xref: /openbmc/linux/drivers/gpu/drm/drm_crtc.c (revision a8da474e)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	struct ida ida;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 	int i;
196 
197 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
198 		ida_init(&drm_connector_enum_list[i].ida);
199 }
200 
201 void drm_connector_ida_destroy(void)
202 {
203 	int i;
204 
205 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
206 		ida_destroy(&drm_connector_enum_list[i].ida);
207 }
208 
209 /**
210  * drm_get_connector_status_name - return a string for connector status
211  * @status: connector status to compute name of
212  *
213  * In contrast to the other drm_get_*_name functions this one here returns a
214  * const pointer and hence is threadsafe.
215  */
216 const char *drm_get_connector_status_name(enum drm_connector_status status)
217 {
218 	if (status == connector_status_connected)
219 		return "connected";
220 	else if (status == connector_status_disconnected)
221 		return "disconnected";
222 	else
223 		return "unknown";
224 }
225 EXPORT_SYMBOL(drm_get_connector_status_name);
226 
227 /**
228  * drm_get_subpixel_order_name - return a string for a given subpixel enum
229  * @order: enum of subpixel_order
230  *
231  * Note you could abuse this and return something out of bounds, but that
232  * would be a caller error.  No unscrubbed user data should make it here.
233  */
234 const char *drm_get_subpixel_order_name(enum subpixel_order order)
235 {
236 	return drm_subpixel_enum_list[order].name;
237 }
238 EXPORT_SYMBOL(drm_get_subpixel_order_name);
239 
240 static char printable_char(int c)
241 {
242 	return isascii(c) && isprint(c) ? c : '?';
243 }
244 
245 /**
246  * drm_get_format_name - return a string for drm fourcc format
247  * @format: format to compute name of
248  *
249  * Note that the buffer used by this function is globally shared and owned by
250  * the function itself.
251  *
252  * FIXME: This isn't really multithreading safe.
253  */
254 const char *drm_get_format_name(uint32_t format)
255 {
256 	static char buf[32];
257 
258 	snprintf(buf, sizeof(buf),
259 		 "%c%c%c%c %s-endian (0x%08x)",
260 		 printable_char(format & 0xff),
261 		 printable_char((format >> 8) & 0xff),
262 		 printable_char((format >> 16) & 0xff),
263 		 printable_char((format >> 24) & 0x7f),
264 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
265 		 format);
266 
267 	return buf;
268 }
269 EXPORT_SYMBOL(drm_get_format_name);
270 
271 /*
272  * Internal function to assign a slot in the object idr and optionally
273  * register the object into the idr.
274  */
275 static int drm_mode_object_get_reg(struct drm_device *dev,
276 				   struct drm_mode_object *obj,
277 				   uint32_t obj_type,
278 				   bool register_obj)
279 {
280 	int ret;
281 
282 	mutex_lock(&dev->mode_config.idr_mutex);
283 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
284 	if (ret >= 0) {
285 		/*
286 		 * Set up the object linking under the protection of the idr
287 		 * lock so that other users can't see inconsistent state.
288 		 */
289 		obj->id = ret;
290 		obj->type = obj_type;
291 	}
292 	mutex_unlock(&dev->mode_config.idr_mutex);
293 
294 	return ret < 0 ? ret : 0;
295 }
296 
297 /**
298  * drm_mode_object_get - allocate a new modeset identifier
299  * @dev: DRM device
300  * @obj: object pointer, used to generate unique ID
301  * @obj_type: object type
302  *
303  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
304  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
305  * modeset identifiers are _not_ reference counted. Hence don't use this for
306  * reference counted modeset objects like framebuffers.
307  *
308  * Returns:
309  * Zero on success, error code on failure.
310  */
311 int drm_mode_object_get(struct drm_device *dev,
312 			struct drm_mode_object *obj, uint32_t obj_type)
313 {
314 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
315 }
316 
317 static void drm_mode_object_register(struct drm_device *dev,
318 				     struct drm_mode_object *obj)
319 {
320 	mutex_lock(&dev->mode_config.idr_mutex);
321 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
322 	mutex_unlock(&dev->mode_config.idr_mutex);
323 }
324 
325 /**
326  * drm_mode_object_put - free a modeset identifer
327  * @dev: DRM device
328  * @object: object to free
329  *
330  * Free @id from @dev's unique identifier pool. Note that despite the _get
331  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
332  * for reference counted modeset objects like framebuffers.
333  */
334 void drm_mode_object_put(struct drm_device *dev,
335 			 struct drm_mode_object *object)
336 {
337 	mutex_lock(&dev->mode_config.idr_mutex);
338 	idr_remove(&dev->mode_config.crtc_idr, object->id);
339 	mutex_unlock(&dev->mode_config.idr_mutex);
340 }
341 
342 static struct drm_mode_object *_object_find(struct drm_device *dev,
343 		uint32_t id, uint32_t type)
344 {
345 	struct drm_mode_object *obj = NULL;
346 
347 	mutex_lock(&dev->mode_config.idr_mutex);
348 	obj = idr_find(&dev->mode_config.crtc_idr, id);
349 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
350 		obj = NULL;
351 	if (obj && obj->id != id)
352 		obj = NULL;
353 	/* don't leak out unref'd fb's */
354 	if (obj &&
355 	    (obj->type == DRM_MODE_OBJECT_FB ||
356 	     obj->type == DRM_MODE_OBJECT_BLOB))
357 		obj = NULL;
358 	mutex_unlock(&dev->mode_config.idr_mutex);
359 
360 	return obj;
361 }
362 
363 /**
364  * drm_mode_object_find - look up a drm object with static lifetime
365  * @dev: drm device
366  * @id: id of the mode object
367  * @type: type of the mode object
368  *
369  * Note that framebuffers cannot be looked up with this functions - since those
370  * are reference counted, they need special treatment.  Even with
371  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
372  * rather than WARN_ON()).
373  */
374 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
375 		uint32_t id, uint32_t type)
376 {
377 	struct drm_mode_object *obj = NULL;
378 
379 	/* Framebuffers are reference counted and need their own lookup
380 	 * function.*/
381 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
382 	obj = _object_find(dev, id, type);
383 	return obj;
384 }
385 EXPORT_SYMBOL(drm_mode_object_find);
386 
387 /**
388  * drm_framebuffer_init - initialize a framebuffer
389  * @dev: DRM device
390  * @fb: framebuffer to be initialized
391  * @funcs: ... with these functions
392  *
393  * Allocates an ID for the framebuffer's parent mode object, sets its mode
394  * functions & device file and adds it to the master fd list.
395  *
396  * IMPORTANT:
397  * This functions publishes the fb and makes it available for concurrent access
398  * by other users. Which means by this point the fb _must_ be fully set up -
399  * since all the fb attributes are invariant over its lifetime, no further
400  * locking but only correct reference counting is required.
401  *
402  * Returns:
403  * Zero on success, error code on failure.
404  */
405 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
406 			 const struct drm_framebuffer_funcs *funcs)
407 {
408 	int ret;
409 
410 	mutex_lock(&dev->mode_config.fb_lock);
411 	kref_init(&fb->refcount);
412 	INIT_LIST_HEAD(&fb->filp_head);
413 	fb->dev = dev;
414 	fb->funcs = funcs;
415 
416 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
417 	if (ret)
418 		goto out;
419 
420 	dev->mode_config.num_fb++;
421 	list_add(&fb->head, &dev->mode_config.fb_list);
422 out:
423 	mutex_unlock(&dev->mode_config.fb_lock);
424 
425 	return ret;
426 }
427 EXPORT_SYMBOL(drm_framebuffer_init);
428 
429 /* dev->mode_config.fb_lock must be held! */
430 static void __drm_framebuffer_unregister(struct drm_device *dev,
431 					 struct drm_framebuffer *fb)
432 {
433 	mutex_lock(&dev->mode_config.idr_mutex);
434 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
435 	mutex_unlock(&dev->mode_config.idr_mutex);
436 
437 	fb->base.id = 0;
438 }
439 
440 static void drm_framebuffer_free(struct kref *kref)
441 {
442 	struct drm_framebuffer *fb =
443 			container_of(kref, struct drm_framebuffer, refcount);
444 	struct drm_device *dev = fb->dev;
445 
446 	/*
447 	 * The lookup idr holds a weak reference, which has not necessarily been
448 	 * removed at this point. Check for that.
449 	 */
450 	mutex_lock(&dev->mode_config.fb_lock);
451 	if (fb->base.id) {
452 		/* Mark fb as reaped and drop idr ref. */
453 		__drm_framebuffer_unregister(dev, fb);
454 	}
455 	mutex_unlock(&dev->mode_config.fb_lock);
456 
457 	fb->funcs->destroy(fb);
458 }
459 
460 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
461 							uint32_t id)
462 {
463 	struct drm_mode_object *obj = NULL;
464 	struct drm_framebuffer *fb;
465 
466 	mutex_lock(&dev->mode_config.idr_mutex);
467 	obj = idr_find(&dev->mode_config.crtc_idr, id);
468 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
469 		fb = NULL;
470 	else
471 		fb = obj_to_fb(obj);
472 	mutex_unlock(&dev->mode_config.idr_mutex);
473 
474 	return fb;
475 }
476 
477 /**
478  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
479  * @dev: drm device
480  * @id: id of the fb object
481  *
482  * If successful, this grabs an additional reference to the framebuffer -
483  * callers need to make sure to eventually unreference the returned framebuffer
484  * again, using @drm_framebuffer_unreference.
485  */
486 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
487 					       uint32_t id)
488 {
489 	struct drm_framebuffer *fb;
490 
491 	mutex_lock(&dev->mode_config.fb_lock);
492 	fb = __drm_framebuffer_lookup(dev, id);
493 	if (fb) {
494 		if (!kref_get_unless_zero(&fb->refcount))
495 			fb = NULL;
496 	}
497 	mutex_unlock(&dev->mode_config.fb_lock);
498 
499 	return fb;
500 }
501 EXPORT_SYMBOL(drm_framebuffer_lookup);
502 
503 /**
504  * drm_framebuffer_unreference - unref a framebuffer
505  * @fb: framebuffer to unref
506  *
507  * This functions decrements the fb's refcount and frees it if it drops to zero.
508  */
509 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
510 {
511 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
512 	kref_put(&fb->refcount, drm_framebuffer_free);
513 }
514 EXPORT_SYMBOL(drm_framebuffer_unreference);
515 
516 /**
517  * drm_framebuffer_reference - incr the fb refcnt
518  * @fb: framebuffer
519  *
520  * This functions increments the fb's refcount.
521  */
522 void drm_framebuffer_reference(struct drm_framebuffer *fb)
523 {
524 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
525 	kref_get(&fb->refcount);
526 }
527 EXPORT_SYMBOL(drm_framebuffer_reference);
528 
529 /**
530  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
531  * @fb: fb to unregister
532  *
533  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
534  * those used for fbdev. Note that the caller must hold a reference of it's own,
535  * i.e. the object may not be destroyed through this call (since it'll lead to a
536  * locking inversion).
537  */
538 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
539 {
540 	struct drm_device *dev;
541 
542 	if (!fb)
543 		return;
544 
545 	dev = fb->dev;
546 
547 	mutex_lock(&dev->mode_config.fb_lock);
548 	/* Mark fb as reaped and drop idr ref. */
549 	__drm_framebuffer_unregister(dev, fb);
550 	mutex_unlock(&dev->mode_config.fb_lock);
551 }
552 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
553 
554 /**
555  * drm_framebuffer_cleanup - remove a framebuffer object
556  * @fb: framebuffer to remove
557  *
558  * Cleanup framebuffer. This function is intended to be used from the drivers
559  * ->destroy callback. It can also be used to clean up driver private
560  *  framebuffers embedded into a larger structure.
561  *
562  * Note that this function does not remove the fb from active usuage - if it is
563  * still used anywhere, hilarity can ensue since userspace could call getfb on
564  * the id and get back -EINVAL. Obviously no concern at driver unload time.
