xref: /openbmc/linux/drivers/gpu/drm/drm_crtc.c (revision a2cce7a9)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	struct ida ida;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 	int i;
196 
197 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
198 		ida_init(&drm_connector_enum_list[i].ida);
199 }
200 
201 void drm_connector_ida_destroy(void)
202 {
203 	int i;
204 
205 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
206 		ida_destroy(&drm_connector_enum_list[i].ida);
207 }
208 
209 /**
210  * drm_get_connector_status_name - return a string for connector status
211  * @status: connector status to compute name of
212  *
213  * In contrast to the other drm_get_*_name functions this one here returns a
214  * const pointer and hence is threadsafe.
215  */
216 const char *drm_get_connector_status_name(enum drm_connector_status status)
217 {
218 	if (status == connector_status_connected)
219 		return "connected";
220 	else if (status == connector_status_disconnected)
221 		return "disconnected";
222 	else
223 		return "unknown";
224 }
225 EXPORT_SYMBOL(drm_get_connector_status_name);
226 
227 /**
228  * drm_get_subpixel_order_name - return a string for a given subpixel enum
229  * @order: enum of subpixel_order
230  *
231  * Note you could abuse this and return something out of bounds, but that
232  * would be a caller error.  No unscrubbed user data should make it here.
233  */
234 const char *drm_get_subpixel_order_name(enum subpixel_order order)
235 {
236 	return drm_subpixel_enum_list[order].name;
237 }
238 EXPORT_SYMBOL(drm_get_subpixel_order_name);
239 
240 static char printable_char(int c)
241 {
242 	return isascii(c) && isprint(c) ? c : '?';
243 }
244 
245 /**
246  * drm_get_format_name - return a string for drm fourcc format
247  * @format: format to compute name of
248  *
249  * Note that the buffer used by this function is globally shared and owned by
250  * the function itself.
251  *
252  * FIXME: This isn't really multithreading safe.
253  */
254 const char *drm_get_format_name(uint32_t format)
255 {
256 	static char buf[32];
257 
258 	snprintf(buf, sizeof(buf),
259 		 "%c%c%c%c %s-endian (0x%08x)",
260 		 printable_char(format & 0xff),
261 		 printable_char((format >> 8) & 0xff),
262 		 printable_char((format >> 16) & 0xff),
263 		 printable_char((format >> 24) & 0x7f),
264 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
265 		 format);
266 
267 	return buf;
268 }
269 EXPORT_SYMBOL(drm_get_format_name);
270 
271 /*
272  * Internal function to assign a slot in the object idr and optionally
273  * register the object into the idr.
274  */
275 static int drm_mode_object_get_reg(struct drm_device *dev,
276 				   struct drm_mode_object *obj,
277 				   uint32_t obj_type,
278 				   bool register_obj)
279 {
280 	int ret;
281 
282 	mutex_lock(&dev->mode_config.idr_mutex);
283 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
284 	if (ret >= 0) {
285 		/*
286 		 * Set up the object linking under the protection of the idr
287 		 * lock so that other users can't see inconsistent state.
288 		 */
289 		obj->id = ret;
290 		obj->type = obj_type;
291 	}
292 	mutex_unlock(&dev->mode_config.idr_mutex);
293 
294 	return ret < 0 ? ret : 0;
295 }
296 
297 /**
298  * drm_mode_object_get - allocate a new modeset identifier
299  * @dev: DRM device
300  * @obj: object pointer, used to generate unique ID
301  * @obj_type: object type
302  *
303  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
304  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
305  * modeset identifiers are _not_ reference counted. Hence don't use this for
306  * reference counted modeset objects like framebuffers.
307  *
308  * Returns:
309  * New unique (relative to other objects in @dev) integer identifier for the
310  * object.
311  */
312 int drm_mode_object_get(struct drm_device *dev,
313 			struct drm_mode_object *obj, uint32_t obj_type)
314 {
315 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
316 }
317 
318 static void drm_mode_object_register(struct drm_device *dev,
319 				     struct drm_mode_object *obj)
320 {
321 	mutex_lock(&dev->mode_config.idr_mutex);
322 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
323 	mutex_unlock(&dev->mode_config.idr_mutex);
324 }
325 
326 /**
327  * drm_mode_object_put - free a modeset identifer
328  * @dev: DRM device
329  * @object: object to free
330  *
331  * Free @id from @dev's unique identifier pool. Note that despite the _get
332  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
333  * for reference counted modeset objects like framebuffers.
334  */
335 void drm_mode_object_put(struct drm_device *dev,
336 			 struct drm_mode_object *object)
337 {
338 	mutex_lock(&dev->mode_config.idr_mutex);
339 	idr_remove(&dev->mode_config.crtc_idr, object->id);
340 	mutex_unlock(&dev->mode_config.idr_mutex);
341 }
342 
343 static struct drm_mode_object *_object_find(struct drm_device *dev,
344 		uint32_t id, uint32_t type)
345 {
346 	struct drm_mode_object *obj = NULL;
347 
348 	mutex_lock(&dev->mode_config.idr_mutex);
349 	obj = idr_find(&dev->mode_config.crtc_idr, id);
350 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
351 		obj = NULL;
352 	if (obj && obj->id != id)
353 		obj = NULL;
354 	/* don't leak out unref'd fb's */
355 	if (obj &&
356 	    (obj->type == DRM_MODE_OBJECT_FB ||
357 	     obj->type == DRM_MODE_OBJECT_BLOB))
358 		obj = NULL;
359 	mutex_unlock(&dev->mode_config.idr_mutex);
360 
361 	return obj;
362 }
363 
364 /**
365  * drm_mode_object_find - look up a drm object with static lifetime
366  * @dev: drm device
367  * @id: id of the mode object
368  * @type: type of the mode object
369  *
370  * Note that framebuffers cannot be looked up with this functions - since those
371  * are reference counted, they need special treatment.  Even with
372  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
373  * rather than WARN_ON()).
374  */
375 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
376 		uint32_t id, uint32_t type)
377 {
378 	struct drm_mode_object *obj = NULL;
379 
380 	/* Framebuffers are reference counted and need their own lookup
381 	 * function.*/
382 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
383 	obj = _object_find(dev, id, type);
384 	return obj;
385 }
386 EXPORT_SYMBOL(drm_mode_object_find);
387 
388 /**
389  * drm_framebuffer_init - initialize a framebuffer
390  * @dev: DRM device
391  * @fb: framebuffer to be initialized
392  * @funcs: ... with these functions
393  *
394  * Allocates an ID for the framebuffer's parent mode object, sets its mode
395  * functions & device file and adds it to the master fd list.
396  *
397  * IMPORTANT:
398  * This functions publishes the fb and makes it available for concurrent access
399  * by other users. Which means by this point the fb _must_ be fully set up -
400  * since all the fb attributes are invariant over its lifetime, no further
401  * locking but only correct reference counting is required.
402  *
403  * Returns:
404  * Zero on success, error code on failure.
405  */
406 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
407 			 const struct drm_framebuffer_funcs *funcs)
408 {
409 	int ret;
410 
411 	mutex_lock(&dev->mode_config.fb_lock);
412 	kref_init(&fb->refcount);
413 	INIT_LIST_HEAD(&fb->filp_head);
414 	fb->dev = dev;
415 	fb->funcs = funcs;
416 
417 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
418 	if (ret)
419 		goto out;
420 
421 	dev->mode_config.num_fb++;
422 	list_add(&fb->head, &dev->mode_config.fb_list);
423 out:
424 	mutex_unlock(&dev->mode_config.fb_lock);
425 
426 	return 0;
427 }
428 EXPORT_SYMBOL(drm_framebuffer_init);
429 
430 /* dev->mode_config.fb_lock must be held! */
431 static void __drm_framebuffer_unregister(struct drm_device *dev,
432 					 struct drm_framebuffer *fb)
433 {
434 	mutex_lock(&dev->mode_config.idr_mutex);
435 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
436 	mutex_unlock(&dev->mode_config.idr_mutex);
437 
438 	fb->base.id = 0;
439 }
440 
441 static void drm_framebuffer_free(struct kref *kref)
442 {
443 	struct drm_framebuffer *fb =
444 			container_of(kref, struct drm_framebuffer, refcount);
445 	struct drm_device *dev = fb->dev;
446 
447 	/*
448 	 * The lookup idr holds a weak reference, which has not necessarily been
449 	 * removed at this point. Check for that.
450 	 */
451 	mutex_lock(&dev->mode_config.fb_lock);
452 	if (fb->base.id) {
453 		/* Mark fb as reaped and drop idr ref. */
454 		__drm_framebuffer_unregister(dev, fb);
455 	}
456 	mutex_unlock(&dev->mode_config.fb_lock);
457 
458 	fb->funcs->destroy(fb);
459 }
460 
461 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
462 							uint32_t id)
463 {
464 	struct drm_mode_object *obj = NULL;
465 	struct drm_framebuffer *fb;
466 
467 	mutex_lock(&dev->mode_config.idr_mutex);
468 	obj = idr_find(&dev->mode_config.crtc_idr, id);
469 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
470 		fb = NULL;
471 	else
472 		fb = obj_to_fb(obj);
473 	mutex_unlock(&dev->mode_config.idr_mutex);
474 
475 	return fb;
476 }
477 
478 /**
479  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
480  * @dev: drm device
481  * @id: id of the fb object
482  *
483  * If successful, this grabs an additional reference to the framebuffer -
484  * callers need to make sure to eventually unreference the returned framebuffer
485  * again, using @drm_framebuffer_unreference.
486  */
487 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
488 					       uint32_t id)
489 {
490 	struct drm_framebuffer *fb;
491 
492 	mutex_lock(&dev->mode_config.fb_lock);
493 	fb = __drm_framebuffer_lookup(dev, id);
494 	if (fb) {
495 		if (!kref_get_unless_zero(&fb->refcount))
496 			fb = NULL;
497 	}
498 	mutex_unlock(&dev->mode_config.fb_lock);
499 
500 	return fb;
501 }
502 EXPORT_SYMBOL(drm_framebuffer_lookup);
503 
504 /**
505  * drm_framebuffer_unreference - unref a framebuffer
506  * @fb: framebuffer to unref
507  *
508  * This functions decrements the fb's refcount and frees it if it drops to zero.
509  */
510 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
511 {
512 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
513 	kref_put(&fb->refcount, drm_framebuffer_free);
514 }
515 EXPORT_SYMBOL(drm_framebuffer_unreference);
516 
517 /**
518  * drm_framebuffer_reference - incr the fb refcnt
519  * @fb: framebuffer
520  *
521  * This functions increments the fb's refcount.
522  */
523 void drm_framebuffer_reference(struct drm_framebuffer *fb)
524 {
525 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
526 	kref_get(&fb->refcount);
527 }
528 EXPORT_SYMBOL(drm_framebuffer_reference);
529 
530 /**
531  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
532  * @fb: fb to unregister
533  *
534  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
535  * those used for fbdev. Note that the caller must hold a reference of it's own,
536  * i.e. the object may not be destroyed through this call (since it'll lead to a
537  * locking inversion).
538  */
539 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
540 {
541 	struct drm_device *dev = fb->dev;
542 
543 	mutex_lock(&dev->mode_config.fb_lock);
544 	/* Mark fb as reaped and drop idr ref. */
545 	__drm_framebuffer_unregister(dev, fb);
546 	mutex_unlock(&dev->mode_config.fb_lock);
547 }
548 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
549 
550 /**
551  * drm_framebuffer_cleanup - remove a framebuffer object
552  * @fb: framebuffer to remove
553  *
554  * Cleanup framebuffer. This function is intended to be used from the drivers
555  * ->destroy callback. It can also be used to clean up driver private
556  *  framebuffers embedded into a larger structure.
557  *
558  * Note that this function does not remove the fb from active usuage - if it is
559  * still used anywhere, hilarity can ensue since userspace could call getfb on
560  * the id and get back -EINVAL. Obviously no concern at driver unload time.
561  *
562  * Also, the framebuffer will not be removed from the lookup idr - for
563  * user-created framebuffers this will happen in in the rmfb ioctl. For
564  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
565  * drm_framebuffer_unregister_private.
566  */
567 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
568 {
569 	struct drm_device *dev = fb->dev;
570 
571 	mutex_lock(&dev->mode_config.fb_lock);
572 	list_del(&fb->head);
573 	dev->mode_config.num_fb--;
574 	mutex_unlock(&dev->mode_config.fb_lock);
575 }
576 EXPORT_SYMBOL(drm_framebuffer_cleanup);
577 
578 /**
579  * drm_framebuffer_remove - remove and unreference a framebuffer object
580  * @fb: framebuffer to remove
581  *
582  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
583  * using @fb, removes it, setting it to NULL. Then drops the reference to the
584  * passed-in framebuffer. Might take the modeset locks.
585  *
586  * Note that this function optimizes the cleanup away if the caller holds the
587  * last reference to the framebuffer. It is also guaranteed to not take the
588  * modeset locks in this case.
589  */
590 void drm_framebuffer_remove(struct drm_framebuffer *fb)
591 {
592 	struct drm_device *dev = fb->dev;
593 	struct drm_crtc *crtc;
594 	struct drm_plane *plane;
595 	struct drm_mode_set set;
596 	int ret;
597 
598 	WARN_ON(!list_empty(&fb->filp_head));
599 
600 	/*
601 	 * drm ABI mandates that we remove any deleted framebuffers from active
602 	 * useage. But since most sane clients only remove framebuffers they no
603 	 * longer need, try to optimize this away.
604 	 *
605 	 * Since we're holding a reference ourselves, observing a refcount of 1
606 	 * means that we're the last holder and can skip it. Also, the refcount
607 	 * can never increase from 1 again, so we don't need any barriers or
608 	 * locks.
609 	 *
610 	 * Note that userspace could try to race with use and instate a new
611 	 * usage _after_ we've cleared all current ones. End result will be an
612 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
613 	 * in this manner.
614 	 */
615 	if (atomic_read(&fb->refcount.refcount) > 1) {
616 		drm_modeset_lock_all(dev);
617 		/* remove from any CRTC */
618 		drm_for_each_crtc(crtc, dev) {
619 			if (crtc->primary->fb == fb) {
620 				/* should turn off the crtc */
621 				memset(&set, 0, sizeof(struct drm_mode_set));
622 				set.crtc = crtc;
623 				set.fb = NULL;
624 				ret = drm_mode_set_config_internal(&set);
625 				if (ret)
626 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
627 			}
628 		}
629 
630 		drm_for_each_plane(plane, dev) {
631 			if (plane->fb == fb)
632 				drm_plane_force_disable(plane);
633 		}
634 		drm_modeset_unlock_all(dev);
635 	}
636 
637 	drm_framebuffer_unreference(fb);
638 }
639 EXPORT_SYMBOL(drm_framebuffer_remove);
640 
641 DEFINE_WW_CLASS(crtc_ww_class);
642 
643 /**
644  * drm_crtc_init_with_planes - Initialise a new CRTC object with
645  *    specified primary and cursor planes.
646  * @dev: DRM device
647  * @crtc: CRTC object to init
648  * @primary: Primary plane for CRTC
649  * @cursor: Cursor plane for CRTC
650  * @funcs: callbacks for the new CRTC
651  *
652  * Inits a new object created as base part of a driver crtc object.
653  *
654  * Returns:
655  * Zero on success, error code on failure.
656  */
657 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
658 			      struct drm_plane *primary,
659 			      struct drm_plane *cursor,
660 			      const struct drm_crtc_funcs *funcs)
661 {
662 	struct drm_mode_config *config = &dev->mode_config;
663 	int ret;
664 
665 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
666 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
667 
668 	crtc->dev = dev;
669 	crtc->funcs = funcs;
670 	crtc->invert_dimensions = false;
671 
672 	drm_modeset_lock_init(&crtc->mutex);
673 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
674 	if (ret)
675 		return ret;
676 
677 	crtc->base.properties = &crtc->properties;
678 
679 	list_add_tail(&crtc->head, &config->crtc_list);
680 	config->num_crtc++;
681 
682 	crtc->primary = primary;
683 	crtc->cursor = cursor;
684 	if (primary)
685 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
686 	if (cursor)
687 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
688 
689 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
690 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
691 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
692 	}
693 
694 	return 0;
695 }
696 EXPORT_SYMBOL(drm_crtc_init_with_planes);
697 
698 /**
699  * drm_crtc_cleanup - Clean up the core crtc usage
700  * @crtc: CRTC to cleanup
701  *
702  * This function cleans up @crtc and removes it from the DRM mode setting
703  * core. Note that the function does *not* free the crtc structure itself,
704  * this is the responsibility of the caller.
705  */
706 void drm_crtc_cleanup(struct drm_crtc *crtc)
707 {
708 	struct drm_device *dev = crtc->dev;
709 
710 	kfree(crtc->gamma_store);
711 	crtc->gamma_store = NULL;
712 
713 	drm_modeset_lock_fini(&crtc->mutex);
714 
715 	drm_mode_object_put(dev, &crtc->base);
716 	list_del(&crtc->head);
717 	dev->mode_config.num_crtc--;
718 
719 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
720 	if (crtc->state && crtc->funcs->atomic_destroy_state)
721 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
722 
723 	memset(crtc, 0, sizeof(*crtc));
724 }
725 EXPORT_SYMBOL(drm_crtc_cleanup);
726 
727 /**
728  * drm_crtc_index - find the index of a registered CRTC
729  * @crtc: CRTC to find index for
730  *
731  * Given a registered CRTC, return the index of that CRTC within a DRM
732  * device's list of CRTCs.
733  */
734 unsigned int drm_crtc_index(struct drm_crtc *crtc)
735 {
736 	unsigned int index = 0;
737 	struct drm_crtc *tmp;
738 
739 	drm_for_each_crtc(tmp, crtc->dev) {
740 		if (tmp == crtc)
741 			return index;
742 
743 		index++;
744 	}
745 
746 	BUG();
747 }
748 EXPORT_SYMBOL(drm_crtc_index);
749 
750 /*
751  * drm_mode_remove - remove and free a mode
752  * @connector: connector list to modify
753  * @mode: mode to remove
754  *
755  * Remove @mode from @connector's mode list, then free it.
756  */
757 static void drm_mode_remove(struct drm_connector *connector,
758 			    struct drm_display_mode *mode)
759 {
760 	list_del(&mode->head);
761 	drm_mode_destroy(connector->dev, mode);
762 }
763 
764 /**
765  * drm_display_info_set_bus_formats - set the supported bus formats
766  * @info: display info to store bus formats in
767  * @formats: array containing the supported bus formats
768  * @num_formats: the number of entries in the fmts array
769  *
770  * Store the supported bus formats in display info structure.
771  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
772  * a full list of available formats.
773  */
774 int drm_display_info_set_bus_formats(struct drm_display_info *info,
775 				     const u32 *formats,
776 				     unsigned int num_formats)
777 {
778 	u32 *fmts = NULL;
779 
780 	if (!formats && num_formats)
781 		return -EINVAL;
782 
783 	if (formats && num_formats) {
784 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
785 			       GFP_KERNEL);
786 		if (!fmts)
787 			return -ENOMEM;
788 	}
789 
790 	kfree(info->bus_formats);
791 	info->bus_formats = fmts;
792 	info->num_bus_formats = num_formats;
793 
794 	return 0;
795 }
796 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
797 
798 /**
799  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
800  * @connector: connector to quwery
801  *
802  * The kernel supports per-connector configration of its consoles through
803  * use of the video= parameter. This function parses that option and
804  * extracts the user's specified mode (or enable/disable status) for a
805  * particular connector. This is typically only used during the early fbdev
806  * setup.
807  */
808 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
809 {
810 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
811 	char *option = NULL;
812 
813 	if (fb_get_options(connector->name, &option))
814 		return;
815 
816 	if (!drm_mode_parse_command_line_for_connector(option,
817 						       connector,
818 						       mode))
819 		return;
820 
821 	if (mode->force) {
822 		const char *s;
823 
824 		switch (mode->force) {
825 		case DRM_FORCE_OFF:
826 			s = "OFF";
827 			break;
828 		case DRM_FORCE_ON_DIGITAL:
829 			s = "ON - dig";
830 			break;
831 		default:
832 		case DRM_FORCE_ON:
833 			s = "ON";
834 			break;
835 		}
836 
837 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
838 		connector->force = mode->force;
839 	}
840 
841 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
842 		      connector->name,
843 		      mode->xres, mode->yres,
844 		      mode->refresh_specified ? mode->refresh : 60,
845 		      mode->rb ? " reduced blanking" : "",
846 		      mode->margins ? " with margins" : "",
847 		      mode->interlace ?  " interlaced" : "");
848 }
849 
850 /**
851  * drm_connector_init - Init a preallocated connector
852  * @dev: DRM device
853  * @connector: the connector to init
854  * @funcs: callbacks for this connector
855  * @connector_type: user visible type of the connector
856  *
857  * Initialises a preallocated connector. Connectors should be
858  * subclassed as part of driver connector objects.
859  *
860  * Returns:
861  * Zero on success, error code on failure.
862  */
863 int drm_connector_init(struct drm_device *dev,
864 		       struct drm_connector *connector,
865 		       const struct drm_connector_funcs *funcs,
866 		       int connector_type)
867 {
868 	struct drm_mode_config *config = &dev->mode_config;
869 	int ret;
870 	struct ida *connector_ida =
871 		&drm_connector_enum_list[connector_type].ida;
872 
873 	drm_modeset_lock_all(dev);
874 
875 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
876 	if (ret)
877 		goto out_unlock;
878 
879 	connector->base.properties = &connector->properties;
880 	connector->dev = dev;
881 	connector->funcs = funcs;
882 	connector->connector_type = connector_type;
883 	connector->connector_type_id =
884 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
885 	if (connector->connector_type_id < 0) {
886 		ret = connector->connector_type_id;
887 		goto out_put;
888 	}
889 	connector->name =
890 		kasprintf(GFP_KERNEL, "%s-%d",
891 			  drm_connector_enum_list[connector_type].name,
892 			  connector->connector_type_id);
893 	if (!connector->name) {
894 		ret = -ENOMEM;
895 		goto out_put;
896 	}
897 
898 	INIT_LIST_HEAD(&connector->probed_modes);
899 	INIT_LIST_HEAD(&connector->modes);
900 	connector->edid_blob_ptr = NULL;
901 	connector->status = connector_status_unknown;
902 
903 	drm_connector_get_cmdline_mode(connector);
904 
905 	/* We should add connectors at the end to avoid upsetting the connector
906 	 * index too much. */
907 	list_add_tail(&connector->head, &config->connector_list);
908 	config->num_connector++;
909 
910 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
911 		drm_object_attach_property(&connector->base,
912 					      config->edid_property,
913 					      0);
914 
915 	drm_object_attach_property(&connector->base,
916 				      config->dpms_property, 0);
917 
918 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
919 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
920 	}
921 
922 	connector->debugfs_entry = NULL;
923 
924 out_put:
925 	if (ret)
926 		drm_mode_object_put(dev, &connector->base);
927 
928 out_unlock:
929 	drm_modeset_unlock_all(dev);
930 
931 	return ret;
932 }
933 EXPORT_SYMBOL(drm_connector_init);
934 
935 /**
936  * drm_connector_cleanup - cleans up an initialised connector
937  * @connector: connector to cleanup
938  *
939  * Cleans up the connector but doesn't free the object.
