lut_size_property = prop;
1693 
1694 	return 0;
1695 }
1696 
1697 /**
1698  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1699  * @dev: DRM device
1700  *
1701  * Called by a driver the first time a DVI-I connector is made.
1702  */
1703 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1704 {
1705 	struct drm_property *dvi_i_selector;
1706 	struct drm_property *dvi_i_subconnector;
1707 
1708 	if (dev->mode_config.dvi_i_select_subconnector_property)
1709 		return 0;
1710 
1711 	dvi_i_selector =
1712 		drm_property_create_enum(dev, 0,
1713 				    "select subconnector",
1714 				    drm_dvi_i_select_enum_list,
1715 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1716 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1717 
1718 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1719 				    "subconnector",
1720 				    drm_dvi_i_subconnector_enum_list,
1721 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1722 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1723 
1724 	return 0;
1725 }
1726 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1727 
1728 /**
1729  * drm_create_tv_properties - create TV specific connector properties
1730  * @dev: DRM device
1731  * @num_modes: number of different TV formats (modes) supported
1732  * @modes: array of pointers to strings containing name of each format
1733  *
1734  * Called by a driver's TV initialization routine, this function creates
1735  * the TV specific connector properties for a given device.  Caller is
1736  * responsible for allocating a list of format names and passing them to
1737  * this routine.
1738  */
1739 int drm_mode_create_tv_properties(struct drm_device *dev,
1740 				  unsigned int num_modes,
1741 				  const char * const modes[])
1742 {
1743 	struct drm_property *tv_selector;
1744 	struct drm_property *tv_subconnector;
1745 	unsigned int i;
1746 
1747 	if (dev->mode_config.tv_select_subconnector_property)
1748 		return 0;
1749 
1750 	/*
1751 	 * Basic connector properties
1752 	 */
1753 	tv_selector = drm_property_create_enum(dev, 0,
1754 					  "select subconnector",
1755 					  drm_tv_select_enum_list,
1756 					  ARRAY_SIZE(drm_tv_select_enum_list));
1757 	if (!tv_selector)
1758 		goto nomem;
1759 
1760 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1761 
1762 	tv_subconnector =
1763 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1764 				    "subconnector",
1765 				    drm_tv_subconnector_enum_list,
1766 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1767 	if (!tv_subconnector)
1768 		goto nomem;
1769 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1770 
1771 	/*
1772 	 * Other, TV specific properties: margins & TV modes.
1773 	 */
1774 	dev->mode_config.tv_left_margin_property =
1775 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1776 	if (!dev->mode_config.tv_left_margin_property)
1777 		goto nomem;
1778 
1779 	dev->mode_config.tv_right_margin_property =
1780 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1781 	if (!dev->mode_config.tv_right_margin_property)
1782 		goto nomem;
1783 
1784 	dev->mode_config.tv_top_margin_property =
1785 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1786 	if (!dev->mode_config.tv_top_margin_property)
1787 		goto nomem;
1788 
1789 	dev->mode_config.tv_bottom_margin_property =
1790 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1791 	if (!dev->mode_config.tv_bottom_margin_property)
1792 		goto nomem;
1793 
1794 	dev->mode_config.tv_mode_property =
1795 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1796 				    "mode", num_modes);
1797 	if (!dev->mode_config.tv_mode_property)
1798 		goto nomem;
1799 
1800 	for (i = 0; i < num_modes; i++)
1801 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1802 				      i, modes[i]);
1803 
1804 	dev->mode_config.tv_brightness_property =
1805 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1806 	if (!dev->mode_config.tv_brightness_property)
1807 		goto nomem;
1808 
1809 	dev->mode_config.tv_contrast_property =
1810 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1811 	if (!dev->mode_config.tv_contrast_property)
1812 		goto nomem;
1813 
1814 	dev->mode_config.tv_flicker_reduction_property =
1815 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1816 	if (!dev->mode_config.tv_flicker_reduction_property)
1817 		goto nomem;
1818 
1819 	dev->mode_config.tv_overscan_property =
1820 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1821 	if (!dev->mode_config.tv_overscan_property)
1822 		goto nomem;
1823 
1824 	dev->mode_config.tv_saturation_property =
1825 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1826 	if (!dev->mode_config.tv_saturation_property)
1827 		goto nomem;
1828 
1829 	dev->mode_config.tv_hue_property =
1830 		drm_property_create_range(dev, 0, "hue", 0, 100);
1831 	if (!dev->mode_config.tv_hue_property)
1832 		goto nomem;
1833 
1834 	return 0;
1835 nomem:
1836 	return -ENOMEM;
1837 }
1838 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1839 
1840 /**
1841  * drm_mode_create_scaling_mode_property - create scaling mode property
1842  * @dev: DRM device
1843  *
1844  * Called by a driver the first time it's needed, must be attached to desired
1845  * connectors.
1846  */
1847 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1848 {
1849 	struct drm_property *scaling_mode;
1850 
1851 	if (dev->mode_config.scaling_mode_property)
1852 		return 0;
1853 
1854 	scaling_mode =
1855 		drm_property_create_enum(dev, 0, "scaling mode",
1856 				drm_scaling_mode_enum_list,
1857 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1858 
1859 	dev->mode_config.scaling_mode_property = scaling_mode;
1860 
1861 	return 0;
1862 }
1863 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1864 
1865 /**
1866  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1867  * @dev: DRM device
1868  *
1869  * Called by a driver the first time it's needed, must be attached to desired
1870  * connectors.
1871  *
1872  * Returns:
1873  * Zero on success, negative errno on failure.
1874  */
1875 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1876 {
1877 	if (dev->mode_config.aspect_ratio_property)
1878 		return 0;
1879 
1880 	dev->mode_config.aspect_ratio_property =
1881 		drm_property_create_enum(dev, 0, "aspect ratio",
1882 				drm_aspect_ratio_enum_list,
1883 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1884 
1885 	if (dev->mode_config.aspect_ratio_property == NULL)
1886 		return -ENOMEM;
1887 
1888 	return 0;
1889 }
1890 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1891 
1892 /**
1893  * drm_mode_create_dirty_property - create dirty property
1894  * @dev: DRM device
1895  *
1896  * Called by a driver the first time it's needed, must be attached to desired
1897  * connectors.
1898  */
1899 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1900 {
1901 	struct drm_property *dirty_info;
1902 
1903 	if (dev->mode_config.dirty_info_property)
1904 		return 0;
1905 
1906 	dirty_info =
1907 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1908 				    "dirty",
1909 				    drm_dirty_info_enum_list,
1910 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1911 	dev->mode_config.dirty_info_property = dirty_info;
1912 
1913 	return 0;
1914 }
1915 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1916 
1917 /**
1918  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1919  * @dev: DRM device
1920  *
1921  * Create the the suggested x/y offset property for connectors.
1922  */
1923 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1924 {
1925 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1926 		return 0;
1927 
1928 	dev->mode_config.suggested_x_property =
1929 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1930 
1931 	dev->mode_config.suggested_y_property =
1932 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1933 
1934 	if (dev->mode_config.suggested_x_property == NULL ||
1935 	    dev->mode_config.suggested_y_property == NULL)
1936 		return -ENOMEM;
1937 	return 0;
1938 }
1939 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1940 
1941 /**
1942  * drm_mode_getresources - get graphics configuration
1943  * @dev: drm device for the ioctl
1944  * @data: data pointer for the ioctl
1945  * @file_priv: drm file for the ioctl call
1946  *
1947  * Construct a set of configuration description structures and return
1948  * them to the user, including CRTC, connector and framebuffer configuration.
1949  *
1950  * Called by the user via ioctl.
1951  *
1952  * Returns:
1953  * Zero on success, negative errno on failure.
1954  */
1955 int drm_mode_getresources(struct drm_device *dev, void *data,
1956 			  struct drm_file *file_priv)
1957 {
1958 	struct drm_mode_card_res *card_res = data;
1959 	struct list_head *lh;
1960 	struct drm_framebuffer *fb;
1961 	struct drm_connector *connector;
1962 	struct drm_crtc *crtc;
1963 	struct drm_encoder *encoder;
1964 	int ret = 0;
1965 	int connector_count = 0;
1966 	int crtc_count = 0;
1967 	int fb_count = 0;
1968 	int encoder_count = 0;
1969 	int copied = 0;
1970 	uint32_t __user *fb_id;
1971 	uint32_t __user *crtc_id;
1972 	uint32_t __user *connector_id;
1973 	uint32_t __user *encoder_id;
1974 
1975 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1976 		return -EINVAL;
1977 
1978 
1979 	mutex_lock(&file_priv->fbs_lock);
1980 	/*
1981 	 * For the non-control nodes we need to limit the list of resources
1982 	 * by IDs in the group list for this node
1983 	 */
1984 	list_for_each(lh, &file_priv->fbs)
1985 		fb_count++;
1986 
1987 	/* handle this in 4 parts */
1988 	/* FBs */
1989 	if (card_res->count_fbs >= fb_count) {
1990 		copied = 0;
1991 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1992 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1993 			if (put_user(fb->base.id, fb_id + copied)) {
1994 				mutex_unlock(&file_priv->fbs_lock);
1995 				return -EFAULT;
1996 			}
1997 			copied++;
1998 		}
1999 	}
2000 	card_res->count_fbs = fb_count;
2001 	mutex_unlock(&file_priv->fbs_lock);
2002 
2003 	/* mode_config.mutex protects the connector list against e.g. DP MST
2004 	 * connector hot-adding. CRTC/Plane lists are invariant. */
2005 	mutex_lock(&dev->mode_config.mutex);
2006 	drm_for_each_crtc(crtc, dev)
2007 		crtc_count++;
2008 
2009 	drm_for_each_connector(connector, dev)
2010 		connector_count++;
2011 
2012 	drm_for_each_encoder(encoder, dev)
2013 		encoder_count++;
2014 
2015 	card_res->max_height = dev->mode_config.max_height;
2016 	card_res->min_height = dev->mode_config.min_height;
2017 	card_res->max_width = dev->mode_config.max_width;
2018 	card_res->min_width = dev->mode_config.min_width;
2019 
2020 	/* CRTCs */
2021 	if (card_res->count_crtcs >= crtc_count) {
2022 		copied = 0;
2023 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
2024 		drm_for_each_crtc(crtc, dev) {
2025 			if (put_user(crtc->base.id, crtc_id + copied)) {
2026 				ret = -EFAULT;
2027 				goto out;
2028 			}
2029 			copied++;
2030 		}
2031 	}
2032 	card_res->count_crtcs = crtc_count;
2033 
2034 	/* Encoders */
2035 	if (card_res->count_encoders >= encoder_count) {
2036 		copied = 0;
2037 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
2038 		drm_for_each_encoder(encoder, dev) {
2039 			if (put_user(encoder->base.id, encoder_id +
2040 				     copied)) {
2041 				ret = -EFAULT;
2042 				goto out;
2043 			}
2044 			copied++;
2045 		}
2046 	}
2047 	card_res->count_encoders = encoder_count;
2048 
2049 	/* Connectors */
2050 	if (card_res->count_connectors >= connector_count) {
2051 		copied = 0;
2052 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
2053 		drm_for_each_connector(connector, dev) {
2054 			if (put_user(connector->base.id,
2055 				     connector_id + copied)) {
2056 				ret = -EFAULT;
2057 				goto out;
2058 			}
2059 			copied++;
2060 		}
2061 	}
2062 	card_res->count_connectors = connector_count;
2063 
2064 out:
2065 	mutex_unlock(&dev->mode_config.mutex);
2066 	return ret;
2067 }
2068 
2069 /**
2070  * drm_mode_getcrtc - get CRTC configuration
2071  * @dev: drm device for the ioctl
2072  * @data: data pointer for the ioctl
2073  * @file_priv: drm file for the ioctl call
2074  *
2075  * Construct a CRTC configuration structure to return to the user.
2076  *
2077  * Called by the user via ioctl.
2078  *
2079  * Returns:
2080  * Zero on success, negative errno on failure.
2081  */
2082 int drm_mode_getcrtc(struct drm_device *dev,
2083 		     void *data, struct drm_file *file_priv)
2084 {
2085 	struct drm_mode_crtc *crtc_resp = data;
2086 	struct drm_crtc *crtc;
2087 
2088 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2089 		return -EINVAL;
2090 
2091 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
2092 	if (!crtc)
2093 		return -ENOENT;
2094 
2095 	drm_modeset_lock_crtc(crtc, crtc->primary);
2096 	crtc_resp->gamma_size = crtc->gamma_size;
2097 	if (crtc->primary->fb)
2098 		crtc_resp->fb_id = crtc->primary->fb->base.id;
2099 	else
2100 		crtc_resp->fb_id = 0;
2101 
2102 	if (crtc->state) {
2103 		crtc_resp->x = crtc->primary->state->src_x >> 16;
2104 		crtc_resp->y = crtc->primary->state->src_y >> 16;
2105 		if (crtc->state->enable) {
2106 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
2107 			crtc_resp->mode_valid = 1;
2108 
2109 		} else {
2110 			crtc_resp->mode_valid = 0;
2111 		}
2112 	} else {
2113 		crtc_resp->x = crtc->x;
2114 		crtc_resp->y = crtc->y;
2115 		if (crtc->enabled) {
2116 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
2117 			crtc_resp->mode_valid = 1;
2118 
2119 		} else {
2120 			crtc_resp->mode_valid = 0;
2121 		}
2122 	}
2123 	drm_modeset_unlock_crtc(crtc);
2124 
2125 	return 0;
2126 }
2127 
2128 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
2129 					 const struct drm_file *file_priv)
2130 {
2131 	/*
2132 	 * If user-space hasn't configured the driver to expose the stereo 3D
2133 	 * modes, don't expose them.
2134 	 */
2135 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
2136 		return false;
2137 
2138 	return true;
2139 }
2140 
2141 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
2142 {
2143 	/* For atomic drivers only state objects are synchronously updated and
2144 	 * protected by modeset locks, so check those first. */
2145 	if (connector->state)
2146 		return connector->state->best_encoder;
2147 	return connector->encoder;
2148 }
2149 
2150 /* helper for getconnector and getproperties ioctls */
2151 static int get_properties(struct drm_mode_object *obj, bool atomic,
2152 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
2153 		uint32_t *arg_count_props)
2154 {
2155 	int props_count;
2156 	int i, ret, copied;
2157 
2158 	props_count = obj->properties->count;
2159 	if (!atomic)
2160 		props_count -= obj->properties->atomic_count;
2161 
2162 	if ((*arg_count_props >= props_count) && props_count) {
2163 		for (i = 0, copied = 0; copied < props_count; i++) {
2164 			struct drm_property *prop = obj->properties->properties[i];
2165 			uint64_t val;
2166 
2167 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
2168 				continue;
2169 
2170 			ret = drm_object_property_get_value(obj, prop, &val);
2171 			if (ret)
2172 				return ret;
2173 
2174 			if (put_user(prop->base.id, prop_ptr + copied))
2175 				return -EFAULT;
2176 
2177 			if (put_user(val, prop_values + copied))
2178 				return -EFAULT;
2179 
2180 			copied++;
2181 		}
2182 	}
2183 	*arg_count_props = props_count;
2184 
2185 	return 0;
2186 }
2187 
2188 /**
2189  * drm_mode_getconnector - get connector configuration
2190  * @dev: drm device for the ioctl
2191  * @data: data pointer for the ioctl
2192  * @file_priv: drm file for the ioctl call
2193  *
2194  * Construct a connector configuration structure to return to the user.
2195  *
2196  * Called by the user via ioctl.
2197  *
2198  * Returns:
2199  * Zero on success, negative errno on failure.
2200  */
2201 int drm_mode_getconnector(struct drm_device *dev, void *data,
2202 			  struct drm_file *file_priv)
2203 {
2204 	struct drm_mode_get_connector *out_resp = data;
2205 	struct drm_connector *connector;
2206 	struct drm_encoder *encoder;
2207 	struct drm_display_mode *mode;
2208 	int mode_count = 0;
2209 	int encoders_count = 0;
2210 	int ret = 0;
2211 	int copied = 0;
2212 	int i;
2213 	struct drm_mode_modeinfo u_mode;
2214 	struct drm_mode_modeinfo __user *mode_ptr;
2215 	uint32_t __user *encoder_ptr;
2216 
2217 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2218 		return -EINVAL;
2219 
2220 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2221 
2222 	mutex_lock(&dev->mode_config.mutex);
2223 
2224 	connector = drm_connector_lookup(dev, out_resp->connector_id);
2225 	if (!connector) {
2226 		ret = -ENOENT;
2227 		goto out_unlock;
2228 	}
2229 
2230 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2231 		if (connector->encoder_ids[i] != 0)
2232 			encoders_count++;
2233 
2234 	if (out_resp->count_modes == 0) {
2235 		connector->funcs->fill_modes(connector,
2236 					     dev->mode_config.max_width,
2237 					     dev->mode_config.max_height);
2238 	}
2239 
2240 	/* delayed so we get modes regardless of pre-fill_modes state */
2241 	list_for_each_entry(mode, &connector->modes, head)
2242 		if (drm_mode_expose_to_userspace(mode, file_priv))
2243 			mode_count++;
2244 
2245 	out_resp->connector_id = connector->base.id;
2246 	out_resp->connector_type = connector->connector_type;
2247 	out_resp->connector_type_id = connector->connector_type_id;
2248 	out_resp->mm_width = connector->display_info.width_mm;
2249 	out_resp->mm_height = connector->display_info.height_mm;
2250 	out_resp->subpixel = connector->display_info.subpixel_order;
2251 	out_resp->connection = connector->status;
2252 
2253 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2254 	encoder = drm_connector_get_encoder(connector);
2255 	if (encoder)
2256 		out_resp->encoder_id = encoder->base.id;
2257 	else
2258 		out_resp->encoder_id = 0;
2259 
2260 	/*
2261 	 * This ioctl is called twice, once to determine how much space is
2262 	 * needed, and the 2nd time to fill it.