565  *
566  * Also, the framebuffer will not be removed from the lookup idr - for
567  * user-created framebuffers this will happen in in the rmfb ioctl. For
568  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
569  * drm_framebuffer_unregister_private.
570  */
571 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
572 {
573 	struct drm_device *dev = fb->dev;
574 
575 	mutex_lock(&dev->mode_config.fb_lock);
576 	list_del(&fb->head);
577 	dev->mode_config.num_fb--;
578 	mutex_unlock(&dev->mode_config.fb_lock);
579 }
580 EXPORT_SYMBOL(drm_framebuffer_cleanup);
581 
582 /**
583  * drm_framebuffer_remove - remove and unreference a framebuffer object
584  * @fb: framebuffer to remove
585  *
586  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
587  * using @fb, removes it, setting it to NULL. Then drops the reference to the
588  * passed-in framebuffer. Might take the modeset locks.
589  *
590  * Note that this function optimizes the cleanup away if the caller holds the
591  * last reference to the framebuffer. It is also guaranteed to not take the
592  * modeset locks in this case.
593  */
594 void drm_framebuffer_remove(struct drm_framebuffer *fb)
595 {
596 	struct drm_device *dev;
597 	struct drm_crtc *crtc;
598 	struct drm_plane *plane;
599 	struct drm_mode_set set;
600 	int ret;
601 
602 	if (!fb)
603 		return;
604 
605 	dev = fb->dev;
606 
607 	WARN_ON(!list_empty(&fb->filp_head));
608 
609 	/*
610 	 * drm ABI mandates that we remove any deleted framebuffers from active
611 	 * useage. But since most sane clients only remove framebuffers they no
612 	 * longer need, try to optimize this away.
613 	 *
614 	 * Since we're holding a reference ourselves, observing a refcount of 1
615 	 * means that we're the last holder and can skip it. Also, the refcount
616 	 * can never increase from 1 again, so we don't need any barriers or
617 	 * locks.
618 	 *
619 	 * Note that userspace could try to race with use and instate a new
620 	 * usage _after_ we've cleared all current ones. End result will be an
621 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
622 	 * in this manner.
623 	 */
624 	if (atomic_read(&fb->refcount.refcount) > 1) {
625 		drm_modeset_lock_all(dev);
626 		/* remove from any CRTC */
627 		drm_for_each_crtc(crtc, dev) {
628 			if (crtc->primary->fb == fb) {
629 				/* should turn off the crtc */
630 				memset(&set, 0, sizeof(struct drm_mode_set));
631 				set.crtc = crtc;
632 				set.fb = NULL;
633 				ret = drm_mode_set_config_internal(&set);
634 				if (ret)
635 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
636 			}
637 		}
638 
639 		drm_for_each_plane(plane, dev) {
640 			if (plane->fb == fb)
641 				drm_plane_force_disable(plane);
642 		}
643 		drm_modeset_unlock_all(dev);
644 	}
645 
646 	drm_framebuffer_unreference(fb);
647 }
648 EXPORT_SYMBOL(drm_framebuffer_remove);
649 
650 DEFINE_WW_CLASS(crtc_ww_class);
651 
652 /**
653  * drm_crtc_init_with_planes - Initialise a new CRTC object with
654  *    specified primary and cursor planes.
655  * @dev: DRM device
656  * @crtc: CRTC object to init
657  * @primary: Primary plane for CRTC
658  * @cursor: Cursor plane for CRTC
659  * @funcs: callbacks for the new CRTC
660  *
661  * Inits a new object created as base part of a driver crtc object.
662  *
663  * Returns:
664  * Zero on success, error code on failure.
665  */
666 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
667 			      struct drm_plane *primary,
668 			      struct drm_plane *cursor,
669 			      const struct drm_crtc_funcs *funcs)
670 {
671 	struct drm_mode_config *config = &dev->mode_config;
672 	int ret;
673 
674 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
675 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
676 
677 	crtc->dev = dev;
678 	crtc->funcs = funcs;
679 
680 	drm_modeset_lock_init(&crtc->mutex);
681 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
682 	if (ret)
683 		return ret;
684 
685 	crtc->base.properties = &crtc->properties;
686 
687 	list_add_tail(&crtc->head, &config->crtc_list);
688 	config->num_crtc++;
689 
690 	crtc->primary = primary;
691 	crtc->cursor = cursor;
692 	if (primary)
693 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
694 	if (cursor)
695 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
696 
697 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
698 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
699 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
700 	}
701 
702 	return 0;
703 }
704 EXPORT_SYMBOL(drm_crtc_init_with_planes);
705 
706 /**
707  * drm_crtc_cleanup - Clean up the core crtc usage
708  * @crtc: CRTC to cleanup
709  *
710  * This function cleans up @crtc and removes it from the DRM mode setting
711  * core. Note that the function does *not* free the crtc structure itself,
712  * this is the responsibility of the caller.
713  */
714 void drm_crtc_cleanup(struct drm_crtc *crtc)
715 {
716 	struct drm_device *dev = crtc->dev;
717 
718 	kfree(crtc->gamma_store);
719 	crtc->gamma_store = NULL;
720 
721 	drm_modeset_lock_fini(&crtc->mutex);
722 
723 	drm_mode_object_put(dev, &crtc->base);
724 	list_del(&crtc->head);
725 	dev->mode_config.num_crtc--;
726 
727 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
728 	if (crtc->state && crtc->funcs->atomic_destroy_state)
729 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
730 
731 	memset(crtc, 0, sizeof(*crtc));
732 }
733 EXPORT_SYMBOL(drm_crtc_cleanup);
734 
735 /**
736  * drm_crtc_index - find the index of a registered CRTC
737  * @crtc: CRTC to find index for
738  *
739  * Given a registered CRTC, return the index of that CRTC within a DRM
740  * device's list of CRTCs.
741  */
742 unsigned int drm_crtc_index(struct drm_crtc *crtc)
743 {
744 	unsigned int index = 0;
745 	struct drm_crtc *tmp;
746 
747 	drm_for_each_crtc(tmp, crtc->dev) {
748 		if (tmp == crtc)
749 			return index;
750 
751 		index++;
752 	}
753 
754 	BUG();
755 }
756 EXPORT_SYMBOL(drm_crtc_index);
757 
758 /*
759  * drm_mode_remove - remove and free a mode
760  * @connector: connector list to modify
761  * @mode: mode to remove
762  *
763  * Remove @mode from @connector's mode list, then free it.
764  */
765 static void drm_mode_remove(struct drm_connector *connector,
766 			    struct drm_display_mode *mode)
767 {
768 	list_del(&mode->head);
769 	drm_mode_destroy(connector->dev, mode);
770 }
771 
772 /**
773  * drm_display_info_set_bus_formats - set the supported bus formats
774  * @info: display info to store bus formats in
775  * @formats: array containing the supported bus formats
776  * @num_formats: the number of entries in the fmts array
777  *
778  * Store the supported bus formats in display info structure.
779  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
780  * a full list of available formats.
781  */
782 int drm_display_info_set_bus_formats(struct drm_display_info *info,
783 				     const u32 *formats,
784 				     unsigned int num_formats)
785 {
786 	u32 *fmts = NULL;
787 
788 	if (!formats && num_formats)
789 		return -EINVAL;
790 
791 	if (formats && num_formats) {
792 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
793 			       GFP_KERNEL);
794 		if (!fmts)
795 			return -ENOMEM;
796 	}
797 
798 	kfree(info->bus_formats);
799 	info->bus_formats = fmts;
800 	info->num_bus_formats = num_formats;
801 
802 	return 0;
803 }
804 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
805 
806 /**
807  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
808  * @connector: connector to quwery
809  *
810  * The kernel supports per-connector configration of its consoles through
811  * use of the video= parameter. This function parses that option and
812  * extracts the user's specified mode (or enable/disable status) for a
813  * particular connector. This is typically only used during the early fbdev
814  * setup.
815  */
816 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
817 {
818 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
819 	char *option = NULL;
820 
821 	if (fb_get_options(connector->name, &option))
822 		return;
823 
824 	if (!drm_mode_parse_command_line_for_connector(option,
825 						       connector,
826 						       mode))
827 		return;
828 
829 	if (mode->force) {
830 		const char *s;
831 
832 		switch (mode->force) {
833 		case DRM_FORCE_OFF:
834 			s = "OFF";
835 			break;
836 		case DRM_FORCE_ON_DIGITAL:
837 			s = "ON - dig";
838 			break;
839 		default:
840 		case DRM_FORCE_ON:
841 			s = "ON";
842 			break;
843 		}
844 
845 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
846 		connector->force = mode->force;
847 	}
848 
849 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
850 		      connector->name,
851 		      mode->xres, mode->yres,
852 		      mode->refresh_specified ? mode->refresh : 60,
853 		      mode->rb ? " reduced blanking" : "",
854 		      mode->margins ? " with margins" : "",
855 		      mode->interlace ?  " interlaced" : "");
856 }
857 
858 /**
859  * drm_connector_init - Init a preallocated connector
860  * @dev: DRM device
861  * @connector: the connector to init
862  * @funcs: callbacks for this connector
863  * @connector_type: user visible type of the connector
864  *
865  * Initialises a preallocated connector. Connectors should be
866  * subclassed as part of driver connector objects.
867  *
868  * Returns:
869  * Zero on success, error code on failure.
870  */
871 int drm_connector_init(struct drm_device *dev,
872 		       struct drm_connector *connector,
873 		       const struct drm_connector_funcs *funcs,
874 		       int connector_type)
875 {
876 	struct drm_mode_config *config = &dev->mode_config;
877 	int ret;
878 	struct ida *connector_ida =
879 		&drm_connector_enum_list[connector_type].ida;
880 
881 	drm_modeset_lock_all(dev);
882 
883 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
884 	if (ret)
885 		goto out_unlock;
886 
887 	connector->base.properties = &connector->properties;
888 	connector->dev = dev;
889 	connector->funcs = funcs;
890 	connector->connector_type = connector_type;
891 	connector->connector_type_id =
892 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
893 	if (connector->connector_type_id < 0) {
894 		ret = connector->connector_type_id;
895 		goto out_put;
896 	}
897 	connector->name =
898 		kasprintf(GFP_KERNEL, "%s-%d",
899 			  drm_connector_enum_list[connector_type].name,
900 			  connector->connector_type_id);
901 	if (!connector->name) {
902 		ret = -ENOMEM;
903 		goto out_put;
904 	}
905 
906 	INIT_LIST_HEAD(&connector->probed_modes);
907 	INIT_LIST_HEAD(&connector->modes);
908 	connector->edid_blob_ptr = NULL;
909 	connector->status = connector_status_unknown;
910 
911 	drm_connector_get_cmdline_mode(connector);
912 
913 	/* We should add connectors at the end to avoid upsetting the connector
914 	 * index too much. */
915 	list_add_tail(&connector->head, &config->connector_list);
916 	config->num_connector++;
917 
918 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
919 		drm_object_attach_property(&connector->base,
920 					      config->edid_property,
921 					      0);
922 
923 	drm_object_attach_property(&connector->base,
924 				      config->dpms_property, 0);
925 
926 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
927 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
928 	}
929 
930 	connector->debugfs_entry = NULL;
931 
932 out_put:
933 	if (ret)
934 		drm_mode_object_put(dev, &connector->base);
935 
936 out_unlock:
937 	drm_modeset_unlock_all(dev);
938 
939 	return ret;
940 }
941 EXPORT_SYMBOL(drm_connector_init);
942 
943 /**
944  * drm_connector_cleanup - cleans up an initialised connector
945  * @connector: connector to cleanup
946  *
947  * Cleans up the connector but doesn't free the object.