940  */
941 void drm_connector_cleanup(struct drm_connector *connector)
942 {
943 	struct drm_device *dev = connector->dev;
944 	struct drm_display_mode *mode, *t;
945 
946 	if (connector->tile_group) {
947 		drm_mode_put_tile_group(dev, connector->tile_group);
948 		connector->tile_group = NULL;
949 	}
950 
951 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
952 		drm_mode_remove(connector, mode);
953 
954 	list_for_each_entry_safe(mode, t, &connector->modes, head)
955 		drm_mode_remove(connector, mode);
956 
957 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
958 		   connector->connector_type_id);
959 
960 	kfree(connector->display_info.bus_formats);
961 	drm_mode_object_put(dev, &connector->base);
962 	kfree(connector->name);
963 	connector->name = NULL;
964 	list_del(&connector->head);
965 	dev->mode_config.num_connector--;
966 
967 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
968 	if (connector->state && connector->funcs->atomic_destroy_state)
969 		connector->funcs->atomic_destroy_state(connector,
970 						       connector->state);
971 
972 	memset(connector, 0, sizeof(*connector));
973 }
974 EXPORT_SYMBOL(drm_connector_cleanup);
975 
976 /**
977  * drm_connector_index - find the index of a registered connector
978  * @connector: connector to find index for
979  *
980  * Given a registered connector, return the index of that connector within a DRM
981  * device's list of connectors.
982  */
983 unsigned int drm_connector_index(struct drm_connector *connector)
984 {
985 	unsigned int index = 0;
986 	struct drm_connector *tmp;
987 	struct drm_mode_config *config = &connector->dev->mode_config;
988 
989 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
990 
991 	drm_for_each_connector(tmp, connector->dev) {
992 		if (tmp == connector)
993 			return index;
994 
995 		index++;
996 	}
997 
998 	BUG();
999 }
1000 EXPORT_SYMBOL(drm_connector_index);
1001 
1002 /**
1003  * drm_connector_register - register a connector
1004  * @connector: the connector to register
1005  *
1006  * Register userspace interfaces for a connector
1007  *
1008  * Returns:
1009  * Zero on success, error code on failure.
1010  */
1011 int drm_connector_register(struct drm_connector *connector)
1012 {
1013 	int ret;
1014 
1015 	drm_mode_object_register(connector->dev, &connector->base);
1016 
1017 	ret = drm_sysfs_connector_add(connector);
1018 	if (ret)
1019 		return ret;
1020 
1021 	ret = drm_debugfs_connector_add(connector);
1022 	if (ret) {
1023 		drm_sysfs_connector_remove(connector);
1024 		return ret;
1025 	}
1026 
1027 	return 0;
1028 }
1029 EXPORT_SYMBOL(drm_connector_register);
1030 
1031 /**
1032  * drm_connector_unregister - unregister a connector
1033  * @connector: the connector to unregister
1034  *
1035  * Unregister userspace interfaces for a connector
1036  */
1037 void drm_connector_unregister(struct drm_connector *connector)
1038 {
1039 	drm_sysfs_connector_remove(connector);
1040 	drm_debugfs_connector_remove(connector);
1041 }
1042 EXPORT_SYMBOL(drm_connector_unregister);
1043 
1044 
1045 /**
1046  * drm_connector_unplug_all - unregister connector userspace interfaces
1047  * @dev: drm device
1048  *
1049  * This function unregisters all connector userspace interfaces in sysfs. Should
1050  * be call when the device is disconnected, e.g. from an usb driver's
1051  * ->disconnect callback.
1052  */
1053 void drm_connector_unplug_all(struct drm_device *dev)
1054 {
1055 	struct drm_connector *connector;
1056 
1057 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1058 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1059 		drm_connector_unregister(connector);
1060 
1061 }
1062 EXPORT_SYMBOL(drm_connector_unplug_all);
1063 
1064 /**
1065  * drm_encoder_init - Init a preallocated encoder
1066  * @dev: drm device
1067  * @encoder: the encoder to init
1068  * @funcs: callbacks for this encoder
1069  * @encoder_type: user visible type of the encoder
1070  *
1071  * Initialises a preallocated encoder. Encoder should be
1072  * subclassed as part of driver encoder objects.
1073  *
1074  * Returns:
1075  * Zero on success, error code on failure.
1076  */
1077 int drm_encoder_init(struct drm_device *dev,
1078 		      struct drm_encoder *encoder,
1079 		      const struct drm_encoder_funcs *funcs,
1080 		      int encoder_type)
1081 {
1082 	int ret;
1083 
1084 	drm_modeset_lock_all(dev);
1085 
1086 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1087 	if (ret)
1088 		goto out_unlock;
1089 
1090 	encoder->dev = dev;
1091 	encoder->encoder_type = encoder_type;
1092 	encoder->funcs = funcs;
1093 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1094 				  drm_encoder_enum_list[encoder_type].name,
1095 				  encoder->base.id);
1096 	if (!encoder->name) {
1097 		ret = -ENOMEM;
1098 		goto out_put;
1099 	}
1100 
1101 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1102 	dev->mode_config.num_encoder++;
1103 
1104 out_put:
1105 	if (ret)
1106 		drm_mode_object_put(dev, &encoder->base);
1107 
1108 out_unlock:
1109 	drm_modeset_unlock_all(dev);
1110 
1111 	return ret;
1112 }
1113 EXPORT_SYMBOL(drm_encoder_init);
1114 
1115 /**
1116  * drm_encoder_cleanup - cleans up an initialised encoder
1117  * @encoder: encoder to cleanup
1118  *
1119  * Cleans up the encoder but doesn't free the object.
1120  */
1121 void drm_encoder_cleanup(struct drm_encoder *encoder)
1122 {
1123 	struct drm_device *dev = encoder->dev;
1124 
1125 	drm_modeset_lock_all(dev);
1126 	drm_mode_object_put(dev, &encoder->base);
1127 	kfree(encoder->name);
1128 	list_del(&encoder->head);
1129 	dev->mode_config.num_encoder--;
1130 	drm_modeset_unlock_all(dev);
1131 
1132 	memset(encoder, 0, sizeof(*encoder));
1133 }
1134 EXPORT_SYMBOL(drm_encoder_cleanup);
1135 
1136 /**
1137  * drm_universal_plane_init - Initialize a new universal plane object
1138  * @dev: DRM device
1139  * @plane: plane object to init
1140  * @possible_crtcs: bitmask of possible CRTCs
1141  * @funcs: callbacks for the new plane
1142  * @formats: array of supported formats (%DRM_FORMAT_*)
1143  * @format_count: number of elements in @formats
1144  * @type: type of plane (overlay, primary, cursor)
1145  *
1146  * Initializes a plane object of type @type.
1147  *
1148  * Returns:
1149  * Zero on success, error code on failure.
1150  */
1151 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1152 			     unsigned long possible_crtcs,
1153 			     const struct drm_plane_funcs *funcs,
1154 			     const uint32_t *formats, unsigned int format_count,
1155 			     enum drm_plane_type type)
1156 {
1157 	struct drm_mode_config *config = &dev->mode_config;
1158 	int ret;
1159 
1160 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1161 	if (ret)
1162 		return ret;
1163 
1164 	drm_modeset_lock_init(&plane->mutex);
1165 
1166 	plane->base.properties = &plane->properties;
1167 	plane->dev = dev;
1168 	plane->funcs = funcs;
1169 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1170 					    GFP_KERNEL);
1171 	if (!plane->format_types) {
1172 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1173 		drm_mode_object_put(dev, &plane->base);
1174 		return -ENOMEM;
1175 	}
1176 
1177 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1178 	plane->format_count = format_count;
1179 	plane->possible_crtcs = possible_crtcs;
1180 	plane->type = type;
1181 
1182 	list_add_tail(&plane->head, &config->plane_list);
1183 	config->num_total_plane++;
1184 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1185 		config->num_overlay_plane++;
1186 
1187 	drm_object_attach_property(&plane->base,
1188 				   config->plane_type_property,
1189 				   plane->type);
1190 
1191 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1192 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1193 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1194 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1195 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1196 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1197 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1198 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1199 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1200 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1201 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1202 	}
1203 
1204 	return 0;
1205 }
1206 EXPORT_SYMBOL(drm_universal_plane_init);
1207 
1208 /**
1209  * drm_plane_init - Initialize a legacy plane
1210  * @dev: DRM device
1211  * @plane: plane object to init
1212  * @possible_crtcs: bitmask of possible CRTCs
1213  * @funcs: callbacks for the new plane
1214  * @formats: array of supported formats (%DRM_FORMAT_*)
1215  * @format_count: number of elements in @formats
1216  * @is_primary: plane type (primary vs overlay)
1217  *
1218  * Legacy API to initialize a DRM plane.
1219  *
1220  * New drivers should call drm_universal_plane_init() instead.
1221  *
1222  * Returns:
1223  * Zero on success, error code on failure.
1224  */
1225 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1226 		   unsigned long possible_crtcs,
1227 		   const struct drm_plane_funcs *funcs,
1228 		   const uint32_t *formats, unsigned int format_count,
1229 		   bool is_primary)
1230 {
1231 	enum drm_plane_type type;
1232 
1233 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1234 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1235 					formats, format_count, type);
1236 }
1237 EXPORT_SYMBOL(drm_plane_init);
1238 
1239 /**
1240  * drm_plane_cleanup - Clean up the core plane usage
1241  * @plane: plane to cleanup
1242  *
1243  * This function cleans up @plane and removes it from the DRM mode setting
1244  * core. Note that the function does *not* free the plane structure itself,
1245  * this is the responsibility of the caller.
1246  */
1247 void drm_plane_cleanup(struct drm_plane *plane)
1248 {
1249 	struct drm_device *dev = plane->dev;
1250 
1251 	drm_modeset_lock_all(dev);
1252 	kfree(plane->format_types);
1253 	drm_mode_object_put(dev, &plane->base);
1254 
1255 	BUG_ON(list_empty(&plane->head));
1256 
1257 	list_del(&plane->head);
1258 	dev->mode_config.num_total_plane--;
1259 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1260 		dev->mode_config.num_overlay_plane--;
1261 	drm_modeset_unlock_all(dev);
1262 
1263 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1264 	if (plane->state && plane->funcs->atomic_destroy_state)
1265 		plane->funcs->atomic_destroy_state(plane, plane->state);
1266 
1267 	memset(plane, 0, sizeof(*plane));
1268 }
1269 EXPORT_SYMBOL(drm_plane_cleanup);
1270 
1271 /**
1272  * drm_plane_index - find the index of a registered plane
1273  * @plane: plane to find index for
1274  *
1275  * Given a registered plane, return the index of that CRTC within a DRM
1276  * device's list of planes.
1277  */
1278 unsigned int drm_plane_index(struct drm_plane *plane)
1279 {
1280 	unsigned int index = 0;
1281 	struct drm_plane *tmp;
1282 
1283 	drm_for_each_plane(tmp, plane->dev) {
1284 		if (tmp == plane)
1285 			return index;
1286 
1287 		index++;
1288 	}
1289 
1290 	BUG();
1291 }
1292 EXPORT_SYMBOL(drm_plane_index);
1293 
1294 /**
1295  * drm_plane_from_index - find the registered plane at an index
1296  * @dev: DRM device
1297  * @idx: index of registered plane to find for
1298  *
1299  * Given a plane index, return the registered plane from DRM device's
1300  * list of planes with matching index.
1301  */
1302 struct drm_plane *
1303 drm_plane_from_index(struct drm_device *dev, int idx)
1304 {
1305 	struct drm_plane *plane;
1306 	unsigned int i = 0;
1307 
1308 	drm_for_each_plane(plane, dev) {
1309 		if (i == idx)
1310 			return plane;
1311 		i++;
1312 	}
1313 	return NULL;
1314 }
1315 EXPORT_SYMBOL(drm_plane_from_index);
1316 
1317 /**
1318  * drm_plane_force_disable - Forcibly disable a plane
1319  * @plane: plane to disable
1320  *
1321  * Forces the plane to be disabled.
1322  *
1323  * Used when the plane's current framebuffer is destroyed,
1324  * and when restoring fbdev mode.
1325  */
1326 void drm_plane_force_disable(struct drm_plane *plane)
1327 {
1328 	int ret;
1329 
1330 	if (!plane->fb)
1331 		return;
1332 
1333 	plane->old_fb = plane->fb;
1334 	ret = plane->funcs->disable_plane(plane);
1335 	if (ret) {
1336 		DRM_ERROR("failed to disable plane with busy fb\n");
1337 		plane->old_fb = NULL;
1338 		return;
1339 	}
1340 	/* disconnect the plane from the fb and crtc: */
1341 	drm_framebuffer_unreference(plane->old_fb);
1342 	plane->old_fb = NULL;
1343 	plane->fb = NULL;
1344 	plane->crtc = NULL;
1345 }
1346 EXPORT_SYMBOL(drm_plane_force_disable);
1347 
1348 static int drm_mode_create_standard_properties(struct drm_device *dev)
1349 {
1350 	struct drm_property *prop;
1351 
1352 	/*
1353 	 * Standard properties (apply to all connectors)
1354 	 */
1355 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1356 				   DRM_MODE_PROP_IMMUTABLE,
1357 				   "EDID", 0);
1358 	if (!prop)
1359 		return -ENOMEM;
1360 	dev->mode_config.edid_property = prop;
1361 
1362 	prop = drm_property_create_enum(dev, 0,
1363 				   "DPMS", drm_dpms_enum_list,
1364 				   ARRAY_SIZE(drm_dpms_enum_list));
1365 	if (!prop)
1366 		return -ENOMEM;
1367 	dev->mode_config.dpms_property = prop;
1368 
1369 	prop = drm_property_create(dev,
1370 				   DRM_MODE_PROP_BLOB |
1371 				   DRM_MODE_PROP_IMMUTABLE,
1372 				   "PATH", 0);
1373 	if (!prop)
1374 		return -ENOMEM;
1375 	dev->mode_config.path_property = prop;
1376 
1377 	prop = drm_property_create(dev,
1378 				   DRM_MODE_PROP_BLOB |
1379 				   DRM_MODE_PROP_IMMUTABLE,
1380 				   "TILE", 0);
1381 	if (!prop)
1382 		return -ENOMEM;
1383 	dev->mode_config.tile_property = prop;
1384 
1385 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1386 					"type", drm_plane_type_enum_list,
1387 					ARRAY_SIZE(drm_plane_type_enum_list));
1388 	if (!prop)
1389 		return -ENOMEM;
1390 	dev->mode_config.plane_type_property = prop;
1391 
1392 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1393 			"SRC_X", 0, UINT_MAX);
1394 	if (!prop)
1395 		return -ENOMEM;
1396 	dev->mode_config.prop_src_x = prop;
1397 
1398 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1399 			"SRC_Y", 0, UINT_MAX);
1400 	if (!prop)
1401 		return -ENOMEM;
1402 	dev->mode_config.prop_src_y = prop;
1403 
1404 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1405 			"SRC_W", 0, UINT_MAX);
1406 	if (!prop)
1407 		return -ENOMEM;
1408 	dev->mode_config.prop_src_w = prop;
1409 
1410 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1411 			"SRC_H", 0, UINT_MAX);
1412 	if (!prop)
1413 		return -ENOMEM;
1414 	dev->mode_config.prop_src_h = prop;
1415 
1416 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1417 			"CRTC_X", INT_MIN, INT_MAX);
1418 	if (!prop)
1419 		return -ENOMEM;
1420 	dev->mode_config.prop_crtc_x = prop;
1421 
1422 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1423 			"CRTC_Y", INT_MIN, INT_MAX);
1424 	if (!prop)
1425 		return -ENOMEM;
1426 	dev->mode_config.prop_crtc_y = prop;
1427 
1428 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1429 			"CRTC_W", 0, INT_MAX);
1430 	if (!prop)
1431 		return -ENOMEM;
1432 	dev->mode_config.prop_crtc_w = prop;
1433 
1434 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1435 			"CRTC_H", 0, INT_MAX);
1436 	if (!prop)
1437 		return -ENOMEM;
1438 	dev->mode_config.prop_crtc_h = prop;
1439 
1440 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1441 			"FB_ID", DRM_MODE_OBJECT_FB);
1442 	if (!prop)
1443 		return -ENOMEM;
1444 	dev->mode_config.prop_fb_id = prop;
1445 
1446 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1447 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1448 	if (!prop)
1449 		return -ENOMEM;
1450 	dev->mode_config.prop_crtc_id = prop;
1451 
1452 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1453 			"ACTIVE");
1454 	if (!prop)
1455 		return -ENOMEM;
1456 	dev->mode_config.prop_active = prop;
1457 
1458 	prop = drm_property_create(dev,
1459 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1460 			"MODE_ID", 0);
1461 	if (!prop)
1462 		return -ENOMEM;
1463 	dev->mode_config.prop_mode_id = prop;
1464 
1465 	return 0;
1466 }
1467 
1468 /**
1469  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1470  * @dev: DRM device
1471  *
1472  * Called by a driver the first time a DVI-I connector is made.
1473  */
1474 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1475 {
1476 	struct drm_property *dvi_i_selector;
1477 	struct drm_property *dvi_i_subconnector;
1478 
1479 	if (dev->mode_config.dvi_i_select_subconnector_property)
1480 		return 0;
1481 
1482 	dvi_i_selector =
1483 		drm_property_create_enum(dev, 0,
1484 				    "select subconnector",
1485 				    drm_dvi_i_select_enum_list,
1486 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1487 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1488 
1489 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1490 				    "subconnector",
1491 				    drm_dvi_i_subconnector_enum_list,
1492 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1493 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1494 
1495 	return 0;
1496 }
1497 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1498 
1499 /**
1500  * drm_create_tv_properties - create TV specific connector properties
1501  * @dev: DRM device
1502  * @num_modes: number of different TV formats (modes) supported
1503  * @modes: array of pointers to strings containing name of each format
1504  *
1505  * Called by a driver's TV initialization routine, this function creates
1506  * the TV specific connector properties for a given device.  Caller is
1507  * responsible for allocating a list of format names and passing them to
1508  * this routine.
1509  */
1510 int drm_mode_create_tv_properties(struct drm_device *dev,
1511 				  unsigned int num_modes,
1512 				  char *modes[])
1513 {
1514 	struct drm_property *tv_selector;
1515 	struct drm_property *tv_subconnector;
1516 	unsigned int i;
1517 
1518 	if (dev->mode_config.tv_select_subconnector_property)
1519 		return 0;
1520 
1521 	/*
1522 	 * Basic connector properties
1523 	 */
1524 	tv_selector = drm_property_create_enum(dev, 0,
1525 					  "select subconnector",
1526 					  drm_tv_select_enum_list,
1527 					  ARRAY_SIZE(drm_tv_select_enum_list));
1528 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1529 
1530 	tv_subconnector =
1531 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1532 				    "subconnector",
1533 				    drm_tv_subconnector_enum_list,
1534 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1535 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1536 
1537 	/*
1538 	 * Other, TV specific properties: margins & TV modes.
1539 	 */
1540 	dev->mode_config.tv_left_margin_property =
1541 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1542 
1543 	dev->mode_config.tv_right_margin_property =
1544 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1545 
1546 	dev->mode_config.tv_top_margin_property =
1547 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1548 
1549 	dev->mode_config.tv_bottom_margin_property =
1550 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1551 
1552 	dev->mode_config.tv_mode_property =
1553 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1554 				    "mode", num_modes);
1555 	for (i = 0; i < num_modes; i++)
1556 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1557 				      i, modes[i]);
1558 
1559 	dev->mode_config.tv_brightness_property =
1560 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1561 
1562 	dev->mode_config.tv_contrast_property =
1563 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1564 
1565 	dev->mode_config.tv_flicker_reduction_property =
1566 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1567 
1568 	dev->mode_config.tv_overscan_property =
1569 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1570 
1571 	dev->mode_config.tv_saturation_property =
1572 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1573 
1574 	dev->mode_config.tv_hue_property =
1575 		drm_property_create_range(dev, 0, "hue", 0, 100);
1576 
1577 	return 0;
1578 }
1579 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1580 
1581 /**
1582  * drm_mode_create_scaling_mode_property - create scaling mode property
1583  * @dev: DRM device
1584  *
1585  * Called by a driver the first time it's needed, must be attached to desired
1586  * connectors.
1587  */
1588 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1589 {
1590 	struct drm_property *scaling_mode;
1591 
1592 	if (dev->mode_config.scaling_mode_property)
1593 		return 0;
1594 
1595 	scaling_mode =
1596 		drm_property_create_enum(dev, 0, "scaling mode",
1597 				drm_scaling_mode_enum_list,
1598 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1599 
1600 	dev->mode_config.scaling_mode_property = scaling_mode;
1601 
1602 	return 0;
1603 }
1604 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1605 
1606 /**
1607  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1608  * @dev: DRM device
1609  *
1610  * Called by a driver the first time it's needed, must be attached to desired
1611  * connectors.
1612  *
1613  * Returns:
1614  * Zero on success, negative errno on failure.