2263 	 */
2264 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2265 		copied = 0;
2266 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2267 		list_for_each_entry(mode, &connector->modes, head) {
2268 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2269 				continue;
2270 
2271 			drm_mode_convert_to_umode(&u_mode, mode);
2272 			if (copy_to_user(mode_ptr + copied,
2273 					 &u_mode, sizeof(u_mode))) {
2274 				ret = -EFAULT;
2275 				goto out;
2276 			}
2277 			copied++;
2278 		}
2279 	}
2280 	out_resp->count_modes = mode_count;
2281 
2282 	ret = get_properties(&connector->base, file_priv->atomic,
2283 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2284 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2285 			&out_resp->count_props);
2286 	if (ret)
2287 		goto out;
2288 
2289 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2290 		copied = 0;
2291 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2292 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2293 			if (connector->encoder_ids[i] != 0) {
2294 				if (put_user(connector->encoder_ids[i],
2295 					     encoder_ptr + copied)) {
2296 					ret = -EFAULT;
2297 					goto out;
2298 				}
2299 				copied++;
2300 			}
2301 		}
2302 	}
2303 	out_resp->count_encoders = encoders_count;
2304 
2305 out:
2306 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2307 
2308 	drm_connector_unreference(connector);
2309 out_unlock:
2310 	mutex_unlock(&dev->mode_config.mutex);
2311 
2312 	return ret;
2313 }
2314 
2315 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2316 {
2317 	struct drm_connector *connector;
2318 	struct drm_device *dev = encoder->dev;
2319 	bool uses_atomic = false;
2320 
2321 	/* For atomic drivers only state objects are synchronously updated and
2322 	 * protected by modeset locks, so check those first. */
2323 	drm_for_each_connector(connector, dev) {
2324 		if (!connector->state)
2325 			continue;
2326 
2327 		uses_atomic = true;
2328 
2329 		if (connector->state->best_encoder != encoder)
2330 			continue;
2331 
2332 		return connector->state->crtc;
2333 	}
2334 
2335 	/* Don't return stale data (e.g. pending async disable). */
2336 	if (uses_atomic)
2337 		return NULL;
2338 
2339 	return encoder->crtc;
2340 }
2341 
2342 /**
2343  * drm_mode_getencoder - get encoder configuration
2344  * @dev: drm device for the ioctl
2345  * @data: data pointer for the ioctl
2346  * @file_priv: drm file for the ioctl call
2347  *
2348  * Construct a encoder configuration structure to return to the user.
2349  *
2350  * Called by the user via ioctl.
2351  *
2352  * Returns:
2353  * Zero on success, negative errno on failure.
2354  */
2355 int drm_mode_getencoder(struct drm_device *dev, void *data,
2356 			struct drm_file *file_priv)
2357 {
2358 	struct drm_mode_get_encoder *enc_resp = data;
2359 	struct drm_encoder *encoder;
2360 	struct drm_crtc *crtc;
2361 
2362 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2363 		return -EINVAL;
2364 
2365 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2366 	if (!encoder)
2367 		return -ENOENT;
2368 
2369 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2370 	crtc = drm_encoder_get_crtc(encoder);
2371 	if (crtc)
2372 		enc_resp->crtc_id = crtc->base.id;
2373 	else
2374 		enc_resp->crtc_id = 0;
2375 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2376 
2377 	enc_resp->encoder_type = encoder->encoder_type;
2378 	enc_resp->encoder_id = encoder->base.id;
2379 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2380 	enc_resp->possible_clones = encoder->possible_clones;
2381 
2382 	return 0;
2383 }
2384 
2385 /**
2386  * drm_mode_getplane_res - enumerate all plane resources
2387  * @dev: DRM device
2388  * @data: ioctl data
2389  * @file_priv: DRM file info
2390  *
2391  * Construct a list of plane ids to return to the user.
2392  *
2393  * Called by the user via ioctl.
2394  *
2395  * Returns:
2396  * Zero on success, negative errno on failure.
2397  */
2398 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2399 			  struct drm_file *file_priv)
2400 {
2401 	struct drm_mode_get_plane_res *plane_resp = data;
2402 	struct drm_mode_config *config;
2403 	struct drm_plane *plane;
2404 	uint32_t __user *plane_ptr;
2405 	int copied = 0;
2406 	unsigned num_planes;
2407 
2408 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2409 		return -EINVAL;
2410 
2411 	config = &dev->mode_config;
2412 
2413 	if (file_priv->universal_planes)
2414 		num_planes = config->num_total_plane;
2415 	else
2416 		num_planes = config->num_overlay_plane;
2417 
2418 	/*
2419 	 * This ioctl is called twice, once to determine how much space is
2420 	 * needed, and the 2nd time to fill it.
2421 	 */
2422 	if (num_planes &&
2423 	    (plane_resp->count_planes >= num_planes)) {
2424 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2425 
2426 		/* Plane lists are invariant, no locking needed. */
2427 		drm_for_each_plane(plane, dev) {
2428 			/*
2429 			 * Unless userspace set the 'universal planes'
2430 			 * capability bit, only advertise overlays.
2431 			 */
2432 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2433 			    !file_priv->universal_planes)
2434 				continue;
2435 
2436 			if (put_user(plane->base.id, plane_ptr + copied))
2437 				return -EFAULT;
2438 			copied++;
2439 		}
2440 	}
2441 	plane_resp->count_planes = num_planes;
2442 
2443 	return 0;
2444 }
2445 
2446 /**
2447  * drm_mode_getplane - get plane configuration
2448  * @dev: DRM device
2449  * @data: ioctl data
2450  * @file_priv: DRM file info
2451  *
2452  * Construct a plane configuration structure to return to the user.
2453  *
2454  * Called by the user via ioctl.
2455  *
2456  * Returns:
2457  * Zero on success, negative errno on failure.
2458  */
2459 int drm_mode_getplane(struct drm_device *dev, void *data,
2460 		      struct drm_file *file_priv)
2461 {
2462 	struct drm_mode_get_plane *plane_resp = data;
2463 	struct drm_plane *plane;
2464 	uint32_t __user *format_ptr;
2465 
2466 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2467 		return -EINVAL;
2468 
2469 	plane = drm_plane_find(dev, plane_resp->plane_id);
2470 	if (!plane)
2471 		return -ENOENT;
2472 
2473 	drm_modeset_lock(&plane->mutex, NULL);
2474 	if (plane->crtc)
2475 		plane_resp->crtc_id = plane->crtc->base.id;
2476 	else
2477 		plane_resp->crtc_id = 0;
2478 
2479 	if (plane->fb)
2480 		plane_resp->fb_id = plane->fb->base.id;
2481 	else
2482 		plane_resp->fb_id = 0;
2483 	drm_modeset_unlock(&plane->mutex);
2484 
2485 	plane_resp->plane_id = plane->base.id;
2486 	plane_resp->possible_crtcs = plane->possible_crtcs;
2487 	plane_resp->gamma_size = 0;
2488 
2489 	/*
2490 	 * This ioctl is called twice, once to determine how much space is
2491 	 * needed, and the 2nd time to fill it.
2492 	 */
2493 	if (plane->format_count &&
2494 	    (plane_resp->count_format_types >= plane->format_count)) {
2495 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2496 		if (copy_to_user(format_ptr,
2497 				 plane->format_types,
2498 				 sizeof(uint32_t) * plane->format_count)) {
2499 			return -EFAULT;
2500 		}
2501 	}
2502 	plane_resp->count_format_types = plane->format_count;
2503 
2504 	return 0;
2505 }
2506 
2507 /**
2508  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2509  * @plane: plane to check for format support
2510  * @format: the pixel format
2511  *
2512  * Returns:
2513  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2514  * otherwise.
2515  */
2516 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2517 {
2518 	unsigned int i;
2519 
2520 	for (i = 0; i < plane->format_count; i++) {
2521 		if (format == plane->format_types[i])
2522 			return 0;
2523 	}
2524 
2525 	return -EINVAL;
2526 }
2527 
2528 static int check_src_coords(uint32_t src_x, uint32_t src_y,
2529 			    uint32_t src_w, uint32_t src_h,
2530 			    const struct drm_framebuffer *fb)
2531 {
2532 	unsigned int fb_width, fb_height;
2533 
2534 	fb_width = fb->width << 16;
2535 	fb_height = fb->height << 16;
2536 
2537 	/* Make sure source coordinates are inside the fb. */
2538 	if (src_w > fb_width ||
2539 	    src_x > fb_width - src_w ||
2540 	    src_h > fb_height ||
2541 	    src_y > fb_height - src_h) {
2542 		DRM_DEBUG_KMS("Invalid source coordinates "
2543 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2544 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2545 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2546 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2547 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2548 		return -ENOSPC;
2549 	}
2550 
2551 	return 0;
2552 }
2553 
2554 /*
2555  * setplane_internal - setplane handler for internal callers
2556  *
2557  * Note that we assume an extra reference has already been taken on fb.  If the
2558  * update fails, this reference will be dropped before return; if it succeeds,
2559  * the previous framebuffer (if any) will be unreferenced instead.
2560  *
2561  * src_{x,y,w,h} are provided in 16.16 fixed point format
2562  */
2563 static int __setplane_internal(struct drm_plane *plane,
2564 			       struct drm_crtc *crtc,
2565 			       struct drm_framebuffer *fb,
2566 			       int32_t crtc_x, int32_t crtc_y,
2567 			       uint32_t crtc_w, uint32_t crtc_h,
2568 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2569 			       uint32_t src_x, uint32_t src_y,
2570 			       uint32_t src_w, uint32_t src_h)
2571 {
2572 	int ret = 0;
2573 
2574 	/* No fb means shut it down */
2575 	if (!fb) {
2576 		plane->old_fb = plane->fb;
2577 		ret = plane->funcs->disable_plane(plane);
2578 		if (!ret) {
2579 			plane->crtc = NULL;
2580 			plane->fb = NULL;
2581 		} else {
2582 			plane->old_fb = NULL;
2583 		}
2584 		goto out;
2585 	}
2586 
2587 	/* Check whether this plane is usable on this CRTC */
2588 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2589 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2590 		ret = -EINVAL;
2591 		goto out;
2592 	}
2593 
2594 	/* Check whether this plane supports the fb pixel format. */
2595 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2596 	if (ret) {
2597 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2598 			      drm_get_format_name(fb->pixel_format));
2599 		goto out;
2600 	}
2601 
2602 	/* Give drivers some help against integer overflows */
2603 	if (crtc_w > INT_MAX ||
2604 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2605 	    crtc_h > INT_MAX ||
2606 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2607 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2608 			      crtc_w, crtc_h, crtc_x, crtc_y);
2609 		ret = -ERANGE;
2610 		goto out;
2611 	}
2612 
2613 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
2614 	if (ret)
2615 		goto out;
2616 
2617 	plane->old_fb = plane->fb;
2618 	ret = plane->funcs->update_plane(plane, crtc, fb,
2619 					 crtc_x, crtc_y, crtc_w, crtc_h,
2620 					 src_x, src_y, src_w, src_h);
2621 	if (!ret) {
2622 		plane->crtc = crtc;
2623 		plane->fb = fb;
2624 		fb = NULL;
2625 	} else {
2626 		plane->old_fb = NULL;
2627 	}
2628 
2629 out:
2630 	if (fb)
2631 		drm_framebuffer_unreference(fb);
2632 	if (plane->old_fb)
2633 		drm_framebuffer_unreference(plane->old_fb);
2634 	plane->old_fb = NULL;
2635 
2636 	return ret;
2637 }
2638 
2639 static int setplane_internal(struct drm_plane *plane,
2640 			     struct drm_crtc *crtc,
2641 			     struct drm_framebuffer *fb,
2642 			     int32_t crtc_x, int32_t crtc_y,
2643 			     uint32_t crtc_w, uint32_t crtc_h,
2644 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2645 			     uint32_t src_x, uint32_t src_y,
2646 			     uint32_t src_w, uint32_t src_h)
2647 {
2648 	int ret;
2649 
2650 	drm_modeset_lock_all(plane->dev);
2651 	ret = __setplane_internal(plane, crtc, fb,
2652 				  crtc_x, crtc_y, crtc_w, crtc_h,
2653 				  src_x, src_y, src_w, src_h);
2654 	drm_modeset_unlock_all(plane->dev);
2655 
2656 	return ret;
2657 }
2658 
2659 /**
2660  * drm_mode_setplane - configure a plane's configuration
2661  * @dev: DRM device
2662  * @data: ioctl data*
2663  * @file_priv: DRM file info
2664  *
2665  * Set plane configuration, including placement, fb, scaling, and other factors.
2666  * Or pass a NULL fb to disable (planes may be disabled without providing a
2667  * valid crtc).
2668  *
2669  * Returns:
2670  * Zero on success, negative errno on failure.
2671  */
2672 int drm_mode_setplane(struct drm_device *dev, void *data,
2673 		      struct drm_file *file_priv)
2674 {
2675 	struct drm_mode_set_plane *plane_req = data;
2676 	struct drm_plane *plane;
2677 	struct drm_crtc *crtc = NULL;
2678 	struct drm_framebuffer *fb = NULL;
2679 
2680 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2681 		return -EINVAL;
2682 
2683 	/*
2684 	 * First, find the plane, crtc, and fb objects.  If not available,
2685 	 * we don't bother to call the driver.
2686 	 */
2687 	plane = drm_plane_find(dev, plane_req->plane_id);
2688 	if (!plane) {
2689 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2690 			      plane_req->plane_id);
2691 		return -ENOENT;
2692 	}
2693 
2694 	if (plane_req->fb_id) {
2695 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2696 		if (!fb) {
2697 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2698 				      plane_req->fb_id);
2699 			return -ENOENT;
2700 		}
2701 
2702 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2703 		if (!crtc) {
2704 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2705 				      plane_req->crtc_id);
2706 			return -ENOENT;
2707 		}
2708 	}
2709 
2710 	/*
2711 	 * setplane_internal will take care of deref'ing either the old or new
2712 	 * framebuffer depending on success.
2713 	 */
2714 	return setplane_internal(plane, crtc, fb,
2715 				 plane_req->crtc_x, plane_req->crtc_y,
2716 				 plane_req->crtc_w, plane_req->crtc_h,
2717 				 plane_req->src_x, plane_req->src_y,
2718 				 plane_req->src_w, plane_req->src_h);
2719 }
2720 
2721 /**
2722  * drm_mode_set_config_internal - helper to call ->set_config
2723  * @set: modeset config to set
2724  *
2725  * This is a little helper to wrap internal calls to the ->set_config driver
2726  * interface. The only thing it adds is correct refcounting dance.
2727  *
2728  * Returns:
2729  * Zero on success, negative errno on failure.
2730  */
2731 int drm_mode_set_config_internal(struct drm_mode_set *set)
2732 {
2733 	struct drm_crtc *crtc = set->crtc;
2734 	struct drm_framebuffer *fb;
2735 	struct drm_crtc *tmp;
2736 	int ret;
2737 
2738 	/*
2739 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2740 	 * connectors from it), hence we need to refcount the fbs across all
2741 	 * crtcs. Atomic modeset will have saner semantics ...
2742 	 */
2743 	drm_for_each_crtc(tmp, crtc->dev)
2744 		tmp->primary->old_fb = tmp->primary->fb;
2745 
2746 	fb = set->fb;
2747 
2748 	ret = crtc->funcs->set_config(set);
2749 	if (ret == 0) {
2750 		crtc->primary->crtc = crtc;
2751 		crtc->primary->fb = fb;
2752 	}
2753 
2754 	drm_for_each_crtc(tmp, crtc->dev) {
2755 		if (tmp->primary->fb)
2756 			drm_framebuffer_reference(tmp->primary->fb);
2757 		if (tmp->primary->old_fb)
2758 			drm_framebuffer_unreference(tmp->primary->old_fb);
2759 		tmp->primary->old_fb = NULL;
2760 	}
2761 
2762 	return ret;
2763 }
2764 EXPORT_SYMBOL(drm_mode_set_config_internal);
2765 
2766 /**
2767  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2768  * @mode: mode to query
2769  * @hdisplay: hdisplay value to fill in
2770  * @vdisplay: vdisplay value to fill in
2771  *
2772  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2773  * the appropriate layout.