948  */
949 void drm_connector_cleanup(struct drm_connector *connector)
950 {
951 	struct drm_device *dev = connector->dev;
952 	struct drm_display_mode *mode, *t;
953 
954 	if (connector->tile_group) {
955 		drm_mode_put_tile_group(dev, connector->tile_group);
956 		connector->tile_group = NULL;
957 	}
958 
959 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
960 		drm_mode_remove(connector, mode);
961 
962 	list_for_each_entry_safe(mode, t, &connector->modes, head)
963 		drm_mode_remove(connector, mode);
964 
965 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
966 		   connector->connector_type_id);
967 
968 	kfree(connector->display_info.bus_formats);
969 	drm_mode_object_put(dev, &connector->base);
970 	kfree(connector->name);
971 	connector->name = NULL;
972 	list_del(&connector->head);
973 	dev->mode_config.num_connector--;
974 
975 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
976 	if (connector->state && connector->funcs->atomic_destroy_state)
977 		connector->funcs->atomic_destroy_state(connector,
978 						       connector->state);
979 
980 	memset(connector, 0, sizeof(*connector));
981 }
982 EXPORT_SYMBOL(drm_connector_cleanup);
983 
984 /**
985  * drm_connector_index - find the index of a registered connector
986  * @connector: connector to find index for
987  *
988  * Given a registered connector, return the index of that connector within a DRM
989  * device's list of connectors.
990  */
991 unsigned int drm_connector_index(struct drm_connector *connector)
992 {
993 	unsigned int index = 0;
994 	struct drm_connector *tmp;
995 	struct drm_mode_config *config = &connector->dev->mode_config;
996 
997 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
998 
999 	drm_for_each_connector(tmp, connector->dev) {
1000 		if (tmp == connector)
1001 			return index;
1002 
1003 		index++;
1004 	}
1005 
1006 	BUG();
1007 }
1008 EXPORT_SYMBOL(drm_connector_index);
1009 
1010 /**
1011  * drm_connector_register - register a connector
1012  * @connector: the connector to register
1013  *
1014  * Register userspace interfaces for a connector
1015  *
1016  * Returns:
1017  * Zero on success, error code on failure.
1018  */
1019 int drm_connector_register(struct drm_connector *connector)
1020 {
1021 	int ret;
1022 
1023 	drm_mode_object_register(connector->dev, &connector->base);
1024 
1025 	ret = drm_sysfs_connector_add(connector);
1026 	if (ret)
1027 		return ret;
1028 
1029 	ret = drm_debugfs_connector_add(connector);
1030 	if (ret) {
1031 		drm_sysfs_connector_remove(connector);
1032 		return ret;
1033 	}
1034 
1035 	return 0;
1036 }
1037 EXPORT_SYMBOL(drm_connector_register);
1038 
1039 /**
1040  * drm_connector_unregister - unregister a connector
1041  * @connector: the connector to unregister
1042  *
1043  * Unregister userspace interfaces for a connector
1044  */
1045 void drm_connector_unregister(struct drm_connector *connector)
1046 {
1047 	drm_sysfs_connector_remove(connector);
1048 	drm_debugfs_connector_remove(connector);
1049 }
1050 EXPORT_SYMBOL(drm_connector_unregister);
1051 
1052 
1053 /**
1054  * drm_connector_unplug_all - unregister connector userspace interfaces
1055  * @dev: drm device
1056  *
1057  * This function unregisters all connector userspace interfaces in sysfs. Should
1058  * be call when the device is disconnected, e.g. from an usb driver's
1059  * ->disconnect callback.
1060  */
1061 void drm_connector_unplug_all(struct drm_device *dev)
1062 {
1063 	struct drm_connector *connector;
1064 
1065 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1066 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1067 		drm_connector_unregister(connector);
1068 
1069 }
1070 EXPORT_SYMBOL(drm_connector_unplug_all);
1071 
1072 /**
1073  * drm_encoder_init - Init a preallocated encoder
1074  * @dev: drm device
1075  * @encoder: the encoder to init
1076  * @funcs: callbacks for this encoder
1077  * @encoder_type: user visible type of the encoder
1078  *
1079  * Initialises a preallocated encoder. Encoder should be
1080  * subclassed as part of driver encoder objects.
1081  *
1082  * Returns:
1083  * Zero on success, error code on failure.
1084  */
1085 int drm_encoder_init(struct drm_device *dev,
1086 		      struct drm_encoder *encoder,
1087 		      const struct drm_encoder_funcs *funcs,
1088 		      int encoder_type)
1089 {
1090 	int ret;
1091 
1092 	drm_modeset_lock_all(dev);
1093 
1094 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1095 	if (ret)
1096 		goto out_unlock;
1097 
1098 	encoder->dev = dev;
1099 	encoder->encoder_type = encoder_type;
1100 	encoder->funcs = funcs;
1101 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1102 				  drm_encoder_enum_list[encoder_type].name,
1103 				  encoder->base.id);
1104 	if (!encoder->name) {
1105 		ret = -ENOMEM;
1106 		goto out_put;
1107 	}
1108 
1109 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1110 	dev->mode_config.num_encoder++;
1111 
1112 out_put:
1113 	if (ret)
1114 		drm_mode_object_put(dev, &encoder->base);
1115 
1116 out_unlock:
1117 	drm_modeset_unlock_all(dev);
1118 
1119 	return ret;
1120 }
1121 EXPORT_SYMBOL(drm_encoder_init);
1122 
1123 /**
1124  * drm_encoder_cleanup - cleans up an initialised encoder
1125  * @encoder: encoder to cleanup
1126  *
1127  * Cleans up the encoder but doesn't free the object.
1128  */
1129 void drm_encoder_cleanup(struct drm_encoder *encoder)
1130 {
1131 	struct drm_device *dev = encoder->dev;
1132 
1133 	drm_modeset_lock_all(dev);
1134 	drm_mode_object_put(dev, &encoder->base);
1135 	kfree(encoder->name);
1136 	list_del(&encoder->head);
1137 	dev->mode_config.num_encoder--;
1138 	drm_modeset_unlock_all(dev);
1139 
1140 	memset(encoder, 0, sizeof(*encoder));
1141 }
1142 EXPORT_SYMBOL(drm_encoder_cleanup);
1143 
1144 /**
1145  * drm_universal_plane_init - Initialize a new universal plane object
1146  * @dev: DRM device
1147  * @plane: plane object to init
1148  * @possible_crtcs: bitmask of possible CRTCs
1149  * @funcs: callbacks for the new plane
1150  * @formats: array of supported formats (%DRM_FORMAT_*)
1151  * @format_count: number of elements in @formats
1152  * @type: type of plane (overlay, primary, cursor)
1153  *
1154  * Initializes a plane object of type @type.
1155  *
1156  * Returns:
1157  * Zero on success, error code on failure.
1158  */
1159 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1160 			     unsigned long possible_crtcs,
1161 			     const struct drm_plane_funcs *funcs,
1162 			     const uint32_t *formats, unsigned int format_count,
1163 			     enum drm_plane_type type)
1164 {
1165 	struct drm_mode_config *config = &dev->mode_config;
1166 	int ret;
1167 
1168 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1169 	if (ret)
1170 		return ret;
1171 
1172 	drm_modeset_lock_init(&plane->mutex);
1173 
1174 	plane->base.properties = &plane->properties;
1175 	plane->dev = dev;
1176 	plane->funcs = funcs;
1177 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1178 					    GFP_KERNEL);
1179 	if (!plane->format_types) {
1180 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1181 		drm_mode_object_put(dev, &plane->base);
1182 		return -ENOMEM;
1183 	}
1184 
1185 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1186 	plane->format_count = format_count;
1187 	plane->possible_crtcs = possible_crtcs;
1188 	plane->type = type;
1189 
1190 	list_add_tail(&plane->head, &config->plane_list);
1191 	config->num_total_plane++;
1192 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1193 		config->num_overlay_plane++;
1194 
1195 	drm_object_attach_property(&plane->base,
1196 				   config->plane_type_property,
1197 				   plane->type);
1198 
1199 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1200 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1201 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1202 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1203 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1204 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1205 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1206 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1207 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1208 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1209 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1210 	}
1211 
1212 	return 0;
1213 }
1214 EXPORT_SYMBOL(drm_universal_plane_init);
1215 
1216 /**
1217  * drm_plane_init - Initialize a legacy plane
1218  * @dev: DRM device
1219  * @plane: plane object to init
1220  * @possible_crtcs: bitmask of possible CRTCs
1221  * @funcs: callbacks for the new plane
1222  * @formats: array of supported formats (%DRM_FORMAT_*)
1223  * @format_count: number of elements in @formats
1224  * @is_primary: plane type (primary vs overlay)
1225  *
1226  * Legacy API to initialize a DRM plane.
1227  *
1228  * New drivers should call drm_universal_plane_init() instead.
1229  *
1230  * Returns:
1231  * Zero on success, error code on failure.
1232  */
1233 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1234 		   unsigned long possible_crtcs,
1235 		   const struct drm_plane_funcs *funcs,
1236 		   const uint32_t *formats, unsigned int format_count,
1237 		   bool is_primary)
1238 {
1239 	enum drm_plane_type type;
1240 
1241 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1242 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1243 					formats, format_count, type);
1244 }
1245 EXPORT_SYMBOL(drm_plane_init);
1246 
1247 /**
1248  * drm_plane_cleanup - Clean up the core plane usage
1249  * @plane: plane to cleanup
1250  *
1251  * This function cleans up @plane and removes it from the DRM mode setting
1252  * core. Note that the function does *not* free the plane structure itself,
1253  * this is the responsibility of the caller.
1254  */
1255 void drm_plane_cleanup(struct drm_plane *plane)
1256 {
1257 	struct drm_device *dev = plane->dev;
1258 
1259 	drm_modeset_lock_all(dev);
1260 	kfree(plane->format_types);
1261 	drm_mode_object_put(dev, &plane->base);
1262 
1263 	BUG_ON(list_empty(&plane->head));
1264 
1265 	list_del(&plane->head);
1266 	dev->mode_config.num_total_plane--;
1267 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1268 		dev->mode_config.num_overlay_plane--;
1269 	drm_modeset_unlock_all(dev);
1270 
1271 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1272 	if (plane->state && plane->funcs->atomic_destroy_state)
1273 		plane->funcs->atomic_destroy_state(plane, plane->state);
1274 
1275 	memset(plane, 0, sizeof(*plane));
1276 }
1277 EXPORT_SYMBOL(drm_plane_cleanup);
1278 
1279 /**
1280  * drm_plane_index - find the index of a registered plane
1281  * @plane: plane to find index for
1282  *
1283  * Given a registered plane, return the index of that CRTC within a DRM
1284  * device's list of planes.
1285  */
1286 unsigned int drm_plane_index(struct drm_plane *plane)
1287 {
1288 	unsigned int index = 0;
1289 	struct drm_plane *tmp;
1290 
1291 	drm_for_each_plane(tmp, plane->dev) {
1292 		if (tmp == plane)
1293 			return index;
1294 
1295 		index++;
1296 	}
1297 
1298 	BUG();
1299 }
1300 EXPORT_SYMBOL(drm_plane_index);
1301 
1302 /**
1303  * drm_plane_from_index - find the registered plane at an index
1304  * @dev: DRM device
1305  * @idx: index of registered plane to find for
1306  *
1307  * Given a plane index, return the registered plane from DRM device's
1308  * list of planes with matching index.
1309  */
1310 struct drm_plane *
1311 drm_plane_from_index(struct drm_device *dev, int idx)
1312 {
1313 	struct drm_plane *plane;
1314 	unsigned int i = 0;
1315 
1316 	drm_for_each_plane(plane, dev) {
1317 		if (i == idx)
1318 			return plane;
1319 		i++;
1320 	}
1321 	return NULL;
1322 }
1323 EXPORT_SYMBOL(drm_plane_from_index);
1324 
1325 /**
1326  * drm_plane_force_disable - Forcibly disable a plane
1327  * @plane: plane to disable
1328  *
1329  * Forces the plane to be disabled.
1330  *
1331  * Used when the plane's current framebuffer is destroyed,
1332  * and when restoring fbdev mode.