1615  */
1616 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1617 {
1618 	if (dev->mode_config.aspect_ratio_property)
1619 		return 0;
1620 
1621 	dev->mode_config.aspect_ratio_property =
1622 		drm_property_create_enum(dev, 0, "aspect ratio",
1623 				drm_aspect_ratio_enum_list,
1624 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1625 
1626 	if (dev->mode_config.aspect_ratio_property == NULL)
1627 		return -ENOMEM;
1628 
1629 	return 0;
1630 }
1631 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1632 
1633 /**
1634  * drm_mode_create_dirty_property - create dirty property
1635  * @dev: DRM device
1636  *
1637  * Called by a driver the first time it's needed, must be attached to desired
1638  * connectors.
1639  */
1640 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1641 {
1642 	struct drm_property *dirty_info;
1643 
1644 	if (dev->mode_config.dirty_info_property)
1645 		return 0;
1646 
1647 	dirty_info =
1648 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1649 				    "dirty",
1650 				    drm_dirty_info_enum_list,
1651 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1652 	dev->mode_config.dirty_info_property = dirty_info;
1653 
1654 	return 0;
1655 }
1656 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1657 
1658 /**
1659  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1660  * @dev: DRM device
1661  *
1662  * Create the the suggested x/y offset property for connectors.
1663  */
1664 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1665 {
1666 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1667 		return 0;
1668 
1669 	dev->mode_config.suggested_x_property =
1670 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1671 
1672 	dev->mode_config.suggested_y_property =
1673 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1674 
1675 	if (dev->mode_config.suggested_x_property == NULL ||
1676 	    dev->mode_config.suggested_y_property == NULL)
1677 		return -ENOMEM;
1678 	return 0;
1679 }
1680 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1681 
1682 /**
1683  * drm_mode_getresources - get graphics configuration
1684  * @dev: drm device for the ioctl
1685  * @data: data pointer for the ioctl
1686  * @file_priv: drm file for the ioctl call
1687  *
1688  * Construct a set of configuration description structures and return
1689  * them to the user, including CRTC, connector and framebuffer configuration.
1690  *
1691  * Called by the user via ioctl.
1692  *
1693  * Returns:
1694  * Zero on success, negative errno on failure.
1695  */
1696 int drm_mode_getresources(struct drm_device *dev, void *data,
1697 			  struct drm_file *file_priv)
1698 {
1699 	struct drm_mode_card_res *card_res = data;
1700 	struct list_head *lh;
1701 	struct drm_framebuffer *fb;
1702 	struct drm_connector *connector;
1703 	struct drm_crtc *crtc;
1704 	struct drm_encoder *encoder;
1705 	int ret = 0;
1706 	int connector_count = 0;
1707 	int crtc_count = 0;
1708 	int fb_count = 0;
1709 	int encoder_count = 0;
1710 	int copied = 0;
1711 	uint32_t __user *fb_id;
1712 	uint32_t __user *crtc_id;
1713 	uint32_t __user *connector_id;
1714 	uint32_t __user *encoder_id;
1715 
1716 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1717 		return -EINVAL;
1718 
1719 
1720 	mutex_lock(&file_priv->fbs_lock);
1721 	/*
1722 	 * For the non-control nodes we need to limit the list of resources
1723 	 * by IDs in the group list for this node
1724 	 */
1725 	list_for_each(lh, &file_priv->fbs)
1726 		fb_count++;
1727 
1728 	/* handle this in 4 parts */
1729 	/* FBs */
1730 	if (card_res->count_fbs >= fb_count) {
1731 		copied = 0;
1732 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1733 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1734 			if (put_user(fb->base.id, fb_id + copied)) {
1735 				mutex_unlock(&file_priv->fbs_lock);
1736 				return -EFAULT;
1737 			}
1738 			copied++;
1739 		}
1740 	}
1741 	card_res->count_fbs = fb_count;
1742 	mutex_unlock(&file_priv->fbs_lock);
1743 
1744 	/* mode_config.mutex protects the connector list against e.g. DP MST
1745 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1746 	mutex_lock(&dev->mode_config.mutex);
1747 	drm_for_each_crtc(crtc, dev)
1748 		crtc_count++;
1749 
1750 	drm_for_each_connector(connector, dev)
1751 		connector_count++;
1752 
1753 	drm_for_each_encoder(encoder, dev)
1754 		encoder_count++;
1755 
1756 	card_res->max_height = dev->mode_config.max_height;
1757 	card_res->min_height = dev->mode_config.min_height;
1758 	card_res->max_width = dev->mode_config.max_width;
1759 	card_res->min_width = dev->mode_config.min_width;
1760 
1761 	/* CRTCs */
1762 	if (card_res->count_crtcs >= crtc_count) {
1763 		copied = 0;
1764 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1765 		drm_for_each_crtc(crtc, dev) {
1766 			DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1767 			if (put_user(crtc->base.id, crtc_id + copied)) {
1768 				ret = -EFAULT;
1769 				goto out;
1770 			}
1771 			copied++;
1772 		}
1773 	}
1774 	card_res->count_crtcs = crtc_count;
1775 
1776 	/* Encoders */
1777 	if (card_res->count_encoders >= encoder_count) {
1778 		copied = 0;
1779 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1780 		drm_for_each_encoder(encoder, dev) {
1781 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1782 					encoder->name);
1783 			if (put_user(encoder->base.id, encoder_id +
1784 				     copied)) {
1785 				ret = -EFAULT;
1786 				goto out;
1787 			}
1788 			copied++;
1789 		}
1790 	}
1791 	card_res->count_encoders = encoder_count;
1792 
1793 	/* Connectors */
1794 	if (card_res->count_connectors >= connector_count) {
1795 		copied = 0;
1796 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1797 		drm_for_each_connector(connector, dev) {
1798 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1799 				connector->base.id,
1800 				connector->name);
1801 			if (put_user(connector->base.id,
1802 				     connector_id + copied)) {
1803 				ret = -EFAULT;
1804 				goto out;
1805 			}
1806 			copied++;
1807 		}
1808 	}
1809 	card_res->count_connectors = connector_count;
1810 
1811 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1812 		  card_res->count_connectors, card_res->count_encoders);
1813 
1814 out:
1815 	mutex_unlock(&dev->mode_config.mutex);
1816 	return ret;
1817 }
1818 
1819 /**
1820  * drm_mode_getcrtc - get CRTC configuration
1821  * @dev: drm device for the ioctl
1822  * @data: data pointer for the ioctl
1823  * @file_priv: drm file for the ioctl call
1824  *
1825  * Construct a CRTC configuration structure to return to the user.
1826  *
1827  * Called by the user via ioctl.
1828  *
1829  * Returns:
1830  * Zero on success, negative errno on failure.
1831  */
1832 int drm_mode_getcrtc(struct drm_device *dev,
1833 		     void *data, struct drm_file *file_priv)
1834 {
1835 	struct drm_mode_crtc *crtc_resp = data;
1836 	struct drm_crtc *crtc;
1837 
1838 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1839 		return -EINVAL;
1840 
1841 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1842 	if (!crtc)
1843 		return -ENOENT;
1844 
1845 	drm_modeset_lock_crtc(crtc, crtc->primary);
1846 	crtc_resp->gamma_size = crtc->gamma_size;
1847 	if (crtc->primary->fb)
1848 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1849 	else
1850 		crtc_resp->fb_id = 0;
1851 
1852 	if (crtc->state) {
1853 		crtc_resp->x = crtc->primary->state->src_x >> 16;
1854 		crtc_resp->y = crtc->primary->state->src_y >> 16;
1855 		if (crtc->state->enable) {
1856 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
1857 			crtc_resp->mode_valid = 1;
1858 
1859 		} else {
1860 			crtc_resp->mode_valid = 0;
1861 		}
1862 	} else {
1863 		crtc_resp->x = crtc->x;
1864 		crtc_resp->y = crtc->y;
1865 		if (crtc->enabled) {
1866 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1867 			crtc_resp->mode_valid = 1;
1868 
1869 		} else {
1870 			crtc_resp->mode_valid = 0;
1871 		}
1872 	}
1873 	drm_modeset_unlock_crtc(crtc);
1874 
1875 	return 0;
1876 }
1877 
1878 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1879 					 const struct drm_file *file_priv)
1880 {
1881 	/*
1882 	 * If user-space hasn't configured the driver to expose the stereo 3D
1883 	 * modes, don't expose them.
1884 	 */
1885 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1886 		return false;
1887 
1888 	return true;
1889 }
1890 
1891 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
1892 {
1893 	/* For atomic drivers only state objects are synchronously updated and
1894 	 * protected by modeset locks, so check those first. */
1895 	if (connector->state)
1896 		return connector->state->best_encoder;
1897 	return connector->encoder;
1898 }
1899 
1900 /* helper for getconnector and getproperties ioctls */
1901 static int get_properties(struct drm_mode_object *obj, bool atomic,
1902 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
1903 		uint32_t *arg_count_props)
1904 {
1905 	int props_count;
1906 	int i, ret, copied;
1907 
1908 	props_count = obj->properties->count;
1909 	if (!atomic)
1910 		props_count -= obj->properties->atomic_count;
1911 
1912 	if ((*arg_count_props >= props_count) && props_count) {
1913 		for (i = 0, copied = 0; copied < props_count; i++) {
1914 			struct drm_property *prop = obj->properties->properties[i];
1915 			uint64_t val;
1916 
1917 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
1918 				continue;
1919 
1920 			ret = drm_object_property_get_value(obj, prop, &val);
1921 			if (ret)
1922 				return ret;
1923 
1924 			if (put_user(prop->base.id, prop_ptr + copied))
1925 				return -EFAULT;
1926 
1927 			if (put_user(val, prop_values + copied))
1928 				return -EFAULT;
1929 
1930 			copied++;
1931 		}
1932 	}
1933 	*arg_count_props = props_count;
1934 
1935 	return 0;
1936 }
1937 
1938 /**
1939  * drm_mode_getconnector - get connector configuration
1940  * @dev: drm device for the ioctl
1941  * @data: data pointer for the ioctl
1942  * @file_priv: drm file for the ioctl call
1943  *
1944  * Construct a connector configuration structure to return to the user.
1945  *
1946  * Called by the user via ioctl.
1947  *
1948  * Returns:
1949  * Zero on success, negative errno on failure.
1950  */
1951 int drm_mode_getconnector(struct drm_device *dev, void *data,
1952 			  struct drm_file *file_priv)
1953 {
1954 	struct drm_mode_get_connector *out_resp = data;
1955 	struct drm_connector *connector;
1956 	struct drm_encoder *encoder;
1957 	struct drm_display_mode *mode;
1958 	int mode_count = 0;
1959 	int encoders_count = 0;
1960 	int ret = 0;
1961 	int copied = 0;
1962 	int i;
1963 	struct drm_mode_modeinfo u_mode;
1964 	struct drm_mode_modeinfo __user *mode_ptr;
1965 	uint32_t __user *encoder_ptr;
1966 
1967 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1968 		return -EINVAL;
1969 
1970 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
1971 
1972 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
1973 
1974 	mutex_lock(&dev->mode_config.mutex);
1975 
1976 	connector = drm_connector_find(dev, out_resp->connector_id);
1977 	if (!connector) {
1978 		ret = -ENOENT;
1979 		goto out_unlock;
1980 	}
1981 
1982 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
1983 		if (connector->encoder_ids[i] != 0)
1984 			encoders_count++;
1985 
1986 	if (out_resp->count_modes == 0) {
1987 		connector->funcs->fill_modes(connector,
1988 					     dev->mode_config.max_width,
1989 					     dev->mode_config.max_height);
1990 	}
1991 
1992 	/* delayed so we get modes regardless of pre-fill_modes state */
1993 	list_for_each_entry(mode, &connector->modes, head)
1994 		if (drm_mode_expose_to_userspace(mode, file_priv))
1995 			mode_count++;
1996 
1997 	out_resp->connector_id = connector->base.id;
1998 	out_resp->connector_type = connector->connector_type;
1999 	out_resp->connector_type_id = connector->connector_type_id;
2000 	out_resp->mm_width = connector->display_info.width_mm;
2001 	out_resp->mm_height = connector->display_info.height_mm;
2002 	out_resp->subpixel = connector->display_info.subpixel_order;
2003 	out_resp->connection = connector->status;
2004 
2005 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2006 	encoder = drm_connector_get_encoder(connector);
2007 	if (encoder)
2008 		out_resp->encoder_id = encoder->base.id;
2009 	else
2010 		out_resp->encoder_id = 0;
2011 
2012 	/*
2013 	 * This ioctl is called twice, once to determine how much space is
2014 	 * needed, and the 2nd time to fill it.
2015 	 */
2016 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2017 		copied = 0;
2018 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2019 		list_for_each_entry(mode, &connector->modes, head) {
2020 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2021 				continue;
2022 
2023 			drm_mode_convert_to_umode(&u_mode, mode);
2024 			if (copy_to_user(mode_ptr + copied,
2025 					 &u_mode, sizeof(u_mode))) {
2026 				ret = -EFAULT;
2027 				goto out;
2028 			}
2029 			copied++;
2030 		}
2031 	}
2032 	out_resp->count_modes = mode_count;
2033 
2034 	ret = get_properties(&connector->base, file_priv->atomic,
2035 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2036 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2037 			&out_resp->count_props);
2038 	if (ret)
2039 		goto out;
2040 
2041 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2042 		copied = 0;
2043 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2044 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2045 			if (connector->encoder_ids[i] != 0) {
2046 				if (put_user(connector->encoder_ids[i],
2047 					     encoder_ptr + copied)) {
2048 					ret = -EFAULT;
2049 					goto out;
2050 				}
2051 				copied++;
2052 			}
2053 		}
2054 	}
2055 	out_resp->count_encoders = encoders_count;
2056 
2057 out:
2058 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2059 
2060 out_unlock:
2061 	mutex_unlock(&dev->mode_config.mutex);
2062 
2063 	return ret;
2064 }
2065 
2066 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2067 {
2068 	struct drm_connector *connector;
2069 	struct drm_device *dev = encoder->dev;
2070 	bool uses_atomic = false;
2071 
2072 	/* For atomic drivers only state objects are synchronously updated and
2073 	 * protected by modeset locks, so check those first. */
2074 	drm_for_each_connector(connector, dev) {
2075 		if (!connector->state)
2076 			continue;
2077 
2078 		uses_atomic = true;
2079 
2080 		if (connector->state->best_encoder != encoder)
2081 			continue;
2082 
2083 		return connector->state->crtc;
2084 	}
2085 
2086 	/* Don't return stale data (e.g. pending async disable). */
2087 	if (uses_atomic)
2088 		return NULL;
2089 
2090 	return encoder->crtc;
2091 }
2092 
2093 /**
2094  * drm_mode_getencoder - get encoder configuration
2095  * @dev: drm device for the ioctl
2096  * @data: data pointer for the ioctl
2097  * @file_priv: drm file for the ioctl call
2098  *
2099  * Construct a encoder configuration structure to return to the user.
2100  *
2101  * Called by the user via ioctl.
2102  *
2103  * Returns:
2104  * Zero on success, negative errno on failure.
2105  */
2106 int drm_mode_getencoder(struct drm_device *dev, void *data,
2107 			struct drm_file *file_priv)
2108 {
2109 	struct drm_mode_get_encoder *enc_resp = data;
2110 	struct drm_encoder *encoder;
2111 	struct drm_crtc *crtc;
2112 
2113 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2114 		return -EINVAL;
2115 
2116 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2117 	if (!encoder)
2118 		return -ENOENT;
2119 
2120 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2121 	crtc = drm_encoder_get_crtc(encoder);
2122 	if (crtc)
2123 		enc_resp->crtc_id = crtc->base.id;
2124 	else
2125 		enc_resp->crtc_id = 0;
2126 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2127 
2128 	enc_resp->encoder_type = encoder->encoder_type;
2129 	enc_resp->encoder_id = encoder->base.id;
2130 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2131 	enc_resp->possible_clones = encoder->possible_clones;
2132 
2133 	return 0;
2134 }
2135 
2136 /**
2137  * drm_mode_getplane_res - enumerate all plane resources
2138  * @dev: DRM device
2139  * @data: ioctl data
2140  * @file_priv: DRM file info
2141  *
2142  * Construct a list of plane ids to return to the user.
2143  *
2144  * Called by the user via ioctl.
2145  *
2146  * Returns:
2147  * Zero on success, negative errno on failure.
2148  */
2149 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2150 			  struct drm_file *file_priv)
2151 {
2152 	struct drm_mode_get_plane_res *plane_resp = data;
2153 	struct drm_mode_config *config;
2154 	struct drm_plane *plane;
2155 	uint32_t __user *plane_ptr;
2156 	int copied = 0;
2157 	unsigned num_planes;
2158 
2159 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2160 		return -EINVAL;
2161 
2162 	config = &dev->mode_config;
2163 
2164 	if (file_priv->universal_planes)
2165 		num_planes = config->num_total_plane;
2166 	else
2167 		num_planes = config->num_overlay_plane;
2168 
2169 	/*
2170 	 * This ioctl is called twice, once to determine how much space is
2171 	 * needed, and the 2nd time to fill it.
2172 	 */
2173 	if (num_planes &&
2174 	    (plane_resp->count_planes >= num_planes)) {
2175 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2176 
2177 		/* Plane lists are invariant, no locking needed. */
2178 		drm_for_each_plane(plane, dev) {
2179 			/*
2180 			 * Unless userspace set the 'universal planes'
2181 			 * capability bit, only advertise overlays.
2182 			 */
2183 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2184 			    !file_priv->universal_planes)
2185 				continue;
2186 
2187 			if (put_user(plane->base.id, plane_ptr + copied))
2188 				return -EFAULT;
2189 			copied++;
2190 		}
2191 	}
2192 	plane_resp->count_planes = num_planes;
2193 
2194 	return 0;
2195 }
2196 
2197 /**
2198  * drm_mode_getplane - get plane configuration
2199  * @dev: DRM device
2200  * @data: ioctl data
2201  * @file_priv: DRM file info
2202  *
2203  * Construct a plane configuration structure to return to the user.
2204  *
2205  * Called by the user via ioctl.
2206  *
2207  * Returns:
2208  * Zero on success, negative errno on failure.
2209  */
2210 int drm_mode_getplane(struct drm_device *dev, void *data,
2211 		      struct drm_file *file_priv)
2212 {
2213 	struct drm_mode_get_plane *plane_resp = data;
2214 	struct drm_plane *plane;
2215 	uint32_t __user *format_ptr;
2216 
2217 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2218 		return -EINVAL;
2219 
2220 	plane = drm_plane_find(dev, plane_resp->plane_id);
2221 	if (!plane)
2222 		return -ENOENT;
2223 
2224 	drm_modeset_lock(&plane->mutex, NULL);
2225 	if (plane->crtc)
2226 		plane_resp->crtc_id = plane->crtc->base.id;
2227 	else
2228 		plane_resp->crtc_id = 0;
2229 
2230 	if (plane->fb)
2231 		plane_resp->fb_id = plane->fb->base.id;
2232 	else
2233 		plane_resp->fb_id = 0;
2234 	drm_modeset_unlock(&plane->mutex);
2235 
2236 	plane_resp->plane_id = plane->base.id;
2237 	plane_resp->possible_crtcs = plane->possible_crtcs;
2238 	plane_resp->gamma_size = 0;
2239 
2240 	/*
2241 	 * This ioctl is called twice, once to determine how much space is
2242 	 * needed, and the 2nd time to fill it.
2243 	 */
2244 	if (plane->format_count &&
2245 	    (plane_resp->count_format_types >= plane->format_count)) {
2246 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2247 		if (copy_to_user(format_ptr,
2248 				 plane->format_types,
2249 				 sizeof(uint32_t) * plane->format_count)) {
2250 			return -EFAULT;
2251 		}
2252 	}
2253 	plane_resp->count_format_types = plane->format_count;
2254 
2255 	return 0;
2256 }
2257 
2258 /**
2259  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2260  * @plane: plane to check for format support
2261  * @format: the pixel format
2262  *
2263  * Returns:
2264  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2265  * otherwise.
2266  */
2267 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2268 {
2269 	unsigned int i;
2270 
2271 	for (i = 0; i < plane->format_count; i++) {
2272 		if (format == plane->format_types[i])
2273 			return 0;
2274 	}
2275 
2276 	return -EINVAL;
2277 }
2278 
2279 /*
2280  * setplane_internal - setplane handler for internal callers
2281  *
2282  * Note that we assume an extra reference has already been taken on fb.  If the
2283  * update fails, this reference will be dropped before return; if it succeeds,
2284  * the previous framebuffer (if any) will be unreferenced instead.