2774  */
2775 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2776 			    int *hdisplay, int *vdisplay)
2777 {
2778 	struct drm_display_mode adjusted;
2779 
2780 	drm_mode_copy(&adjusted, mode);
2781 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2782 	*hdisplay = adjusted.crtc_hdisplay;
2783 	*vdisplay = adjusted.crtc_vdisplay;
2784 }
2785 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2786 
2787 /**
2788  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2789  *     CRTC viewport
2790  * @crtc: CRTC that framebuffer will be displayed on
2791  * @x: x panning
2792  * @y: y panning
2793  * @mode: mode that framebuffer will be displayed under
2794  * @fb: framebuffer to check size of
2795  */
2796 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2797 			    int x, int y,
2798 			    const struct drm_display_mode *mode,
2799 			    const struct drm_framebuffer *fb)
2800 
2801 {
2802 	int hdisplay, vdisplay;
2803 
2804 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2805 
2806 	if (crtc->state &&
2807 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
2808 					      BIT(DRM_ROTATE_270)))
2809 		swap(hdisplay, vdisplay);
2810 
2811 	return check_src_coords(x << 16, y << 16,
2812 				hdisplay << 16, vdisplay << 16, fb);
2813 }
2814 EXPORT_SYMBOL(drm_crtc_check_viewport);
2815 
2816 /**
2817  * drm_mode_setcrtc - set CRTC configuration
2818  * @dev: drm device for the ioctl
2819  * @data: data pointer for the ioctl
2820  * @file_priv: drm file for the ioctl call
2821  *
2822  * Build a new CRTC configuration based on user request.
2823  *
2824  * Called by the user via ioctl.
2825  *
2826  * Returns:
2827  * Zero on success, negative errno on failure.
2828  */
2829 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2830 		     struct drm_file *file_priv)
2831 {
2832 	struct drm_mode_config *config = &dev->mode_config;
2833 	struct drm_mode_crtc *crtc_req = data;
2834 	struct drm_crtc *crtc;
2835 	struct drm_connector **connector_set = NULL, *connector;
2836 	struct drm_framebuffer *fb = NULL;
2837 	struct drm_display_mode *mode = NULL;
2838 	struct drm_mode_set set;
2839 	uint32_t __user *set_connectors_ptr;
2840 	int ret;
2841 	int i;
2842 
2843 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2844 		return -EINVAL;
2845 
2846 	/*
2847 	 * Universal plane src offsets are only 16.16, prevent havoc for
2848 	 * drivers using universal plane code internally.
2849 	 */
2850 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2851 		return -ERANGE;
2852 
2853 	drm_modeset_lock_all(dev);
2854 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2855 	if (!crtc) {
2856 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2857 		ret = -ENOENT;
2858 		goto out;
2859 	}
2860 	DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
2861 
2862 	if (crtc_req->mode_valid) {
2863 		/* If we have a mode we need a framebuffer. */
2864 		/* If we pass -1, set the mode with the currently bound fb */
2865 		if (crtc_req->fb_id == -1) {
2866 			if (!crtc->primary->fb) {
2867 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2868 				ret = -EINVAL;
2869 				goto out;
2870 			}
2871 			fb = crtc->primary->fb;
2872 			/* Make refcounting symmetric with the lookup path. */
2873 			drm_framebuffer_reference(fb);
2874 		} else {
2875 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2876 			if (!fb) {
2877 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2878 						crtc_req->fb_id);
2879 				ret = -ENOENT;
2880 				goto out;
2881 			}
2882 		}
2883 
2884 		mode = drm_mode_create(dev);
2885 		if (!mode) {
2886 			ret = -ENOMEM;
2887 			goto out;
2888 		}
2889 
2890 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2891 		if (ret) {
2892 			DRM_DEBUG_KMS("Invalid mode\n");
2893 			goto out;
2894 		}
2895 
2896 		/*
2897 		 * Check whether the primary plane supports the fb pixel format.
2898 		 * Drivers not implementing the universal planes API use a
2899 		 * default formats list provided by the DRM core which doesn't
2900 		 * match real hardware capabilities. Skip the check in that
2901 		 * case.
2902 		 */
2903 		if (!crtc->primary->format_default) {
2904 			ret = drm_plane_check_pixel_format(crtc->primary,
2905 							   fb->pixel_format);
2906 			if (ret) {
2907 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2908 					drm_get_format_name(fb->pixel_format));
2909 				goto out;
2910 			}
2911 		}
2912 
2913 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2914 					      mode, fb);
2915 		if (ret)
2916 			goto out;
2917 
2918 	}
2919 
2920 	if (crtc_req->count_connectors == 0 && mode) {
2921 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2922 		ret = -EINVAL;
2923 		goto out;
2924 	}
2925 
2926 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2927 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2928 			  crtc_req->count_connectors);
2929 		ret = -EINVAL;
2930 		goto out;
2931 	}
2932 
2933 	if (crtc_req->count_connectors > 0) {
2934 		u32 out_id;
2935 
2936 		/* Avoid unbounded kernel memory allocation */
2937 		if (crtc_req->count_connectors > config->num_connector) {
2938 			ret = -EINVAL;
2939 			goto out;
2940 		}
2941 
2942 		connector_set = kmalloc_array(crtc_req->count_connectors,
2943 					      sizeof(struct drm_connector *),
2944 					      GFP_KERNEL);
2945 		if (!connector_set) {
2946 			ret = -ENOMEM;
2947 			goto out;
2948 		}
2949 
2950 		for (i = 0; i < crtc_req->count_connectors; i++) {
2951 			connector_set[i] = NULL;
2952 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2953 			if (get_user(out_id, &set_connectors_ptr[i])) {
2954 				ret = -EFAULT;
2955 				goto out;
2956 			}
2957 
2958 			connector = drm_connector_lookup(dev, out_id);
2959 			if (!connector) {
2960 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2961 						out_id);
2962 				ret = -ENOENT;
2963 				goto out;
2964 			}
2965 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2966 					connector->base.id,
2967 					connector->name);
2968 
2969 			connector_set[i] = connector;
2970 		}
2971 	}
2972 
2973 	set.crtc = crtc;
2974 	set.x = crtc_req->x;
2975 	set.y = crtc_req->y;
2976 	set.mode = mode;
2977 	set.connectors = connector_set;
2978 	set.num_connectors = crtc_req->count_connectors;
2979 	set.fb = fb;
2980 	ret = drm_mode_set_config_internal(&set);
2981 
2982 out:
2983 	if (fb)
2984 		drm_framebuffer_unreference(fb);
2985 
2986 	if (connector_set) {
2987 		for (i = 0; i < crtc_req->count_connectors; i++) {
2988 			if (connector_set[i])
2989 				drm_connector_unreference(connector_set[i]);
2990 		}
2991 	}
2992 	kfree(connector_set);
2993 	drm_mode_destroy(dev, mode);
2994 	drm_modeset_unlock_all(dev);
2995 	return ret;
2996 }
2997 
2998 /**
2999  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
3000  *     universal plane handler call
3001  * @crtc: crtc to update cursor for
3002  * @req: data pointer for the ioctl
3003  * @file_priv: drm file for the ioctl call
3004  *
3005  * Legacy cursor ioctl's work directly with driver buffer handles.  To
3006  * translate legacy ioctl calls into universal plane handler calls, we need to
3007  * wrap the native buffer handle in a drm_framebuffer.
3008  *
3009  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
3010  * buffer with a pitch of 4*width; the universal plane interface should be used
3011  * directly in cases where the hardware can support other buffer settings and
3012  * userspace wants to make use of these capabilities.
3013  *
3014  * Returns:
3015  * Zero on success, negative errno on failure.
3016  */
3017 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
3018 				     struct drm_mode_cursor2 *req,
3019 				     struct drm_file *file_priv)
3020 {
3021 	struct drm_device *dev = crtc->dev;
3022 	struct drm_framebuffer *fb = NULL;
3023 	struct drm_mode_fb_cmd2 fbreq = {
3024 		.width = req->width,
3025 		.height = req->height,
3026 		.pixel_format = DRM_FORMAT_ARGB8888,
3027 		.pitches = { req->width * 4 },
3028 		.handles = { req->handle },
3029 	};
3030 	int32_t crtc_x, crtc_y;
3031 	uint32_t crtc_w = 0, crtc_h = 0;
3032 	uint32_t src_w = 0, src_h = 0;
3033 	int ret = 0;
3034 
3035 	BUG_ON(!crtc->cursor);
3036 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
3037 
3038 	/*
3039 	 * Obtain fb we'll be using (either new or existing) and take an extra
3040 	 * reference to it if fb != null.  setplane will take care of dropping
3041 	 * the reference if the plane update fails.
3042 	 */
3043 	if (req->flags & DRM_MODE_CURSOR_BO) {
3044 		if (req->handle) {
3045 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
3046 			if (IS_ERR(fb)) {
3047 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
3048 				return PTR_ERR(fb);
3049 			}
3050 			fb->hot_x = req->hot_x;
3051 			fb->hot_y = req->hot_y;
3052 		} else {
3053 			fb = NULL;
3054 		}
3055 	} else {
3056 		fb = crtc->cursor->fb;
3057 		if (fb)
3058 			drm_framebuffer_reference(fb);
3059 	}
3060 
3061 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
3062 		crtc_x = req->x;
3063 		crtc_y = req->y;
3064 	} else {
3065 		crtc_x = crtc->cursor_x;
3066 		crtc_y = crtc->cursor_y;
3067 	}
3068 
3069 	if (fb) {
3070 		crtc_w = fb->width;
3071 		crtc_h = fb->height;
3072 		src_w = fb->width << 16;
3073 		src_h = fb->height << 16;
3074 	}
3075 
3076 	/*
3077 	 * setplane_internal will take care of deref'ing either the old or new
3078 	 * framebuffer depending on success.
3079 	 */
3080 	ret = __setplane_internal(crtc->cursor, crtc, fb,
3081 				crtc_x, crtc_y, crtc_w, crtc_h,
3082 				0, 0, src_w, src_h);
3083 
3084 	/* Update successful; save new cursor position, if necessary */
3085 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
3086 		crtc->cursor_x = req->x;
3087 		crtc->cursor_y = req->y;
3088 	}
3089 
3090 	return ret;
3091 }
3092 
3093 static int drm_mode_cursor_common(struct drm_device *dev,
3094 				  struct drm_mode_cursor2 *req,
3095 				  struct drm_file *file_priv)
3096 {
3097 	struct drm_crtc *crtc;
3098 	int ret = 0;
3099 
3100 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3101 		return -EINVAL;
3102 
3103 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
3104 		return -EINVAL;
3105 
3106 	crtc = drm_crtc_find(dev, req->crtc_id);
3107 	if (!crtc) {
3108 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
3109 		return -ENOENT;
3110 	}
3111 
3112 	/*
3113 	 * If this crtc has a universal cursor plane, call that plane's update
3114 	 * handler rather than using legacy cursor handlers.
3115 	 */
3116 	drm_modeset_lock_crtc(crtc, crtc->cursor);
3117 	if (crtc->cursor) {
3118 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
3119 		goto out;
3120 	}
3121 
3122 	if (req->flags & DRM_MODE_CURSOR_BO) {
3123 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
3124 			ret = -ENXIO;
3125 			goto out;
3126 		}
3127 		/* Turns off the cursor if handle is 0 */
3128 		if (crtc->funcs->cursor_set2)
3129 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
3130 						      req->width, req->height, req->hot_x, req->hot_y);
3131 		else
3132 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
3133 						      req->width, req->height);
3134 	}
3135 
3136 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
3137 		if (crtc->funcs->cursor_move) {
3138 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
3139 		} else {
3140 			ret = -EFAULT;
3141 			goto out;
3142 		}
3143 	}
3144 out:
3145 	drm_modeset_unlock_crtc(crtc);
3146 
3147 	return ret;
3148 
3149 }
3150 
3151 
3152 /**
3153  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
3154  * @dev: drm device for the ioctl
3155  * @data: data pointer for the ioctl
3156  * @file_priv: drm file for the ioctl call
3157  *
3158  * Set the cursor configuration based on user request.
3159  *
3160  * Called by the user via ioctl.
3161  *
3162  * Returns:
3163  * Zero on success, negative errno on failure.
3164  */
3165 int drm_mode_cursor_ioctl(struct drm_device *dev,
3166 			  void *data, struct drm_file *file_priv)
3167 {
3168 	struct drm_mode_cursor *req = data;
3169 	struct drm_mode_cursor2 new_req;
3170 
3171 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
3172 	new_req.hot_x = new_req.hot_y = 0;
3173 
3174 	return drm_mode_cursor_common(dev, &new_req, file_priv);
3175 }
3176 
3177 /**
3178  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
3179  * @dev: drm device for the ioctl
3180  * @data: data pointer for the ioctl
3181  * @file_priv: drm file for the ioctl call
3182  *
3183  * Set the cursor configuration based on user request. This implements the 2nd
3184  * version of the cursor ioctl, which allows userspace to additionally specify
3185  * the hotspot of the pointer.
3186  *
3187  * Called by the user via ioctl.
3188  *
3189  * Returns:
3190  * Zero on success, negative errno on failure.
3191  */
3192 int drm_mode_cursor2_ioctl(struct drm_device *dev,
3193 			   void *data, struct drm_file *file_priv)
3194 {
3195 	struct drm_mode_cursor2 *req = data;
3196 
3197 	return drm_mode_cursor_common(dev, req, file_priv);
3198 }
3199 
3200 /**
3201  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3202  * @bpp: bits per pixels
3203  * @depth: bit depth per pixel
3204  *
3205  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3206  * Useful in fbdev emulation code, since that deals in those values.
3207  */
3208 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3209 {
3210 	uint32_t fmt;
3211 
3212 	switch (bpp) {
3213 	case 8:
3214 		fmt = DRM_FORMAT_C8;
3215 		break;
3216 	case 16:
3217 		if (depth == 15)
3218 			fmt = DRM_FORMAT_XRGB1555;
3219 		else
3220 			fmt = DRM_FORMAT_RGB565;
3221 		break;
3222 	case 24:
3223 		fmt = DRM_FORMAT_RGB888;
3224 		break;
3225 	case 32:
3226 		if (depth == 24)
3227 			fmt = DRM_FORMAT_XRGB8888;
3228 		else if (depth == 30)
3229 			fmt = DRM_FORMAT_XRGB2101010;
3230 		else
3231 			fmt = DRM_FORMAT_ARGB8888;
3232 		break;
3233 	default:
3234 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3235 		fmt = DRM_FORMAT_XRGB8888;
3236 		break;
3237 	}
3238 
3239 	return fmt;
3240 }
3241 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3242 
3243 /**
3244  * drm_mode_addfb - add an FB to the graphics configuration
3245  * @dev: drm device for the ioctl
3246  * @data: data pointer for the ioctl
3247  * @file_priv: drm file for the ioctl call
3248  *
3249  * Add a new FB to the specified CRTC, given a user request. This is the
3250  * original addfb ioctl which only supported RGB formats.
3251  *
3252  * Called by the user via ioctl.
3253  *
3254  * Returns:
3255  * Zero on success, negative errno on failure.