1333  */
1334 void drm_plane_force_disable(struct drm_plane *plane)
1335 {
1336 	int ret;
1337 
1338 	if (!plane->fb)
1339 		return;
1340 
1341 	plane->old_fb = plane->fb;
1342 	ret = plane->funcs->disable_plane(plane);
1343 	if (ret) {
1344 		DRM_ERROR("failed to disable plane with busy fb\n");
1345 		plane->old_fb = NULL;
1346 		return;
1347 	}
1348 	/* disconnect the plane from the fb and crtc: */
1349 	drm_framebuffer_unreference(plane->old_fb);
1350 	plane->old_fb = NULL;
1351 	plane->fb = NULL;
1352 	plane->crtc = NULL;
1353 }
1354 EXPORT_SYMBOL(drm_plane_force_disable);
1355 
1356 static int drm_mode_create_standard_properties(struct drm_device *dev)
1357 {
1358 	struct drm_property *prop;
1359 
1360 	/*
1361 	 * Standard properties (apply to all connectors)
1362 	 */
1363 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1364 				   DRM_MODE_PROP_IMMUTABLE,
1365 				   "EDID", 0);
1366 	if (!prop)
1367 		return -ENOMEM;
1368 	dev->mode_config.edid_property = prop;
1369 
1370 	prop = drm_property_create_enum(dev, 0,
1371 				   "DPMS", drm_dpms_enum_list,
1372 				   ARRAY_SIZE(drm_dpms_enum_list));
1373 	if (!prop)
1374 		return -ENOMEM;
1375 	dev->mode_config.dpms_property = prop;
1376 
1377 	prop = drm_property_create(dev,
1378 				   DRM_MODE_PROP_BLOB |
1379 				   DRM_MODE_PROP_IMMUTABLE,
1380 				   "PATH", 0);
1381 	if (!prop)
1382 		return -ENOMEM;
1383 	dev->mode_config.path_property = prop;
1384 
1385 	prop = drm_property_create(dev,
1386 				   DRM_MODE_PROP_BLOB |
1387 				   DRM_MODE_PROP_IMMUTABLE,
1388 				   "TILE", 0);
1389 	if (!prop)
1390 		return -ENOMEM;
1391 	dev->mode_config.tile_property = prop;
1392 
1393 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1394 					"type", drm_plane_type_enum_list,
1395 					ARRAY_SIZE(drm_plane_type_enum_list));
1396 	if (!prop)
1397 		return -ENOMEM;
1398 	dev->mode_config.plane_type_property = prop;
1399 
1400 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1401 			"SRC_X", 0, UINT_MAX);
1402 	if (!prop)
1403 		return -ENOMEM;
1404 	dev->mode_config.prop_src_x = prop;
1405 
1406 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1407 			"SRC_Y", 0, UINT_MAX);
1408 	if (!prop)
1409 		return -ENOMEM;
1410 	dev->mode_config.prop_src_y = prop;
1411 
1412 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1413 			"SRC_W", 0, UINT_MAX);
1414 	if (!prop)
1415 		return -ENOMEM;
1416 	dev->mode_config.prop_src_w = prop;
1417 
1418 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1419 			"SRC_H", 0, UINT_MAX);
1420 	if (!prop)
1421 		return -ENOMEM;
1422 	dev->mode_config.prop_src_h = prop;
1423 
1424 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1425 			"CRTC_X", INT_MIN, INT_MAX);
1426 	if (!prop)
1427 		return -ENOMEM;
1428 	dev->mode_config.prop_crtc_x = prop;
1429 
1430 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1431 			"CRTC_Y", INT_MIN, INT_MAX);
1432 	if (!prop)
1433 		return -ENOMEM;
1434 	dev->mode_config.prop_crtc_y = prop;
1435 
1436 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1437 			"CRTC_W", 0, INT_MAX);
1438 	if (!prop)
1439 		return -ENOMEM;
1440 	dev->mode_config.prop_crtc_w = prop;
1441 
1442 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1443 			"CRTC_H", 0, INT_MAX);
1444 	if (!prop)
1445 		return -ENOMEM;
1446 	dev->mode_config.prop_crtc_h = prop;
1447 
1448 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1449 			"FB_ID", DRM_MODE_OBJECT_FB);
1450 	if (!prop)
1451 		return -ENOMEM;
1452 	dev->mode_config.prop_fb_id = prop;
1453 
1454 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1455 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1456 	if (!prop)
1457 		return -ENOMEM;
1458 	dev->mode_config.prop_crtc_id = prop;
1459 
1460 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1461 			"ACTIVE");
1462 	if (!prop)
1463 		return -ENOMEM;
1464 	dev->mode_config.prop_active = prop;
1465 
1466 	prop = drm_property_create(dev,
1467 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1468 			"MODE_ID", 0);
1469 	if (!prop)
1470 		return -ENOMEM;
1471 	dev->mode_config.prop_mode_id = prop;
1472 
1473 	return 0;
1474 }
1475 
1476 /**
1477  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1478  * @dev: DRM device
1479  *
1480  * Called by a driver the first time a DVI-I connector is made.
1481  */
1482 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1483 {
1484 	struct drm_property *dvi_i_selector;
1485 	struct drm_property *dvi_i_subconnector;
1486 
1487 	if (dev->mode_config.dvi_i_select_subconnector_property)
1488 		return 0;
1489 
1490 	dvi_i_selector =
1491 		drm_property_create_enum(dev, 0,
1492 				    "select subconnector",
1493 				    drm_dvi_i_select_enum_list,
1494 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1495 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1496 
1497 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1498 				    "subconnector",
1499 				    drm_dvi_i_subconnector_enum_list,
1500 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1501 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1502 
1503 	return 0;
1504 }
1505 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1506 
1507 /**
1508  * drm_create_tv_properties - create TV specific connector properties
1509  * @dev: DRM device
1510  * @num_modes: number of different TV formats (modes) supported
1511  * @modes: array of pointers to strings containing name of each format
1512  *
1513  * Called by a driver's TV initialization routine, this function creates
1514  * the TV specific connector properties for a given device.  Caller is
1515  * responsible for allocating a list of format names and passing them to
1516  * this routine.
1517  */
1518 int drm_mode_create_tv_properties(struct drm_device *dev,
1519 				  unsigned int num_modes,
1520 				  const char * const modes[])
1521 {
1522 	struct drm_property *tv_selector;
1523 	struct drm_property *tv_subconnector;
1524 	unsigned int i;
1525 
1526 	if (dev->mode_config.tv_select_subconnector_property)
1527 		return 0;
1528 
1529 	/*
1530 	 * Basic connector properties
1531 	 */
1532 	tv_selector = drm_property_create_enum(dev, 0,
1533 					  "select subconnector",
1534 					  drm_tv_select_enum_list,
1535 					  ARRAY_SIZE(drm_tv_select_enum_list));
1536 	if (!tv_selector)
1537 		goto nomem;
1538 
1539 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1540 
1541 	tv_subconnector =
1542 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1543 				    "subconnector",
1544 				    drm_tv_subconnector_enum_list,
1545 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1546 	if (!tv_subconnector)
1547 		goto nomem;
1548 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1549 
1550 	/*
1551 	 * Other, TV specific properties: margins & TV modes.
1552 	 */
1553 	dev->mode_config.tv_left_margin_property =
1554 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1555 	if (!dev->mode_config.tv_left_margin_property)
1556 		goto nomem;
1557 
1558 	dev->mode_config.tv_right_margin_property =
1559 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1560 	if (!dev->mode_config.tv_right_margin_property)
1561 		goto nomem;
1562 
1563 	dev->mode_config.tv_top_margin_property =
1564 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1565 	if (!dev->mode_config.tv_top_margin_property)
1566 		goto nomem;
1567 
1568 	dev->mode_config.tv_bottom_margin_property =
1569 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1570 	if (!dev->mode_config.tv_bottom_margin_property)
1571 		goto nomem;
1572 
1573 	dev->mode_config.tv_mode_property =
1574 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1575 				    "mode", num_modes);
1576 	if (!dev->mode_config.tv_mode_property)
1577 		goto nomem;
1578 
1579 	for (i = 0; i < num_modes; i++)
1580 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1581 				      i, modes[i]);
1582 
1583 	dev->mode_config.tv_brightness_property =
1584 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1585 	if (!dev->mode_config.tv_brightness_property)
1586 		goto nomem;
1587 
1588 	dev->mode_config.tv_contrast_property =
1589 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1590 	if (!dev->mode_config.tv_contrast_property)
1591 		goto nomem;
1592 
1593 	dev->mode_config.tv_flicker_reduction_property =
1594 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1595 	if (!dev->mode_config.tv_flicker_reduction_property)
1596 		goto nomem;
1597 
1598 	dev->mode_config.tv_overscan_property =
1599 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1600 	if (!dev->mode_config.tv_overscan_property)
1601 		goto nomem;
1602 
1603 	dev->mode_config.tv_saturation_property =
1604 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1605 	if (!dev->mode_config.tv_saturation_property)
1606 		goto nomem;
1607 
1608 	dev->mode_config.tv_hue_property =
1609 		drm_property_create_range(dev, 0, "hue", 0, 100);
1610 	if (!dev->mode_config.tv_hue_property)
1611 		goto nomem;
1612 
1613 	return 0;
1614 nomem:
1615 	return -ENOMEM;
1616 }
1617 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1618 
1619 /**
1620  * drm_mode_create_scaling_mode_property - create scaling mode property
1621  * @dev: DRM device
1622  *
1623  * Called by a driver the first time it's needed, must be attached to desired
1624  * connectors.
1625  */
1626 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1627 {
1628 	struct drm_property *scaling_mode;
1629 
1630 	if (dev->mode_config.scaling_mode_property)
1631 		return 0;
1632 
1633 	scaling_mode =
1634 		drm_property_create_enum(dev, 0, "scaling mode",
1635 				drm_scaling_mode_enum_list,
1636 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1637 
1638 	dev->mode_config.scaling_mode_property = scaling_mode;
1639 
1640 	return 0;
1641 }
1642 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1643 
1644 /**
1645  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1646  * @dev: DRM device
1647  *
1648  * Called by a driver the first time it's needed, must be attached to desired
1649  * connectors.
1650  *
1651  * Returns:
1652  * Zero on success, negative errno on failure.
1653  */
1654 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1655 {
1656 	if (dev->mode_config.aspect_ratio_property)
1657 		return 0;
1658 
1659 	dev->mode_config.aspect_ratio_property =
1660 		drm_property_create_enum(dev, 0, "aspect ratio",
1661 				drm_aspect_ratio_enum_list,
1662 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1663 
1664 	if (dev->mode_config.aspect_ratio_property == NULL)
1665 		return -ENOMEM;
1666 
1667 	return 0;
1668 }
1669 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1670 
1671 /**
1672  * drm_mode_create_dirty_property - create dirty property
1673  * @dev: DRM device
1674  *
1675  * Called by a driver the first time it's needed, must be attached to desired
1676  * connectors.
1677  */
1678 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1679 {
1680 	struct drm_property *dirty_info;
1681 
1682 	if (dev->mode_config.dirty_info_property)
1683 		return 0;
1684 
1685 	dirty_info =
1686 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1687 				    "dirty",
1688 				    drm_dirty_info_enum_list,
1689 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1690 	dev->mode_config.dirty_info_property = dirty_info;
1691 
1692 	return 0;
1693 }
1694 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1695 
1696 /**
1697  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1698  * @dev: DRM device
1699  *
1700  * Create the the suggested x/y offset property for connectors.
1701  */
1702 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1703 {
1704 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1705 		return 0;
1706 
1707 	dev->mode_config.suggested_x_property =
1708 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1709 
1710 	dev->mode_config.suggested_y_property =
1711 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1712 
1713 	if (dev->mode_config.suggested_x_property == NULL ||
1714 	    dev->mode_config.suggested_y_property == NULL)
1715 		return -ENOMEM;
1716 	return 0;
1717 }
1718 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1719 
1720 /**
1721  * drm_mode_getresources - get graphics configuration
1722  * @dev: drm device for the ioctl
1723  * @data: data pointer for the ioctl
1724  * @file_priv: drm file for the ioctl call
1725  *
1726  * Construct a set of configuration description structures and return
1727  * them to the user, including CRTC, connector and framebuffer configuration.
1728  *
1729  * Called by the user via ioctl.
1730  *
1731  * Returns:
1732  * Zero on success, negative errno on failure.