2285  *
2286  * src_{x,y,w,h} are provided in 16.16 fixed point format
2287  */
2288 static int __setplane_internal(struct drm_plane *plane,
2289 			       struct drm_crtc *crtc,
2290 			       struct drm_framebuffer *fb,
2291 			       int32_t crtc_x, int32_t crtc_y,
2292 			       uint32_t crtc_w, uint32_t crtc_h,
2293 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2294 			       uint32_t src_x, uint32_t src_y,
2295 			       uint32_t src_w, uint32_t src_h)
2296 {
2297 	int ret = 0;
2298 	unsigned int fb_width, fb_height;
2299 
2300 	/* No fb means shut it down */
2301 	if (!fb) {
2302 		plane->old_fb = plane->fb;
2303 		ret = plane->funcs->disable_plane(plane);
2304 		if (!ret) {
2305 			plane->crtc = NULL;
2306 			plane->fb = NULL;
2307 		} else {
2308 			plane->old_fb = NULL;
2309 		}
2310 		goto out;
2311 	}
2312 
2313 	/* Check whether this plane is usable on this CRTC */
2314 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2315 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2316 		ret = -EINVAL;
2317 		goto out;
2318 	}
2319 
2320 	/* Check whether this plane supports the fb pixel format. */
2321 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2322 	if (ret) {
2323 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2324 			      drm_get_format_name(fb->pixel_format));
2325 		goto out;
2326 	}
2327 
2328 	/* Give drivers some help against integer overflows */
2329 	if (crtc_w > INT_MAX ||
2330 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2331 	    crtc_h > INT_MAX ||
2332 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2333 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2334 			      crtc_w, crtc_h, crtc_x, crtc_y);
2335 		return -ERANGE;
2336 	}
2337 
2338 
2339 	fb_width = fb->width << 16;
2340 	fb_height = fb->height << 16;
2341 
2342 	/* Make sure source coordinates are inside the fb. */
2343 	if (src_w > fb_width ||
2344 	    src_x > fb_width - src_w ||
2345 	    src_h > fb_height ||
2346 	    src_y > fb_height - src_h) {
2347 		DRM_DEBUG_KMS("Invalid source coordinates "
2348 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2349 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2350 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2351 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2352 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2353 		ret = -ENOSPC;
2354 		goto out;
2355 	}
2356 
2357 	plane->old_fb = plane->fb;
2358 	ret = plane->funcs->update_plane(plane, crtc, fb,
2359 					 crtc_x, crtc_y, crtc_w, crtc_h,
2360 					 src_x, src_y, src_w, src_h);
2361 	if (!ret) {
2362 		plane->crtc = crtc;
2363 		plane->fb = fb;
2364 		fb = NULL;
2365 	} else {
2366 		plane->old_fb = NULL;
2367 	}
2368 
2369 out:
2370 	if (fb)
2371 		drm_framebuffer_unreference(fb);
2372 	if (plane->old_fb)
2373 		drm_framebuffer_unreference(plane->old_fb);
2374 	plane->old_fb = NULL;
2375 
2376 	return ret;
2377 }
2378 
2379 static int setplane_internal(struct drm_plane *plane,
2380 			     struct drm_crtc *crtc,
2381 			     struct drm_framebuffer *fb,
2382 			     int32_t crtc_x, int32_t crtc_y,
2383 			     uint32_t crtc_w, uint32_t crtc_h,
2384 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2385 			     uint32_t src_x, uint32_t src_y,
2386 			     uint32_t src_w, uint32_t src_h)
2387 {
2388 	int ret;
2389 
2390 	drm_modeset_lock_all(plane->dev);
2391 	ret = __setplane_internal(plane, crtc, fb,
2392 				  crtc_x, crtc_y, crtc_w, crtc_h,
2393 				  src_x, src_y, src_w, src_h);
2394 	drm_modeset_unlock_all(plane->dev);
2395 
2396 	return ret;
2397 }
2398 
2399 /**
2400  * drm_mode_setplane - configure a plane's configuration
2401  * @dev: DRM device
2402  * @data: ioctl data*
2403  * @file_priv: DRM file info
2404  *
2405  * Set plane configuration, including placement, fb, scaling, and other factors.
2406  * Or pass a NULL fb to disable (planes may be disabled without providing a
2407  * valid crtc).
2408  *
2409  * Returns:
2410  * Zero on success, negative errno on failure.
2411  */
2412 int drm_mode_setplane(struct drm_device *dev, void *data,
2413 		      struct drm_file *file_priv)
2414 {
2415 	struct drm_mode_set_plane *plane_req = data;
2416 	struct drm_plane *plane;
2417 	struct drm_crtc *crtc = NULL;
2418 	struct drm_framebuffer *fb = NULL;
2419 
2420 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2421 		return -EINVAL;
2422 
2423 	/*
2424 	 * First, find the plane, crtc, and fb objects.  If not available,
2425 	 * we don't bother to call the driver.
2426 	 */
2427 	plane = drm_plane_find(dev, plane_req->plane_id);
2428 	if (!plane) {
2429 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2430 			      plane_req->plane_id);
2431 		return -ENOENT;
2432 	}
2433 
2434 	if (plane_req->fb_id) {
2435 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2436 		if (!fb) {
2437 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2438 				      plane_req->fb_id);
2439 			return -ENOENT;
2440 		}
2441 
2442 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2443 		if (!crtc) {
2444 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2445 				      plane_req->crtc_id);
2446 			return -ENOENT;
2447 		}
2448 	}
2449 
2450 	/*
2451 	 * setplane_internal will take care of deref'ing either the old or new
2452 	 * framebuffer depending on success.
2453 	 */
2454 	return setplane_internal(plane, crtc, fb,
2455 				 plane_req->crtc_x, plane_req->crtc_y,
2456 				 plane_req->crtc_w, plane_req->crtc_h,
2457 				 plane_req->src_x, plane_req->src_y,
2458 				 plane_req->src_w, plane_req->src_h);
2459 }
2460 
2461 /**
2462  * drm_mode_set_config_internal - helper to call ->set_config
2463  * @set: modeset config to set
2464  *
2465  * This is a little helper to wrap internal calls to the ->set_config driver
2466  * interface. The only thing it adds is correct refcounting dance.
2467  *
2468  * Returns:
2469  * Zero on success, negative errno on failure.
2470  */
2471 int drm_mode_set_config_internal(struct drm_mode_set *set)
2472 {
2473 	struct drm_crtc *crtc = set->crtc;
2474 	struct drm_framebuffer *fb;
2475 	struct drm_crtc *tmp;
2476 	int ret;
2477 
2478 	/*
2479 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2480 	 * connectors from it), hence we need to refcount the fbs across all
2481 	 * crtcs. Atomic modeset will have saner semantics ...
2482 	 */
2483 	drm_for_each_crtc(tmp, crtc->dev)
2484 		tmp->primary->old_fb = tmp->primary->fb;
2485 
2486 	fb = set->fb;
2487 
2488 	ret = crtc->funcs->set_config(set);
2489 	if (ret == 0) {
2490 		crtc->primary->crtc = crtc;
2491 		crtc->primary->fb = fb;
2492 	}
2493 
2494 	drm_for_each_crtc(tmp, crtc->dev) {
2495 		if (tmp->primary->fb)
2496 			drm_framebuffer_reference(tmp->primary->fb);
2497 		if (tmp->primary->old_fb)
2498 			drm_framebuffer_unreference(tmp->primary->old_fb);
2499 		tmp->primary->old_fb = NULL;
2500 	}
2501 
2502 	return ret;
2503 }
2504 EXPORT_SYMBOL(drm_mode_set_config_internal);
2505 
2506 /**
2507  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2508  * @mode: mode to query
2509  * @hdisplay: hdisplay value to fill in
2510  * @vdisplay: vdisplay value to fill in
2511  *
2512  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2513  * the appropriate layout.
2514  */
2515 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2516 			    int *hdisplay, int *vdisplay)
2517 {
2518 	struct drm_display_mode adjusted;
2519 
2520 	drm_mode_copy(&adjusted, mode);
2521 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2522 	*hdisplay = adjusted.crtc_hdisplay;
2523 	*vdisplay = adjusted.crtc_vdisplay;
2524 }
2525 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2526 
2527 /**
2528  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2529  *     CRTC viewport
2530  * @crtc: CRTC that framebuffer will be displayed on
2531  * @x: x panning
2532  * @y: y panning
2533  * @mode: mode that framebuffer will be displayed under
2534  * @fb: framebuffer to check size of
2535  */
2536 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2537 			    int x, int y,
2538 			    const struct drm_display_mode *mode,
2539 			    const struct drm_framebuffer *fb)
2540 
2541 {
2542 	int hdisplay, vdisplay;
2543 
2544 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2545 
2546 	if (crtc->invert_dimensions)
2547 		swap(hdisplay, vdisplay);
2548 
2549 	if (hdisplay > fb->width ||
2550 	    vdisplay > fb->height ||
2551 	    x > fb->width - hdisplay ||
2552 	    y > fb->height - vdisplay) {
2553 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2554 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2555 			      crtc->invert_dimensions ? " (inverted)" : "");
2556 		return -ENOSPC;
2557 	}
2558 
2559 	return 0;
2560 }
2561 EXPORT_SYMBOL(drm_crtc_check_viewport);
2562 
2563 /**
2564  * drm_mode_setcrtc - set CRTC configuration
2565  * @dev: drm device for the ioctl
2566  * @data: data pointer for the ioctl
2567  * @file_priv: drm file for the ioctl call
2568  *
2569  * Build a new CRTC configuration based on user request.
2570  *
2571  * Called by the user via ioctl.
2572  *
2573  * Returns:
2574  * Zero on success, negative errno on failure.
2575  */
2576 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2577 		     struct drm_file *file_priv)
2578 {
2579 	struct drm_mode_config *config = &dev->mode_config;
2580 	struct drm_mode_crtc *crtc_req = data;
2581 	struct drm_crtc *crtc;
2582 	struct drm_connector **connector_set = NULL, *connector;
2583 	struct drm_framebuffer *fb = NULL;
2584 	struct drm_display_mode *mode = NULL;
2585 	struct drm_mode_set set;
2586 	uint32_t __user *set_connectors_ptr;
2587 	int ret;
2588 	int i;
2589 
2590 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2591 		return -EINVAL;
2592 
2593 	/*
2594 	 * Universal plane src offsets are only 16.16, prevent havoc for
2595 	 * drivers using universal plane code internally.
2596 	 */
2597 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2598 		return -ERANGE;
2599 
2600 	drm_modeset_lock_all(dev);
2601 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2602 	if (!crtc) {
2603 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2604 		ret = -ENOENT;
2605 		goto out;
2606 	}
2607 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2608 
2609 	if (crtc_req->mode_valid) {
2610 		/* If we have a mode we need a framebuffer. */
2611 		/* If we pass -1, set the mode with the currently bound fb */
2612 		if (crtc_req->fb_id == -1) {
2613 			if (!crtc->primary->fb) {
2614 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2615 				ret = -EINVAL;
2616 				goto out;
2617 			}
2618 			fb = crtc->primary->fb;
2619 			/* Make refcounting symmetric with the lookup path. */
2620 			drm_framebuffer_reference(fb);
2621 		} else {
2622 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2623 			if (!fb) {
2624 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2625 						crtc_req->fb_id);
2626 				ret = -ENOENT;
2627 				goto out;
2628 			}
2629 		}
2630 
2631 		mode = drm_mode_create(dev);
2632 		if (!mode) {
2633 			ret = -ENOMEM;
2634 			goto out;
2635 		}
2636 
2637 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2638 		if (ret) {
2639 			DRM_DEBUG_KMS("Invalid mode\n");
2640 			goto out;
2641 		}
2642 
2643 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2644 
2645 		/*
2646 		 * Check whether the primary plane supports the fb pixel format.
2647 		 * Drivers not implementing the universal planes API use a
2648 		 * default formats list provided by the DRM core which doesn't
2649 		 * match real hardware capabilities. Skip the check in that
2650 		 * case.
2651 		 */
2652 		if (!crtc->primary->format_default) {
2653 			ret = drm_plane_check_pixel_format(crtc->primary,
2654 							   fb->pixel_format);
2655 			if (ret) {
2656 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2657 					drm_get_format_name(fb->pixel_format));
2658 				goto out;
2659 			}
2660 		}
2661 
2662 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2663 					      mode, fb);
2664 		if (ret)
2665 			goto out;
2666 
2667 	}
2668 
2669 	if (crtc_req->count_connectors == 0 && mode) {
2670 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2671 		ret = -EINVAL;
2672 		goto out;
2673 	}
2674 
2675 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2676 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2677 			  crtc_req->count_connectors);
2678 		ret = -EINVAL;
2679 		goto out;
2680 	}
2681 
2682 	if (crtc_req->count_connectors > 0) {
2683 		u32 out_id;
2684 
2685 		/* Avoid unbounded kernel memory allocation */
2686 		if (crtc_req->count_connectors > config->num_connector) {
2687 			ret = -EINVAL;
2688 			goto out;
2689 		}
2690 
2691 		connector_set = kmalloc_array(crtc_req->count_connectors,
2692 					      sizeof(struct drm_connector *),
2693 					      GFP_KERNEL);
2694 		if (!connector_set) {
2695 			ret = -ENOMEM;
2696 			goto out;
2697 		}
2698 
2699 		for (i = 0; i < crtc_req->count_connectors; i++) {
2700 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2701 			if (get_user(out_id, &set_connectors_ptr[i])) {
2702 				ret = -EFAULT;
2703 				goto out;
2704 			}
2705 
2706 			connector = drm_connector_find(dev, out_id);
2707 			if (!connector) {
2708 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2709 						out_id);
2710 				ret = -ENOENT;
2711 				goto out;
2712 			}
2713 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2714 					connector->base.id,
2715 					connector->name);
2716 
2717 			connector_set[i] = connector;
2718 		}
2719 	}
2720 
2721 	set.crtc = crtc;
2722 	set.x = crtc_req->x;
2723 	set.y = crtc_req->y;
2724 	set.mode = mode;
2725 	set.connectors = connector_set;
2726 	set.num_connectors = crtc_req->count_connectors;
2727 	set.fb = fb;
2728 	ret = drm_mode_set_config_internal(&set);
2729 
2730 out:
2731 	if (fb)
2732 		drm_framebuffer_unreference(fb);
2733 
2734 	kfree(connector_set);
2735 	drm_mode_destroy(dev, mode);
2736 	drm_modeset_unlock_all(dev);
2737 	return ret;
2738 }
2739 
2740 /**
2741  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2742  *     universal plane handler call
2743  * @crtc: crtc to update cursor for
2744  * @req: data pointer for the ioctl
2745  * @file_priv: drm file for the ioctl call
2746  *
2747  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2748  * translate legacy ioctl calls into universal plane handler calls, we need to
2749  * wrap the native buffer handle in a drm_framebuffer.
2750  *
2751  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2752  * buffer with a pitch of 4*width; the universal plane interface should be used
2753  * directly in cases where the hardware can support other buffer settings and
2754  * userspace wants to make use of these capabilities.
2755  *
2756  * Returns:
2757  * Zero on success, negative errno on failure.
2758  */
2759 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2760 				     struct drm_mode_cursor2 *req,
2761 				     struct drm_file *file_priv)
2762 {
2763 	struct drm_device *dev = crtc->dev;
2764 	struct drm_framebuffer *fb = NULL;
2765 	struct drm_mode_fb_cmd2 fbreq = {
2766 		.width = req->width,
2767 		.height = req->height,
2768 		.pixel_format = DRM_FORMAT_ARGB8888,
2769 		.pitches = { req->width * 4 },
2770 		.handles = { req->handle },
2771 	};
2772 	int32_t crtc_x, crtc_y;
2773 	uint32_t crtc_w = 0, crtc_h = 0;
2774 	uint32_t src_w = 0, src_h = 0;
2775 	int ret = 0;
2776 
2777 	BUG_ON(!crtc->cursor);
2778 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2779 
2780 	/*
2781 	 * Obtain fb we'll be using (either new or existing) and take an extra
2782 	 * reference to it if fb != null.  setplane will take care of dropping
2783 	 * the reference if the plane update fails.
2784 	 */
2785 	if (req->flags & DRM_MODE_CURSOR_BO) {
2786 		if (req->handle) {
2787 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2788 			if (IS_ERR(fb)) {
2789 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2790 				return PTR_ERR(fb);
2791 			}
2792 		} else {
2793 			fb = NULL;
2794 		}
2795 	} else {
2796 		fb = crtc->cursor->fb;
2797 		if (fb)
2798 			drm_framebuffer_reference(fb);
2799 	}
2800 
2801 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2802 		crtc_x = req->x;
2803 		crtc_y = req->y;
2804 	} else {
2805 		crtc_x = crtc->cursor_x;
2806 		crtc_y = crtc->cursor_y;
2807 	}
2808 
2809 	if (fb) {
2810 		crtc_w = fb->width;
2811 		crtc_h = fb->height;
2812 		src_w = fb->width << 16;
2813 		src_h = fb->height << 16;
2814 	}
2815 
2816 	/*
2817 	 * setplane_internal will take care of deref'ing either the old or new
2818 	 * framebuffer depending on success.
2819 	 */
2820 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2821 				crtc_x, crtc_y, crtc_w, crtc_h,
2822 				0, 0, src_w, src_h);
2823 
2824 	/* Update successful; save new cursor position, if necessary */
2825 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2826 		crtc->cursor_x = req->x;
2827 		crtc->cursor_y = req->y;
2828 	}
2829 
2830 	return ret;
2831 }
2832 
2833 static int drm_mode_cursor_common(struct drm_device *dev,
2834 				  struct drm_mode_cursor2 *req,
2835 				  struct drm_file *file_priv)
2836 {
2837 	struct drm_crtc *crtc;
2838 	int ret = 0;
2839 
2840 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2841 		return -EINVAL;
2842 
2843 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2844 		return -EINVAL;
2845 
2846 	crtc = drm_crtc_find(dev, req->crtc_id);
2847 	if (!crtc) {
2848 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2849 		return -ENOENT;
2850 	}
2851 
2852 	/*
2853 	 * If this crtc has a universal cursor plane, call that plane's update
2854 	 * handler rather than using legacy cursor handlers.
2855 	 */
2856 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2857 	if (crtc->cursor) {
2858 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2859 		goto out;
2860 	}
2861 
2862 	if (req->flags & DRM_MODE_CURSOR_BO) {
2863 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2864 			ret = -ENXIO;
2865 			goto out;
2866 		}
2867 		/* Turns off the cursor if handle is 0 */
2868 		if (crtc->funcs->cursor_set2)
2869 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2870 						      req->width, req->height, req->hot_x, req->hot_y);
2871 		else
2872 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2873 						      req->width, req->height);
2874 	}
2875 
2876 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2877 		if (crtc->funcs->cursor_move) {
2878 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2879 		} else {
2880 			ret = -EFAULT;
2881 			goto out;
2882 		}
2883 	}
2884 out:
2885 	drm_modeset_unlock_crtc(crtc);
2886 
2887 	return ret;
2888 
2889 }
2890 
2891 
2892 /**
2893  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2894  * @dev: drm device for the ioctl
2895  * @data: data pointer for the ioctl
2896  * @file_priv: drm file for the ioctl call
2897  *
2898  * Set the cursor configuration based on user request.
2899  *
2900  * Called by the user via ioctl.
2901  *
2902  * Returns:
2903  * Zero on success, negative errno on failure.
2904  */
2905 int drm_mode_cursor_ioctl(struct drm_device *dev,
2906 			  void *data, struct drm_file *file_priv)
2907 {
2908 	struct drm_mode_cursor *req = data;
2909 	struct drm_mode_cursor2 new_req;
2910 
2911 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2912 	new_req.hot_x = new_req.hot_y = 0;
2913 
2914 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2915 }
2916 
2917 /**
2918  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2919  * @dev: drm device for the ioctl
2920  * @data: data pointer for the ioctl
2921  * @file_priv: drm file for the ioctl call
2922  *
2923  * Set the cursor configuration based on user request. This implements the 2nd
2924  * version of the cursor ioctl, which allows userspace to additionally specify
2925  * the hotspot of the pointer.
2926  *
2927  * Called by the user via ioctl.
2928  *
2929  * Returns:
2930  * Zero on success, negative errno on failure.
2931  */
2932 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2933 			   void *data, struct drm_file *file_priv)
2934 {
2935 	struct drm_mode_cursor2 *req = data;
2936 
2937 	return drm_mode_cursor_common(dev, req, file_priv);
2938 }
2939 
2940 /**
2941  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
2942  * @bpp: bits per pixels
2943  * @depth: bit depth per pixel
2944  *
2945  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
2946  * Useful in fbdev emulation code, since that deals in those values.
2947  */
2948 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
2949 {
2950 	uint32_t fmt;
2951 
2952 	switch (bpp) {
2953 	case 8:
2954 		fmt = DRM_FORMAT_C8;
2955 		break;
2956 	case 16:
2957 		if (depth == 15)
2958 			fmt = DRM_FORMAT_XRGB1555;
2959 		else
2960 			fmt = DRM_FORMAT_RGB565;
2961 		break;
2962 	case 24:
2963 		fmt = DRM_FORMAT_RGB888;
2964 		break;
2965 	case 32:
2966 		if (depth == 24)
2967 			fmt = DRM_FORMAT_XRGB8888;
2968 		else if (depth == 30)
2969 			fmt = DRM_FORMAT_XRGB2101010;
2970 		else
2971 			fmt = DRM_FORMAT_ARGB8888;
2972 		break;
2973 	default:
2974 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
2975 		fmt = DRM_FORMAT_XRGB8888;
2976 		break;
2977 	}
2978 
2979 	return fmt;
2980 }
2981 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
2982 
2983 /**
2984  * drm_mode_addfb - add an FB to the graphics configuration
2985  * @dev: drm device for the ioctl
2986  * @data: data pointer for the ioctl
2987  * @file_priv: drm file for the ioctl call
2988  *
2989  * Add a new FB to the specified CRTC, given a user request. This is the
2990  * original addfb ioctl which only supported RGB formats.
2991  *
2992  * Called by the user via ioctl.
2993  *
2994  * Returns:
2995  * Zero on success, negative errno on failure.