3256  */
3257 int drm_mode_addfb(struct drm_device *dev,
3258 		   void *data, struct drm_file *file_priv)
3259 {
3260 	struct drm_mode_fb_cmd *or = data;
3261 	struct drm_mode_fb_cmd2 r = {};
3262 	int ret;
3263 
3264 	/* convert to new format and call new ioctl */
3265 	r.fb_id = or->fb_id;
3266 	r.width = or->width;
3267 	r.height = or->height;
3268 	r.pitches[0] = or->pitch;
3269 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3270 	r.handles[0] = or->handle;
3271 
3272 	ret = drm_mode_addfb2(dev, &r, file_priv);
3273 	if (ret)
3274 		return ret;
3275 
3276 	or->fb_id = r.fb_id;
3277 
3278 	return 0;
3279 }
3280 
3281 static int format_check(const struct drm_mode_fb_cmd2 *r)
3282 {
3283 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3284 
3285 	switch (format) {
3286 	case DRM_FORMAT_C8:
3287 	case DRM_FORMAT_RGB332:
3288 	case DRM_FORMAT_BGR233:
3289 	case DRM_FORMAT_XRGB4444:
3290 	case DRM_FORMAT_XBGR4444:
3291 	case DRM_FORMAT_RGBX4444:
3292 	case DRM_FORMAT_BGRX4444:
3293 	case DRM_FORMAT_ARGB4444:
3294 	case DRM_FORMAT_ABGR4444:
3295 	case DRM_FORMAT_RGBA4444:
3296 	case DRM_FORMAT_BGRA4444:
3297 	case DRM_FORMAT_XRGB1555:
3298 	case DRM_FORMAT_XBGR1555:
3299 	case DRM_FORMAT_RGBX5551:
3300 	case DRM_FORMAT_BGRX5551:
3301 	case DRM_FORMAT_ARGB1555:
3302 	case DRM_FORMAT_ABGR1555:
3303 	case DRM_FORMAT_RGBA5551:
3304 	case DRM_FORMAT_BGRA5551:
3305 	case DRM_FORMAT_RGB565:
3306 	case DRM_FORMAT_BGR565:
3307 	case DRM_FORMAT_RGB888:
3308 	case DRM_FORMAT_BGR888:
3309 	case DRM_FORMAT_XRGB8888:
3310 	case DRM_FORMAT_XBGR8888:
3311 	case DRM_FORMAT_RGBX8888:
3312 	case DRM_FORMAT_BGRX8888:
3313 	case DRM_FORMAT_ARGB8888:
3314 	case DRM_FORMAT_ABGR8888:
3315 	case DRM_FORMAT_RGBA8888:
3316 	case DRM_FORMAT_BGRA8888:
3317 	case DRM_FORMAT_XRGB2101010:
3318 	case DRM_FORMAT_XBGR2101010:
3319 	case DRM_FORMAT_RGBX1010102:
3320 	case DRM_FORMAT_BGRX1010102:
3321 	case DRM_FORMAT_ARGB2101010:
3322 	case DRM_FORMAT_ABGR2101010:
3323 	case DRM_FORMAT_RGBA1010102:
3324 	case DRM_FORMAT_BGRA1010102:
3325 	case DRM_FORMAT_YUYV:
3326 	case DRM_FORMAT_YVYU:
3327 	case DRM_FORMAT_UYVY:
3328 	case DRM_FORMAT_VYUY:
3329 	case DRM_FORMAT_AYUV:
3330 	case DRM_FORMAT_NV12:
3331 	case DRM_FORMAT_NV21:
3332 	case DRM_FORMAT_NV16:
3333 	case DRM_FORMAT_NV61:
3334 	case DRM_FORMAT_NV24:
3335 	case DRM_FORMAT_NV42:
3336 	case DRM_FORMAT_YUV410:
3337 	case DRM_FORMAT_YVU410:
3338 	case DRM_FORMAT_YUV411:
3339 	case DRM_FORMAT_YVU411:
3340 	case DRM_FORMAT_YUV420:
3341 	case DRM_FORMAT_YVU420:
3342 	case DRM_FORMAT_YUV422:
3343 	case DRM_FORMAT_YVU422:
3344 	case DRM_FORMAT_YUV444:
3345 	case DRM_FORMAT_YVU444:
3346 		return 0;
3347 	default:
3348 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3349 			      drm_get_format_name(r->pixel_format));
3350 		return -EINVAL;
3351 	}
3352 }
3353 
3354 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3355 {
3356 	int ret, hsub, vsub, num_planes, i;
3357 
3358 	ret = format_check(r);
3359 	if (ret) {
3360 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3361 			      drm_get_format_name(r->pixel_format));
3362 		return ret;
3363 	}
3364 
3365 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3366 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3367 	num_planes = drm_format_num_planes(r->pixel_format);
3368 
3369 	if (r->width == 0 || r->width % hsub) {
3370 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3371 		return -EINVAL;
3372 	}
3373 
3374 	if (r->height == 0 || r->height % vsub) {
3375 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3376 		return -EINVAL;
3377 	}
3378 
3379 	for (i = 0; i < num_planes; i++) {
3380 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3381 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3382 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3383 
3384 		if (!r->handles[i]) {
3385 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3386 			return -EINVAL;
3387 		}
3388 
3389 		if ((uint64_t) width * cpp > UINT_MAX)
3390 			return -ERANGE;
3391 
3392 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3393 			return -ERANGE;
3394 
3395 		if (r->pitches[i] < width * cpp) {
3396 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3397 			return -EINVAL;
3398 		}
3399 
3400 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3401 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
3402 				      r->modifier[i], i);
3403 			return -EINVAL;
3404 		}
3405 
3406 		/* modifier specific checks: */
3407 		switch (r->modifier[i]) {
3408 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3409 			/* NOTE: the pitch restriction may be lifted later if it turns
3410 			 * out that no hw has this restriction:
3411 			 */
3412 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3413 					width % 128 || height % 32 ||
3414 					r->pitches[i] % 128) {
3415 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3416 				return -EINVAL;
3417 			}
3418 			break;
3419 
3420 		default:
3421 			break;
3422 		}
3423 	}
3424 
3425 	for (i = num_planes; i < 4; i++) {
3426 		if (r->modifier[i]) {
3427 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3428 			return -EINVAL;
3429 		}
3430 
3431 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3432 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3433 			continue;
3434 
3435 		if (r->handles[i]) {
3436 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3437 			return -EINVAL;
3438 		}
3439 
3440 		if (r->pitches[i]) {
3441 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3442 			return -EINVAL;
3443 		}
3444 
3445 		if (r->offsets[i]) {
3446 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3447 			return -EINVAL;
3448 		}
3449 	}
3450 
3451 	return 0;
3452 }
3453 
3454 static struct drm_framebuffer *
3455 internal_framebuffer_create(struct drm_device *dev,
3456 			    const struct drm_mode_fb_cmd2 *r,
3457 			    struct drm_file *file_priv)
3458 {
3459 	struct drm_mode_config *config = &dev->mode_config;
3460 	struct drm_framebuffer *fb;
3461 	int ret;
3462 
3463 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3464 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3465 		return ERR_PTR(-EINVAL);
3466 	}
3467 
3468 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3469 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3470 			  r->width, config->min_width, config->max_width);
3471 		return ERR_PTR(-EINVAL);
3472 	}
3473 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3474 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3475 			  r->height, config->min_height, config->max_height);
3476 		return ERR_PTR(-EINVAL);
3477 	}
3478 
3479 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3480 	    !dev->mode_config.allow_fb_modifiers) {
3481 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3482 		return ERR_PTR(-EINVAL);
3483 	}
3484 
3485 	ret = framebuffer_check(r);
3486 	if (ret)
3487 		return ERR_PTR(ret);
3488 
3489 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3490 	if (IS_ERR(fb)) {
3491 		DRM_DEBUG_KMS("could not create framebuffer\n");
3492 		return fb;
3493 	}
3494 
3495 	return fb;
3496 }
3497 
3498 /**
3499  * drm_mode_addfb2 - add an FB to the graphics configuration
3500  * @dev: drm device for the ioctl
3501  * @data: data pointer for the ioctl
3502  * @file_priv: drm file for the ioctl call
3503  *
3504  * Add a new FB to the specified CRTC, given a user request with format. This is
3505  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3506  * and uses fourcc codes as pixel format specifiers.
3507  *
3508  * Called by the user via ioctl.
3509  *
3510  * Returns:
3511  * Zero on success, negative errno on failure.
3512  */
3513 int drm_mode_addfb2(struct drm_device *dev,
3514 		    void *data, struct drm_file *file_priv)
3515 {
3516 	struct drm_mode_fb_cmd2 *r = data;
3517 	struct drm_framebuffer *fb;
3518 
3519 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3520 		return -EINVAL;
3521 
3522 	fb = internal_framebuffer_create(dev, r, file_priv);
3523 	if (IS_ERR(fb))
3524 		return PTR_ERR(fb);
3525 
3526 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3527 	r->fb_id = fb->base.id;
3528 
3529 	/* Transfer ownership to the filp for reaping on close */
3530 	mutex_lock(&file_priv->fbs_lock);
3531 	list_add(&fb->filp_head, &file_priv->fbs);
3532 	mutex_unlock(&file_priv->fbs_lock);
3533 
3534 	return 0;
3535 }
3536 
3537 struct drm_mode_rmfb_work {
3538 	struct work_struct work;
3539 	struct list_head fbs;
3540 };
3541 
3542 static void drm_mode_rmfb_work_fn(struct work_struct *w)
3543 {
3544 	struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work);
3545 
3546 	while (!list_empty(&arg->fbs)) {
3547 		struct drm_framebuffer *fb =
3548 			list_first_entry(&arg->fbs, typeof(*fb), filp_head);
3549 
3550 		list_del_init(&fb->filp_head);
3551 		drm_framebuffer_remove(fb);
3552 	}
3553 }
3554 
3555 /**
3556  * drm_mode_rmfb - remove an FB from the configuration
3557  * @dev: drm device for the ioctl
3558  * @data: data pointer for the ioctl
3559  * @file_priv: drm file for the ioctl call
3560  *
3561  * Remove the FB specified by the user.
3562  *
3563  * Called by the user via ioctl.
3564  *
3565  * Returns:
3566  * Zero on success, negative errno on failure.
3567  */
3568 int drm_mode_rmfb(struct drm_device *dev,
3569 		   void *data, struct drm_file *file_priv)
3570 {
3571 	struct drm_framebuffer *fb = NULL;
3572 	struct drm_framebuffer *fbl = NULL;
3573 	uint32_t *id = data;
3574 	int found = 0;
3575 
3576 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3577 		return -EINVAL;
3578 
3579 	fb = drm_framebuffer_lookup(dev, *id);
3580 	if (!fb)
3581 		return -ENOENT;
3582 
3583 	mutex_lock(&file_priv->fbs_lock);
3584 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3585 		if (fb == fbl)
3586 			found = 1;
3587 	if (!found) {
3588 		mutex_unlock(&file_priv->fbs_lock);
3589 		goto fail_unref;
3590 	}
3591 
3592 	list_del_init(&fb->filp_head);
3593 	mutex_unlock(&file_priv->fbs_lock);
3594 
3595 	/* drop the reference we picked up in framebuffer lookup */
3596 	drm_framebuffer_unreference(fb);
3597 
3598 	/*
3599 	 * we now own the reference that was stored in the fbs list
3600 	 *
3601 	 * drm_framebuffer_remove may fail with -EINTR on pending signals,
3602 	 * so run this in a separate stack as there's no way to correctly
3603 	 * handle this after the fb is already removed from the lookup table.
3604 	 */
3605 	if (drm_framebuffer_read_refcount(fb) > 1) {
3606 		struct drm_mode_rmfb_work arg;
3607 
3608 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
3609 		INIT_LIST_HEAD(&arg.fbs);
3610 		list_add_tail(&fb->filp_head, &arg.fbs);
3611 
3612 		schedule_work(&arg.work);
3613 		flush_work(&arg.work);
3614 		destroy_work_on_stack(&arg.work);
3615 	} else
3616 		drm_framebuffer_unreference(fb);
3617 
3618 	return 0;
3619 
3620 fail_unref:
3621 	drm_framebuffer_unreference(fb);
3622 	return -ENOENT;
3623 }
3624 
3625 /**
3626  * drm_mode_getfb - get FB info
3627  * @dev: drm device for the ioctl
3628  * @data: data pointer for the ioctl
3629  * @file_priv: drm file for the ioctl call
3630  *
3631  * Lookup the FB given its ID and return info about it.
3632  *
3633  * Called by the user via ioctl.
3634  *
3635  * Returns:
3636  * Zero on success, negative errno on failure.
3637  */
3638 int drm_mode_getfb(struct drm_device *dev,
3639 		   void *data, struct drm_file *file_priv)
3640 {
3641 	struct drm_mode_fb_cmd *r = data;
3642 	struct drm_framebuffer *fb;
3643 	int ret;
3644 
3645 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3646 		return -EINVAL;
3647 
3648 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3649 	if (!fb)
3650 		return -ENOENT;
3651 
3652 	r->height = fb->height;
3653 	r->width = fb->width;
3654 	r->depth = fb->depth;
3655 	r->bpp = fb->bits_per_pixel;
3656 	r->pitch = fb->pitches[0];
3657 	if (fb->funcs->create_handle) {
3658 		if (drm_is_current_master(file_priv) || capable(CAP_SYS_ADMIN) ||
3659 		    drm_is_control_client(file_priv)) {
3660 			ret = fb->funcs->create_handle(fb, file_priv,
3661 						       &r->handle);
3662 		} else {
3663 			/* GET_FB() is an unprivileged ioctl so we must not
3664 			 * return a buffer-handle to non-master processes! For
3665 			 * backwards-compatibility reasons, we cannot make
3666 			 * GET_FB() privileged, so just return an invalid handle
3667 			 * for non-masters. */
3668 			r->handle = 0;
3669 			ret = 0;
3670 		}
3671 	} else {
3672 		ret = -ENODEV;
3673 	}
3674 
3675 	drm_framebuffer_unreference(fb);
3676 
3677 	return ret;
3678 }
3679 
3680 /**
3681  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3682  * @dev: drm device for the ioctl
3683  * @data: data pointer for the ioctl
3684  * @file_priv: drm file for the ioctl call
3685  *
3686  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3687  * rectangle list. Generic userspace which does frontbuffer rendering must call
3688  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3689  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3690  *
3691  * Modesetting drivers which always update the frontbuffer do not need to
3692  * implement the corresponding ->dirty framebuffer callback.
3693  *
3694  * Called by the user via ioctl.
3695  *
3696  * Returns:
3697  * Zero on success, negative errno on failure.
3698  */
3699 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3700 			   void *data, struct drm_file *file_priv)
3701 {
3702 	struct drm_clip_rect __user *clips_ptr;
3703 	struct drm_clip_rect *clips = NULL;
3704 	struct drm_mode_fb_dirty_cmd *r = data;
3705 	struct drm_framebuffer *fb;
3706 	unsigned flags;
3707 	int num_clips;
3708 	int ret;
3709 
3710 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3711 		return -EINVAL;
3712 
3713 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3714 	if (!fb)
3715 		return -ENOENT;
3716 
3717 	num_clips = r->num_clips;
3718 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3719 
3720 	if (!num_clips != !clips_ptr) {
3721 		ret = -EINVAL;
3722 		goto out_err1;
3723 	}
3724 
3725 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3726 
3727 	/* If userspace annotates copy, clips must come in pairs */
3728 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3729 		ret = -EINVAL;
3730 		goto out_err1;
3731 	}
3732 
3733 	if (num_clips && clips_ptr) {
3734 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3735 			ret = -EINVAL;
3736 			goto out_err1;
3737 		}
3738 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3739 		if (!clips) {
3740 			ret = -ENOMEM;
3741 			goto out_err1;
3742 		}
3743 
3744 		ret = copy_from_user(clips, clips_ptr,
3745 				     num_clips * sizeof(*clips));
3746 		if (ret) {
3747 			ret = -EFAULT;
3748 			goto out_err2;
3749 		}
3750 	}
3751 
3752 	if (fb->funcs->dirty) {
3753 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3754 				       clips, num_clips);
3755 	} else {
3756 		ret = -ENOSYS;
3757 	}
3758 
3759 out_err2:
3760 	kfree(clips);
3761 out_err1:
3762 	drm_framebuffer_unreference(fb);
3763 
3764 	return ret;
3765 }
3766 
3767 /**
3768  * drm_fb_release - remove and free the FBs on this file
3769  * @priv: drm file for the ioctl
3770  *
3771  * Destroy all the FBs associated with @filp.
3772  *
3773  * Called by the user via ioctl.
3774  *
3775  * Returns:
3776  * Zero on success, negative errno on failure.
3777  */
3778 void drm_fb_release(struct drm_file *priv)
3779 {
3780 	struct drm_framebuffer *fb, *tfb;
3781 	struct drm_mode_rmfb_work arg;
3782 
3783 	INIT_LIST_HEAD(&arg.fbs);
3784 
3785 	/*
3786 	 * When the file gets released that means no one else can access the fb
3787 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3788 	 * avoid upsetting lockdep since the universal cursor code adds a
3789 	 * framebuffer while holding mutex locks.
3790 	 *
3791 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3792 	 * locks is impossible here since no one else but this function can get
3793 	 * at it any more.
3794 	 */
3795 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3796 		if (drm_framebuffer_read_refcount(fb) > 1) {
3797 			list_move_tail(&fb->filp_head, &arg.fbs);
3798 		} else {
3799 			list_del_init(&fb->filp_head);
3800 
3801 			/* This drops the fpriv->fbs reference. */
3802 			drm_framebuffer_unreference(fb);
3803 		}
3804 	}
3805 
3806 	if (!list_empty(&arg.fbs)) {
3807 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
3808 
3809 		schedule_work(&arg.work);
3810 		flush_work(&arg.work);
3811 		destroy_work_on_stack(&arg.work);
3812 	}
3813 }
3814 
3815 static bool drm_property_type_valid(struct drm_property *property)
3816 {
3817 	if (property->flags & DRM_MODE_PROP_EXTENDED_TYPE)
3818 		return !(property->flags & DRM_MODE_PROP_LEGACY_TYPE);
3819 	return !!(property->flags & DRM_MODE_PROP_LEGACY_TYPE);
3820 }
3821 
3822 /**
3823  * drm_property_create - create a new property type
3824  * @dev: drm device
3825  * @flags: flags specifying the property type
3826  * @name: name of the property
3827  * @num_values: number of pre-defined values
3828  *
3829  * This creates a new generic drm property which can then be attached to a drm
3830  * object with drm_object_attach_property. The returned property object must be
3831  * freed with drm_property_destroy.