1733  */
1734 int drm_mode_getresources(struct drm_device *dev, void *data,
1735 			  struct drm_file *file_priv)
1736 {
1737 	struct drm_mode_card_res *card_res = data;
1738 	struct list_head *lh;
1739 	struct drm_framebuffer *fb;
1740 	struct drm_connector *connector;
1741 	struct drm_crtc *crtc;
1742 	struct drm_encoder *encoder;
1743 	int ret = 0;
1744 	int connector_count = 0;
1745 	int crtc_count = 0;
1746 	int fb_count = 0;
1747 	int encoder_count = 0;
1748 	int copied = 0;
1749 	uint32_t __user *fb_id;
1750 	uint32_t __user *crtc_id;
1751 	uint32_t __user *connector_id;
1752 	uint32_t __user *encoder_id;
1753 
1754 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1755 		return -EINVAL;
1756 
1757 
1758 	mutex_lock(&file_priv->fbs_lock);
1759 	/*
1760 	 * For the non-control nodes we need to limit the list of resources
1761 	 * by IDs in the group list for this node
1762 	 */
1763 	list_for_each(lh, &file_priv->fbs)
1764 		fb_count++;
1765 
1766 	/* handle this in 4 parts */
1767 	/* FBs */
1768 	if (card_res->count_fbs >= fb_count) {
1769 		copied = 0;
1770 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1771 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1772 			if (put_user(fb->base.id, fb_id + copied)) {
1773 				mutex_unlock(&file_priv->fbs_lock);
1774 				return -EFAULT;
1775 			}
1776 			copied++;
1777 		}
1778 	}
1779 	card_res->count_fbs = fb_count;
1780 	mutex_unlock(&file_priv->fbs_lock);
1781 
1782 	/* mode_config.mutex protects the connector list against e.g. DP MST
1783 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1784 	mutex_lock(&dev->mode_config.mutex);
1785 	drm_for_each_crtc(crtc, dev)
1786 		crtc_count++;
1787 
1788 	drm_for_each_connector(connector, dev)
1789 		connector_count++;
1790 
1791 	drm_for_each_encoder(encoder, dev)
1792 		encoder_count++;
1793 
1794 	card_res->max_height = dev->mode_config.max_height;
1795 	card_res->min_height = dev->mode_config.min_height;
1796 	card_res->max_width = dev->mode_config.max_width;
1797 	card_res->min_width = dev->mode_config.min_width;
1798 
1799 	/* CRTCs */
1800 	if (card_res->count_crtcs >= crtc_count) {
1801 		copied = 0;
1802 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1803 		drm_for_each_crtc(crtc, dev) {
1804 			DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1805 			if (put_user(crtc->base.id, crtc_id + copied)) {
1806 				ret = -EFAULT;
1807 				goto out;
1808 			}
1809 			copied++;
1810 		}
1811 	}
1812 	card_res->count_crtcs = crtc_count;
1813 
1814 	/* Encoders */
1815 	if (card_res->count_encoders >= encoder_count) {
1816 		copied = 0;
1817 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1818 		drm_for_each_encoder(encoder, dev) {
1819 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1820 					encoder->name);
1821 			if (put_user(encoder->base.id, encoder_id +
1822 				     copied)) {
1823 				ret = -EFAULT;
1824 				goto out;
1825 			}
1826 			copied++;
1827 		}
1828 	}
1829 	card_res->count_encoders = encoder_count;
1830 
1831 	/* Connectors */
1832 	if (card_res->count_connectors >= connector_count) {
1833 		copied = 0;
1834 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1835 		drm_for_each_connector(connector, dev) {
1836 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1837 				connector->base.id,
1838 				connector->name);
1839 			if (put_user(connector->base.id,
1840 				     connector_id + copied)) {
1841 				ret = -EFAULT;
1842 				goto out;
1843 			}
1844 			copied++;
1845 		}
1846 	}
1847 	card_res->count_connectors = connector_count;
1848 
1849 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1850 		  card_res->count_connectors, card_res->count_encoders);
1851 
1852 out:
1853 	mutex_unlock(&dev->mode_config.mutex);
1854 	return ret;
1855 }
1856 
1857 /**
1858  * drm_mode_getcrtc - get CRTC configuration
1859  * @dev: drm device for the ioctl
1860  * @data: data pointer for the ioctl
1861  * @file_priv: drm file for the ioctl call
1862  *
1863  * Construct a CRTC configuration structure to return to the user.
1864  *
1865  * Called by the user via ioctl.
1866  *
1867  * Returns:
1868  * Zero on success, negative errno on failure.
1869  */
1870 int drm_mode_getcrtc(struct drm_device *dev,
1871 		     void *data, struct drm_file *file_priv)
1872 {
1873 	struct drm_mode_crtc *crtc_resp = data;
1874 	struct drm_crtc *crtc;
1875 
1876 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1877 		return -EINVAL;
1878 
1879 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1880 	if (!crtc)
1881 		return -ENOENT;
1882 
1883 	drm_modeset_lock_crtc(crtc, crtc->primary);
1884 	crtc_resp->gamma_size = crtc->gamma_size;
1885 	if (crtc->primary->fb)
1886 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1887 	else
1888 		crtc_resp->fb_id = 0;
1889 
1890 	if (crtc->state) {
1891 		crtc_resp->x = crtc->primary->state->src_x >> 16;
1892 		crtc_resp->y = crtc->primary->state->src_y >> 16;
1893 		if (crtc->state->enable) {
1894 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
1895 			crtc_resp->mode_valid = 1;
1896 
1897 		} else {
1898 			crtc_resp->mode_valid = 0;
1899 		}
1900 	} else {
1901 		crtc_resp->x = crtc->x;
1902 		crtc_resp->y = crtc->y;
1903 		if (crtc->enabled) {
1904 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1905 			crtc_resp->mode_valid = 1;
1906 
1907 		} else {
1908 			crtc_resp->mode_valid = 0;
1909 		}
1910 	}
1911 	drm_modeset_unlock_crtc(crtc);
1912 
1913 	return 0;
1914 }
1915 
1916 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1917 					 const struct drm_file *file_priv)
1918 {
1919 	/*
1920 	 * If user-space hasn't configured the driver to expose the stereo 3D
1921 	 * modes, don't expose them.
1922 	 */
1923 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1924 		return false;
1925 
1926 	return true;
1927 }
1928 
1929 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
1930 {
1931 	/* For atomic drivers only state objects are synchronously updated and
1932 	 * protected by modeset locks, so check those first. */
1933 	if (connector->state)
1934 		return connector->state->best_encoder;
1935 	return connector->encoder;
1936 }
1937 
1938 /* helper for getconnector and getproperties ioctls */
1939 static int get_properties(struct drm_mode_object *obj, bool atomic,
1940 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
1941 		uint32_t *arg_count_props)
1942 {
1943 	int props_count;
1944 	int i, ret, copied;
1945 
1946 	props_count = obj->properties->count;
1947 	if (!atomic)
1948 		props_count -= obj->properties->atomic_count;
1949 
1950 	if ((*arg_count_props >= props_count) && props_count) {
1951 		for (i = 0, copied = 0; copied < props_count; i++) {
1952 			struct drm_property *prop = obj->properties->properties[i];
1953 			uint64_t val;
1954 
1955 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
1956 				continue;
1957 
1958 			ret = drm_object_property_get_value(obj, prop, &val);
1959 			if (ret)
1960 				return ret;
1961 
1962 			if (put_user(prop->base.id, prop_ptr + copied))
1963 				return -EFAULT;
1964 
1965 			if (put_user(val, prop_values + copied))
1966 				return -EFAULT;
1967 
1968 			copied++;
1969 		}
1970 	}
1971 	*arg_count_props = props_count;
1972 
1973 	return 0;
1974 }
1975 
1976 /**
1977  * drm_mode_getconnector - get connector configuration
1978  * @dev: drm device for the ioctl
1979  * @data: data pointer for the ioctl
1980  * @file_priv: drm file for the ioctl call
1981  *
1982  * Construct a connector configuration structure to return to the user.
1983  *
1984  * Called by the user via ioctl.
1985  *
1986  * Returns:
1987  * Zero on success, negative errno on failure.
1988  */
1989 int drm_mode_getconnector(struct drm_device *dev, void *data,
1990 			  struct drm_file *file_priv)
1991 {
1992 	struct drm_mode_get_connector *out_resp = data;
1993 	struct drm_connector *connector;
1994 	struct drm_encoder *encoder;
1995 	struct drm_display_mode *mode;
1996 	int mode_count = 0;
1997 	int encoders_count = 0;
1998 	int ret = 0;
1999 	int copied = 0;
2000 	int i;
2001 	struct drm_mode_modeinfo u_mode;
2002 	struct drm_mode_modeinfo __user *mode_ptr;
2003 	uint32_t __user *encoder_ptr;
2004 
2005 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2006 		return -EINVAL;
2007 
2008 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2009 
2010 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2011 
2012 	mutex_lock(&dev->mode_config.mutex);
2013 
2014 	connector = drm_connector_find(dev, out_resp->connector_id);
2015 	if (!connector) {
2016 		ret = -ENOENT;
2017 		goto out_unlock;
2018 	}
2019 
2020 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2021 		if (connector->encoder_ids[i] != 0)
2022 			encoders_count++;
2023 
2024 	if (out_resp->count_modes == 0) {
2025 		connector->funcs->fill_modes(connector,
2026 					     dev->mode_config.max_width,
2027 					     dev->mode_config.max_height);
2028 	}
2029 
2030 	/* delayed so we get modes regardless of pre-fill_modes state */
2031 	list_for_each_entry(mode, &connector->modes, head)
2032 		if (drm_mode_expose_to_userspace(mode, file_priv))
2033 			mode_count++;
2034 
2035 	out_resp->connector_id = connector->base.id;
2036 	out_resp->connector_type = connector->connector_type;
2037 	out_resp->connector_type_id = connector->connector_type_id;
2038 	out_resp->mm_width = connector->display_info.width_mm;
2039 	out_resp->mm_height = connector->display_info.height_mm;
2040 	out_resp->subpixel = connector->display_info.subpixel_order;
2041 	out_resp->connection = connector->status;
2042 
2043 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2044 	encoder = drm_connector_get_encoder(connector);
2045 	if (encoder)
2046 		out_resp->encoder_id = encoder->base.id;
2047 	else
2048 		out_resp->encoder_id = 0;
2049 
2050 	/*
2051 	 * This ioctl is called twice, once to determine how much space is
2052 	 * needed, and the 2nd time to fill it.
2053 	 */
2054 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2055 		copied = 0;
2056 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2057 		list_for_each_entry(mode, &connector->modes, head) {
2058 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2059 				continue;
2060 
2061 			drm_mode_convert_to_umode(&u_mode, mode);
2062 			if (copy_to_user(mode_ptr + copied,
2063 					 &u_mode, sizeof(u_mode))) {
2064 				ret = -EFAULT;
2065 				goto out;
2066 			}
2067 			copied++;
2068 		}
2069 	}
2070 	out_resp->count_modes = mode_count;
2071 
2072 	ret = get_properties(&connector->base, file_priv->atomic,
2073 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2074 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2075 			&out_resp->count_props);
2076 	if (ret)
2077 		goto out;
2078 
2079 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2080 		copied = 0;
2081 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2082 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2083 			if (connector->encoder_ids[i] != 0) {
2084 				if (put_user(connector->encoder_ids[i],
2085 					     encoder_ptr + copied)) {
2086 					ret = -EFAULT;
2087 					goto out;
2088 				}
2089 				copied++;
2090 			}
2091 		}
2092 	}
2093 	out_resp->count_encoders = encoders_count;
2094 
2095 out:
2096 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2097 
2098 out_unlock:
2099 	mutex_unlock(&dev->mode_config.mutex);
2100 
2101 	return ret;
2102 }
2103 
2104 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2105 {
2106 	struct drm_connector *connector;
2107 	struct drm_device *dev = encoder->dev;
2108 	bool uses_atomic = false;
2109 
2110 	/* For atomic drivers only state objects are synchronously updated and
2111 	 * protected by modeset locks, so check those first. */
2112 	drm_for_each_connector(connector, dev) {
2113 		if (!connector->state)
2114 			continue;
2115 
2116 		uses_atomic = true;
2117 
2118 		if (connector->state->best_encoder != encoder)
2119 			continue;
2120 
2121 		return connector->state->crtc;
2122 	}
2123 
2124 	/* Don't return stale data (e.g. pending async disable). */
2125 	if (uses_atomic)
2126 		return NULL;
2127 
2128 	return encoder->crtc;
2129 }
2130 
2131 /**
2132  * drm_mode_getencoder - get encoder configuration
2133  * @dev: drm device for the ioctl
2134  * @data: data pointer for the ioctl
2135  * @file_priv: drm file for the ioctl call
2136  *
2137  * Construct a encoder configuration structure to return to the user.