2996  */
2997 int drm_mode_addfb(struct drm_device *dev,
2998 		   void *data, struct drm_file *file_priv)
2999 {
3000 	struct drm_mode_fb_cmd *or = data;
3001 	struct drm_mode_fb_cmd2 r = {};
3002 	int ret;
3003 
3004 	/* convert to new format and call new ioctl */
3005 	r.fb_id = or->fb_id;
3006 	r.width = or->width;
3007 	r.height = or->height;
3008 	r.pitches[0] = or->pitch;
3009 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3010 	r.handles[0] = or->handle;
3011 
3012 	ret = drm_mode_addfb2(dev, &r, file_priv);
3013 	if (ret)
3014 		return ret;
3015 
3016 	or->fb_id = r.fb_id;
3017 
3018 	return 0;
3019 }
3020 
3021 static int format_check(const struct drm_mode_fb_cmd2 *r)
3022 {
3023 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3024 
3025 	switch (format) {
3026 	case DRM_FORMAT_C8:
3027 	case DRM_FORMAT_RGB332:
3028 	case DRM_FORMAT_BGR233:
3029 	case DRM_FORMAT_XRGB4444:
3030 	case DRM_FORMAT_XBGR4444:
3031 	case DRM_FORMAT_RGBX4444:
3032 	case DRM_FORMAT_BGRX4444:
3033 	case DRM_FORMAT_ARGB4444:
3034 	case DRM_FORMAT_ABGR4444:
3035 	case DRM_FORMAT_RGBA4444:
3036 	case DRM_FORMAT_BGRA4444:
3037 	case DRM_FORMAT_XRGB1555:
3038 	case DRM_FORMAT_XBGR1555:
3039 	case DRM_FORMAT_RGBX5551:
3040 	case DRM_FORMAT_BGRX5551:
3041 	case DRM_FORMAT_ARGB1555:
3042 	case DRM_FORMAT_ABGR1555:
3043 	case DRM_FORMAT_RGBA5551:
3044 	case DRM_FORMAT_BGRA5551:
3045 	case DRM_FORMAT_RGB565:
3046 	case DRM_FORMAT_BGR565:
3047 	case DRM_FORMAT_RGB888:
3048 	case DRM_FORMAT_BGR888:
3049 	case DRM_FORMAT_XRGB8888:
3050 	case DRM_FORMAT_XBGR8888:
3051 	case DRM_FORMAT_RGBX8888:
3052 	case DRM_FORMAT_BGRX8888:
3053 	case DRM_FORMAT_ARGB8888:
3054 	case DRM_FORMAT_ABGR8888:
3055 	case DRM_FORMAT_RGBA8888:
3056 	case DRM_FORMAT_BGRA8888:
3057 	case DRM_FORMAT_XRGB2101010:
3058 	case DRM_FORMAT_XBGR2101010:
3059 	case DRM_FORMAT_RGBX1010102:
3060 	case DRM_FORMAT_BGRX1010102:
3061 	case DRM_FORMAT_ARGB2101010:
3062 	case DRM_FORMAT_ABGR2101010:
3063 	case DRM_FORMAT_RGBA1010102:
3064 	case DRM_FORMAT_BGRA1010102:
3065 	case DRM_FORMAT_YUYV:
3066 	case DRM_FORMAT_YVYU:
3067 	case DRM_FORMAT_UYVY:
3068 	case DRM_FORMAT_VYUY:
3069 	case DRM_FORMAT_AYUV:
3070 	case DRM_FORMAT_NV12:
3071 	case DRM_FORMAT_NV21:
3072 	case DRM_FORMAT_NV16:
3073 	case DRM_FORMAT_NV61:
3074 	case DRM_FORMAT_NV24:
3075 	case DRM_FORMAT_NV42:
3076 	case DRM_FORMAT_YUV410:
3077 	case DRM_FORMAT_YVU410:
3078 	case DRM_FORMAT_YUV411:
3079 	case DRM_FORMAT_YVU411:
3080 	case DRM_FORMAT_YUV420:
3081 	case DRM_FORMAT_YVU420:
3082 	case DRM_FORMAT_YUV422:
3083 	case DRM_FORMAT_YVU422:
3084 	case DRM_FORMAT_YUV444:
3085 	case DRM_FORMAT_YVU444:
3086 		return 0;
3087 	default:
3088 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3089 			      drm_get_format_name(r->pixel_format));
3090 		return -EINVAL;
3091 	}
3092 }
3093 
3094 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3095 {
3096 	int ret, hsub, vsub, num_planes, i;
3097 
3098 	ret = format_check(r);
3099 	if (ret) {
3100 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3101 			      drm_get_format_name(r->pixel_format));
3102 		return ret;
3103 	}
3104 
3105 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3106 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3107 	num_planes = drm_format_num_planes(r->pixel_format);
3108 
3109 	if (r->width == 0 || r->width % hsub) {
3110 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3111 		return -EINVAL;
3112 	}
3113 
3114 	if (r->height == 0 || r->height % vsub) {
3115 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3116 		return -EINVAL;
3117 	}
3118 
3119 	for (i = 0; i < num_planes; i++) {
3120 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3121 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3122 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3123 
3124 		if (!r->handles[i]) {
3125 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3126 			return -EINVAL;
3127 		}
3128 
3129 		if ((uint64_t) width * cpp > UINT_MAX)
3130 			return -ERANGE;
3131 
3132 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3133 			return -ERANGE;
3134 
3135 		if (r->pitches[i] < width * cpp) {
3136 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3137 			return -EINVAL;
3138 		}
3139 
3140 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3141 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
3142 				      r->modifier[i], i);
3143 			return -EINVAL;
3144 		}
3145 
3146 		/* modifier specific checks: */
3147 		switch (r->modifier[i]) {
3148 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3149 			/* NOTE: the pitch restriction may be lifted later if it turns
3150 			 * out that no hw has this restriction:
3151 			 */
3152 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3153 					width % 128 || height % 32 ||
3154 					r->pitches[i] % 128) {
3155 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3156 				return -EINVAL;
3157 			}
3158 			break;
3159 
3160 		default:
3161 			break;
3162 		}
3163 	}
3164 
3165 	for (i = num_planes; i < 4; i++) {
3166 		if (r->modifier[i]) {
3167 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3168 			return -EINVAL;
3169 		}
3170 
3171 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3172 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3173 			continue;
3174 
3175 		if (r->handles[i]) {
3176 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3177 			return -EINVAL;
3178 		}
3179 
3180 		if (r->pitches[i]) {
3181 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3182 			return -EINVAL;
3183 		}
3184 
3185 		if (r->offsets[i]) {
3186 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3187 			return -EINVAL;
3188 		}
3189 	}
3190 
3191 	return 0;
3192 }
3193 
3194 static struct drm_framebuffer *
3195 internal_framebuffer_create(struct drm_device *dev,
3196 			    struct drm_mode_fb_cmd2 *r,
3197 			    struct drm_file *file_priv)
3198 {
3199 	struct drm_mode_config *config = &dev->mode_config;
3200 	struct drm_framebuffer *fb;
3201 	int ret;
3202 
3203 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3204 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3205 		return ERR_PTR(-EINVAL);
3206 	}
3207 
3208 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3209 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3210 			  r->width, config->min_width, config->max_width);
3211 		return ERR_PTR(-EINVAL);
3212 	}
3213 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3214 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3215 			  r->height, config->min_height, config->max_height);
3216 		return ERR_PTR(-EINVAL);
3217 	}
3218 
3219 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3220 	    !dev->mode_config.allow_fb_modifiers) {
3221 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3222 		return ERR_PTR(-EINVAL);
3223 	}
3224 
3225 	ret = framebuffer_check(r);
3226 	if (ret)
3227 		return ERR_PTR(ret);
3228 
3229 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3230 	if (IS_ERR(fb)) {
3231 		DRM_DEBUG_KMS("could not create framebuffer\n");
3232 		return fb;
3233 	}
3234 
3235 	return fb;
3236 }
3237 
3238 /**
3239  * drm_mode_addfb2 - add an FB to the graphics configuration
3240  * @dev: drm device for the ioctl
3241  * @data: data pointer for the ioctl
3242  * @file_priv: drm file for the ioctl call
3243  *
3244  * Add a new FB to the specified CRTC, given a user request with format. This is
3245  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3246  * and uses fourcc codes as pixel format specifiers.
3247  *
3248  * Called by the user via ioctl.
3249  *
3250  * Returns:
3251  * Zero on success, negative errno on failure.
3252  */
3253 int drm_mode_addfb2(struct drm_device *dev,
3254 		    void *data, struct drm_file *file_priv)
3255 {
3256 	struct drm_mode_fb_cmd2 *r = data;
3257 	struct drm_framebuffer *fb;
3258 
3259 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3260 		return -EINVAL;
3261 
3262 	fb = internal_framebuffer_create(dev, r, file_priv);
3263 	if (IS_ERR(fb))
3264 		return PTR_ERR(fb);
3265 
3266 	/* Transfer ownership to the filp for reaping on close */
3267 
3268 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3269 	mutex_lock(&file_priv->fbs_lock);
3270 	r->fb_id = fb->base.id;
3271 	list_add(&fb->filp_head, &file_priv->fbs);
3272 	mutex_unlock(&file_priv->fbs_lock);
3273 
3274 	return 0;
3275 }
3276 
3277 /**
3278  * drm_mode_rmfb - remove an FB from the configuration
3279  * @dev: drm device for the ioctl
3280  * @data: data pointer for the ioctl
3281  * @file_priv: drm file for the ioctl call
3282  *
3283  * Remove the FB specified by the user.
3284  *
3285  * Called by the user via ioctl.
3286  *
3287  * Returns:
3288  * Zero on success, negative errno on failure.
3289  */
3290 int drm_mode_rmfb(struct drm_device *dev,
3291 		   void *data, struct drm_file *file_priv)
3292 {
3293 	struct drm_framebuffer *fb = NULL;
3294 	struct drm_framebuffer *fbl = NULL;
3295 	uint32_t *id = data;
3296 	int found = 0;
3297 
3298 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3299 		return -EINVAL;
3300 
3301 	mutex_lock(&file_priv->fbs_lock);
3302 	mutex_lock(&dev->mode_config.fb_lock);
3303 	fb = __drm_framebuffer_lookup(dev, *id);
3304 	if (!fb)
3305 		goto fail_lookup;
3306 
3307 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3308 		if (fb == fbl)
3309 			found = 1;
3310 	if (!found)
3311 		goto fail_lookup;
3312 
3313 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3314 	__drm_framebuffer_unregister(dev, fb);
3315 
3316 	list_del_init(&fb->filp_head);
3317 	mutex_unlock(&dev->mode_config.fb_lock);
3318 	mutex_unlock(&file_priv->fbs_lock);
3319 
3320 	drm_framebuffer_remove(fb);
3321 
3322 	return 0;
3323 
3324 fail_lookup:
3325 	mutex_unlock(&dev->mode_config.fb_lock);
3326 	mutex_unlock(&file_priv->fbs_lock);
3327 
3328 	return -ENOENT;
3329 }
3330 
3331 /**
3332  * drm_mode_getfb - get FB info
3333  * @dev: drm device for the ioctl
3334  * @data: data pointer for the ioctl
3335  * @file_priv: drm file for the ioctl call
3336  *
3337  * Lookup the FB given its ID and return info about it.
3338  *
3339  * Called by the user via ioctl.
3340  *
3341  * Returns:
3342  * Zero on success, negative errno on failure.
3343  */
3344 int drm_mode_getfb(struct drm_device *dev,
3345 		   void *data, struct drm_file *file_priv)
3346 {
3347 	struct drm_mode_fb_cmd *r = data;
3348 	struct drm_framebuffer *fb;
3349 	int ret;
3350 
3351 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3352 		return -EINVAL;
3353 
3354 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3355 	if (!fb)
3356 		return -ENOENT;
3357 
3358 	r->height = fb->height;
3359 	r->width = fb->width;
3360 	r->depth = fb->depth;
3361 	r->bpp = fb->bits_per_pixel;
3362 	r->pitch = fb->pitches[0];
3363 	if (fb->funcs->create_handle) {
3364 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3365 		    drm_is_control_client(file_priv)) {
3366 			ret = fb->funcs->create_handle(fb, file_priv,
3367 						       &r->handle);
3368 		} else {
3369 			/* GET_FB() is an unprivileged ioctl so we must not
3370 			 * return a buffer-handle to non-master processes! For
3371 			 * backwards-compatibility reasons, we cannot make
3372 			 * GET_FB() privileged, so just return an invalid handle
3373 			 * for non-masters. */
3374 			r->handle = 0;
3375 			ret = 0;
3376 		}
3377 	} else {
3378 		ret = -ENODEV;
3379 	}
3380 
3381 	drm_framebuffer_unreference(fb);
3382 
3383 	return ret;
3384 }
3385 
3386 /**
3387  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3388  * @dev: drm device for the ioctl
3389  * @data: data pointer for the ioctl
3390  * @file_priv: drm file for the ioctl call
3391  *
3392  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3393  * rectangle list. Generic userspace which does frontbuffer rendering must call
3394  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3395  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3396  *
3397  * Modesetting drivers which always update the frontbuffer do not need to
3398  * implement the corresponding ->dirty framebuffer callback.
3399  *
3400  * Called by the user via ioctl.
3401  *
3402  * Returns:
3403  * Zero on success, negative errno on failure.
3404  */
3405 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3406 			   void *data, struct drm_file *file_priv)
3407 {
3408 	struct drm_clip_rect __user *clips_ptr;
3409 	struct drm_clip_rect *clips = NULL;
3410 	struct drm_mode_fb_dirty_cmd *r = data;
3411 	struct drm_framebuffer *fb;
3412 	unsigned flags;
3413 	int num_clips;
3414 	int ret;
3415 
3416 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3417 		return -EINVAL;
3418 
3419 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3420 	if (!fb)
3421 		return -ENOENT;
3422 
3423 	num_clips = r->num_clips;
3424 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3425 
3426 	if (!num_clips != !clips_ptr) {
3427 		ret = -EINVAL;
3428 		goto out_err1;
3429 	}
3430 
3431 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3432 
3433 	/* If userspace annotates copy, clips must come in pairs */
3434 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3435 		ret = -EINVAL;
3436 		goto out_err1;
3437 	}
3438 
3439 	if (num_clips && clips_ptr) {
3440 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3441 			ret = -EINVAL;
3442 			goto out_err1;
3443 		}
3444 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3445 		if (!clips) {
3446 			ret = -ENOMEM;
3447 			goto out_err1;
3448 		}
3449 
3450 		ret = copy_from_user(clips, clips_ptr,
3451 				     num_clips * sizeof(*clips));
3452 		if (ret) {
3453 			ret = -EFAULT;
3454 			goto out_err2;
3455 		}
3456 	}
3457 
3458 	if (fb->funcs->dirty) {
3459 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3460 				       clips, num_clips);
3461 	} else {
3462 		ret = -ENOSYS;
3463 	}
3464 
3465 out_err2:
3466 	kfree(clips);
3467 out_err1:
3468 	drm_framebuffer_unreference(fb);
3469 
3470 	return ret;
3471 }
3472 
3473 
3474 /**
3475  * drm_fb_release - remove and free the FBs on this file
3476  * @priv: drm file for the ioctl
3477  *
3478  * Destroy all the FBs associated with @filp.
3479  *
3480  * Called by the user via ioctl.
3481  *
3482  * Returns:
3483  * Zero on success, negative errno on failure.
3484  */
3485 void drm_fb_release(struct drm_file *priv)
3486 {
3487 	struct drm_device *dev = priv->minor->dev;
3488 	struct drm_framebuffer *fb, *tfb;
3489 
3490 	/*
3491 	 * When the file gets released that means no one else can access the fb
3492 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3493 	 * avoid upsetting lockdep since the universal cursor code adds a
3494 	 * framebuffer while holding mutex locks.
3495 	 *
3496 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3497 	 * locks is impossible here since no one else but this function can get
3498 	 * at it any more.
3499 	 */
3500 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3501 
3502 		mutex_lock(&dev->mode_config.fb_lock);
3503 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3504 		__drm_framebuffer_unregister(dev, fb);
3505 		mutex_unlock(&dev->mode_config.fb_lock);
3506 
3507 		list_del_init(&fb->filp_head);
3508 
3509 		/* This will also drop the fpriv->fbs reference. */
3510 		drm_framebuffer_remove(fb);
3511 	}
3512 }
3513 
3514 /**
3515  * drm_property_create - create a new property type
3516  * @dev: drm device
3517  * @flags: flags specifying the property type
3518  * @name: name of the property
3519  * @num_values: number of pre-defined values
3520  *
3521  * This creates a new generic drm property which can then be attached to a drm
3522  * object with drm_object_attach_property. The returned property object must be
3523  * freed with drm_property_destroy.
3524  *
3525  * Note that the DRM core keeps a per-device list of properties and that, if
3526  * drm_mode_config_cleanup() is called, it will destroy all properties created
3527  * by the driver.
3528  *
3529  * Returns:
3530  * A pointer to the newly created property on success, NULL on failure.
3531  */
3532 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3533 					 const char *name, int num_values)
3534 {
3535 	struct drm_property *property = NULL;
3536 	int ret;
3537 
3538 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3539 	if (!property)
3540 		return NULL;
3541 
3542 	property->dev = dev;
3543 
3544 	if (num_values) {
3545 		property->values = kcalloc(num_values, sizeof(uint64_t),
3546 					   GFP_KERNEL);
3547 		if (!property->values)
3548 			goto fail;
3549 	}
3550 
3551 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3552 	if (ret)
3553 		goto fail;
3554 
3555 	property->flags = flags;
3556 	property->num_values = num_values;
3557 	INIT_LIST_HEAD(&property->enum_list);
3558 
3559 	if (name) {
3560 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3561 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3562 	}
3563 
3564 	list_add_tail(&property->head, &dev->mode_config.property_list);
3565 
3566 	WARN_ON(!drm_property_type_valid(property));
3567 
3568 	return property;
3569 fail:
3570 	kfree(property->values);
3571 	kfree(property);
3572 	return NULL;
3573 }
3574 EXPORT_SYMBOL(drm_property_create);
3575 
3576 /**
3577  * drm_property_create_enum - create a new enumeration property type
3578  * @dev: drm device
3579  * @flags: flags specifying the property type
3580  * @name: name of the property
3581  * @props: enumeration lists with property values
3582  * @num_values: number of pre-defined values
3583  *
3584  * This creates a new generic drm property which can then be attached to a drm
3585  * object with drm_object_attach_property. The returned property object must be
3586  * freed with drm_property_destroy.
3587  *
3588  * Userspace is only allowed to set one of the predefined values for enumeration
3589  * properties.
3590  *
3591  * Returns:
3592  * A pointer to the newly created property on success, NULL on failure.
3593  */
3594 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3595 					 const char *name,
3596 					 const struct drm_prop_enum_list *props,
3597 					 int num_values)
3598 {
3599 	struct drm_property *property;
3600 	int i, ret;
3601 
3602 	flags |= DRM_MODE_PROP_ENUM;
3603 
3604 	property = drm_property_create(dev, flags, name, num_values);
3605 	if (!property)
3606 		return NULL;
3607 
3608 	for (i = 0; i < num_values; i++) {
3609 		ret = drm_property_add_enum(property, i,
3610 				      props[i].type,
3611 				      props[i].name);
3612 		if (ret) {
3613 			drm_property_destroy(dev, property);
3614 			return NULL;
3615 		}
3616 	}
3617 
3618 	return property;
3619 }
3620 EXPORT_SYMBOL(drm_property_create_enum);
3621 
3622 /**
3623  * drm_property_create_bitmask - create a new bitmask property type
3624  * @dev: drm device
3625  * @flags: flags specifying the property type
3626  * @name: name of the property
3627  * @props: enumeration lists with property bitflags
3628  * @num_props: size of the @props array
3629  * @supported_bits: bitmask of all supported enumeration values
3630  *
3631  * This creates a new bitmask drm property which can then be attached to a drm
3632  * object with drm_object_attach_property. The returned property object must be
3633  * freed with drm_property_destroy.
3634  *
3635  * Compared to plain enumeration properties userspace is allowed to set any
3636  * or'ed together combination of the predefined property bitflag values
3637  *
3638  * Returns:
3639  * A pointer to the newly created property on success, NULL on failure.
3640  */
3641 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3642 					 int flags, const char *name,
3643 					 const struct drm_prop_enum_list *props,
3644 					 int num_props,
3645 					 uint64_t supported_bits)
3646 {
3647 	struct drm_property *property;
3648 	int i, ret, index = 0;
3649 	int num_values = hweight64(supported_bits);
3650 
3651 	flags |= DRM_MODE_PROP_BITMASK;
3652 
3653 	property = drm_property_create(dev, flags, name, num_values);
3654 	if (!property)
3655 		return NULL;
3656 	for (i = 0; i < num_props; i++) {
3657 		if (!(supported_bits & (1ULL << props[i].type)))
3658 			continue;
3659 
3660 		if (WARN_ON(index >= num_values)) {
3661 			drm_property_destroy(dev, property);
3662 			return NULL;
3663 		}
3664 
3665 		ret = drm_property_add_enum(property, index++,
3666 				      props[i].type,
3667 				      props[i].name);
3668 		if (ret) {
3669 			drm_property_destroy(dev, property);
3670 			return NULL;
3671 		}
3672 	}
3673 
3674 	return property;
3675 }
3676 EXPORT_SYMBOL(drm_property_create_bitmask);
3677 
3678 static struct drm_property *property_create_range(struct drm_device *dev,
3679 					 int flags, const char *name,
3680 					 uint64_t min, uint64_t max)
3681 {
3682 	struct drm_property *property;
3683 
3684 	property = drm_property_create(dev, flags, name, 2);
3685 	if (!property)
3686 		return NULL;
3687 
3688 	property->values[0] = min;
3689 	property->values[1] = max;
3690 
3691 	return property;
3692 }
3693 
3694 /**
3695  * drm_property_create_range - create a new unsigned ranged property type
3696  * @dev: drm device
3697  * @flags: flags specifying the property type
3698  * @name: name of the property
3699  * @min: minimum value of the property
3700  * @max: maximum value of the property
3701  *
3702  * This creates a new generic drm property which can then be attached to a drm
3703  * object with drm_object_attach_property. The returned property object must be
3704  * freed with drm_property_destroy.
3705  *
3706  * Userspace is allowed to set any unsigned integer value in the (min, max)
3707  * range inclusive.
3708  *
3709  * Returns:
3710  * A pointer to the newly created property on success, NULL on failure.
3711  */
3712 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3713 					 const char *name,
3714 					 uint64_t min, uint64_t max)
3715 {
3716 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3717 			name, min, max);
3718 }
3719 EXPORT_SYMBOL(drm_property_create_range);
3720 
3721 /**
3722  * drm_property_create_signed_range - create a new signed ranged property type
3723  * @dev: drm device
3724  * @flags: flags specifying the property type
3725  * @name: name of the property
3726  * @min: minimum value of the property
3727  * @max: maximum value of the property
3728  *
3729  * This creates a new generic drm property which can then be attached to a drm
3730  * object with drm_object_attach_property. The returned property object must be
3731  * freed with drm_property_destroy.
3732  *
3733  * Userspace is allowed to set any signed integer value in the (min, max)
3734  * range inclusive.
3735  *
3736  * Returns:
3737  * A pointer to the newly created property on success, NULL on failure.
3738  */
3739 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3740 					 int flags, const char *name,
3741 					 int64_t min, int64_t max)
3742 {
3743 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3744 			name, I642U64(min), I642U64(max));
3745 }
3746 EXPORT_SYMBOL(drm_property_create_signed_range);
3747 
3748 /**
3749  * drm_property_create_object - create a new object property type
3750  * @dev: drm device
3751  * @flags: flags specifying the property type
3752  * @name: name of the property
3753  * @type: object type from DRM_MODE_OBJECT_* defines
3754  *
3755  * This creates a new generic drm property which can then be attached to a drm
3756  * object with drm_object_attach_property. The returned property object must be
3757  * freed with drm_property_destroy.
3758  *
3759  * Userspace is only allowed to set this to any property value of the given
3760  * @type. Only useful for atomic properties, which is enforced.