3832  *
3833  * Note that the DRM core keeps a per-device list of properties and that, if
3834  * drm_mode_config_cleanup() is called, it will destroy all properties created
3835  * by the driver.
3836  *
3837  * Returns:
3838  * A pointer to the newly created property on success, NULL on failure.
3839  */
3840 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3841 					 const char *name, int num_values)
3842 {
3843 	struct drm_property *property = NULL;
3844 	int ret;
3845 
3846 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3847 	if (!property)
3848 		return NULL;
3849 
3850 	property->dev = dev;
3851 
3852 	if (num_values) {
3853 		property->values = kcalloc(num_values, sizeof(uint64_t),
3854 					   GFP_KERNEL);
3855 		if (!property->values)
3856 			goto fail;
3857 	}
3858 
3859 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3860 	if (ret)
3861 		goto fail;
3862 
3863 	property->flags = flags;
3864 	property->num_values = num_values;
3865 	INIT_LIST_HEAD(&property->enum_list);
3866 
3867 	if (name) {
3868 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3869 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3870 	}
3871 
3872 	list_add_tail(&property->head, &dev->mode_config.property_list);
3873 
3874 	WARN_ON(!drm_property_type_valid(property));
3875 
3876 	return property;
3877 fail:
3878 	kfree(property->values);
3879 	kfree(property);
3880 	return NULL;
3881 }
3882 EXPORT_SYMBOL(drm_property_create);
3883 
3884 /**
3885  * drm_property_create_enum - create a new enumeration property type
3886  * @dev: drm device
3887  * @flags: flags specifying the property type
3888  * @name: name of the property
3889  * @props: enumeration lists with property values
3890  * @num_values: number of pre-defined values
3891  *
3892  * This creates a new generic drm property which can then be attached to a drm
3893  * object with drm_object_attach_property. The returned property object must be
3894  * freed with drm_property_destroy.
3895  *
3896  * Userspace is only allowed to set one of the predefined values for enumeration
3897  * properties.
3898  *
3899  * Returns:
3900  * A pointer to the newly created property on success, NULL on failure.
3901  */
3902 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3903 					 const char *name,
3904 					 const struct drm_prop_enum_list *props,
3905 					 int num_values)
3906 {
3907 	struct drm_property *property;
3908 	int i, ret;
3909 
3910 	flags |= DRM_MODE_PROP_ENUM;
3911 
3912 	property = drm_property_create(dev, flags, name, num_values);
3913 	if (!property)
3914 		return NULL;
3915 
3916 	for (i = 0; i < num_values; i++) {
3917 		ret = drm_property_add_enum(property, i,
3918 				      props[i].type,
3919 				      props[i].name);
3920 		if (ret) {
3921 			drm_property_destroy(dev, property);
3922 			return NULL;
3923 		}
3924 	}
3925 
3926 	return property;
3927 }
3928 EXPORT_SYMBOL(drm_property_create_enum);
3929 
3930 /**
3931  * drm_property_create_bitmask - create a new bitmask property type
3932  * @dev: drm device
3933  * @flags: flags specifying the property type
3934  * @name: name of the property
3935  * @props: enumeration lists with property bitflags
3936  * @num_props: size of the @props array
3937  * @supported_bits: bitmask of all supported enumeration values
3938  *
3939  * This creates a new bitmask drm property which can then be attached to a drm
3940  * object with drm_object_attach_property. The returned property object must be
3941  * freed with drm_property_destroy.
3942  *
3943  * Compared to plain enumeration properties userspace is allowed to set any
3944  * or'ed together combination of the predefined property bitflag values
3945  *
3946  * Returns:
3947  * A pointer to the newly created property on success, NULL on failure.
3948  */
3949 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3950 					 int flags, const char *name,
3951 					 const struct drm_prop_enum_list *props,
3952 					 int num_props,
3953 					 uint64_t supported_bits)
3954 {
3955 	struct drm_property *property;
3956 	int i, ret, index = 0;
3957 	int num_values = hweight64(supported_bits);
3958 
3959 	flags |= DRM_MODE_PROP_BITMASK;
3960 
3961 	property = drm_property_create(dev, flags, name, num_values);
3962 	if (!property)
3963 		return NULL;
3964 	for (i = 0; i < num_props; i++) {
3965 		if (!(supported_bits & (1ULL << props[i].type)))
3966 			continue;
3967 
3968 		if (WARN_ON(index >= num_values)) {
3969 			drm_property_destroy(dev, property);
3970 			return NULL;
3971 		}
3972 
3973 		ret = drm_property_add_enum(property, index++,
3974 				      props[i].type,
3975 				      props[i].name);
3976 		if (ret) {
3977 			drm_property_destroy(dev, property);
3978 			return NULL;
3979 		}
3980 	}
3981 
3982 	return property;
3983 }
3984 EXPORT_SYMBOL(drm_property_create_bitmask);
3985 
3986 static struct drm_property *property_create_range(struct drm_device *dev,
3987 					 int flags, const char *name,
3988 					 uint64_t min, uint64_t max)
3989 {
3990 	struct drm_property *property;
3991 
3992 	property = drm_property_create(dev, flags, name, 2);
3993 	if (!property)
3994 		return NULL;
3995 
3996 	property->values[0] = min;
3997 	property->values[1] = max;
3998 
3999 	return property;
4000 }
4001 
4002 /**
4003  * drm_property_create_range - create a new unsigned ranged property type
4004  * @dev: drm device
4005  * @flags: flags specifying the property type
4006  * @name: name of the property
4007  * @min: minimum value of the property
4008  * @max: maximum value of the property
4009  *
4010  * This creates a new generic drm property which can then be attached to a drm
4011  * object with drm_object_attach_property. The returned property object must be
4012  * freed with drm_property_destroy.
4013  *
4014  * Userspace is allowed to set any unsigned integer value in the (min, max)
4015  * range inclusive.
4016  *
4017  * Returns:
4018  * A pointer to the newly created property on success, NULL on failure.
4019  */
4020 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
4021 					 const char *name,
4022 					 uint64_t min, uint64_t max)
4023 {
4024 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
4025 			name, min, max);
4026 }
4027 EXPORT_SYMBOL(drm_property_create_range);
4028 
4029 /**
4030  * drm_property_create_signed_range - create a new signed ranged property type
4031  * @dev: drm device
4032  * @flags: flags specifying the property type
4033  * @name: name of the property
4034  * @min: minimum value of the property
4035  * @max: maximum value of the property
4036  *
4037  * This creates a new generic drm property which can then be attached to a drm
4038  * object with drm_object_attach_property. The returned property object must be
4039  * freed with drm_property_destroy.
4040  *
4041  * Userspace is allowed to set any signed integer value in the (min, max)
4042  * range inclusive.
4043  *
4044  * Returns:
4045  * A pointer to the newly created property on success, NULL on failure.
4046  */
4047 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
4048 					 int flags, const char *name,
4049 					 int64_t min, int64_t max)
4050 {
4051 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
4052 			name, I642U64(min), I642U64(max));
4053 }
4054 EXPORT_SYMBOL(drm_property_create_signed_range);
4055 
4056 /**
4057  * drm_property_create_object - create a new object property type
4058  * @dev: drm device
4059  * @flags: flags specifying the property type
4060  * @name: name of the property
4061  * @type: object type from DRM_MODE_OBJECT_* defines
4062  *
4063  * This creates a new generic drm property which can then be attached to a drm
4064  * object with drm_object_attach_property. The returned property object must be
4065  * freed with drm_property_destroy.
4066  *
4067  * Userspace is only allowed to set this to any property value of the given
4068  * @type. Only useful for atomic properties, which is enforced.
4069  *
4070  * Returns:
4071  * A pointer to the newly created property on success, NULL on failure.
4072  */
4073 struct drm_property *drm_property_create_object(struct drm_device *dev,
4074 					 int flags, const char *name, uint32_t type)
4075 {
4076 	struct drm_property *property;
4077 
4078 	flags |= DRM_MODE_PROP_OBJECT;
4079 
4080 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
4081 		return NULL;
4082 
4083 	property = drm_property_create(dev, flags, name, 1);
4084 	if (!property)
4085 		return NULL;
4086 
4087 	property->values[0] = type;
4088 
4089 	return property;
4090 }
4091 EXPORT_SYMBOL(drm_property_create_object);
4092 
4093 /**
4094  * drm_property_create_bool - create a new boolean property type
4095  * @dev: drm device
4096  * @flags: flags specifying the property type
4097  * @name: name of the property
4098  *
4099  * This creates a new generic drm property which can then be attached to a drm
4100  * object with drm_object_attach_property. The returned property object must be
4101  * freed with drm_property_destroy.
4102  *
4103  * This is implemented as a ranged property with only {0, 1} as valid values.
4104  *
4105  * Returns:
4106  * A pointer to the newly created property on success, NULL on failure.
4107  */
4108 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
4109 					 const char *name)
4110 {
4111 	return drm_property_create_range(dev, flags, name, 0, 1);
4112 }
4113 EXPORT_SYMBOL(drm_property_create_bool);
4114 
4115 /**
4116  * drm_property_add_enum - add a possible value to an enumeration property
4117  * @property: enumeration property to change
4118  * @index: index of the new enumeration
4119  * @value: value of the new enumeration
4120  * @name: symbolic name of the new enumeration
4121  *
4122  * This functions adds enumerations to a property.
4123  *
4124  * It's use is deprecated, drivers should use one of the more specific helpers
4125  * to directly create the property with all enumerations already attached.
4126  *
4127  * Returns:
4128  * Zero on success, error code on failure.
4129  */
4130 int drm_property_add_enum(struct drm_property *property, int index,
4131 			  uint64_t value, const char *name)
4132 {
4133 	struct drm_property_enum *prop_enum;
4134 
4135 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4136 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
4137 		return -EINVAL;
4138 
4139 	/*
4140 	 * Bitmask enum properties have the additional constraint of values
4141 	 * from 0 to 63
4142 	 */
4143 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
4144 			(value > 63))
4145 		return -EINVAL;
4146 
4147 	if (!list_empty(&property->enum_list)) {
4148 		list_for_each_entry(prop_enum, &property->enum_list, head) {
4149 			if (prop_enum->value == value) {
4150 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
4151 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
4152 				return 0;
4153 			}
4154 		}
4155 	}
4156 
4157 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
4158 	if (!prop_enum)
4159 		return -ENOMEM;
4160 
4161 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
4162 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
4163 	prop_enum->value = value;
4164 
4165 	property->values[index] = value;
4166 	list_add_tail(&prop_enum->head, &property->enum_list);
4167 	return 0;
4168 }
4169 EXPORT_SYMBOL(drm_property_add_enum);
4170 
4171 /**
4172  * drm_property_destroy - destroy a drm property
4173  * @dev: drm device
4174  * @property: property to destry
4175  *
4176  * This function frees a property including any attached resources like
4177  * enumeration values.
4178  */
4179 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
4180 {
4181 	struct drm_property_enum *prop_enum, *pt;
4182 
4183 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
4184 		list_del(&prop_enum->head);
4185 		kfree(prop_enum);
4186 	}
4187 
4188 	if (property->num_values)
4189 		kfree(property->values);
4190 	drm_mode_object_unregister(dev, &property->base);
4191 	list_del(&property->head);
4192 	kfree(property);
4193 }
4194 EXPORT_SYMBOL(drm_property_destroy);
4195 
4196 /**
4197  * drm_object_attach_property - attach a property to a modeset object
4198  * @obj: drm modeset object
4199  * @property: property to attach
4200  * @init_val: initial value of the property
4201  *
4202  * This attaches the given property to the modeset object with the given initial
4203  * value. Currently this function cannot fail since the properties are stored in
4204  * a statically sized array.
4205  */
4206 void drm_object_attach_property(struct drm_mode_object *obj,
4207 				struct drm_property *property,
4208 				uint64_t init_val)
4209 {
4210 	int count = obj->properties->count;
4211 
4212 	if (count == DRM_OBJECT_MAX_PROPERTY) {
4213 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
4214 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
4215 			"you see this message on the same object type.\n",
4216 			obj->type);
4217 		return;
4218 	}
4219 
4220 	obj->properties->properties[count] = property;
4221 	obj->properties->values[count] = init_val;
4222 	obj->properties->count++;
4223 	if (property->flags & DRM_MODE_PROP_ATOMIC)
4224 		obj->properties->atomic_count++;
4225 }
4226 EXPORT_SYMBOL(drm_object_attach_property);
4227 
4228 /**
4229  * drm_object_property_set_value - set the value of a property
4230  * @obj: drm mode object to set property value for
4231  * @property: property to set
4232  * @val: value the property should be set to
4233  *
4234  * This functions sets a given property on a given object. This function only
4235  * changes the software state of the property, it does not call into the
4236  * driver's ->set_property callback.
4237  *
4238  * Returns:
4239  * Zero on success, error code on failure.
4240  */
4241 int drm_object_property_set_value(struct drm_mode_object *obj,
4242 				  struct drm_property *property, uint64_t val)
4243 {
4244 	int i;
4245 
4246 	for (i = 0; i < obj->properties->count; i++) {
4247 		if (obj->properties->properties[i] == property) {
4248 			obj->properties->values[i] = val;
4249 			return 0;
4250 		}
4251 	}
4252 
4253 	return -EINVAL;
4254 }
4255 EXPORT_SYMBOL(drm_object_property_set_value);
4256 
4257 /**
4258  * drm_object_property_get_value - retrieve the value of a property
4259  * @obj: drm mode object to get property value from
4260  * @property: property to retrieve
4261  * @val: storage for the property value
4262  *
4263  * This function retrieves the softare state of the given property for the given
4264  * property. Since there is no driver callback to retrieve the current property
4265  * value this might be out of sync with the hardware, depending upon the driver
4266  * and property.
4267  *
4268  * Returns:
4269  * Zero on success, error code on failure.
4270  */
4271 int drm_object_property_get_value(struct drm_mode_object *obj,
4272 				  struct drm_property *property, uint64_t *val)
4273 {
4274 	int i;
4275 
4276 	/* read-only properties bypass atomic mechanism and still store
4277 	 * their value in obj->properties->values[].. mostly to avoid
4278 	 * having to deal w/ EDID and similar props in atomic paths:
4279 	 */
4280 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4281 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4282 		return drm_atomic_get_property(obj, property, val);
4283 
4284 	for (i = 0; i < obj->properties->count; i++) {
4285 		if (obj->properties->properties[i] == property) {
4286 			*val = obj->properties->values[i];
4287 			return 0;
4288 		}
4289 	}
4290 
4291 	return -EINVAL;
4292 }
4293 EXPORT_SYMBOL(drm_object_property_get_value);
4294 
4295 /**
4296  * drm_mode_getproperty_ioctl - get the property metadata
4297  * @dev: DRM device
4298  * @data: ioctl data
4299  * @file_priv: DRM file info
4300  *
4301  * This function retrieves the metadata for a given property, like the different
4302  * possible values for an enum property or the limits for a range property.
4303  *
4304  * Blob properties are special
4305  *
4306  * Called by the user via ioctl.
4307  *
4308  * Returns:
4309  * Zero on success, negative errno on failure.
4310  */
4311 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4312 			       void *data, struct drm_file *file_priv)
4313 {
4314 	struct drm_mode_get_property *out_resp = data;
4315 	struct drm_property *property;
4316 	int enum_count = 0;
4317 	int value_count = 0;
4318 	int ret = 0, i;
4319 	int copied;
4320 	struct drm_property_enum *prop_enum;
4321 	struct drm_mode_property_enum __user *enum_ptr;
4322 	uint64_t __user *values_ptr;
4323 
4324 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4325 		return -EINVAL;
4326 
4327 	drm_modeset_lock_all(dev);
4328 	property = drm_property_find(dev, out_resp->prop_id);
4329 	if (!property) {
4330 		ret = -ENOENT;
4331 		goto done;
4332 	}
4333 
4334 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4335 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4336 		list_for_each_entry(prop_enum, &property->enum_list, head)
4337 			enum_count++;
4338 	}
4339 
4340 	value_count = property->num_values;
4341 
4342 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4343 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4344 	out_resp->flags = property->flags;
4345 
4346 	if ((out_resp->count_values >= value_count) && value_count) {
4347 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4348 		for (i = 0; i < value_count; i++) {
4349 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4350 				ret = -EFAULT;
4351 				goto done;
4352 			}
4353 		}
4354 	}
4355 	out_resp->count_values = value_count;
4356 
4357 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4358 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4359 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4360 			copied = 0;
4361 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4362 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4363 
4364 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4365 					ret = -EFAULT;
4366 					goto done;
4367 				}
4368 
4369 				if (copy_to_user(&enum_ptr[copied].name,
4370 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4371 					ret = -EFAULT;
4372 					goto done;
4373 				}
4374 				copied++;
4375 			}
4376 		}
4377 		out_resp->count_enum_blobs = enum_count;
4378 	}
4379 
4380 	/*
4381 	 * NOTE: The idea seems to have been to use this to read all the blob
4382 	 * property values. But nothing ever added them to the corresponding
4383 	 * list, userspace always used the special-purpose get_blob ioctl to
4384 	 * read the value for a blob property. It also doesn't make a lot of
4385 	 * sense to return values here when everything else is just metadata for
4386 	 * the property itself.