2138  *
2139  * Called by the user via ioctl.
2140  *
2141  * Returns:
2142  * Zero on success, negative errno on failure.
2143  */
2144 int drm_mode_getencoder(struct drm_device *dev, void *data,
2145 			struct drm_file *file_priv)
2146 {
2147 	struct drm_mode_get_encoder *enc_resp = data;
2148 	struct drm_encoder *encoder;
2149 	struct drm_crtc *crtc;
2150 
2151 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2152 		return -EINVAL;
2153 
2154 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2155 	if (!encoder)
2156 		return -ENOENT;
2157 
2158 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2159 	crtc = drm_encoder_get_crtc(encoder);
2160 	if (crtc)
2161 		enc_resp->crtc_id = crtc->base.id;
2162 	else
2163 		enc_resp->crtc_id = 0;
2164 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2165 
2166 	enc_resp->encoder_type = encoder->encoder_type;
2167 	enc_resp->encoder_id = encoder->base.id;
2168 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2169 	enc_resp->possible_clones = encoder->possible_clones;
2170 
2171 	return 0;
2172 }
2173 
2174 /**
2175  * drm_mode_getplane_res - enumerate all plane resources
2176  * @dev: DRM device
2177  * @data: ioctl data
2178  * @file_priv: DRM file info
2179  *
2180  * Construct a list of plane ids to return to the user.
2181  *
2182  * Called by the user via ioctl.
2183  *
2184  * Returns:
2185  * Zero on success, negative errno on failure.
2186  */
2187 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2188 			  struct drm_file *file_priv)
2189 {
2190 	struct drm_mode_get_plane_res *plane_resp = data;
2191 	struct drm_mode_config *config;
2192 	struct drm_plane *plane;
2193 	uint32_t __user *plane_ptr;
2194 	int copied = 0;
2195 	unsigned num_planes;
2196 
2197 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2198 		return -EINVAL;
2199 
2200 	config = &dev->mode_config;
2201 
2202 	if (file_priv->universal_planes)
2203 		num_planes = config->num_total_plane;
2204 	else
2205 		num_planes = config->num_overlay_plane;
2206 
2207 	/*
2208 	 * This ioctl is called twice, once to determine how much space is
2209 	 * needed, and the 2nd time to fill it.
2210 	 */
2211 	if (num_planes &&
2212 	    (plane_resp->count_planes >= num_planes)) {
2213 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2214 
2215 		/* Plane lists are invariant, no locking needed. */
2216 		drm_for_each_plane(plane, dev) {
2217 			/*
2218 			 * Unless userspace set the 'universal planes'
2219 			 * capability bit, only advertise overlays.
2220 			 */
2221 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2222 			    !file_priv->universal_planes)
2223 				continue;
2224 
2225 			if (put_user(plane->base.id, plane_ptr + copied))
2226 				return -EFAULT;
2227 			copied++;
2228 		}
2229 	}
2230 	plane_resp->count_planes = num_planes;
2231 
2232 	return 0;
2233 }
2234 
2235 /**
2236  * drm_mode_getplane - get plane configuration
2237  * @dev: DRM device
2238  * @data: ioctl data
2239  * @file_priv: DRM file info
2240  *
2241  * Construct a plane configuration structure to return to the user.
2242  *
2243  * Called by the user via ioctl.
2244  *
2245  * Returns:
2246  * Zero on success, negative errno on failure.
2247  */
2248 int drm_mode_getplane(struct drm_device *dev, void *data,
2249 		      struct drm_file *file_priv)
2250 {
2251 	struct drm_mode_get_plane *plane_resp = data;
2252 	struct drm_plane *plane;
2253 	uint32_t __user *format_ptr;
2254 
2255 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2256 		return -EINVAL;
2257 
2258 	plane = drm_plane_find(dev, plane_resp->plane_id);
2259 	if (!plane)
2260 		return -ENOENT;
2261 
2262 	drm_modeset_lock(&plane->mutex, NULL);
2263 	if (plane->crtc)
2264 		plane_resp->crtc_id = plane->crtc->base.id;
2265 	else
2266 		plane_resp->crtc_id = 0;
2267 
2268 	if (plane->fb)
2269 		plane_resp->fb_id = plane->fb->base.id;
2270 	else
2271 		plane_resp->fb_id = 0;
2272 	drm_modeset_unlock(&plane->mutex);
2273 
2274 	plane_resp->plane_id = plane->base.id;
2275 	plane_resp->possible_crtcs = plane->possible_crtcs;
2276 	plane_resp->gamma_size = 0;
2277 
2278 	/*
2279 	 * This ioctl is called twice, once to determine how much space is
2280 	 * needed, and the 2nd time to fill it.
2281 	 */
2282 	if (plane->format_count &&
2283 	    (plane_resp->count_format_types >= plane->format_count)) {
2284 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2285 		if (copy_to_user(format_ptr,
2286 				 plane->format_types,
2287 				 sizeof(uint32_t) * plane->format_count)) {
2288 			return -EFAULT;
2289 		}
2290 	}
2291 	plane_resp->count_format_types = plane->format_count;
2292 
2293 	return 0;
2294 }
2295 
2296 /**
2297  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2298  * @plane: plane to check for format support
2299  * @format: the pixel format
2300  *
2301  * Returns:
2302  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2303  * otherwise.
2304  */
2305 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2306 {
2307 	unsigned int i;
2308 
2309 	for (i = 0; i < plane->format_count; i++) {
2310 		if (format == plane->format_types[i])
2311 			return 0;
2312 	}
2313 
2314 	return -EINVAL;
2315 }
2316 
2317 static int check_src_coords(uint32_t src_x, uint32_t src_y,
2318 			    uint32_t src_w, uint32_t src_h,
2319 			    const struct drm_framebuffer *fb)
2320 {
2321 	unsigned int fb_width, fb_height;
2322 
2323 	fb_width = fb->width << 16;
2324 	fb_height = fb->height << 16;
2325 
2326 	/* Make sure source coordinates are inside the fb. */
2327 	if (src_w > fb_width ||
2328 	    src_x > fb_width - src_w ||
2329 	    src_h > fb_height ||
2330 	    src_y > fb_height - src_h) {
2331 		DRM_DEBUG_KMS("Invalid source coordinates "
2332 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2333 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2334 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2335 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2336 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2337 		return -ENOSPC;
2338 	}
2339 
2340 	return 0;
2341 }
2342 
2343 /*
2344  * setplane_internal - setplane handler for internal callers
2345  *
2346  * Note that we assume an extra reference has already been taken on fb.  If the
2347  * update fails, this reference will be dropped before return; if it succeeds,
2348  * the previous framebuffer (if any) will be unreferenced instead.
2349  *
2350  * src_{x,y,w,h} are provided in 16.16 fixed point format
2351  */
2352 static int __setplane_internal(struct drm_plane *plane,
2353 			       struct drm_crtc *crtc,
2354 			       struct drm_framebuffer *fb,
2355 			       int32_t crtc_x, int32_t crtc_y,
2356 			       uint32_t crtc_w, uint32_t crtc_h,
2357 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2358 			       uint32_t src_x, uint32_t src_y,
2359 			       uint32_t src_w, uint32_t src_h)
2360 {
2361 	int ret = 0;
2362 
2363 	/* No fb means shut it down */
2364 	if (!fb) {
2365 		plane->old_fb = plane->fb;
2366 		ret = plane->funcs->disable_plane(plane);
2367 		if (!ret) {
2368 			plane->crtc = NULL;
2369 			plane->fb = NULL;
2370 		} else {
2371 			plane->old_fb = NULL;
2372 		}
2373 		goto out;
2374 	}
2375 
2376 	/* Check whether this plane is usable on this CRTC */
2377 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2378 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2379 		ret = -EINVAL;
2380 		goto out;
2381 	}
2382 
2383 	/* Check whether this plane supports the fb pixel format. */
2384 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2385 	if (ret) {
2386 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2387 			      drm_get_format_name(fb->pixel_format));
2388 		goto out;
2389 	}
2390 
2391 	/* Give drivers some help against integer overflows */
2392 	if (crtc_w > INT_MAX ||
2393 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2394 	    crtc_h > INT_MAX ||
2395 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2396 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2397 			      crtc_w, crtc_h, crtc_x, crtc_y);
2398 		ret = -ERANGE;
2399 		goto out;
2400 	}
2401 
2402 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
2403 	if (ret)
2404 		goto out;
2405 
2406 	plane->old_fb = plane->fb;
2407 	ret = plane->funcs->update_plane(plane, crtc, fb,
2408 					 crtc_x, crtc_y, crtc_w, crtc_h,
2409 					 src_x, src_y, src_w, src_h);
2410 	if (!ret) {
2411 		plane->crtc = crtc;
2412 		plane->fb = fb;
2413 		fb = NULL;
2414 	} else {
2415 		plane->old_fb = NULL;
2416 	}
2417 
2418 out:
2419 	if (fb)
2420 		drm_framebuffer_unreference(fb);
2421 	if (plane->old_fb)
2422 		drm_framebuffer_unreference(plane->old_fb);
2423 	plane->old_fb = NULL;
2424 
2425 	return ret;
2426 }
2427 
2428 static int setplane_internal(struct drm_plane *plane,
2429 			     struct drm_crtc *crtc,
2430 			     struct drm_framebuffer *fb,
2431 			     int32_t crtc_x, int32_t crtc_y,
2432 			     uint32_t crtc_w, uint32_t crtc_h,
2433 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2434 			     uint32_t src_x, uint32_t src_y,
2435 			     uint32_t src_w, uint32_t src_h)
2436 {
2437 	int ret;
2438 
2439 	drm_modeset_lock_all(plane->dev);
2440 	ret = __setplane_internal(plane, crtc, fb,
2441 				  crtc_x, crtc_y, crtc_w, crtc_h,
2442 				  src_x, src_y, src_w, src_h);
2443 	drm_modeset_unlock_all(plane->dev);
2444 
2445 	return ret;
2446 }
2447 
2448 /**
2449  * drm_mode_setplane - configure a plane's configuration
2450  * @dev: DRM device
2451  * @data: ioctl data*
2452  * @file_priv: DRM file info
2453  *
2454  * Set plane configuration, including placement, fb, scaling, and other factors.
2455  * Or pass a NULL fb to disable (planes may be disabled without providing a
2456  * valid crtc).
2457  *
2458  * Returns:
2459  * Zero on success, negative errno on failure.
2460  */
2461 int drm_mode_setplane(struct drm_device *dev, void *data,
2462 		      struct drm_file *file_priv)
2463 {
2464 	struct drm_mode_set_plane *plane_req = data;
2465 	struct drm_plane *plane;
2466 	struct drm_crtc *crtc = NULL;
2467 	struct drm_framebuffer *fb = NULL;
2468 
2469 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2470 		return -EINVAL;
2471 
2472 	/*
2473 	 * First, find the plane, crtc, and fb objects.  If not available,
2474 	 * we don't bother to call the driver.
2475 	 */
2476 	plane = drm_plane_find(dev, plane_req->plane_id);
2477 	if (!plane) {
2478 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2479 			      plane_req->plane_id);
2480 		return -ENOENT;
2481 	}
2482 
2483 	if (plane_req->fb_id) {
2484 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2485 		if (!fb) {
2486 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2487 				      plane_req->fb_id);
2488 			return -ENOENT;
2489 		}
2490 
2491 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2492 		if (!crtc) {
2493 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2494 				      plane_req->crtc_id);
2495 			return -ENOENT;
2496 		}
2497 	}
2498 
2499 	/*
2500 	 * setplane_internal will take care of deref'ing either the old or new
2501 	 * framebuffer depending on success.