3761  *
3762  * Returns:
3763  * A pointer to the newly created property on success, NULL on failure.
3764  */
3765 struct drm_property *drm_property_create_object(struct drm_device *dev,
3766 					 int flags, const char *name, uint32_t type)
3767 {
3768 	struct drm_property *property;
3769 
3770 	flags |= DRM_MODE_PROP_OBJECT;
3771 
3772 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3773 		return NULL;
3774 
3775 	property = drm_property_create(dev, flags, name, 1);
3776 	if (!property)
3777 		return NULL;
3778 
3779 	property->values[0] = type;
3780 
3781 	return property;
3782 }
3783 EXPORT_SYMBOL(drm_property_create_object);
3784 
3785 /**
3786  * drm_property_create_bool - create a new boolean property type
3787  * @dev: drm device
3788  * @flags: flags specifying the property type
3789  * @name: name of the property
3790  *
3791  * This creates a new generic drm property which can then be attached to a drm
3792  * object with drm_object_attach_property. The returned property object must be
3793  * freed with drm_property_destroy.
3794  *
3795  * This is implemented as a ranged property with only {0, 1} as valid values.
3796  *
3797  * Returns:
3798  * A pointer to the newly created property on success, NULL on failure.
3799  */
3800 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3801 					 const char *name)
3802 {
3803 	return drm_property_create_range(dev, flags, name, 0, 1);
3804 }
3805 EXPORT_SYMBOL(drm_property_create_bool);
3806 
3807 /**
3808  * drm_property_add_enum - add a possible value to an enumeration property
3809  * @property: enumeration property to change
3810  * @index: index of the new enumeration
3811  * @value: value of the new enumeration
3812  * @name: symbolic name of the new enumeration
3813  *
3814  * This functions adds enumerations to a property.
3815  *
3816  * It's use is deprecated, drivers should use one of the more specific helpers
3817  * to directly create the property with all enumerations already attached.
3818  *
3819  * Returns:
3820  * Zero on success, error code on failure.
3821  */
3822 int drm_property_add_enum(struct drm_property *property, int index,
3823 			  uint64_t value, const char *name)
3824 {
3825 	struct drm_property_enum *prop_enum;
3826 
3827 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3828 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3829 		return -EINVAL;
3830 
3831 	/*
3832 	 * Bitmask enum properties have the additional constraint of values
3833 	 * from 0 to 63
3834 	 */
3835 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3836 			(value > 63))
3837 		return -EINVAL;
3838 
3839 	if (!list_empty(&property->enum_list)) {
3840 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3841 			if (prop_enum->value == value) {
3842 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3843 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3844 				return 0;
3845 			}
3846 		}
3847 	}
3848 
3849 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3850 	if (!prop_enum)
3851 		return -ENOMEM;
3852 
3853 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3854 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3855 	prop_enum->value = value;
3856 
3857 	property->values[index] = value;
3858 	list_add_tail(&prop_enum->head, &property->enum_list);
3859 	return 0;
3860 }
3861 EXPORT_SYMBOL(drm_property_add_enum);
3862 
3863 /**
3864  * drm_property_destroy - destroy a drm property
3865  * @dev: drm device
3866  * @property: property to destry
3867  *
3868  * This function frees a property including any attached resources like
3869  * enumeration values.
3870  */
3871 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3872 {
3873 	struct drm_property_enum *prop_enum, *pt;
3874 
3875 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3876 		list_del(&prop_enum->head);
3877 		kfree(prop_enum);
3878 	}
3879 
3880 	if (property->num_values)
3881 		kfree(property->values);
3882 	drm_mode_object_put(dev, &property->base);
3883 	list_del(&property->head);
3884 	kfree(property);
3885 }
3886 EXPORT_SYMBOL(drm_property_destroy);
3887 
3888 /**
3889  * drm_object_attach_property - attach a property to a modeset object
3890  * @obj: drm modeset object
3891  * @property: property to attach
3892  * @init_val: initial value of the property
3893  *
3894  * This attaches the given property to the modeset object with the given initial
3895  * value. Currently this function cannot fail since the properties are stored in
3896  * a statically sized array.
3897  */
3898 void drm_object_attach_property(struct drm_mode_object *obj,
3899 				struct drm_property *property,
3900 				uint64_t init_val)
3901 {
3902 	int count = obj->properties->count;
3903 
3904 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3905 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3906 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3907 			"you see this message on the same object type.\n",
3908 			obj->type);
3909 		return;
3910 	}
3911 
3912 	obj->properties->properties[count] = property;
3913 	obj->properties->values[count] = init_val;
3914 	obj->properties->count++;
3915 	if (property->flags & DRM_MODE_PROP_ATOMIC)
3916 		obj->properties->atomic_count++;
3917 }
3918 EXPORT_SYMBOL(drm_object_attach_property);
3919 
3920 /**
3921  * drm_object_property_set_value - set the value of a property
3922  * @obj: drm mode object to set property value for
3923  * @property: property to set
3924  * @val: value the property should be set to
3925  *
3926  * This functions sets a given property on a given object. This function only
3927  * changes the software state of the property, it does not call into the
3928  * driver's ->set_property callback.
3929  *
3930  * Returns:
3931  * Zero on success, error code on failure.
3932  */
3933 int drm_object_property_set_value(struct drm_mode_object *obj,
3934 				  struct drm_property *property, uint64_t val)
3935 {
3936 	int i;
3937 
3938 	for (i = 0; i < obj->properties->count; i++) {
3939 		if (obj->properties->properties[i] == property) {
3940 			obj->properties->values[i] = val;
3941 			return 0;
3942 		}
3943 	}
3944 
3945 	return -EINVAL;
3946 }
3947 EXPORT_SYMBOL(drm_object_property_set_value);
3948 
3949 /**
3950  * drm_object_property_get_value - retrieve the value of a property
3951  * @obj: drm mode object to get property value from
3952  * @property: property to retrieve
3953  * @val: storage for the property value
3954  *
3955  * This function retrieves the softare state of the given property for the given
3956  * property. Since there is no driver callback to retrieve the current property
3957  * value this might be out of sync with the hardware, depending upon the driver
3958  * and property.
3959  *
3960  * Returns:
3961  * Zero on success, error code on failure.
3962  */
3963 int drm_object_property_get_value(struct drm_mode_object *obj,
3964 				  struct drm_property *property, uint64_t *val)
3965 {
3966 	int i;
3967 
3968 	/* read-only properties bypass atomic mechanism and still store
3969 	 * their value in obj->properties->values[].. mostly to avoid
3970 	 * having to deal w/ EDID and similar props in atomic paths:
3971 	 */
3972 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
3973 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
3974 		return drm_atomic_get_property(obj, property, val);
3975 
3976 	for (i = 0; i < obj->properties->count; i++) {
3977 		if (obj->properties->properties[i] == property) {
3978 			*val = obj->properties->values[i];
3979 			return 0;
3980 		}
3981 	}
3982 
3983 	return -EINVAL;
3984 }
3985 EXPORT_SYMBOL(drm_object_property_get_value);
3986 
3987 /**
3988  * drm_mode_getproperty_ioctl - get the property metadata
3989  * @dev: DRM device
3990  * @data: ioctl data
3991  * @file_priv: DRM file info
3992  *
3993  * This function retrieves the metadata for a given property, like the different
3994  * possible values for an enum property or the limits for a range property.
3995  *
3996  * Blob properties are special
3997  *
3998  * Called by the user via ioctl.
3999  *
4000  * Returns:
4001  * Zero on success, negative errno on failure.
4002  */
4003 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4004 			       void *data, struct drm_file *file_priv)
4005 {
4006 	struct drm_mode_get_property *out_resp = data;
4007 	struct drm_property *property;
4008 	int enum_count = 0;
4009 	int value_count = 0;
4010 	int ret = 0, i;
4011 	int copied;
4012 	struct drm_property_enum *prop_enum;
4013 	struct drm_mode_property_enum __user *enum_ptr;
4014 	uint64_t __user *values_ptr;
4015 
4016 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4017 		return -EINVAL;
4018 
4019 	drm_modeset_lock_all(dev);
4020 	property = drm_property_find(dev, out_resp->prop_id);
4021 	if (!property) {
4022 		ret = -ENOENT;
4023 		goto done;
4024 	}
4025 
4026 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4027 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4028 		list_for_each_entry(prop_enum, &property->enum_list, head)
4029 			enum_count++;
4030 	}
4031 
4032 	value_count = property->num_values;
4033 
4034 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4035 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4036 	out_resp->flags = property->flags;
4037 
4038 	if ((out_resp->count_values >= value_count) && value_count) {
4039 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4040 		for (i = 0; i < value_count; i++) {
4041 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4042 				ret = -EFAULT;
4043 				goto done;
4044 			}
4045 		}
4046 	}
4047 	out_resp->count_values = value_count;
4048 
4049 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4050 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4051 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4052 			copied = 0;
4053 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4054 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4055 
4056 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4057 					ret = -EFAULT;
4058 					goto done;
4059 				}
4060 
4061 				if (copy_to_user(&enum_ptr[copied].name,
4062 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4063 					ret = -EFAULT;
4064 					goto done;
4065 				}
4066 				copied++;
4067 			}
4068 		}
4069 		out_resp->count_enum_blobs = enum_count;
4070 	}
4071 
4072 	/*
4073 	 * NOTE: The idea seems to have been to use this to read all the blob
4074 	 * property values. But nothing ever added them to the corresponding
4075 	 * list, userspace always used the special-purpose get_blob ioctl to
4076 	 * read the value for a blob property. It also doesn't make a lot of
4077 	 * sense to return values here when everything else is just metadata for
4078 	 * the property itself.
4079 	 */
4080 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4081 		out_resp->count_enum_blobs = 0;
4082 done:
4083 	drm_modeset_unlock_all(dev);
4084 	return ret;
4085 }
4086 
4087 /**
4088  * drm_property_create_blob - Create new blob property
4089  *
4090  * Creates a new blob property for a specified DRM device, optionally
4091  * copying data.
4092  *
4093  * @dev: DRM device to create property for
4094  * @length: Length to allocate for blob data
4095  * @data: If specified, copies data into blob
4096  *
4097  * Returns:
4098  * New blob property with a single reference on success, or an ERR_PTR
4099  * value on failure.
4100  */
4101 struct drm_property_blob *
4102 drm_property_create_blob(struct drm_device *dev, size_t length,
4103 			 const void *data)
4104 {
4105 	struct drm_property_blob *blob;
4106 	int ret;
4107 
4108 	if (!length)
4109 		return ERR_PTR(-EINVAL);
4110 
4111 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4112 	if (!blob)
4113 		return ERR_PTR(-ENOMEM);
4114 
4115 	/* This must be explicitly initialised, so we can safely call list_del
4116 	 * on it in the removal handler, even if it isn't in a file list. */
4117 	INIT_LIST_HEAD(&blob->head_file);
4118 	blob->length = length;
4119 	blob->dev = dev;
4120 
4121 	if (data)
4122 		memcpy(blob->data, data, length);
4123 
4124 	mutex_lock(&dev->mode_config.blob_lock);
4125 
4126 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4127 	if (ret) {
4128 		kfree(blob);
4129 		mutex_unlock(&dev->mode_config.blob_lock);
4130 		return ERR_PTR(-EINVAL);
4131 	}
4132 
4133 	kref_init(&blob->refcount);
4134 
4135 	list_add_tail(&blob->head_global,
4136 	              &dev->mode_config.property_blob_list);
4137 
4138 	mutex_unlock(&dev->mode_config.blob_lock);
4139 
4140 	return blob;
4141 }
4142 EXPORT_SYMBOL(drm_property_create_blob);
4143 
4144 /**
4145  * drm_property_free_blob - Blob property destructor
4146  *
4147  * Internal free function for blob properties; must not be used directly.
4148  *
4149  * @kref: Reference
4150  */
4151 static void drm_property_free_blob(struct kref *kref)
4152 {
4153 	struct drm_property_blob *blob =
4154 		container_of(kref, struct drm_property_blob, refcount);
4155 
4156 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
4157 
4158 	list_del(&blob->head_global);
4159 	list_del(&blob->head_file);
4160 	drm_mode_object_put(blob->dev, &blob->base);
4161 
4162 	kfree(blob);
4163 }
4164 
4165 /**
4166  * drm_property_unreference_blob - Unreference a blob property
4167  *
4168  * Drop a reference on a blob property. May free the object.
4169  *
4170  * @blob: Pointer to blob property
4171  */
4172 void drm_property_unreference_blob(struct drm_property_blob *blob)
4173 {
4174 	struct drm_device *dev;
4175 
4176 	if (!blob)
4177 		return;
4178 
4179 	dev = blob->dev;
4180 
4181 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4182 
4183 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
4184 			   &dev->mode_config.blob_lock))
4185 		mutex_unlock(&dev->mode_config.blob_lock);
4186 	else
4187 		might_lock(&dev->mode_config.blob_lock);
4188 }
4189 EXPORT_SYMBOL(drm_property_unreference_blob);
4190 
4191 /**
4192  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
4193  *
4194  * Drop a reference on a blob property. May free the object. This must be
4195  * called with blob_lock held.
4196  *
4197  * @blob: Pointer to blob property
4198  */
4199 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
4200 {
4201 	if (!blob)
4202 		return;
4203 
4204 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4205 
4206 	kref_put(&blob->refcount, drm_property_free_blob);
4207 }
4208 
4209 /**
4210  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4211  * @dev:       DRM device
4212  * @file_priv: destroy all blobs owned by this file handle
4213  */
4214 void drm_property_destroy_user_blobs(struct drm_device *dev,
4215 				     struct drm_file *file_priv)
4216 {
4217 	struct drm_property_blob *blob, *bt;
4218 
4219 	mutex_lock(&dev->mode_config.blob_lock);
4220 
4221 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4222 		list_del_init(&blob->head_file);
4223 		drm_property_unreference_blob_locked(blob);
4224 	}
4225 
4226 	mutex_unlock(&dev->mode_config.blob_lock);
4227 }
4228 
4229 /**
4230  * drm_property_reference_blob - Take a reference on an existing property
4231  *
4232  * Take a new reference on an existing blob property.
4233  *
4234  * @blob: Pointer to blob property
4235  */
4236 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4237 {
4238 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4239 	kref_get(&blob->refcount);
4240 	return blob;
4241 }
4242 EXPORT_SYMBOL(drm_property_reference_blob);
4243 
4244 /*
4245  * Like drm_property_lookup_blob, but does not return an additional reference.
4246  * Must be called with blob_lock held.
4247  */
4248 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
4249 							    uint32_t id)
4250 {
4251 	struct drm_mode_object *obj = NULL;
4252 	struct drm_property_blob *blob;
4253 
4254 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
4255 
4256 	mutex_lock(&dev->mode_config.idr_mutex);
4257 	obj = idr_find(&dev->mode_config.crtc_idr, id);
4258 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
4259 		blob = NULL;
4260 	else
4261 		blob = obj_to_blob(obj);
4262 	mutex_unlock(&dev->mode_config.idr_mutex);
4263 
4264 	return blob;
4265 }
4266 
4267 /**
4268  * drm_property_lookup_blob - look up a blob property and take a reference
4269  * @dev: drm device
4270  * @id: id of the blob property
4271  *
4272  * If successful, this takes an additional reference to the blob property.
4273  * callers need to make sure to eventually unreference the returned property
4274  * again, using @drm_property_unreference_blob.
4275  */
4276 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4277 					           uint32_t id)
4278 {
4279 	struct drm_property_blob *blob;
4280 
4281 	mutex_lock(&dev->mode_config.blob_lock);
4282 	blob = __drm_property_lookup_blob(dev, id);
4283 	if (blob) {
4284 		if (!kref_get_unless_zero(&blob->refcount))
4285 			blob = NULL;
4286 	}
4287 	mutex_unlock(&dev->mode_config.blob_lock);
4288 
4289 	return blob;
4290 }
4291 EXPORT_SYMBOL(drm_property_lookup_blob);
4292 
4293 /**
4294  * drm_property_replace_global_blob - atomically replace existing blob property
4295  * @dev: drm device
4296  * @replace: location of blob property pointer to be replaced
4297  * @length: length of data for new blob, or 0 for no data
4298  * @data: content for new blob, or NULL for no data
4299  * @obj_holds_id: optional object for property holding blob ID
4300  * @prop_holds_id: optional property holding blob ID
4301  * @return 0 on success or error on failure
4302  *
4303  * This function will atomically replace a global property in the blob list,
4304  * optionally updating a property which holds the ID of that property. It is
4305  * guaranteed to be atomic: no caller will be allowed to see intermediate
4306  * results, and either the entire operation will succeed and clean up the
4307  * previous property, or it will fail and the state will be unchanged.
4308  *
4309  * If length is 0 or data is NULL, no new blob will be created, and the holding
4310  * property, if specified, will be set to 0.
4311  *
4312  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4313  * by holding the relevant modesetting object lock for its parent.
4314  *
4315  * For example, a drm_connector has a 'PATH' property, which contains the ID
4316  * of a blob property with the value of the MST path information. Calling this
4317  * function with replace pointing to the connector's path_blob_ptr, length and
4318  * data set for the new path information, obj_holds_id set to the connector's
4319  * base object, and prop_holds_id set to the path property name, will perform
4320  * a completely atomic update. The access to path_blob_ptr is protected by the
4321  * caller holding a lock on the connector.
4322  */
4323 static int drm_property_replace_global_blob(struct drm_device *dev,
4324                                             struct drm_property_blob **replace,
4325                                             size_t length,
4326                                             const void *data,
4327                                             struct drm_mode_object *obj_holds_id,
4328                                             struct drm_property *prop_holds_id)
4329 {
4330 	struct drm_property_blob *new_blob = NULL;
4331 	struct drm_property_blob *old_blob = NULL;
4332 	int ret;
4333 
4334 	WARN_ON(replace == NULL);
4335 
4336 	old_blob = *replace;
4337 
4338 	if (length && data) {
4339 		new_blob = drm_property_create_blob(dev, length, data);
4340 		if (IS_ERR(new_blob))
4341 			return PTR_ERR(new_blob);
4342 	}
4343 
4344 	/* This does not need to be synchronised with blob_lock, as the
4345 	 * get_properties ioctl locks all modesetting objects, and
4346 	 * obj_holds_id must be locked before calling here, so we cannot
4347 	 * have its value out of sync with the list membership modified
4348 	 * below under blob_lock. */
4349 	if (obj_holds_id) {
4350 		ret = drm_object_property_set_value(obj_holds_id,
4351 						    prop_holds_id,
4352 						    new_blob ?
4353 						        new_blob->base.id : 0);
4354 		if (ret != 0)
4355 			goto err_created;
4356 	}
4357 
4358 	drm_property_unreference_blob(old_blob);
4359 	*replace = new_blob;
4360 
4361 	return 0;
4362 
4363 err_created:
4364 	drm_property_unreference_blob(new_blob);
4365 	return ret;
4366 }
4367 
4368 /**
4369  * drm_mode_getblob_ioctl - get the contents of a blob property value
4370  * @dev: DRM device
4371  * @data: ioctl data
4372  * @file_priv: DRM file info
4373  *
4374  * This function retrieves the contents of a blob property. The value stored in
4375  * an object's blob property is just a normal modeset object id.
4376  *
4377  * Called by the user via ioctl.
4378  *
4379  * Returns:
4380  * Zero on success, negative errno on failure.
4381  */
4382 int drm_mode_getblob_ioctl(struct drm_device *dev,
4383 			   void *data, struct drm_file *file_priv)
4384 {
4385 	struct drm_mode_get_blob *out_resp = data;
4386 	struct drm_property_blob *blob;
4387 	int ret = 0;
4388 	void __user *blob_ptr;
4389 
4390 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4391 		return -EINVAL;
4392 
4393 	drm_modeset_lock_all(dev);
4394 	mutex_lock(&dev->mode_config.blob_lock);
4395 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4396 	if (!blob) {
4397 		ret = -ENOENT;
4398 		goto done;
4399 	}
4400 
4401 	if (out_resp->length == blob->length) {
4402 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4403 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4404 			ret = -EFAULT;
4405 			goto done;
4406 		}
4407 	}
4408 	out_resp->length = blob->length;
4409 
4410 done:
4411 	mutex_unlock(&dev->mode_config.blob_lock);
4412 	drm_modeset_unlock_all(dev);
4413 	return ret;
4414 }
4415 
4416 /**
4417  * drm_mode_createblob_ioctl - create a new blob property
4418  * @dev: DRM device
4419  * @data: ioctl data
4420  * @file_priv: DRM file info
4421  *
4422  * This function creates a new blob property with user-defined values. In order
4423  * to give us sensible validation and checking when creating, rather than at
4424  * every potential use, we also require a type to be provided upfront.
4425  *
4426  * Called by the user via ioctl.
4427  *
4428  * Returns:
4429  * Zero on success, negative errno on failure.
4430  */
4431 int drm_mode_createblob_ioctl(struct drm_device *dev,
4432 			      void *data, struct drm_file *file_priv)
4433 {
4434 	struct drm_mode_create_blob *out_resp = data;
4435 	struct drm_property_blob *blob;
4436 	void __user *blob_ptr;
4437 	int ret = 0;
4438 
4439 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4440 		return -EINVAL;
4441 
4442 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4443 	if (IS_ERR(blob))
4444 		return PTR_ERR(blob);
4445 
4446 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4447 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4448 		ret = -EFAULT;
4449 		goto out_blob;
4450 	}
4451 
4452 	/* Dropping the lock between create_blob and our access here is safe
4453 	 * as only the same file_priv can remove the blob; at this point, it is
4454 	 * not associated with any file_priv. */
4455 	mutex_lock(&dev->mode_config.blob_lock);
4456 	out_resp->blob_id = blob->base.id;
4457 	list_add_tail(&file_priv->blobs, &blob->head_file);
4458 	mutex_unlock(&dev->mode_config.blob_lock);
4459 
4460 	return 0;
4461 
4462 out_blob:
4463 	drm_property_unreference_blob(blob);
4464 	return ret;
4465 }
4466 
4467 /**
4468  * drm_mode_destroyblob_ioctl - destroy a user blob property
4469  * @dev: DRM device
4470  * @data: ioctl data
4471  * @file_priv: DRM file info
4472  *
4473  * Destroy an existing user-defined blob property.
4474  *
4475  * Called by the user via ioctl.