4387 	 */
4388 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4389 		out_resp->count_enum_blobs = 0;
4390 done:
4391 	drm_modeset_unlock_all(dev);
4392 	return ret;
4393 }
4394 
4395 static void drm_property_free_blob(struct kref *kref)
4396 {
4397 	struct drm_property_blob *blob =
4398 		container_of(kref, struct drm_property_blob, base.refcount);
4399 
4400 	mutex_lock(&blob->dev->mode_config.blob_lock);
4401 	list_del(&blob->head_global);
4402 	mutex_unlock(&blob->dev->mode_config.blob_lock);
4403 
4404 	drm_mode_object_unregister(blob->dev, &blob->base);
4405 
4406 	kfree(blob);
4407 }
4408 
4409 /**
4410  * drm_property_create_blob - Create new blob property
4411  *
4412  * Creates a new blob property for a specified DRM device, optionally
4413  * copying data.
4414  *
4415  * @dev: DRM device to create property for
4416  * @length: Length to allocate for blob data
4417  * @data: If specified, copies data into blob
4418  *
4419  * Returns:
4420  * New blob property with a single reference on success, or an ERR_PTR
4421  * value on failure.
4422  */
4423 struct drm_property_blob *
4424 drm_property_create_blob(struct drm_device *dev, size_t length,
4425 			 const void *data)
4426 {
4427 	struct drm_property_blob *blob;
4428 	int ret;
4429 
4430 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
4431 		return ERR_PTR(-EINVAL);
4432 
4433 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4434 	if (!blob)
4435 		return ERR_PTR(-ENOMEM);
4436 
4437 	/* This must be explicitly initialised, so we can safely call list_del
4438 	 * on it in the removal handler, even if it isn't in a file list. */
4439 	INIT_LIST_HEAD(&blob->head_file);
4440 	blob->length = length;
4441 	blob->dev = dev;
4442 
4443 	if (data)
4444 		memcpy(blob->data, data, length);
4445 
4446 	ret = drm_mode_object_get_reg(dev, &blob->base, DRM_MODE_OBJECT_BLOB,
4447 				      true, drm_property_free_blob);
4448 	if (ret) {
4449 		kfree(blob);
4450 		return ERR_PTR(-EINVAL);
4451 	}
4452 
4453 	mutex_lock(&dev->mode_config.blob_lock);
4454 	list_add_tail(&blob->head_global,
4455 	              &dev->mode_config.property_blob_list);
4456 	mutex_unlock(&dev->mode_config.blob_lock);
4457 
4458 	return blob;
4459 }
4460 EXPORT_SYMBOL(drm_property_create_blob);
4461 
4462 /**
4463  * drm_property_unreference_blob - Unreference a blob property
4464  *
4465  * Drop a reference on a blob property. May free the object.
4466  *
4467  * @blob: Pointer to blob property
4468  */
4469 void drm_property_unreference_blob(struct drm_property_blob *blob)
4470 {
4471 	if (!blob)
4472 		return;
4473 
4474 	drm_mode_object_unreference(&blob->base);
4475 }
4476 EXPORT_SYMBOL(drm_property_unreference_blob);
4477 
4478 /**
4479  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4480  * @dev:       DRM device
4481  * @file_priv: destroy all blobs owned by this file handle
4482  */
4483 void drm_property_destroy_user_blobs(struct drm_device *dev,
4484 				     struct drm_file *file_priv)
4485 {
4486 	struct drm_property_blob *blob, *bt;
4487 
4488 	/*
4489 	 * When the file gets released that means no one else can access the
4490 	 * blob list any more, so no need to grab dev->blob_lock.
4491 	 */
4492 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4493 		list_del_init(&blob->head_file);
4494 		drm_property_unreference_blob(blob);
4495 	}
4496 }
4497 
4498 /**
4499  * drm_property_reference_blob - Take a reference on an existing property
4500  *
4501  * Take a new reference on an existing blob property.
4502  *
4503  * @blob: Pointer to blob property
4504  */
4505 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4506 {
4507 	drm_mode_object_reference(&blob->base);
4508 	return blob;
4509 }
4510 EXPORT_SYMBOL(drm_property_reference_blob);
4511 
4512 /**
4513  * drm_property_lookup_blob - look up a blob property and take a reference
4514  * @dev: drm device
4515  * @id: id of the blob property
4516  *
4517  * If successful, this takes an additional reference to the blob property.
4518  * callers need to make sure to eventually unreference the returned property
4519  * again, using @drm_property_unreference_blob.
4520  */
4521 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4522 					           uint32_t id)
4523 {
4524 	struct drm_mode_object *obj;
4525 	struct drm_property_blob *blob = NULL;
4526 
4527 	obj = _object_find(dev, id, DRM_MODE_OBJECT_BLOB);
4528 	if (obj)
4529 		blob = obj_to_blob(obj);
4530 	return blob;
4531 }
4532 EXPORT_SYMBOL(drm_property_lookup_blob);
4533 
4534 /**
4535  * drm_property_replace_global_blob - atomically replace existing blob property
4536  * @dev: drm device
4537  * @replace: location of blob property pointer to be replaced
4538  * @length: length of data for new blob, or 0 for no data
4539  * @data: content for new blob, or NULL for no data
4540  * @obj_holds_id: optional object for property holding blob ID
4541  * @prop_holds_id: optional property holding blob ID
4542  * @return 0 on success or error on failure
4543  *
4544  * This function will atomically replace a global property in the blob list,
4545  * optionally updating a property which holds the ID of that property. It is
4546  * guaranteed to be atomic: no caller will be allowed to see intermediate
4547  * results, and either the entire operation will succeed and clean up the
4548  * previous property, or it will fail and the state will be unchanged.
4549  *
4550  * If length is 0 or data is NULL, no new blob will be created, and the holding
4551  * property, if specified, will be set to 0.
4552  *
4553  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4554  * by holding the relevant modesetting object lock for its parent.
4555  *
4556  * For example, a drm_connector has a 'PATH' property, which contains the ID
4557  * of a blob property with the value of the MST path information. Calling this
4558  * function with replace pointing to the connector's path_blob_ptr, length and
4559  * data set for the new path information, obj_holds_id set to the connector's
4560  * base object, and prop_holds_id set to the path property name, will perform
4561  * a completely atomic update. The access to path_blob_ptr is protected by the
4562  * caller holding a lock on the connector.
4563  */
4564 static int drm_property_replace_global_blob(struct drm_device *dev,
4565                                             struct drm_property_blob **replace,
4566                                             size_t length,
4567                                             const void *data,
4568                                             struct drm_mode_object *obj_holds_id,
4569                                             struct drm_property *prop_holds_id)
4570 {
4571 	struct drm_property_blob *new_blob = NULL;
4572 	struct drm_property_blob *old_blob = NULL;
4573 	int ret;
4574 
4575 	WARN_ON(replace == NULL);
4576 
4577 	old_blob = *replace;
4578 
4579 	if (length && data) {
4580 		new_blob = drm_property_create_blob(dev, length, data);
4581 		if (IS_ERR(new_blob))
4582 			return PTR_ERR(new_blob);
4583 	}
4584 
4585 	/* This does not need to be synchronised with blob_lock, as the
4586 	 * get_properties ioctl locks all modesetting objects, and
4587 	 * obj_holds_id must be locked before calling here, so we cannot
4588 	 * have its value out of sync with the list membership modified
4589 	 * below under blob_lock. */
4590 	if (obj_holds_id) {
4591 		ret = drm_object_property_set_value(obj_holds_id,
4592 						    prop_holds_id,
4593 						    new_blob ?
4594 						        new_blob->base.id : 0);
4595 		if (ret != 0)
4596 			goto err_created;
4597 	}
4598 
4599 	drm_property_unreference_blob(old_blob);
4600 	*replace = new_blob;
4601 
4602 	return 0;
4603 
4604 err_created:
4605 	drm_property_unreference_blob(new_blob);
4606 	return ret;
4607 }
4608 
4609 /**
4610  * drm_mode_getblob_ioctl - get the contents of a blob property value
4611  * @dev: DRM device
4612  * @data: ioctl data
4613  * @file_priv: DRM file info
4614  *
4615  * This function retrieves the contents of a blob property. The value stored in
4616  * an object's blob property is just a normal modeset object id.
4617  *
4618  * Called by the user via ioctl.
4619  *
4620  * Returns:
4621  * Zero on success, negative errno on failure.
4622  */
4623 int drm_mode_getblob_ioctl(struct drm_device *dev,
4624 			   void *data, struct drm_file *file_priv)
4625 {
4626 	struct drm_mode_get_blob *out_resp = data;
4627 	struct drm_property_blob *blob;
4628 	int ret = 0;
4629 	void __user *blob_ptr;
4630 
4631 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4632 		return -EINVAL;
4633 
4634 	blob = drm_property_lookup_blob(dev, out_resp->blob_id);
4635 	if (!blob)
4636 		return -ENOENT;
4637 
4638 	if (out_resp->length == blob->length) {
4639 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4640 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4641 			ret = -EFAULT;
4642 			goto unref;
4643 		}
4644 	}
4645 	out_resp->length = blob->length;
4646 unref:
4647 	drm_property_unreference_blob(blob);
4648 
4649 	return ret;
4650 }
4651 
4652 /**
4653  * drm_mode_createblob_ioctl - create a new blob property
4654  * @dev: DRM device
4655  * @data: ioctl data
4656  * @file_priv: DRM file info
4657  *
4658  * This function creates a new blob property with user-defined values. In order
4659  * to give us sensible validation and checking when creating, rather than at
4660  * every potential use, we also require a type to be provided upfront.
4661  *
4662  * Called by the user via ioctl.
4663  *
4664  * Returns:
4665  * Zero on success, negative errno on failure.
4666  */
4667 int drm_mode_createblob_ioctl(struct drm_device *dev,
4668 			      void *data, struct drm_file *file_priv)
4669 {
4670 	struct drm_mode_create_blob *out_resp = data;
4671 	struct drm_property_blob *blob;
4672 	void __user *blob_ptr;
4673 	int ret = 0;
4674 
4675 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4676 		return -EINVAL;
4677 
4678 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4679 	if (IS_ERR(blob))
4680 		return PTR_ERR(blob);
4681 
4682 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4683 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4684 		ret = -EFAULT;
4685 		goto out_blob;
4686 	}
4687 
4688 	/* Dropping the lock between create_blob and our access here is safe
4689 	 * as only the same file_priv can remove the blob; at this point, it is
4690 	 * not associated with any file_priv. */
4691 	mutex_lock(&dev->mode_config.blob_lock);
4692 	out_resp->blob_id = blob->base.id;
4693 	list_add_tail(&blob->head_file, &file_priv->blobs);
4694 	mutex_unlock(&dev->mode_config.blob_lock);
4695 
4696 	return 0;
4697 
4698 out_blob:
4699 	drm_property_unreference_blob(blob);
4700 	return ret;
4701 }
4702 
4703 /**
4704  * drm_mode_destroyblob_ioctl - destroy a user blob property
4705  * @dev: DRM device
4706  * @data: ioctl data
4707  * @file_priv: DRM file info
4708  *
4709  * Destroy an existing user-defined blob property.
4710  *
4711  * Called by the user via ioctl.
4712  *
4713  * Returns:
4714  * Zero on success, negative errno on failure.
4715  */
4716 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4717 			       void *data, struct drm_file *file_priv)
4718 {
4719 	struct drm_mode_destroy_blob *out_resp = data;
4720 	struct drm_property_blob *blob = NULL, *bt;
4721 	bool found = false;
4722 	int ret = 0;
4723 
4724 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4725 		return -EINVAL;
4726 
4727 	blob = drm_property_lookup_blob(dev, out_resp->blob_id);
4728 	if (!blob)
4729 		return -ENOENT;
4730 
4731 	mutex_lock(&dev->mode_config.blob_lock);
4732 	/* Ensure the property was actually created by this user. */
4733 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4734 		if (bt == blob) {
4735 			found = true;
4736 			break;
4737 		}
4738 	}
4739 
4740 	if (!found) {
4741 		ret = -EPERM;
4742 		goto err;
4743 	}
4744 
4745 	/* We must drop head_file here, because we may not be the last
4746 	 * reference on the blob. */
4747 	list_del_init(&blob->head_file);
4748 	mutex_unlock(&dev->mode_config.blob_lock);
4749 
4750 	/* One reference from lookup, and one from the filp. */
4751 	drm_property_unreference_blob(blob);
4752 	drm_property_unreference_blob(blob);
4753 
4754 	return 0;
4755 
4756 err:
4757 	mutex_unlock(&dev->mode_config.blob_lock);
4758 	drm_property_unreference_blob(blob);
4759 
4760 	return ret;
4761 }
4762 
4763 /**
4764  * drm_mode_connector_set_path_property - set tile property on connector
4765  * @connector: connector to set property on.
4766  * @path: path to use for property; must not be NULL.
4767  *
4768  * This creates a property to expose to userspace to specify a
4769  * connector path. This is mainly used for DisplayPort MST where
4770  * connectors have a topology and we want to allow userspace to give
4771  * them more meaningful names.
4772  *
4773  * Returns:
4774  * Zero on success, negative errno on failure.
4775  */
4776 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4777 					 const char *path)
4778 {
4779 	struct drm_device *dev = connector->dev;
4780 	int ret;
4781 
4782 	ret = drm_property_replace_global_blob(dev,
4783 	                                       &connector->path_blob_ptr,
4784 	                                       strlen(path) + 1,
4785 	                                       path,
4786 	                                       &connector->base,
4787 	                                       dev->mode_config.path_property);
4788 	return ret;
4789 }
4790 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4791 
4792 /**
4793  * drm_mode_connector_set_tile_property - set tile property on connector
4794  * @connector: connector to set property on.
4795  *
4796  * This looks up the tile information for a connector, and creates a
4797  * property for userspace to parse if it exists. The property is of
4798  * the form of 8 integers using ':' as a separator.
4799  *
4800  * Returns:
4801  * Zero on success, errno on failure.
4802  */
4803 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4804 {
4805 	struct drm_device *dev = connector->dev;
4806 	char tile[256];
4807 	int ret;
4808 
4809 	if (!connector->has_tile) {
4810 		ret  = drm_property_replace_global_blob(dev,
4811 		                                        &connector->tile_blob_ptr,
4812 		                                        0,
4813 		                                        NULL,
4814 		                                        &connector->base,
4815 		                                        dev->mode_config.tile_property);
4816 		return ret;
4817 	}
4818 
4819 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4820 		 connector->tile_group->id, connector->tile_is_single_monitor,
4821 		 connector->num_h_tile, connector->num_v_tile,
4822 		 connector->tile_h_loc, connector->tile_v_loc,
4823 		 connector->tile_h_size, connector->tile_v_size);
4824 
4825 	ret = drm_property_replace_global_blob(dev,
4826 	                                       &connector->tile_blob_ptr,
4827 	                                       strlen(tile) + 1,
4828 	                                       tile,
4829 	                                       &connector->base,
4830 	                                       dev->mode_config.tile_property);
4831 	return ret;
4832 }
4833 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4834 
4835 /**
4836  * drm_mode_connector_update_edid_property - update the edid property of a connector
4837  * @connector: drm connector
4838  * @edid: new value of the edid property
4839  *
4840  * This function creates a new blob modeset object and assigns its id to the
4841  * connector's edid property.
4842  *
4843  * Returns:
4844  * Zero on success, negative errno on failure.
4845  */
4846 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4847 					    const struct edid *edid)
4848 {
4849 	struct drm_device *dev = connector->dev;
4850 	size_t size = 0;
4851 	int ret;
4852 
4853 	/* ignore requests to set edid when overridden */
4854 	if (connector->override_edid)
4855 		return 0;
4856 
4857 	if (edid)
4858 		size = EDID_LENGTH * (1 + edid->extensions);
4859 
4860 	ret = drm_property_replace_global_blob(dev,
4861 					       &connector->edid_blob_ptr,
4862 	                                       size,
4863 	                                       edid,
4864 	                                       &connector->base,
4865 	                                       dev->mode_config.edid_property);
4866 	return ret;
4867 }
4868 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4869 
4870 /* Some properties could refer to dynamic refcnt'd objects, or things that
4871  * need special locking to handle lifetime issues (ie. to ensure the prop
4872  * value doesn't become invalid part way through the property update due to
4873  * race).  The value returned by reference via 'obj' should be passed back
4874  * to drm_property_change_valid_put() after the property is set (and the
4875  * object to which the property is attached has a chance to take it's own
4876  * reference).