2502 	 */
2503 	return setplane_internal(plane, crtc, fb,
2504 				 plane_req->crtc_x, plane_req->crtc_y,
2505 				 plane_req->crtc_w, plane_req->crtc_h,
2506 				 plane_req->src_x, plane_req->src_y,
2507 				 plane_req->src_w, plane_req->src_h);
2508 }
2509 
2510 /**
2511  * drm_mode_set_config_internal - helper to call ->set_config
2512  * @set: modeset config to set
2513  *
2514  * This is a little helper to wrap internal calls to the ->set_config driver
2515  * interface. The only thing it adds is correct refcounting dance.
2516  *
2517  * Returns:
2518  * Zero on success, negative errno on failure.
2519  */
2520 int drm_mode_set_config_internal(struct drm_mode_set *set)
2521 {
2522 	struct drm_crtc *crtc = set->crtc;
2523 	struct drm_framebuffer *fb;
2524 	struct drm_crtc *tmp;
2525 	int ret;
2526 
2527 	/*
2528 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2529 	 * connectors from it), hence we need to refcount the fbs across all
2530 	 * crtcs. Atomic modeset will have saner semantics ...
2531 	 */
2532 	drm_for_each_crtc(tmp, crtc->dev)
2533 		tmp->primary->old_fb = tmp->primary->fb;
2534 
2535 	fb = set->fb;
2536 
2537 	ret = crtc->funcs->set_config(set);
2538 	if (ret == 0) {
2539 		crtc->primary->crtc = crtc;
2540 		crtc->primary->fb = fb;
2541 	}
2542 
2543 	drm_for_each_crtc(tmp, crtc->dev) {
2544 		if (tmp->primary->fb)
2545 			drm_framebuffer_reference(tmp->primary->fb);
2546 		if (tmp->primary->old_fb)
2547 			drm_framebuffer_unreference(tmp->primary->old_fb);
2548 		tmp->primary->old_fb = NULL;
2549 	}
2550 
2551 	return ret;
2552 }
2553 EXPORT_SYMBOL(drm_mode_set_config_internal);
2554 
2555 /**
2556  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2557  * @mode: mode to query
2558  * @hdisplay: hdisplay value to fill in
2559  * @vdisplay: vdisplay value to fill in
2560  *
2561  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2562  * the appropriate layout.
2563  */
2564 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2565 			    int *hdisplay, int *vdisplay)
2566 {
2567 	struct drm_display_mode adjusted;
2568 
2569 	drm_mode_copy(&adjusted, mode);
2570 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2571 	*hdisplay = adjusted.crtc_hdisplay;
2572 	*vdisplay = adjusted.crtc_vdisplay;
2573 }
2574 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2575 
2576 /**
2577  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2578  *     CRTC viewport
2579  * @crtc: CRTC that framebuffer will be displayed on
2580  * @x: x panning
2581  * @y: y panning
2582  * @mode: mode that framebuffer will be displayed under
2583  * @fb: framebuffer to check size of
2584  */
2585 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2586 			    int x, int y,
2587 			    const struct drm_display_mode *mode,
2588 			    const struct drm_framebuffer *fb)
2589 
2590 {
2591 	int hdisplay, vdisplay;
2592 
2593 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2594 
2595 	if (crtc->state &&
2596 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
2597 					      BIT(DRM_ROTATE_270)))
2598 		swap(hdisplay, vdisplay);
2599 
2600 	return check_src_coords(x << 16, y << 16,
2601 				hdisplay << 16, vdisplay << 16, fb);
2602 }
2603 EXPORT_SYMBOL(drm_crtc_check_viewport);
2604 
2605 /**
2606  * drm_mode_setcrtc - set CRTC configuration
2607  * @dev: drm device for the ioctl
2608  * @data: data pointer for the ioctl
2609  * @file_priv: drm file for the ioctl call
2610  *
2611  * Build a new CRTC configuration based on user request.
2612  *
2613  * Called by the user via ioctl.
2614  *
2615  * Returns:
2616  * Zero on success, negative errno on failure.
2617  */
2618 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2619 		     struct drm_file *file_priv)
2620 {
2621 	struct drm_mode_config *config = &dev->mode_config;
2622 	struct drm_mode_crtc *crtc_req = data;
2623 	struct drm_crtc *crtc;
2624 	struct drm_connector **connector_set = NULL, *connector;
2625 	struct drm_framebuffer *fb = NULL;
2626 	struct drm_display_mode *mode = NULL;
2627 	struct drm_mode_set set;
2628 	uint32_t __user *set_connectors_ptr;
2629 	int ret;
2630 	int i;
2631 
2632 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2633 		return -EINVAL;
2634 
2635 	/*
2636 	 * Universal plane src offsets are only 16.16, prevent havoc for
2637 	 * drivers using universal plane code internally.
2638 	 */
2639 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2640 		return -ERANGE;
2641 
2642 	drm_modeset_lock_all(dev);
2643 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2644 	if (!crtc) {
2645 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2646 		ret = -ENOENT;
2647 		goto out;
2648 	}
2649 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2650 
2651 	if (crtc_req->mode_valid) {
2652 		/* If we have a mode we need a framebuffer. */
2653 		/* If we pass -1, set the mode with the currently bound fb */
2654 		if (crtc_req->fb_id == -1) {
2655 			if (!crtc->primary->fb) {
2656 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2657 				ret = -EINVAL;
2658 				goto out;
2659 			}
2660 			fb = crtc->primary->fb;
2661 			/* Make refcounting symmetric with the lookup path. */
2662 			drm_framebuffer_reference(fb);
2663 		} else {
2664 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2665 			if (!fb) {
2666 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2667 						crtc_req->fb_id);
2668 				ret = -ENOENT;
2669 				goto out;
2670 			}
2671 		}
2672 
2673 		mode = drm_mode_create(dev);
2674 		if (!mode) {
2675 			ret = -ENOMEM;
2676 			goto out;
2677 		}
2678 
2679 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2680 		if (ret) {
2681 			DRM_DEBUG_KMS("Invalid mode\n");
2682 			goto out;
2683 		}
2684 
2685 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2686 
2687 		/*
2688 		 * Check whether the primary plane supports the fb pixel format.
2689 		 * Drivers not implementing the universal planes API use a
2690 		 * default formats list provided by the DRM core which doesn't
2691 		 * match real hardware capabilities. Skip the check in that
2692 		 * case.
2693 		 */
2694 		if (!crtc->primary->format_default) {
2695 			ret = drm_plane_check_pixel_format(crtc->primary,
2696 							   fb->pixel_format);
2697 			if (ret) {
2698 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2699 					drm_get_format_name(fb->pixel_format));
2700 				goto out;
2701 			}
2702 		}
2703 
2704 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2705 					      mode, fb);
2706 		if (ret)
2707 			goto out;
2708 
2709 	}
2710 
2711 	if (crtc_req->count_connectors == 0 && mode) {
2712 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2713 		ret = -EINVAL;
2714 		goto out;
2715 	}
2716 
2717 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2718 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2719 			  crtc_req->count_connectors);
2720 		ret = -EINVAL;
2721 		goto out;
2722 	}
2723 
2724 	if (crtc_req->count_connectors > 0) {
2725 		u32 out_id;
2726 
2727 		/* Avoid unbounded kernel memory allocation */
2728 		if (crtc_req->count_connectors > config->num_connector) {
2729 			ret = -EINVAL;
2730 			goto out;
2731 		}
2732 
2733 		connector_set = kmalloc_array(crtc_req->count_connectors,
2734 					      sizeof(struct drm_connector *),
2735 					      GFP_KERNEL);
2736 		if (!connector_set) {
2737 			ret = -ENOMEM;
2738 			goto out;
2739 		}
2740 
2741 		for (i = 0; i < crtc_req->count_connectors; i++) {
2742 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2743 			if (get_user(out_id, &set_connectors_ptr[i])) {
2744 				ret = -EFAULT;
2745 				goto out;
2746 			}
2747 
2748 			connector = drm_connector_find(dev, out_id);
2749 			if (!connector) {
2750 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2751 						out_id);
2752 				ret = -ENOENT;
2753 				goto out;
2754 			}
2755 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2756 					connector->base.id,
2757 					connector->name);
2758 
2759 			connector_set[i] = connector;
2760 		}
2761 	}
2762 
2763 	set.crtc = crtc;
2764 	set.x = crtc_req->x;
2765 	set.y = crtc_req->y;
2766 	set.mode = mode;
2767 	set.connectors = connector_set;
2768 	set.num_connectors = crtc_req->count_connectors;
2769 	set.fb = fb;
2770 	ret = drm_mode_set_config_internal(&set);
2771 
2772 out:
2773 	if (fb)
2774 		drm_framebuffer_unreference(fb);
2775 
2776 	kfree(connector_set);
2777 	drm_mode_destroy(dev, mode);
2778 	drm_modeset_unlock_all(dev);
2779 	return ret;
2780 }
2781 
2782 /**
2783  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2784  *     universal plane handler call
2785  * @crtc: crtc to update cursor for
2786  * @req: data pointer for the ioctl
2787  * @file_priv: drm file for the ioctl call
2788  *
2789  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2790  * translate legacy ioctl calls into universal plane handler calls, we need to
2791  * wrap the native buffer handle in a drm_framebuffer.
2792  *
2793  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2794  * buffer with a pitch of 4*width; the universal plane interface should be used
2795  * directly in cases where the hardware can support other buffer settings and
2796  * userspace wants to make use of these capabilities.
2797  *
2798  * Returns:
2799  * Zero on success, negative errno on failure.
2800  */
2801 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2802 				     struct drm_mode_cursor2 *req,
2803 				     struct drm_file *file_priv)
2804 {
2805 	struct drm_device *dev = crtc->dev;
2806 	struct drm_framebuffer *fb = NULL;
2807 	struct drm_mode_fb_cmd2 fbreq = {
2808 		.width = req->width,
2809 		.height = req->height,
2810 		.pixel_format = DRM_FORMAT_ARGB8888,
2811 		.pitches = { req->width * 4 },
2812 		.handles = { req->handle },
2813 	};
2814 	int32_t crtc_x, crtc_y;
2815 	uint32_t crtc_w = 0, crtc_h = 0;
2816 	uint32_t src_w = 0, src_h = 0;
2817 	int ret = 0;
2818 
2819 	BUG_ON(!crtc->cursor);
2820 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2821 
2822 	/*
2823 	 * Obtain fb we'll be using (either new or existing) and take an extra
2824 	 * reference to it if fb != null.  setplane will take care of dropping
2825 	 * the reference if the plane update fails.
2826 	 */
2827 	if (req->flags & DRM_MODE_CURSOR_BO) {
2828 		if (req->handle) {
2829 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2830 			if (IS_ERR(fb)) {
2831 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2832 				return PTR_ERR(fb);
2833 			}
2834 		} else {
2835 			fb = NULL;
2836 		}
2837 	} else {
2838 		fb = crtc->cursor->fb;
2839 		if (fb)
2840 			drm_framebuffer_reference(fb);
2841 	}
2842 
2843 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2844 		crtc_x = req->x;
2845 		crtc_y = req->y;
2846 	} else {
2847 		crtc_x = crtc->cursor_x;
2848 		crtc_y = crtc->cursor_y;
2849 	}
2850 
2851 	if (fb) {
2852 		crtc_w = fb->width;
2853 		crtc_h = fb->height;
2854 		src_w = fb->width << 16;
2855 		src_h = fb->height << 16;
2856 	}
2857 
2858 	/*
2859 	 * setplane_internal will take care of deref'ing either the old or new
2860 	 * framebuffer depending on success.