4476  *
4477  * Returns:
4478  * Zero on success, negative errno on failure.
4479  */
4480 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4481 			       void *data, struct drm_file *file_priv)
4482 {
4483 	struct drm_mode_destroy_blob *out_resp = data;
4484 	struct drm_property_blob *blob = NULL, *bt;
4485 	bool found = false;
4486 	int ret = 0;
4487 
4488 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4489 		return -EINVAL;
4490 
4491 	mutex_lock(&dev->mode_config.blob_lock);
4492 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4493 	if (!blob) {
4494 		ret = -ENOENT;
4495 		goto err;
4496 	}
4497 
4498 	/* Ensure the property was actually created by this user. */
4499 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4500 		if (bt == blob) {
4501 			found = true;
4502 			break;
4503 		}
4504 	}
4505 
4506 	if (!found) {
4507 		ret = -EPERM;
4508 		goto err;
4509 	}
4510 
4511 	/* We must drop head_file here, because we may not be the last
4512 	 * reference on the blob. */
4513 	list_del_init(&blob->head_file);
4514 	drm_property_unreference_blob_locked(blob);
4515 	mutex_unlock(&dev->mode_config.blob_lock);
4516 
4517 	return 0;
4518 
4519 err:
4520 	mutex_unlock(&dev->mode_config.blob_lock);
4521 	return ret;
4522 }
4523 
4524 /**
4525  * drm_mode_connector_set_path_property - set tile property on connector
4526  * @connector: connector to set property on.
4527  * @path: path to use for property; must not be NULL.
4528  *
4529  * This creates a property to expose to userspace to specify a
4530  * connector path. This is mainly used for DisplayPort MST where
4531  * connectors have a topology and we want to allow userspace to give
4532  * them more meaningful names.
4533  *
4534  * Returns:
4535  * Zero on success, negative errno on failure.
4536  */
4537 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4538 					 const char *path)
4539 {
4540 	struct drm_device *dev = connector->dev;
4541 	int ret;
4542 
4543 	ret = drm_property_replace_global_blob(dev,
4544 	                                       &connector->path_blob_ptr,
4545 	                                       strlen(path) + 1,
4546 	                                       path,
4547 	                                       &connector->base,
4548 	                                       dev->mode_config.path_property);
4549 	return ret;
4550 }
4551 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4552 
4553 /**
4554  * drm_mode_connector_set_tile_property - set tile property on connector
4555  * @connector: connector to set property on.
4556  *
4557  * This looks up the tile information for a connector, and creates a
4558  * property for userspace to parse if it exists. The property is of
4559  * the form of 8 integers using ':' as a separator.
4560  *
4561  * Returns:
4562  * Zero on success, errno on failure.
4563  */
4564 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4565 {
4566 	struct drm_device *dev = connector->dev;
4567 	char tile[256];
4568 	int ret;
4569 
4570 	if (!connector->has_tile) {
4571 		ret  = drm_property_replace_global_blob(dev,
4572 		                                        &connector->tile_blob_ptr,
4573 		                                        0,
4574 		                                        NULL,
4575 		                                        &connector->base,
4576 		                                        dev->mode_config.tile_property);
4577 		return ret;
4578 	}
4579 
4580 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4581 		 connector->tile_group->id, connector->tile_is_single_monitor,
4582 		 connector->num_h_tile, connector->num_v_tile,
4583 		 connector->tile_h_loc, connector->tile_v_loc,
4584 		 connector->tile_h_size, connector->tile_v_size);
4585 
4586 	ret = drm_property_replace_global_blob(dev,
4587 	                                       &connector->tile_blob_ptr,
4588 	                                       strlen(tile) + 1,
4589 	                                       tile,
4590 	                                       &connector->base,
4591 	                                       dev->mode_config.tile_property);
4592 	return ret;
4593 }
4594 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4595 
4596 /**
4597  * drm_mode_connector_update_edid_property - update the edid property of a connector
4598  * @connector: drm connector
4599  * @edid: new value of the edid property
4600  *
4601  * This function creates a new blob modeset object and assigns its id to the
4602  * connector's edid property.
4603  *
4604  * Returns:
4605  * Zero on success, negative errno on failure.
4606  */
4607 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4608 					    const struct edid *edid)
4609 {
4610 	struct drm_device *dev = connector->dev;
4611 	size_t size = 0;
4612 	int ret;
4613 
4614 	/* ignore requests to set edid when overridden */
4615 	if (connector->override_edid)
4616 		return 0;
4617 
4618 	if (edid)
4619 		size = EDID_LENGTH * (1 + edid->extensions);
4620 
4621 	ret = drm_property_replace_global_blob(dev,
4622 					       &connector->edid_blob_ptr,
4623 	                                       size,
4624 	                                       edid,
4625 	                                       &connector->base,
4626 	                                       dev->mode_config.edid_property);
4627 	return ret;
4628 }
4629 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4630 
4631 /* Some properties could refer to dynamic refcnt'd objects, or things that
4632  * need special locking to handle lifetime issues (ie. to ensure the prop
4633  * value doesn't become invalid part way through the property update due to
4634  * race).  The value returned by reference via 'obj' should be passed back
4635  * to drm_property_change_valid_put() after the property is set (and the
4636  * object to which the property is attached has a chance to take it's own
4637  * reference).
4638  */
4639 bool drm_property_change_valid_get(struct drm_property *property,
4640 					 uint64_t value, struct drm_mode_object **ref)
4641 {
4642 	int i;
4643 
4644 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4645 		return false;
4646 
4647 	*ref = NULL;
4648 
4649 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4650 		if (value < property->values[0] || value > property->values[1])
4651 			return false;
4652 		return true;
4653 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4654 		int64_t svalue = U642I64(value);
4655 
4656 		if (svalue < U642I64(property->values[0]) ||
4657 				svalue > U642I64(property->values[1]))
4658 			return false;
4659 		return true;
4660 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4661 		uint64_t valid_mask = 0;
4662 
4663 		for (i = 0; i < property->num_values; i++)
4664 			valid_mask |= (1ULL << property->values[i]);
4665 		return !(value & ~valid_mask);
4666 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4667 		struct drm_property_blob *blob;
4668 
4669 		if (value == 0)
4670 			return true;
4671 
4672 		blob = drm_property_lookup_blob(property->dev, value);
4673 		if (blob) {
4674 			*ref = &blob->base;
4675 			return true;
4676 		} else {
4677 			return false;
4678 		}
4679 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4680 		/* a zero value for an object property translates to null: */
4681 		if (value == 0)
4682 			return true;
4683 
4684 		/* handle refcnt'd objects specially: */
4685 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4686 			struct drm_framebuffer *fb;
4687 			fb = drm_framebuffer_lookup(property->dev, value);
4688 			if (fb) {
4689 				*ref = &fb->base;
4690 				return true;
4691 			} else {
4692 				return false;
4693 			}
4694 		} else {
4695 			return _object_find(property->dev, value, property->values[0]) != NULL;
4696 		}
4697 	}
4698 
4699 	for (i = 0; i < property->num_values; i++)
4700 		if (property->values[i] == value)
4701 			return true;
4702 	return false;
4703 }
4704 
4705 void drm_property_change_valid_put(struct drm_property *property,
4706 		struct drm_mode_object *ref)
4707 {
4708 	if (!ref)
4709 		return;
4710 
4711 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4712 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4713 			drm_framebuffer_unreference(obj_to_fb(ref));
4714 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4715 		drm_property_unreference_blob(obj_to_blob(ref));
4716 }
4717 
4718 /**
4719  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4720  * @dev: DRM device
4721  * @data: ioctl data
4722  * @file_priv: DRM file info
4723  *
4724  * This function sets the current value for a connectors's property. It also
4725  * calls into a driver's ->set_property callback to update the hardware state
4726  *
4727  * Called by the user via ioctl.
4728  *
4729  * Returns:
4730  * Zero on success, negative errno on failure.
4731  */
4732 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4733 				       void *data, struct drm_file *file_priv)
4734 {
4735 	struct drm_mode_connector_set_property *conn_set_prop = data;
4736 	struct drm_mode_obj_set_property obj_set_prop = {
4737 		.value = conn_set_prop->value,
4738 		.prop_id = conn_set_prop->prop_id,
4739 		.obj_id = conn_set_prop->connector_id,
4740 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4741 	};
4742 
4743 	/* It does all the locking and checking we need */
4744 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4745 }
4746 
4747 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4748 					   struct drm_property *property,
4749 					   uint64_t value)
4750 {
4751 	int ret = -EINVAL;
4752 	struct drm_connector *connector = obj_to_connector(obj);
4753 
4754 	/* Do DPMS ourselves */
4755 	if (property == connector->dev->mode_config.dpms_property) {
4756 		ret = 0;
4757 		if (connector->funcs->dpms)
4758 			ret = (*connector->funcs->dpms)(connector, (int)value);
4759 	} else if (connector->funcs->set_property)
4760 		ret = connector->funcs->set_property(connector, property, value);
4761 
4762 	/* store the property value if successful */
4763 	if (!ret)
4764 		drm_object_property_set_value(&connector->base, property, value);
4765 	return ret;
4766 }
4767 
4768 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4769 				      struct drm_property *property,
4770 				      uint64_t value)
4771 {
4772 	int ret = -EINVAL;
4773 	struct drm_crtc *crtc = obj_to_crtc(obj);
4774 
4775 	if (crtc->funcs->set_property)
4776 		ret = crtc->funcs->set_property(crtc, property, value);
4777 	if (!ret)
4778 		drm_object_property_set_value(obj, property, value);
4779 
4780 	return ret;
4781 }
4782 
4783 /**
4784  * drm_mode_plane_set_obj_prop - set the value of a property
4785  * @plane: drm plane object to set property value for
4786  * @property: property to set
4787  * @value: value the property should be set to
4788  *
4789  * This functions sets a given property on a given plane object. This function
4790  * calls the driver's ->set_property callback and changes the software state of
4791  * the property if the callback succeeds.
4792  *
4793  * Returns:
4794  * Zero on success, error code on failure.
4795  */
4796 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4797 				struct drm_property *property,
4798 				uint64_t value)
4799 {
4800 	int ret = -EINVAL;
4801 	struct drm_mode_object *obj = &plane->base;
4802 
4803 	if (plane->funcs->set_property)
4804 		ret = plane->funcs->set_property(plane, property, value);
4805 	if (!ret)
4806 		drm_object_property_set_value(obj, property, value);
4807 
4808 	return ret;
4809 }
4810 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4811 
4812 /**
4813  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4814  * @dev: DRM device
4815  * @data: ioctl data
4816  * @file_priv: DRM file info
4817  *
4818  * This function retrieves the current value for an object's property. Compared
4819  * to the connector specific ioctl this one is extended to also work on crtc and
4820  * plane objects.
4821  *
4822  * Called by the user via ioctl.
4823  *
4824  * Returns:
4825  * Zero on success, negative errno on failure.
4826  */
4827 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4828 				      struct drm_file *file_priv)
4829 {
4830 	struct drm_mode_obj_get_properties *arg = data;
4831 	struct drm_mode_object *obj;
4832 	int ret = 0;
4833 
4834 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4835 		return -EINVAL;
4836 
4837 	drm_modeset_lock_all(dev);
4838 
4839 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4840 	if (!obj) {
4841 		ret = -ENOENT;
4842 		goto out;
4843 	}
4844 	if (!obj->properties) {
4845 		ret = -EINVAL;
4846 		goto out;
4847 	}
4848 
4849 	ret = get_properties(obj, file_priv->atomic,
4850 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4851 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4852 			&arg->count_props);
4853 
4854 out:
4855 	drm_modeset_unlock_all(dev);
4856 	return ret;
4857 }
4858 
4859 /**
4860  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4861  * @dev: DRM device
4862  * @data: ioctl data
4863  * @file_priv: DRM file info
4864  *
4865  * This function sets the current value for an object's property. It also calls
4866  * into a driver's ->set_property callback to update the hardware state.
4867  * Compared to the connector specific ioctl this one is extended to also work on
4868  * crtc and plane objects.
4869  *
4870  * Called by the user via ioctl.
4871  *
4872  * Returns:
4873  * Zero on success, negative errno on failure.
4874  */
4875 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4876 				    struct drm_file *file_priv)
4877 {
4878 	struct drm_mode_obj_set_property *arg = data;
4879 	struct drm_mode_object *arg_obj;
4880 	struct drm_mode_object *prop_obj;
4881 	struct drm_property *property;
4882 	int i, ret = -EINVAL;
4883 	struct drm_mode_object *ref;
4884 
4885 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4886 		return -EINVAL;
4887 
4888 	drm_modeset_lock_all(dev);
4889 
4890 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4891 	if (!arg_obj) {
4892 		ret = -ENOENT;
4893 		goto out;
4894 	}
4895 	if (!arg_obj->properties)
4896 		goto out;
4897 
4898 	for (i = 0; i < arg_obj->properties->count; i++)
4899 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
4900 			break;
4901 
4902 	if (i == arg_obj->properties->count)
4903 		goto out;
4904 
4905 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4906 					DRM_MODE_OBJECT_PROPERTY);
4907 	if (!prop_obj) {
4908 		ret = -ENOENT;
4909 		goto out;
4910 	}
4911 	property = obj_to_property(prop_obj);
4912 
4913 	if (!drm_property_change_valid_get(property, arg->value, &ref))
4914 		goto out;
4915 
4916 	switch (arg_obj->type) {
4917 	case DRM_MODE_OBJECT_CONNECTOR:
4918 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4919 						      arg->value);
4920 		break;
4921 	case DRM_MODE_OBJECT_CRTC:
4922 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4923 		break;
4924 	case DRM_MODE_OBJECT_PLANE:
4925 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4926 						  property, arg->value);
4927 		break;
4928 	}
4929 
4930 	drm_property_change_valid_put(property, ref);
4931 
4932 out:
4933 	drm_modeset_unlock_all(dev);
4934 	return ret;
4935 }
4936 
4937 /**
4938  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4939  * @connector: connector to attach
4940  * @encoder: encoder to attach @connector to
4941  *
4942  * This function links up a connector to an encoder. Note that the routing
4943  * restrictions between encoders and crtcs are exposed to userspace through the
4944  * possible_clones and possible_crtcs bitmasks.
4945  *
4946  * Returns:
4947  * Zero on success, negative errno on failure.
4948  */
4949 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4950 				      struct drm_encoder *encoder)
4951 {
4952 	int i;
4953 
4954 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4955 		if (connector->encoder_ids[i] == 0) {
4956 			connector->encoder_ids[i] = encoder->base.id;
4957 			return 0;
4958 		}
4959 	}
4960 	return -ENOMEM;
4961 }
4962 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4963 
4964 /**
4965  * drm_mode_crtc_set_gamma_size - set the gamma table size
4966  * @crtc: CRTC to set the gamma table size for
4967  * @gamma_size: size of the gamma table
4968  *
4969  * Drivers which support gamma tables should set this to the supported gamma
4970  * table size when initializing the CRTC. Currently the drm core only supports a
4971  * fixed gamma table size.
4972  *
4973  * Returns:
4974  * Zero on success, negative errno on failure.
4975  */
4976 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4977 				 int gamma_size)
4978 {
4979 	crtc->gamma_size = gamma_size;
4980 
4981 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
4982 				    GFP_KERNEL);
4983 	if (!crtc->gamma_store) {
4984 		crtc->gamma_size = 0;
4985 		return -ENOMEM;
4986 	}
4987 
4988 	return 0;
4989 }
4990 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4991 
4992 /**
4993  * drm_mode_gamma_set_ioctl - set the gamma table
4994  * @dev: DRM device
4995  * @data: ioctl data
4996  * @file_priv: DRM file info
4997  *
4998  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4999  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5000  *
5001  * Called by the user via ioctl.
5002  *
5003  * Returns:
5004  * Zero on success, negative errno on failure.
5005  */
5006 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5007 			     void *data, struct drm_file *file_priv)
5008 {
5009 	struct drm_mode_crtc_lut *crtc_lut = data;
5010 	struct drm_crtc *crtc;
5011 	void *r_base, *g_base, *b_base;
5012 	int size;
5013 	int ret = 0;
5014 
5015 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5016 		return -EINVAL;
5017 
5018 	drm_modeset_lock_all(dev);
5019 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5020 	if (!crtc) {
5021 		ret = -ENOENT;
5022 		goto out;
5023 	}
5024 
5025 	if (crtc->funcs->gamma_set == NULL) {
5026 		ret = -ENOSYS;
5027 		goto out;
5028 	}
5029 
5030 	/* memcpy into gamma store */
5031 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5032 		ret = -EINVAL;
5033 		goto out;
5034 	}
5035 
5036 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5037 	r_base = crtc->gamma_store;
5038 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5039 		ret = -EFAULT;
5040 		goto out;
5041 	}
5042 
5043 	g_base = r_base + size;
5044 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5045 		ret = -EFAULT;
5046 		goto out;
5047 	}
5048 
5049 	b_base = g_base + size;
5050 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5051 		ret = -EFAULT;
5052 		goto out;
5053 	}
5054 
5055 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
5056 
5057 out:
5058 	drm_modeset_unlock_all(dev);
5059 	return ret;
5060 
5061 }
5062 
5063 /**
5064  * drm_mode_gamma_get_ioctl - get the gamma table
5065  * @dev: DRM device
5066  * @data: ioctl data
5067  * @file_priv: DRM file info
5068  *
5069  * Copy the current gamma table into the storage provided. This also provides
5070  * the gamma table size the driver expects, which can be used to size the
5071  * allocated storage.
5072  *
5073  * Called by the user via ioctl.
5074  *
5075  * Returns:
5076  * Zero on success, negative errno on failure.
5077  */
5078 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5079 			     void *data, struct drm_file *file_priv)
5080 {
5081 	struct drm_mode_crtc_lut *crtc_lut = data;
5082 	struct drm_crtc *crtc;
5083 	void *r_base, *g_base, *b_base;
5084 	int size;
5085 	int ret = 0;
5086 
5087 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5088 		return -EINVAL;
5089 
5090 	drm_modeset_lock_all(dev);
5091 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5092 	if (!crtc) {
5093 		ret = -ENOENT;
5094 		goto out;
5095 	}
5096 
5097 	/* memcpy into gamma store */
5098 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5099 		ret = -EINVAL;
5100 		goto out;
5101 	}
5102 
5103 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5104 	r_base = crtc->gamma_store;
5105 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5106 		ret = -EFAULT;
5107 		goto out;
5108 	}
5109 
5110 	g_base = r_base + size;
5111 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5112 		ret = -EFAULT;
5113 		goto out;
5114 	}
5115 
5116 	b_base = g_base + size;
5117 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5118 		ret = -EFAULT;
5119 		goto out;
5120 	}
5121 out:
5122 	drm_modeset_unlock_all(dev);
5123 	return ret;
5124 }
5125 
5126 /**
5127  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5128  * @dev: DRM device
5129  * @data: ioctl data
5130  * @file_priv: DRM file info
5131  *
5132  * This schedules an asynchronous update on a given CRTC, called page flip.
5133  * Optionally a drm event is generated to signal the completion of the event.
5134  * Generic drivers cannot assume that a pageflip with changed framebuffer
5135  * properties (including driver specific metadata like tiling layout) will work,
5136  * but some drivers support e.g. pixel format changes through the pageflip
5137  * ioctl.
5138  *
5139  * Called by the user via ioctl.
5140  *
5141  * Returns:
5142  * Zero on success, negative errno on failure.
5143  */
5144 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5145 			     void *data, struct drm_file *file_priv)
5146 {
5147 	struct drm_mode_crtc_page_flip *page_flip = data;
5148 	struct drm_crtc *crtc;
5149 	struct drm_framebuffer *fb = NULL;
5150 	struct drm_pending_vblank_event *e = NULL;
5151 	unsigned long flags;
5152 	int ret = -EINVAL;
5153 
5154 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5155 	    page_flip->reserved != 0)
5156 		return -EINVAL;
5157 
5158 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5159 		return -EINVAL;
5160 
5161 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5162 	if (!crtc)
5163 		return -ENOENT;
5164 
5165 	drm_modeset_lock_crtc(crtc, crtc->primary);
5166 	if (crtc->primary->fb == NULL) {
5167 		/* The framebuffer is currently unbound, presumably
5168 		 * due to a hotplug event, that userspace has not
5169 		 * yet discovered.
5170 		 */
5171 		ret = -EBUSY;
5172 		goto out;
5173 	}
5174 
5175 	if (crtc->funcs->page_flip == NULL)
5176 		goto out;
5177 
5178 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5179 	if (!fb) {
5180 		ret = -ENOENT;
5181 		goto out;
5182 	}
5183 
5184 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5185 	if (ret)
5186 		goto out;
5187 
5188 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5189 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5190 		ret = -EINVAL;
5191 		goto out;
5192 	}
5193 
5194 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5195 		ret = -ENOMEM;
5196 		spin_lock_irqsave(&dev->event_lock, flags);
5197 		if (file_priv->event_space < sizeof(e->event)) {
5198 			spin_unlock_irqrestore(&dev->event_lock, flags);
5199 			goto out;
5200 		}
5201 		file_priv->event_space -= sizeof(e->event);
5202 		spin_unlock_irqrestore(&dev->event_lock, flags);
5203 
5204 		e = kzalloc(sizeof(*e), GFP_KERNEL);
5205 		if (e == NULL) {
5206 			spin_lock_irqsave(&dev->event_lock, flags);
5207 			file_priv->event_space += sizeof(e->event);
5208 			spin_unlock_irqrestore(&dev->event_lock, flags);
5209 			goto out;
5210 		}
5211 
5212 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5213 		e->event.base.length = sizeof(e->event);
5214 		e->event.user_data = page_flip->user_data;
5215 		e->base.event = &e->event.base;
5216 		e->base.file_priv = file_priv;
5217 		e->base.destroy =
5218 			(void (*) (struct drm_pending_event *)) kfree;
5219 	}
5220 
5221 	crtc->primary->old_fb = crtc->primary->fb;
5222 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5223 	if (ret) {
5224 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5225 			spin_lock_irqsave(&dev->event_lock, flags);
5226 			file_priv->event_space += sizeof(e->event);
5227 			spin_unlock_irqrestore(&dev->event_lock, flags);
5228 			kfree(e);
5229 		}
5230 		/* Keep the old fb, don't unref it. */
5231 		crtc->primary->old_fb = NULL;
5232 	} else {
5233 		crtc->primary->fb = fb;
5234 		/* Unref only the old framebuffer. */
5235 		fb = NULL;
5236 	}
5237 
5238 out:
5239 	if (fb)
5240 		drm_framebuffer_unreference(fb);
5241 	if (crtc->primary->old_fb)
5242 		drm_framebuffer_unreference(crtc->primary->old_fb);
5243 	crtc->primary->old_fb = NULL;
5244 	drm_modeset_unlock_crtc(crtc);
5245 
5246 	return ret;
5247 }
5248 
5249 /**
5250  * drm_mode_config_reset - call ->reset callbacks
5251  * @dev: drm device
5252  *
5253  * This functions calls all the crtc's, encoder's and connector's ->reset
5254  * callback. Drivers can use this in e.g. their driver load or resume code to
5255  * reset hardware and software state.