4877  */
4878 bool drm_property_change_valid_get(struct drm_property *property,
4879 					 uint64_t value, struct drm_mode_object **ref)
4880 {
4881 	int i;
4882 
4883 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4884 		return false;
4885 
4886 	*ref = NULL;
4887 
4888 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4889 		if (value < property->values[0] || value > property->values[1])
4890 			return false;
4891 		return true;
4892 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4893 		int64_t svalue = U642I64(value);
4894 
4895 		if (svalue < U642I64(property->values[0]) ||
4896 				svalue > U642I64(property->values[1]))
4897 			return false;
4898 		return true;
4899 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4900 		uint64_t valid_mask = 0;
4901 
4902 		for (i = 0; i < property->num_values; i++)
4903 			valid_mask |= (1ULL << property->values[i]);
4904 		return !(value & ~valid_mask);
4905 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4906 		struct drm_property_blob *blob;
4907 
4908 		if (value == 0)
4909 			return true;
4910 
4911 		blob = drm_property_lookup_blob(property->dev, value);
4912 		if (blob) {
4913 			*ref = &blob->base;
4914 			return true;
4915 		} else {
4916 			return false;
4917 		}
4918 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4919 		/* a zero value for an object property translates to null: */
4920 		if (value == 0)
4921 			return true;
4922 
4923 		*ref = _object_find(property->dev, value, property->values[0]);
4924 		return *ref != NULL;
4925 	}
4926 
4927 	for (i = 0; i < property->num_values; i++)
4928 		if (property->values[i] == value)
4929 			return true;
4930 	return false;
4931 }
4932 
4933 void drm_property_change_valid_put(struct drm_property *property,
4934 		struct drm_mode_object *ref)
4935 {
4936 	if (!ref)
4937 		return;
4938 
4939 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4940 		drm_mode_object_unreference(ref);
4941 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4942 		drm_property_unreference_blob(obj_to_blob(ref));
4943 }
4944 
4945 /**
4946  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4947  * @dev: DRM device
4948  * @data: ioctl data
4949  * @file_priv: DRM file info
4950  *
4951  * This function sets the current value for a connectors's property. It also
4952  * calls into a driver's ->set_property callback to update the hardware state
4953  *
4954  * Called by the user via ioctl.
4955  *
4956  * Returns:
4957  * Zero on success, negative errno on failure.
4958  */
4959 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4960 				       void *data, struct drm_file *file_priv)
4961 {
4962 	struct drm_mode_connector_set_property *conn_set_prop = data;
4963 	struct drm_mode_obj_set_property obj_set_prop = {
4964 		.value = conn_set_prop->value,
4965 		.prop_id = conn_set_prop->prop_id,
4966 		.obj_id = conn_set_prop->connector_id,
4967 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4968 	};
4969 
4970 	/* It does all the locking and checking we need */
4971 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4972 }
4973 
4974 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4975 					   struct drm_property *property,
4976 					   uint64_t value)
4977 {
4978 	int ret = -EINVAL;
4979 	struct drm_connector *connector = obj_to_connector(obj);
4980 
4981 	/* Do DPMS ourselves */
4982 	if (property == connector->dev->mode_config.dpms_property) {
4983 		ret = (*connector->funcs->dpms)(connector, (int)value);
4984 	} else if (connector->funcs->set_property)
4985 		ret = connector->funcs->set_property(connector, property, value);
4986 
4987 	/* store the property value if successful */
4988 	if (!ret)
4989 		drm_object_property_set_value(&connector->base, property, value);
4990 	return ret;
4991 }
4992 
4993 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4994 				      struct drm_property *property,
4995 				      uint64_t value)
4996 {
4997 	int ret = -EINVAL;
4998 	struct drm_crtc *crtc = obj_to_crtc(obj);
4999 
5000 	if (crtc->funcs->set_property)
5001 		ret = crtc->funcs->set_property(crtc, property, value);
5002 	if (!ret)
5003 		drm_object_property_set_value(obj, property, value);
5004 
5005 	return ret;
5006 }
5007 
5008 /**
5009  * drm_mode_plane_set_obj_prop - set the value of a property
5010  * @plane: drm plane object to set property value for
5011  * @property: property to set
5012  * @value: value the property should be set to
5013  *
5014  * This functions sets a given property on a given plane object. This function
5015  * calls the driver's ->set_property callback and changes the software state of
5016  * the property if the callback succeeds.
5017  *
5018  * Returns:
5019  * Zero on success, error code on failure.
5020  */
5021 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
5022 				struct drm_property *property,
5023 				uint64_t value)
5024 {
5025 	int ret = -EINVAL;
5026 	struct drm_mode_object *obj = &plane->base;
5027 
5028 	if (plane->funcs->set_property)
5029 		ret = plane->funcs->set_property(plane, property, value);
5030 	if (!ret)
5031 		drm_object_property_set_value(obj, property, value);
5032 
5033 	return ret;
5034 }
5035 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
5036 
5037 /**
5038  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
5039  * @dev: DRM device
5040  * @data: ioctl data
5041  * @file_priv: DRM file info
5042  *
5043  * This function retrieves the current value for an object's property. Compared
5044  * to the connector specific ioctl this one is extended to also work on crtc and
5045  * plane objects.
5046  *
5047  * Called by the user via ioctl.
5048  *
5049  * Returns:
5050  * Zero on success, negative errno on failure.
5051  */
5052 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
5053 				      struct drm_file *file_priv)
5054 {
5055 	struct drm_mode_obj_get_properties *arg = data;
5056 	struct drm_mode_object *obj;
5057 	int ret = 0;
5058 
5059 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5060 		return -EINVAL;
5061 
5062 	drm_modeset_lock_all(dev);
5063 
5064 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
5065 	if (!obj) {
5066 		ret = -ENOENT;
5067 		goto out;
5068 	}
5069 	if (!obj->properties) {
5070 		ret = -EINVAL;
5071 		goto out_unref;
5072 	}
5073 
5074 	ret = get_properties(obj, file_priv->atomic,
5075 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
5076 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
5077 			&arg->count_props);
5078 
5079 out_unref:
5080 	drm_mode_object_unreference(obj);
5081 out:
5082 	drm_modeset_unlock_all(dev);
5083 	return ret;
5084 }
5085 
5086 /**
5087  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
5088  * @dev: DRM device
5089  * @data: ioctl data
5090  * @file_priv: DRM file info
5091  *
5092  * This function sets the current value for an object's property. It also calls
5093  * into a driver's ->set_property callback to update the hardware state.
5094  * Compared to the connector specific ioctl this one is extended to also work on
5095  * crtc and plane objects.
5096  *
5097  * Called by the user via ioctl.
5098  *
5099  * Returns:
5100  * Zero on success, negative errno on failure.
5101  */
5102 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
5103 				    struct drm_file *file_priv)
5104 {
5105 	struct drm_mode_obj_set_property *arg = data;
5106 	struct drm_mode_object *arg_obj;
5107 	struct drm_mode_object *prop_obj;
5108 	struct drm_property *property;
5109 	int i, ret = -EINVAL;
5110 	struct drm_mode_object *ref;
5111 
5112 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5113 		return -EINVAL;
5114 
5115 	drm_modeset_lock_all(dev);
5116 
5117 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
5118 	if (!arg_obj) {
5119 		ret = -ENOENT;
5120 		goto out;
5121 	}
5122 	if (!arg_obj->properties)
5123 		goto out_unref;
5124 
5125 	for (i = 0; i < arg_obj->properties->count; i++)
5126 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
5127 			break;
5128 
5129 	if (i == arg_obj->properties->count)
5130 		goto out_unref;
5131 
5132 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
5133 					DRM_MODE_OBJECT_PROPERTY);
5134 	if (!prop_obj) {
5135 		ret = -ENOENT;
5136 		goto out_unref;
5137 	}
5138 	property = obj_to_property(prop_obj);
5139 
5140 	if (!drm_property_change_valid_get(property, arg->value, &ref))
5141 		goto out_unref;
5142 
5143 	switch (arg_obj->type) {
5144 	case DRM_MODE_OBJECT_CONNECTOR:
5145 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
5146 						      arg->value);
5147 		break;
5148 	case DRM_MODE_OBJECT_CRTC:
5149 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
5150 		break;
5151 	case DRM_MODE_OBJECT_PLANE:
5152 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
5153 						  property, arg->value);
5154 		break;
5155 	}
5156 
5157 	drm_property_change_valid_put(property, ref);
5158 
5159 out_unref:
5160 	drm_mode_object_unreference(arg_obj);
5161 out:
5162 	drm_modeset_unlock_all(dev);
5163 	return ret;
5164 }
5165 
5166 /**
5167  * drm_mode_connector_attach_encoder - attach a connector to an encoder
5168  * @connector: connector to attach
5169  * @encoder: encoder to attach @connector to
5170  *
5171  * This function links up a connector to an encoder. Note that the routing
5172  * restrictions between encoders and crtcs are exposed to userspace through the
5173  * possible_clones and possible_crtcs bitmasks.
5174  *
5175  * Returns:
5176  * Zero on success, negative errno on failure.
5177  */
5178 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
5179 				      struct drm_encoder *encoder)
5180 {
5181 	int i;
5182 
5183 	/*
5184 	 * In the past, drivers have attempted to model the static association
5185 	 * of connector to encoder in simple connector/encoder devices using a
5186 	 * direct assignment of connector->encoder = encoder. This connection
5187 	 * is a logical one and the responsibility of the core, so drivers are
5188 	 * expected not to mess with this.
5189 	 *
5190 	 * Note that the error return should've been enough here, but a large
5191 	 * majority of drivers ignores the return value, so add in a big WARN
5192 	 * to get people's attention.
5193 	 */
5194 	if (WARN_ON(connector->encoder))
5195 		return -EINVAL;
5196 
5197 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
5198 		if (connector->encoder_ids[i] == 0) {
5199 			connector->encoder_ids[i] = encoder->base.id;
5200 			return 0;
5201 		}
5202 	}
5203 	return -ENOMEM;
5204 }
5205 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
5206 
5207 /**
5208  * drm_mode_crtc_set_gamma_size - set the gamma table size
5209  * @crtc: CRTC to set the gamma table size for
5210  * @gamma_size: size of the gamma table
5211  *
5212  * Drivers which support gamma tables should set this to the supported gamma
5213  * table size when initializing the CRTC. Currently the drm core only supports a
5214  * fixed gamma table size.
5215  *
5216  * Returns:
5217  * Zero on success, negative errno on failure.
5218  */
5219 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
5220 				 int gamma_size)
5221 {
5222 	uint16_t *r_base, *g_base, *b_base;
5223 	int i;
5224 
5225 	crtc->gamma_size = gamma_size;
5226 
5227 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
5228 				    GFP_KERNEL);
5229 	if (!crtc->gamma_store) {
5230 		crtc->gamma_size = 0;
5231 		return -ENOMEM;
5232 	}
5233 
5234 	r_base = crtc->gamma_store;
5235 	g_base = r_base + gamma_size;
5236 	b_base = g_base + gamma_size;
5237 	for (i = 0; i < gamma_size; i++) {
5238 		r_base[i] = i << 8;
5239 		g_base[i] = i << 8;
5240 		b_base[i] = i << 8;
5241 	}
5242 
5243 
5244 	return 0;
5245 }
5246 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
5247 
5248 /**
5249  * drm_mode_gamma_set_ioctl - set the gamma table
5250  * @dev: DRM device
5251  * @data: ioctl data
5252  * @file_priv: DRM file info
5253  *
5254  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
5255  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5256  *
5257  * Called by the user via ioctl.
5258  *
5259  * Returns:
5260  * Zero on success, negative errno on failure.
5261  */
5262 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5263 			     void *data, struct drm_file *file_priv)
5264 {
5265 	struct drm_mode_crtc_lut *crtc_lut = data;
5266 	struct drm_crtc *crtc;
5267 	void *r_base, *g_base, *b_base;
5268 	int size;
5269 	int ret = 0;
5270 
5271 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5272 		return -EINVAL;
5273 
5274 	drm_modeset_lock_all(dev);
5275 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5276 	if (!crtc) {
5277 		ret = -ENOENT;
5278 		goto out;
5279 	}
5280 
5281 	if (crtc->funcs->gamma_set == NULL) {
5282 		ret = -ENOSYS;
5283 		goto out;
5284 	}
5285 
5286 	/* memcpy into gamma store */
5287 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5288 		ret = -EINVAL;
5289 		goto out;
5290 	}
5291 
5292 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5293 	r_base = crtc->gamma_store;
5294 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5295 		ret = -EFAULT;
5296 		goto out;
5297 	}
5298 
5299 	g_base = r_base + size;
5300 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5301 		ret = -EFAULT;
5302 		goto out;
5303 	}
5304 
5305 	b_base = g_base + size;
5306 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5307 		ret = -EFAULT;
5308 		goto out;
5309 	}
5310 
5311 	ret = crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, crtc->gamma_size);
5312 
5313 out:
5314 	drm_modeset_unlock_all(dev);
5315 	return ret;
5316 
5317 }
5318 
5319 /**
5320  * drm_mode_gamma_get_ioctl - get the gamma table
5321  * @dev: DRM device
5322  * @data: ioctl data
5323  * @file_priv: DRM file info
5324  *
5325  * Copy the current gamma table into the storage provided. This also provides
5326  * the gamma table size the driver expects, which can be used to size the
5327  * allocated storage.
5328  *
5329  * Called by the user via ioctl.
5330  *
5331  * Returns:
5332  * Zero on success, negative errno on failure.
5333  */
5334 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5335 			     void *data, struct drm_file *file_priv)
5336 {
5337 	struct drm_mode_crtc_lut *crtc_lut = data;
5338 	struct drm_crtc *crtc;
5339 	void *r_base, *g_base, *b_base;
5340 	int size;
5341 	int ret = 0;
5342 
5343 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5344 		return -EINVAL;
5345 
5346 	drm_modeset_lock_all(dev);
5347 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5348 	if (!crtc) {
5349 		ret = -ENOENT;
5350 		goto out;
5351 	}
5352 
5353 	/* memcpy into gamma store */
5354 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5355 		ret = -EINVAL;
5356 		goto out;
5357 	}
5358 
5359 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5360 	r_base = crtc->gamma_store;
5361 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5362 		ret = -EFAULT;
5363 		goto out;
5364 	}
5365 
5366 	g_base = r_base + size;
5367 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5368 		ret = -EFAULT;
5369 		goto out;
5370 	}
5371 
5372 	b_base = g_base + size;
5373 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5374 		ret = -EFAULT;
5375 		goto out;
5376 	}
5377 out:
5378 	drm_modeset_unlock_all(dev);
5379 	return ret;
5380 }
5381 
5382 /**
5383  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5384  * @dev: DRM device
5385  * @data: ioctl data
5386  * @file_priv: DRM file info
5387  *
5388  * This schedules an asynchronous update on a given CRTC, called page flip.
5389  * Optionally a drm event is generated to signal the completion of the event.
5390  * Generic drivers cannot assume that a pageflip with changed framebuffer
5391  * properties (including driver specific metadata like tiling layout) will work,
5392  * but some drivers support e.g. pixel format changes through the pageflip
5393  * ioctl.
5394  *
5395  * Called by the user via ioctl.
5396  *
5397  * Returns:
5398  * Zero on success, negative errno on failure.
5399  */
5400 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5401 			     void *data, struct drm_file *file_priv)
5402 {
5403 	struct drm_mode_crtc_page_flip *page_flip = data;
5404 	struct drm_crtc *crtc;
5405 	struct drm_framebuffer *fb = NULL;
5406 	struct drm_pending_vblank_event *e = NULL;
5407 	int ret = -EINVAL;
5408 
5409 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5410 	    page_flip->reserved != 0)
5411 		return -EINVAL;
5412 
5413 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5414 		return -EINVAL;
5415 
5416 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5417 	if (!crtc)
5418 		return -ENOENT;
5419 
5420 	drm_modeset_lock_crtc(crtc, crtc->primary);
5421 	if (crtc->primary->fb == NULL) {
5422 		/* The framebuffer is currently unbound, presumably
5423 		 * due to a hotplug event, that userspace has not
5424 		 * yet discovered.