5256  */
5257 void drm_mode_config_reset(struct drm_device *dev)
5258 {
5259 	struct drm_crtc *crtc;
5260 	struct drm_plane *plane;
5261 	struct drm_encoder *encoder;
5262 	struct drm_connector *connector;
5263 
5264 	drm_for_each_plane(plane, dev)
5265 		if (plane->funcs->reset)
5266 			plane->funcs->reset(plane);
5267 
5268 	drm_for_each_crtc(crtc, dev)
5269 		if (crtc->funcs->reset)
5270 			crtc->funcs->reset(crtc);
5271 
5272 	drm_for_each_encoder(encoder, dev)
5273 		if (encoder->funcs->reset)
5274 			encoder->funcs->reset(encoder);
5275 
5276 	mutex_lock(&dev->mode_config.mutex);
5277 	drm_for_each_connector(connector, dev)
5278 		if (connector->funcs->reset)
5279 			connector->funcs->reset(connector);
5280 	mutex_unlock(&dev->mode_config.mutex);
5281 }
5282 EXPORT_SYMBOL(drm_mode_config_reset);
5283 
5284 /**
5285  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5286  * @dev: DRM device
5287  * @data: ioctl data
5288  * @file_priv: DRM file info
5289  *
5290  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5291  * TTM or something else entirely) and returns the resulting buffer handle. This
5292  * handle can then be wrapped up into a framebuffer modeset object.
5293  *
5294  * Note that userspace is not allowed to use such objects for render
5295  * acceleration - drivers must create their own private ioctls for such a use
5296  * case.
5297  *
5298  * Called by the user via ioctl.
5299  *
5300  * Returns:
5301  * Zero on success, negative errno on failure.
5302  */
5303 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5304 			       void *data, struct drm_file *file_priv)
5305 {
5306 	struct drm_mode_create_dumb *args = data;
5307 	u32 cpp, stride, size;
5308 
5309 	if (!dev->driver->dumb_create)
5310 		return -ENOSYS;
5311 	if (!args->width || !args->height || !args->bpp)
5312 		return -EINVAL;
5313 
5314 	/* overflow checks for 32bit size calculations */
5315 	/* NOTE: DIV_ROUND_UP() can overflow */
5316 	cpp = DIV_ROUND_UP(args->bpp, 8);
5317 	if (!cpp || cpp > 0xffffffffU / args->width)
5318 		return -EINVAL;
5319 	stride = cpp * args->width;
5320 	if (args->height > 0xffffffffU / stride)
5321 		return -EINVAL;
5322 
5323 	/* test for wrap-around */
5324 	size = args->height * stride;
5325 	if (PAGE_ALIGN(size) == 0)
5326 		return -EINVAL;
5327 
5328 	/*
5329 	 * handle, pitch and size are output parameters. Zero them out to
5330 	 * prevent drivers from accidentally using uninitialized data. Since
5331 	 * not all existing userspace is clearing these fields properly we
5332 	 * cannot reject IOCTL with garbage in them.
5333 	 */
5334 	args->handle = 0;
5335 	args->pitch = 0;
5336 	args->size = 0;
5337 
5338 	return dev->driver->dumb_create(file_priv, dev, args);
5339 }
5340 
5341 /**
5342  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5343  * @dev: DRM device
5344  * @data: ioctl data
5345  * @file_priv: DRM file info
5346  *
5347  * Allocate an offset in the drm device node's address space to be able to
5348  * memory map a dumb buffer.
5349  *
5350  * Called by the user via ioctl.
5351  *
5352  * Returns:
5353  * Zero on success, negative errno on failure.
5354  */
5355 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5356 			     void *data, struct drm_file *file_priv)
5357 {
5358 	struct drm_mode_map_dumb *args = data;
5359 
5360 	/* call driver ioctl to get mmap offset */
5361 	if (!dev->driver->dumb_map_offset)
5362 		return -ENOSYS;
5363 
5364 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5365 }
5366 
5367 /**
5368  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5369  * @dev: DRM device
5370  * @data: ioctl data
5371  * @file_priv: DRM file info
5372  *
5373  * This destroys the userspace handle for the given dumb backing storage buffer.
5374  * Since buffer objects must be reference counted in the kernel a buffer object
5375  * won't be immediately freed if a framebuffer modeset object still uses it.
5376  *
5377  * Called by the user via ioctl.
5378  *
5379  * Returns:
5380  * Zero on success, negative errno on failure.
5381  */
5382 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5383 				void *data, struct drm_file *file_priv)
5384 {
5385 	struct drm_mode_destroy_dumb *args = data;
5386 
5387 	if (!dev->driver->dumb_destroy)
5388 		return -ENOSYS;
5389 
5390 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5391 }
5392 
5393 /**
5394  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5395  * @format: pixel format (DRM_FORMAT_*)
5396  * @depth: storage for the depth value
5397  * @bpp: storage for the bpp value
5398  *
5399  * This only supports RGB formats here for compat with code that doesn't use
5400  * pixel formats directly yet.
5401  */
5402 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5403 			  int *bpp)
5404 {
5405 	switch (format) {
5406 	case DRM_FORMAT_C8:
5407 	case DRM_FORMAT_RGB332:
5408 	case DRM_FORMAT_BGR233:
5409 		*depth = 8;
5410 		*bpp = 8;
5411 		break;
5412 	case DRM_FORMAT_XRGB1555:
5413 	case DRM_FORMAT_XBGR1555:
5414 	case DRM_FORMAT_RGBX5551:
5415 	case DRM_FORMAT_BGRX5551:
5416 	case DRM_FORMAT_ARGB1555:
5417 	case DRM_FORMAT_ABGR1555:
5418 	case DRM_FORMAT_RGBA5551:
5419 	case DRM_FORMAT_BGRA5551:
5420 		*depth = 15;
5421 		*bpp = 16;
5422 		break;
5423 	case DRM_FORMAT_RGB565:
5424 	case DRM_FORMAT_BGR565:
5425 		*depth = 16;
5426 		*bpp = 16;
5427 		break;
5428 	case DRM_FORMAT_RGB888:
5429 	case DRM_FORMAT_BGR888:
5430 		*depth = 24;
5431 		*bpp = 24;
5432 		break;
5433 	case DRM_FORMAT_XRGB8888:
5434 	case DRM_FORMAT_XBGR8888:
5435 	case DRM_FORMAT_RGBX8888:
5436 	case DRM_FORMAT_BGRX8888:
5437 		*depth = 24;
5438 		*bpp = 32;
5439 		break;
5440 	case DRM_FORMAT_XRGB2101010:
5441 	case DRM_FORMAT_XBGR2101010:
5442 	case DRM_FORMAT_RGBX1010102:
5443 	case DRM_FORMAT_BGRX1010102:
5444 	case DRM_FORMAT_ARGB2101010:
5445 	case DRM_FORMAT_ABGR2101010:
5446 	case DRM_FORMAT_RGBA1010102:
5447 	case DRM_FORMAT_BGRA1010102:
5448 		*depth = 30;
5449 		*bpp = 32;
5450 		break;
5451 	case DRM_FORMAT_ARGB8888:
5452 	case DRM_FORMAT_ABGR8888:
5453 	case DRM_FORMAT_RGBA8888:
5454 	case DRM_FORMAT_BGRA8888:
5455 		*depth = 32;
5456 		*bpp = 32;
5457 		break;
5458 	default:
5459 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5460 			      drm_get_format_name(format));
5461 		*depth = 0;
5462 		*bpp = 0;
5463 		break;
5464 	}
5465 }
5466 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5467 
5468 /**
5469  * drm_format_num_planes - get the number of planes for format
5470  * @format: pixel format (DRM_FORMAT_*)
5471  *
5472  * Returns:
5473  * The number of planes used by the specified pixel format.
5474  */
5475 int drm_format_num_planes(uint32_t format)
5476 {
5477 	switch (format) {
5478 	case DRM_FORMAT_YUV410:
5479 	case DRM_FORMAT_YVU410:
5480 	case DRM_FORMAT_YUV411:
5481 	case DRM_FORMAT_YVU411:
5482 	case DRM_FORMAT_YUV420:
5483 	case DRM_FORMAT_YVU420:
5484 	case DRM_FORMAT_YUV422:
5485 	case DRM_FORMAT_YVU422:
5486 	case DRM_FORMAT_YUV444:
5487 	case DRM_FORMAT_YVU444:
5488 		return 3;
5489 	case DRM_FORMAT_NV12:
5490 	case DRM_FORMAT_NV21:
5491 	case DRM_FORMAT_NV16:
5492 	case DRM_FORMAT_NV61:
5493 	case DRM_FORMAT_NV24:
5494 	case DRM_FORMAT_NV42:
5495 		return 2;
5496 	default:
5497 		return 1;
5498 	}
5499 }
5500 EXPORT_SYMBOL(drm_format_num_planes);
5501 
5502 /**
5503  * drm_format_plane_cpp - determine the bytes per pixel value
5504  * @format: pixel format (DRM_FORMAT_*)
5505  * @plane: plane index
5506  *
5507  * Returns:
5508  * The bytes per pixel value for the specified plane.
5509  */
5510 int drm_format_plane_cpp(uint32_t format, int plane)
5511 {
5512 	unsigned int depth;
5513 	int bpp;
5514 
5515 	if (plane >= drm_format_num_planes(format))
5516 		return 0;
5517 
5518 	switch (format) {
5519 	case DRM_FORMAT_YUYV:
5520 	case DRM_FORMAT_YVYU:
5521 	case DRM_FORMAT_UYVY:
5522 	case DRM_FORMAT_VYUY:
5523 		return 2;
5524 	case DRM_FORMAT_NV12:
5525 	case DRM_FORMAT_NV21:
5526 	case DRM_FORMAT_NV16:
5527 	case DRM_FORMAT_NV61:
5528 	case DRM_FORMAT_NV24:
5529 	case DRM_FORMAT_NV42:
5530 		return plane ? 2 : 1;
5531 	case DRM_FORMAT_YUV410:
5532 	case DRM_FORMAT_YVU410:
5533 	case DRM_FORMAT_YUV411:
5534 	case DRM_FORMAT_YVU411:
5535 	case DRM_FORMAT_YUV420:
5536 	case DRM_FORMAT_YVU420:
5537 	case DRM_FORMAT_YUV422:
5538 	case DRM_FORMAT_YVU422:
5539 	case DRM_FORMAT_YUV444:
5540 	case DRM_FORMAT_YVU444:
5541 		return 1;
5542 	default:
5543 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5544 		return bpp >> 3;
5545 	}
5546 }
5547 EXPORT_SYMBOL(drm_format_plane_cpp);
5548 
5549 /**
5550  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5551  * @format: pixel format (DRM_FORMAT_*)
5552  *
5553  * Returns:
5554  * The horizontal chroma subsampling factor for the
5555  * specified pixel format.
5556  */
5557 int drm_format_horz_chroma_subsampling(uint32_t format)
5558 {
5559 	switch (format) {
5560 	case DRM_FORMAT_YUV411:
5561 	case DRM_FORMAT_YVU411:
5562 	case DRM_FORMAT_YUV410:
5563 	case DRM_FORMAT_YVU410:
5564 		return 4;
5565 	case DRM_FORMAT_YUYV:
5566 	case DRM_FORMAT_YVYU:
5567 	case DRM_FORMAT_UYVY:
5568 	case DRM_FORMAT_VYUY:
5569 	case DRM_FORMAT_NV12:
5570 	case DRM_FORMAT_NV21:
5571 	case DRM_FORMAT_NV16:
5572 	case DRM_FORMAT_NV61:
5573 	case DRM_FORMAT_YUV422:
5574 	case DRM_FORMAT_YVU422:
5575 	case DRM_FORMAT_YUV420:
5576 	case DRM_FORMAT_YVU420:
5577 		return 2;
5578 	default:
5579 		return 1;
5580 	}
5581 }
5582 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5583 
5584 /**
5585  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5586  * @format: pixel format (DRM_FORMAT_*)
5587  *
5588  * Returns:
5589  * The vertical chroma subsampling factor for the
5590  * specified pixel format.
5591  */
5592 int drm_format_vert_chroma_subsampling(uint32_t format)
5593 {
5594 	switch (format) {
5595 	case DRM_FORMAT_YUV410:
5596 	case DRM_FORMAT_YVU410:
5597 		return 4;
5598 	case DRM_FORMAT_YUV420:
5599 	case DRM_FORMAT_YVU420:
5600 	case DRM_FORMAT_NV12:
5601 	case DRM_FORMAT_NV21:
5602 		return 2;
5603 	default:
5604 		return 1;
5605 	}
5606 }
5607 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5608 
5609 /**
5610  * drm_rotation_simplify() - Try to simplify the rotation
5611  * @rotation: Rotation to be simplified
5612  * @supported_rotations: Supported rotations
5613  *
5614  * Attempt to simplify the rotation to a form that is supported.
5615  * Eg. if the hardware supports everything except DRM_REFLECT_X
5616  * one could call this function like this:
5617  *
5618  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5619  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5620  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5621  *
5622  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5623  * transforms the hardware supports, this function may not
5624  * be able to produce a supported transform, so the caller should
5625  * check the result afterwards.
5626  */
5627 unsigned int drm_rotation_simplify(unsigned int rotation,
5628 				   unsigned int supported_rotations)
5629 {
5630 	if (rotation & ~supported_rotations) {
5631 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5632 		rotation = (rotation & ~0xf) | BIT((ffs(rotation & 0xf) + 1) % 4);
5633 	}
5634 
5635 	return rotation;
5636 }
5637 EXPORT_SYMBOL(drm_rotation_simplify);
5638 
5639 /**
5640  * drm_mode_config_init - initialize DRM mode_configuration structure
5641  * @dev: DRM device
5642  *
5643  * Initialize @dev's mode_config structure, used for tracking the graphics
5644  * configuration of @dev.
5645  *
5646  * Since this initializes the modeset locks, no locking is possible. Which is no
5647  * problem, since this should happen single threaded at init time. It is the
5648  * driver's problem to ensure this guarantee.
5649  *
5650  */
5651 void drm_mode_config_init(struct drm_device *dev)
5652 {
5653 	mutex_init(&dev->mode_config.mutex);
5654 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5655 	mutex_init(&dev->mode_config.idr_mutex);
5656 	mutex_init(&dev->mode_config.fb_lock);
5657 	mutex_init(&dev->mode_config.blob_lock);
5658 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5659 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5660 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5661 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5662 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5663 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5664 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5665 	idr_init(&dev->mode_config.crtc_idr);
5666 	idr_init(&dev->mode_config.tile_idr);
5667 
5668 	drm_modeset_lock_all(dev);
5669 	drm_mode_create_standard_properties(dev);
5670 	drm_modeset_unlock_all(dev);
5671 
5672 	/* Just to be sure */
5673 	dev->mode_config.num_fb = 0;
5674 	dev->mode_config.num_connector = 0;
5675 	dev->mode_config.num_crtc = 0;
5676 	dev->mode_config.num_encoder = 0;
5677 	dev->mode_config.num_overlay_plane = 0;
5678 	dev->mode_config.num_total_plane = 0;
5679 }
5680 EXPORT_SYMBOL(drm_mode_config_init);
5681 
5682 /**
5683  * drm_mode_config_cleanup - free up DRM mode_config info
5684  * @dev: DRM device
5685  *
5686  * Free up all the connectors and CRTCs associated with this DRM device, then
5687  * free up the framebuffers and associated buffer objects.
5688  *
5689  * Note that since this /should/ happen single-threaded at driver/device
5690  * teardown time, no locking is required. It's the driver's job to ensure that
5691  * this guarantee actually holds true.
5692  *
5693  * FIXME: cleanup any dangling user buffer objects too
5694  */
5695 void drm_mode_config_cleanup(struct drm_device *dev)
5696 {
5697 	struct drm_connector *connector, *ot;
5698 	struct drm_crtc *crtc, *ct;
5699 	struct drm_encoder *encoder, *enct;
5700 	struct drm_framebuffer *fb, *fbt;
5701 	struct drm_property *property, *pt;
5702 	struct drm_property_blob *blob, *bt;
5703 	struct drm_plane *plane, *plt;
5704 
5705 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5706 				 head) {
5707 		encoder->funcs->destroy(encoder);
5708 	}
5709 
5710 	list_for_each_entry_safe(connector, ot,
5711 				 &dev->mode_config.connector_list, head) {
5712 		connector->funcs->destroy(connector);
5713 	}
5714 
5715 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5716 				 head) {
5717 		drm_property_destroy(dev, property);
5718 	}
5719 
5720 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5721 				 head_global) {
5722 		drm_property_unreference_blob(blob);
5723 	}
5724 
5725 	/*
5726 	 * Single-threaded teardown context, so it's not required to grab the
5727 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5728 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5729 	 *
5730 	 * Also, if there are any framebuffers left, that's a driver leak now,
5731 	 * so politely WARN about this.
5732 	 */
5733 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5734 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5735 		drm_framebuffer_remove(fb);
5736 	}
5737 
5738 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5739 				 head) {
5740 		plane->funcs->destroy(plane);
5741 	}
5742 
5743 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5744 		crtc->funcs->destroy(crtc);
5745 	}
5746 
5747 	idr_destroy(&dev->mode_config.tile_idr);
5748 	idr_destroy(&dev->mode_config.crtc_idr);
5749 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5750 }
5751 EXPORT_SYMBOL(drm_mode_config_cleanup);
5752 
5753 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5754 						       unsigned int supported_rotations)
5755 {
5756 	static const struct drm_prop_enum_list props[] = {
5757 		{ DRM_ROTATE_0,   "rotate-0" },
5758 		{ DRM_ROTATE_90,  "rotate-90" },
5759 		{ DRM_ROTATE_180, "rotate-180" },
5760 		{ DRM_ROTATE_270, "rotate-270" },
5761 		{ DRM_REFLECT_X,  "reflect-x" },
5762 		{ DRM_REFLECT_Y,  "reflect-y" },
5763 	};
5764 
5765 	return drm_property_create_bitmask(dev, 0, "rotation",
5766 					   props, ARRAY_SIZE(props),
5767 					   supported_rotations);
5768 }
5769 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5770 
5771 /**
5772  * DOC: Tile group
5773  *
5774  * Tile groups are used to represent tiled monitors with a unique
5775  * integer identifier. Tiled monitors using DisplayID v1.3 have
5776  * a unique 8-byte handle, we store this in a tile group, so we
5777  * have a common identifier for all tiles in a monitor group.
5778  */
5779 static void drm_tile_group_free(struct kref *kref)
5780 {
5781 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5782 	struct drm_device *dev = tg->dev;
5783 	mutex_lock(&dev->mode_config.idr_mutex);
5784 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5785 	mutex_unlock(&dev->mode_config.idr_mutex);
5786 	kfree(tg);
5787 }
5788 
5789 /**
5790  * drm_mode_put_tile_group - drop a reference to a tile group.
5791  * @dev: DRM device
5792  * @tg: tile group to drop reference to.
5793  *
5794  * drop reference to tile group and free if 0.
5795  */
5796 void drm_mode_put_tile_group(struct drm_device *dev,
5797 			     struct drm_tile_group *tg)
5798 {
5799 	kref_put(&tg->refcount, drm_tile_group_free);
5800 }
5801 
5802 /**
5803  * drm_mode_get_tile_group - get a reference to an existing tile group
5804  * @dev: DRM device
5805  * @topology: 8-bytes unique per monitor.
5806  *
5807  * Use the unique bytes to get a reference to an existing tile group.
5808  *
5809  * RETURNS:
5810  * tile group or NULL if not found.
5811  */
5812 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5813 					       char topology[8])
5814 {
5815 	struct drm_tile_group *tg;
5816 	int id;
5817 	mutex_lock(&dev->mode_config.idr_mutex);
5818 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5819 		if (!memcmp(tg->group_data, topology, 8)) {
5820 			if (!kref_get_unless_zero(&tg->refcount))
5821 				tg = NULL;
5822 			mutex_unlock(&dev->mode_config.idr_mutex);
5823 			return tg;
5824 		}
5825 	}
5826 	mutex_unlock(&dev->mode_config.idr_mutex);
5827 	return NULL;
5828 }
5829 EXPORT_SYMBOL(drm_mode_get_tile_group);
5830 
5831 /**
5832  * drm_mode_create_tile_group - create a tile group from a displayid description
5833  * @dev: DRM device
5834  * @topology: 8-bytes unique per monitor.
5835  *
5836  * Create a tile group for the unique monitor, and get a unique
5837  * identifier for the tile group.
5838  *
5839  * RETURNS:
5840  * new tile group or error.
5841  */
5842 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5843 						  char topology[8])
5844 {
5845 	struct drm_tile_group *tg;
5846 	int ret;
5847 
5848 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5849 	if (!tg)
5850 		return ERR_PTR(-ENOMEM);
5851 
5852 	kref_init(&tg->refcount);
5853 	memcpy(tg->group_data, topology, 8);
5854 	tg->dev = dev;
5855 
5856 	mutex_lock(&dev->mode_config.idr_mutex);
5857 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5858 	if (ret >= 0) {
5859 		tg->id = ret;
5860 	} else {
5861 		kfree(tg);
5862 		tg = ERR_PTR(ret);
5863 	}
5864 
5865 	mutex_unlock(&dev->mode_config.idr_mutex);
5866 	return tg;
5867 }
5868 EXPORT_SYMBOL(drm_mode_create_tile_group);
5869