5425 		 */
5426 		ret = -EBUSY;
5427 		goto out;
5428 	}
5429 
5430 	if (crtc->funcs->page_flip == NULL)
5431 		goto out;
5432 
5433 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5434 	if (!fb) {
5435 		ret = -ENOENT;
5436 		goto out;
5437 	}
5438 
5439 	if (crtc->state) {
5440 		const struct drm_plane_state *state = crtc->primary->state;
5441 
5442 		ret = check_src_coords(state->src_x, state->src_y,
5443 				       state->src_w, state->src_h, fb);
5444 	} else {
5445 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5446 	}
5447 	if (ret)
5448 		goto out;
5449 
5450 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5451 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5452 		ret = -EINVAL;
5453 		goto out;
5454 	}
5455 
5456 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5457 		e = kzalloc(sizeof *e, GFP_KERNEL);
5458 		if (!e) {
5459 			ret = -ENOMEM;
5460 			goto out;
5461 		}
5462 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5463 		e->event.base.length = sizeof(e->event);
5464 		e->event.user_data = page_flip->user_data;
5465 		ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
5466 		if (ret) {
5467 			kfree(e);
5468 			goto out;
5469 		}
5470 	}
5471 
5472 	crtc->primary->old_fb = crtc->primary->fb;
5473 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5474 	if (ret) {
5475 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
5476 			drm_event_cancel_free(dev, &e->base);
5477 		/* Keep the old fb, don't unref it. */
5478 		crtc->primary->old_fb = NULL;
5479 	} else {
5480 		crtc->primary->fb = fb;
5481 		/* Unref only the old framebuffer. */
5482 		fb = NULL;
5483 	}
5484 
5485 out:
5486 	if (fb)
5487 		drm_framebuffer_unreference(fb);
5488 	if (crtc->primary->old_fb)
5489 		drm_framebuffer_unreference(crtc->primary->old_fb);
5490 	crtc->primary->old_fb = NULL;
5491 	drm_modeset_unlock_crtc(crtc);
5492 
5493 	return ret;
5494 }
5495 
5496 /**
5497  * drm_mode_config_reset - call ->reset callbacks
5498  * @dev: drm device
5499  *
5500  * This functions calls all the crtc's, encoder's and connector's ->reset
5501  * callback. Drivers can use this in e.g. their driver load or resume code to
5502  * reset hardware and software state.
5503  */
5504 void drm_mode_config_reset(struct drm_device *dev)
5505 {
5506 	struct drm_crtc *crtc;
5507 	struct drm_plane *plane;
5508 	struct drm_encoder *encoder;
5509 	struct drm_connector *connector;
5510 
5511 	drm_for_each_plane(plane, dev)
5512 		if (plane->funcs->reset)
5513 			plane->funcs->reset(plane);
5514 
5515 	drm_for_each_crtc(crtc, dev)
5516 		if (crtc->funcs->reset)
5517 			crtc->funcs->reset(crtc);
5518 
5519 	drm_for_each_encoder(encoder, dev)
5520 		if (encoder->funcs->reset)
5521 			encoder->funcs->reset(encoder);
5522 
5523 	mutex_lock(&dev->mode_config.mutex);
5524 	drm_for_each_connector(connector, dev)
5525 		if (connector->funcs->reset)
5526 			connector->funcs->reset(connector);
5527 	mutex_unlock(&dev->mode_config.mutex);
5528 }
5529 EXPORT_SYMBOL(drm_mode_config_reset);
5530 
5531 /**
5532  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5533  * @dev: DRM device
5534  * @data: ioctl data
5535  * @file_priv: DRM file info
5536  *
5537  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5538  * TTM or something else entirely) and returns the resulting buffer handle. This
5539  * handle can then be wrapped up into a framebuffer modeset object.
5540  *
5541  * Note that userspace is not allowed to use such objects for render
5542  * acceleration - drivers must create their own private ioctls for such a use
5543  * case.
5544  *
5545  * Called by the user via ioctl.
5546  *
5547  * Returns:
5548  * Zero on success, negative errno on failure.
5549  */
5550 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5551 			       void *data, struct drm_file *file_priv)
5552 {
5553 	struct drm_mode_create_dumb *args = data;
5554 	u32 cpp, stride, size;
5555 
5556 	if (!dev->driver->dumb_create)
5557 		return -ENOSYS;
5558 	if (!args->width || !args->height || !args->bpp)
5559 		return -EINVAL;
5560 
5561 	/* overflow checks for 32bit size calculations */
5562 	/* NOTE: DIV_ROUND_UP() can overflow */
5563 	cpp = DIV_ROUND_UP(args->bpp, 8);
5564 	if (!cpp || cpp > 0xffffffffU / args->width)
5565 		return -EINVAL;
5566 	stride = cpp * args->width;
5567 	if (args->height > 0xffffffffU / stride)
5568 		return -EINVAL;
5569 
5570 	/* test for wrap-around */
5571 	size = args->height * stride;
5572 	if (PAGE_ALIGN(size) == 0)
5573 		return -EINVAL;
5574 
5575 	/*
5576 	 * handle, pitch and size are output parameters. Zero them out to
5577 	 * prevent drivers from accidentally using uninitialized data. Since
5578 	 * not all existing userspace is clearing these fields properly we
5579 	 * cannot reject IOCTL with garbage in them.
5580 	 */
5581 	args->handle = 0;
5582 	args->pitch = 0;
5583 	args->size = 0;
5584 
5585 	return dev->driver->dumb_create(file_priv, dev, args);
5586 }
5587 
5588 /**
5589  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5590  * @dev: DRM device
5591  * @data: ioctl data
5592  * @file_priv: DRM file info
5593  *
5594  * Allocate an offset in the drm device node's address space to be able to
5595  * memory map a dumb buffer.
5596  *
5597  * Called by the user via ioctl.
5598  *
5599  * Returns:
5600  * Zero on success, negative errno on failure.
5601  */
5602 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5603 			     void *data, struct drm_file *file_priv)
5604 {
5605 	struct drm_mode_map_dumb *args = data;
5606 
5607 	/* call driver ioctl to get mmap offset */
5608 	if (!dev->driver->dumb_map_offset)
5609 		return -ENOSYS;
5610 
5611 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5612 }
5613 
5614 /**
5615  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5616  * @dev: DRM device
5617  * @data: ioctl data
5618  * @file_priv: DRM file info
5619  *
5620  * This destroys the userspace handle for the given dumb backing storage buffer.
5621  * Since buffer objects must be reference counted in the kernel a buffer object
5622  * won't be immediately freed if a framebuffer modeset object still uses it.
5623  *
5624  * Called by the user via ioctl.
5625  *
5626  * Returns:
5627  * Zero on success, negative errno on failure.
5628  */
5629 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5630 				void *data, struct drm_file *file_priv)
5631 {
5632 	struct drm_mode_destroy_dumb *args = data;
5633 
5634 	if (!dev->driver->dumb_destroy)
5635 		return -ENOSYS;
5636 
5637 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5638 }
5639 
5640 /**
5641  * drm_rotation_simplify() - Try to simplify the rotation
5642  * @rotation: Rotation to be simplified
5643  * @supported_rotations: Supported rotations
5644  *
5645  * Attempt to simplify the rotation to a form that is supported.
5646  * Eg. if the hardware supports everything except DRM_REFLECT_X
5647  * one could call this function like this:
5648  *
5649  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5650  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5651  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5652  *
5653  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5654  * transforms the hardware supports, this function may not
5655  * be able to produce a supported transform, so the caller should
5656  * check the result afterwards.
5657  */
5658 unsigned int drm_rotation_simplify(unsigned int rotation,
5659 				   unsigned int supported_rotations)
5660 {
5661 	if (rotation & ~supported_rotations) {
5662 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5663 		rotation = (rotation & DRM_REFLECT_MASK) |
5664 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
5665 	}
5666 
5667 	return rotation;
5668 }
5669 EXPORT_SYMBOL(drm_rotation_simplify);
5670 
5671 /**
5672  * drm_mode_config_init - initialize DRM mode_configuration structure
5673  * @dev: DRM device
5674  *
5675  * Initialize @dev's mode_config structure, used for tracking the graphics
5676  * configuration of @dev.
5677  *
5678  * Since this initializes the modeset locks, no locking is possible. Which is no
5679  * problem, since this should happen single threaded at init time. It is the
5680  * driver's problem to ensure this guarantee.
5681  *
5682  */
5683 void drm_mode_config_init(struct drm_device *dev)
5684 {
5685 	mutex_init(&dev->mode_config.mutex);
5686 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5687 	mutex_init(&dev->mode_config.idr_mutex);
5688 	mutex_init(&dev->mode_config.fb_lock);
5689 	mutex_init(&dev->mode_config.blob_lock);
5690 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5691 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5692 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5693 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5694 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5695 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5696 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5697 	idr_init(&dev->mode_config.crtc_idr);
5698 	idr_init(&dev->mode_config.tile_idr);
5699 	ida_init(&dev->mode_config.connector_ida);
5700 
5701 	drm_modeset_lock_all(dev);
5702 	drm_mode_create_standard_properties(dev);
5703 	drm_modeset_unlock_all(dev);
5704 
5705 	/* Just to be sure */
5706 	dev->mode_config.num_fb = 0;
5707 	dev->mode_config.num_connector = 0;
5708 	dev->mode_config.num_crtc = 0;
5709 	dev->mode_config.num_encoder = 0;
5710 	dev->mode_config.num_overlay_plane = 0;
5711 	dev->mode_config.num_total_plane = 0;
5712 }
5713 EXPORT_SYMBOL(drm_mode_config_init);
5714 
5715 /**
5716  * drm_mode_config_cleanup - free up DRM mode_config info
5717  * @dev: DRM device
5718  *
5719  * Free up all the connectors and CRTCs associated with this DRM device, then
5720  * free up the framebuffers and associated buffer objects.
5721  *
5722  * Note that since this /should/ happen single-threaded at driver/device
5723  * teardown time, no locking is required. It's the driver's job to ensure that
5724  * this guarantee actually holds true.
5725  *
5726  * FIXME: cleanup any dangling user buffer objects too
5727  */
5728 void drm_mode_config_cleanup(struct drm_device *dev)
5729 {
5730 	struct drm_connector *connector, *ot;
5731 	struct drm_crtc *crtc, *ct;
5732 	struct drm_encoder *encoder, *enct;
5733 	struct drm_framebuffer *fb, *fbt;
5734 	struct drm_property *property, *pt;
5735 	struct drm_property_blob *blob, *bt;
5736 	struct drm_plane *plane, *plt;
5737 
5738 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5739 				 head) {
5740 		encoder->funcs->destroy(encoder);
5741 	}
5742 
5743 	list_for_each_entry_safe(connector, ot,
5744 				 &dev->mode_config.connector_list, head) {
5745 		connector->funcs->destroy(connector);
5746 	}
5747 
5748 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5749 				 head) {
5750 		drm_property_destroy(dev, property);
5751 	}
5752 
5753 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5754 				 head) {
5755 		plane->funcs->destroy(plane);
5756 	}
5757 
5758 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5759 		crtc->funcs->destroy(crtc);
5760 	}
5761 
5762 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5763 				 head_global) {
5764 		drm_property_unreference_blob(blob);
5765 	}
5766 
5767 	/*
5768 	 * Single-threaded teardown context, so it's not required to grab the
5769 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5770 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5771 	 *
5772 	 * Also, if there are any framebuffers left, that's a driver leak now,
5773 	 * so politely WARN about this.
5774 	 */
5775 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5776 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5777 		drm_framebuffer_free(&fb->base.refcount);
5778 	}
5779 
5780 	ida_destroy(&dev->mode_config.connector_ida);
5781 	idr_destroy(&dev->mode_config.tile_idr);
5782 	idr_destroy(&dev->mode_config.crtc_idr);
5783 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5784 }
5785 EXPORT_SYMBOL(drm_mode_config_cleanup);
5786 
5787 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5788 						       unsigned int supported_rotations)
5789 {
5790 	static const struct drm_prop_enum_list props[] = {
5791 		{ DRM_ROTATE_0,   "rotate-0" },
5792 		{ DRM_ROTATE_90,  "rotate-90" },
5793 		{ DRM_ROTATE_180, "rotate-180" },
5794 		{ DRM_ROTATE_270, "rotate-270" },
5795 		{ DRM_REFLECT_X,  "reflect-x" },
5796 		{ DRM_REFLECT_Y,  "reflect-y" },
5797 	};
5798 
5799 	return drm_property_create_bitmask(dev, 0, "rotation",
5800 					   props, ARRAY_SIZE(props),
5801 					   supported_rotations);
5802 }
5803 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5804 
5805 /**
5806  * DOC: Tile group
5807  *
5808  * Tile groups are used to represent tiled monitors with a unique
5809  * integer identifier. Tiled monitors using DisplayID v1.3 have
5810  * a unique 8-byte handle, we store this in a tile group, so we
5811  * have a common identifier for all tiles in a monitor group.
5812  */
5813 static void drm_tile_group_free(struct kref *kref)
5814 {
5815 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5816 	struct drm_device *dev = tg->dev;
5817 	mutex_lock(&dev->mode_config.idr_mutex);
5818 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5819 	mutex_unlock(&dev->mode_config.idr_mutex);
5820 	kfree(tg);
5821 }
5822 
5823 /**
5824  * drm_mode_put_tile_group - drop a reference to a tile group.
5825  * @dev: DRM device
5826  * @tg: tile group to drop reference to.
5827  *
5828  * drop reference to tile group and free if 0.
5829  */
5830 void drm_mode_put_tile_group(struct drm_device *dev,
5831 			     struct drm_tile_group *tg)
5832 {
5833 	kref_put(&tg->refcount, drm_tile_group_free);
5834 }
5835 
5836 /**
5837  * drm_mode_get_tile_group - get a reference to an existing tile group
5838  * @dev: DRM device
5839  * @topology: 8-bytes unique per monitor.
5840  *
5841  * Use the unique bytes to get a reference to an existing tile group.
5842  *
5843  * RETURNS:
5844  * tile group or NULL if not found.
5845  */
5846 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5847 					       char topology[8])
5848 {
5849 	struct drm_tile_group *tg;
5850 	int id;
5851 	mutex_lock(&dev->mode_config.idr_mutex);
5852 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5853 		if (!memcmp(tg->group_data, topology, 8)) {
5854 			if (!kref_get_unless_zero(&tg->refcount))
5855 				tg = NULL;
5856 			mutex_unlock(&dev->mode_config.idr_mutex);
5857 			return tg;
5858 		}
5859 	}
5860 	mutex_unlock(&dev->mode_config.idr_mutex);
5861 	return NULL;
5862 }
5863 EXPORT_SYMBOL(drm_mode_get_tile_group);
5864 
5865 /**
5866  * drm_mode_create_tile_group - create a tile group from a displayid description
5867  * @dev: DRM device
5868  * @topology: 8-bytes unique per monitor.
5869  *
5870  * Create a tile group for the unique monitor, and get a unique
5871  * identifier for the tile group.
5872  *
5873  * RETURNS:
5874  * new tile group or error.
5875  */
5876 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5877 						  char topology[8])
5878 {
5879 	struct drm_tile_group *tg;
5880 	int ret;
5881 
5882 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5883 	if (!tg)
5884 		return ERR_PTR(-ENOMEM);
5885 
5886 	kref_init(&tg->refcount);
5887 	memcpy(tg->group_data, topology, 8);
5888 	tg->dev = dev;
5889 
5890 	mutex_lock(&dev->mode_config.idr_mutex);
5891 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5892 	if (ret >= 0) {
5893 		tg->id = ret;
5894 	} else {
5895 		kfree(tg);
5896 		tg = ERR_PTR(ret);
5897 	}
5898 
5899 	mutex_unlock(&dev->mode_config.idr_mutex);
5900 	return tg;
5901 }
5902 EXPORT_SYMBOL(drm_mode_create_tile_group);
5903 
5904 /**
5905  * drm_crtc_enable_color_mgmt - enable color management properties
5906  * @crtc: DRM CRTC
5907  * @degamma_lut_size: the size of the degamma lut (before CSC)
5908  * @has_ctm: whether to attach ctm_property for CSC matrix
5909  * @gamma_lut_size: the size of the gamma lut (after CSC)
5910  *
5911  * This function lets the driver enable the color correction
5912  * properties on a CRTC. This includes 3 degamma, csc and gamma
5913  * properties that userspace can set and 2 size properties to inform
5914  * the userspace of the lut sizes. Each of the properties are
5915  * optional. The gamma and degamma properties are only attached if
5916  * their size is not 0 and ctm_property is only attached if has_ctm is
5917  * true.
5918  */
5919 void drm_crtc_enable_color_mgmt(struct drm_crtc *crtc,
5920 				uint degamma_lut_size,
5921 				bool has_ctm,
5922 				uint gamma_lut_size)
5923 {
5924 	struct drm_device *dev = crtc->dev;
5925 	struct drm_mode_config *config = &dev->mode_config;
5926 
5927 	if (degamma_lut_size) {
5928 		drm_object_attach_property(&crtc->base,
5929 					   config->degamma_lut_property, 0);
5930 		drm_object_attach_property(&crtc->base,
5931 					   config->degamma_lut_size_property,
5932 					   degamma_lut_size);
5933 	}
5934 
5935 	if (has_ctm)
5936 		drm_object_attach_property(&crtc->base,
5937 					   config->ctm_property, 0);
5938 
5939 	if (gamma_lut_size) {
5940 		drm_object_attach_property(&crtc->base,
5941 					   config->gamma_lut_property, 0);
5942 		drm_object_attach_property(&crtc->base,
5943 					   config->gamma_lut_size_property,
5944 					   gamma_lut_size);
5945 	}
5946 }
5947 EXPORT_SYMBOL(drm_crtc_enable_color_mgmt);
5948