2861 	 */
2862 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2863 				crtc_x, crtc_y, crtc_w, crtc_h,
2864 				0, 0, src_w, src_h);
2865 
2866 	/* Update successful; save new cursor position, if necessary */
2867 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2868 		crtc->cursor_x = req->x;
2869 		crtc->cursor_y = req->y;
2870 	}
2871 
2872 	return ret;
2873 }
2874 
2875 static int drm_mode_cursor_common(struct drm_device *dev,
2876 				  struct drm_mode_cursor2 *req,
2877 				  struct drm_file *file_priv)
2878 {
2879 	struct drm_crtc *crtc;
2880 	int ret = 0;
2881 
2882 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2883 		return -EINVAL;
2884 
2885 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2886 		return -EINVAL;
2887 
2888 	crtc = drm_crtc_find(dev, req->crtc_id);
2889 	if (!crtc) {
2890 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2891 		return -ENOENT;
2892 	}
2893 
2894 	/*
2895 	 * If this crtc has a universal cursor plane, call that plane's update
2896 	 * handler rather than using legacy cursor handlers.
2897 	 */
2898 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2899 	if (crtc->cursor) {
2900 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2901 		goto out;
2902 	}
2903 
2904 	if (req->flags & DRM_MODE_CURSOR_BO) {
2905 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2906 			ret = -ENXIO;
2907 			goto out;
2908 		}
2909 		/* Turns off the cursor if handle is 0 */
2910 		if (crtc->funcs->cursor_set2)
2911 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2912 						      req->width, req->height, req->hot_x, req->hot_y);
2913 		else
2914 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2915 						      req->width, req->height);
2916 	}
2917 
2918 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2919 		if (crtc->funcs->cursor_move) {
2920 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2921 		} else {
2922 			ret = -EFAULT;
2923 			goto out;
2924 		}
2925 	}
2926 out:
2927 	drm_modeset_unlock_crtc(crtc);
2928 
2929 	return ret;
2930 
2931 }
2932 
2933 
2934 /**
2935  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2936  * @dev: drm device for the ioctl
2937  * @data: data pointer for the ioctl
2938  * @file_priv: drm file for the ioctl call
2939  *
2940  * Set the cursor configuration based on user request.
2941  *
2942  * Called by the user via ioctl.
2943  *
2944  * Returns:
2945  * Zero on success, negative errno on failure.
2946  */
2947 int drm_mode_cursor_ioctl(struct drm_device *dev,
2948 			  void *data, struct drm_file *file_priv)
2949 {
2950 	struct drm_mode_cursor *req = data;
2951 	struct drm_mode_cursor2 new_req;
2952 
2953 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2954 	new_req.hot_x = new_req.hot_y = 0;
2955 
2956 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2957 }
2958 
2959 /**
2960  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2961  * @dev: drm device for the ioctl
2962  * @data: data pointer for the ioctl
2963  * @file_priv: drm file for the ioctl call
2964  *
2965  * Set the cursor configuration based on user request. This implements the 2nd
2966  * version of the cursor ioctl, which allows userspace to additionally specify
2967  * the hotspot of the pointer.
2968  *
2969  * Called by the user via ioctl.
2970  *
2971  * Returns:
2972  * Zero on success, negative errno on failure.
2973  */
2974 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2975 			   void *data, struct drm_file *file_priv)
2976 {
2977 	struct drm_mode_cursor2 *req = data;
2978 
2979 	return drm_mode_cursor_common(dev, req, file_priv);
2980 }
2981 
2982 /**
2983  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
2984  * @bpp: bits per pixels
2985  * @depth: bit depth per pixel
2986  *
2987  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
2988  * Useful in fbdev emulation code, since that deals in those values.
2989  */
2990 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
2991 {
2992 	uint32_t fmt;
2993 
2994 	switch (bpp) {
2995 	case 8:
2996 		fmt = DRM_FORMAT_C8;
2997 		break;
2998 	case 16:
2999 		if (depth == 15)
3000 			fmt = DRM_FORMAT_XRGB1555;
3001 		else
3002 			fmt = DRM_FORMAT_RGB565;
3003 		break;
3004 	case 24:
3005 		fmt = DRM_FORMAT_RGB888;
3006 		break;
3007 	case 32:
3008 		if (depth == 24)
3009 			fmt = DRM_FORMAT_XRGB8888;
3010 		else if (depth == 30)
3011 			fmt = DRM_FORMAT_XRGB2101010;
3012 		else
3013 			fmt = DRM_FORMAT_ARGB8888;
3014 		break;
3015 	default:
3016 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3017 		fmt = DRM_FORMAT_XRGB8888;
3018 		break;
3019 	}
3020 
3021 	return fmt;
3022 }
3023 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3024 
3025 /**
3026  * drm_mode_addfb - add an FB to the graphics configuration
3027  * @dev: drm device for the ioctl
3028  * @data: data pointer for the ioctl
3029  * @file_priv: drm file for the ioctl call
3030  *
3031  * Add a new FB to the specified CRTC, given a user request. This is the
3032  * original addfb ioctl which only supported RGB formats.
3033  *
3034  * Called by the user via ioctl.
3035  *
3036  * Returns:
3037  * Zero on success, negative errno on failure.
3038  */
3039 int drm_mode_addfb(struct drm_device *dev,
3040 		   void *data, struct drm_file *file_priv)
3041 {
3042 	struct drm_mode_fb_cmd *or = data;
3043 	struct drm_mode_fb_cmd2 r = {};
3044 	int ret;
3045 
3046 	/* convert to new format and call new ioctl */
3047 	r.fb_id = or->fb_id;
3048 	r.width = or->width;
3049 	r.height = or->height;
3050 	r.pitches[0] = or->pitch;
3051 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3052 	r.handles[0] = or->handle;
3053 
3054 	ret = drm_mode_addfb2(dev, &r, file_priv);
3055 	if (ret)
3056 		return ret;
3057 
3058 	or->fb_id = r.fb_id;
3059 
3060 	return 0;
3061 }
3062 
3063 static int format_check(const struct drm_mode_fb_cmd2 *r)
3064 {
3065 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3066 
3067 	switch (format) {
3068 	case DRM_FORMAT_C8:
3069 	case DRM_FORMAT_RGB332:
3070 	case DRM_FORMAT_BGR233:
3071 	case DRM_FORMAT_XRGB4444:
3072 	case DRM_FORMAT_XBGR4444:
3073 	case DRM_FORMAT_RGBX4444:
3074 	case DRM_FORMAT_BGRX4444:
3075 	case DRM_FORMAT_ARGB4444:
3076 	case DRM_FORMAT_ABGR4444:
3077 	case DRM_FORMAT_RGBA4444:
3078 	case DRM_FORMAT_BGRA4444:
3079 	case DRM_FORMAT_XRGB1555:
3080 	case DRM_FORMAT_XBGR1555:
3081 	case DRM_FORMAT_RGBX5551:
3082 	case DRM_FORMAT_BGRX5551:
3083 	case DRM_FORMAT_ARGB1555:
3084 	case DRM_FORMAT_ABGR1555:
3085 	case DRM_FORMAT_RGBA5551:
3086 	case DRM_FORMAT_BGRA5551:
3087 	case DRM_FORMAT_RGB565:
3088 	case DRM_FORMAT_BGR565:
3089 	case DRM_FORMAT_RGB888:
3090 	case DRM_FORMAT_BGR888:
3091 	case DRM_FORMAT_XRGB8888:
3092 	case DRM_FORMAT_XBGR8888:
3093 	case DRM_FORMAT_RGBX8888:
3094 	case DRM_FORMAT_BGRX8888:
3095 	case DRM_FORMAT_ARGB8888:
3096 	case DRM_FORMAT_ABGR8888:
3097 	case DRM_FORMAT_RGBA8888:
3098 	case DRM_FORMAT_BGRA8888:
3099 	case DRM_FORMAT_XRGB2101010:
3100 	case DRM_FORMAT_XBGR2101010:
3101 	case DRM_FORMAT_RGBX1010102:
3102 	case DRM_FORMAT_BGRX1010102:
3103 	case DRM_FORMAT_ARGB2101010:
3104 	case DRM_FORMAT_ABGR2101010:
3105 	case DRM_FORMAT_RGBA1010102:
3106 	case DRM_FORMAT_BGRA1010102:
3107 	case DRM_FORMAT_YUYV:
3108 	case DRM_FORMAT_YVYU:
3109 	case DRM_FORMAT_UYVY:
3110 	case DRM_FORMAT_VYUY:
3111 	case DRM_FORMAT_AYUV:
3112 	case DRM_FORMAT_NV12:
3113 	case DRM_FORMAT_NV21:
3114 	case DRM_FORMAT_NV16:
3115 	case DRM_FORMAT_NV61:
3116 	case DRM_FORMAT_NV24:
3117 	case DRM_FORMAT_NV42:
3118 	case DRM_FORMAT_YUV410:
3119 	case DRM_FORMAT_YVU410:
3120 	case DRM_FORMAT_YUV411:
3121 	case DRM_FORMAT_YVU411:
3122 	case DRM_FORMAT_YUV420:
3123 	case DRM_FORMAT_YVU420:
3124 	case DRM_FORMAT_YUV422:
3125 	case DRM_FORMAT_YVU422:
3126 	case DRM_FORMAT_YUV444:
3127 	case DRM_FORMAT_YVU444:
3128 		return 0;
3129 	default:
3130 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3131 			      drm_get_format_name(r->pixel_format));
3132 		return -EINVAL;
3133 	}
3134 }
3135 
3136 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3137 {
3138 	int ret, hsub, vsub, num_planes, i;
3139 
3140 	ret = format_check(r);
3141 	if (ret) {
3142 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3143 			      drm_get_format_name(r->pixel_format));
3144 		return ret;
3145 	}
3146 
3147 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3148 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3149 	num_planes = drm_format_num_planes(r->pixel_format);
3150 
3151 	if (r->width == 0 || r->width % hsub) {
3152 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3153 		return -EINVAL;
3154 	}
3155 
3156 	if (r->height == 0 || r->height % vsub) {
3157 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3158 		return -EINVAL;
3159 	}
3160 
3161 	for (i = 0; i < num_planes; i++) {
3162 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3163 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3164 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3165 
3166 		if (!r->handles[i]) {
3167 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3168 			return -EINVAL;
3169 		}
3170 
3171 		if ((uint64_t) width * cpp > UINT_MAX)
3172 			return -ERANGE;
3173 
3174 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3175 			return -ERANGE;
3176 
3177 		if (r->pitches[i] < width * cpp) {
3178 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3179 			return -EINVAL;
3180 		}
3181 
3182 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3183 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
3184 				      r->modifier[i], i);
3185 			return -EINVAL;
3186 		}
3187 
3188 		/* modifier specific checks: */
3189 		switch (r->modifier[i]) {
3190 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3191 			/* NOTE: the pitch restriction may be lifted later if it turns
3192 			 * out that no hw has this restriction:
3193 			 */
3194 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3195 					width % 128 || height % 32 ||
3196 					r->pitches[i] % 128) {
3197 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3198 				return -EINVAL;
3199 			}
3200 			break;
3201 
3202 		default:
3203 			break;
3204 		}
3205 	}
3206 
3207 	for (i = num_planes; i < 4; i++) {
3208 		if (r->modifier[i]) {
3209 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3210 			return -EINVAL;
3211 		}
3212 
3213 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3214 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3215 			continue;
3216 
3217 		if (r->handles[i]) {
3218 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3219 			return -EINVAL;
3220 		}
3221 
3222 		if (r->pitches[i]) {
3223 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3224 			return -EINVAL;
3225 		}
3226 
3227 		if (r->offsets[i]) {
3228 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3229 			return -EINVAL;
3230 		}
3231 	}
3232 
3233 	return 0;
3234 }
3235 
3236 static struct drm_framebuffer *
3237 internal_framebuffer_create(struct drm_device *dev,
3238 			    struct drm_mode_fb_cmd2 *r,
3239 			    struct drm_file *file_priv)
3240 {
3241 	struct drm_mode_config *config = &dev->mode_config;
3242 	struct drm_framebuffer *fb;
3243 	int ret;
3244 
3245 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3246 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3247 		return ERR_PTR(-EINVAL);
3248 	}
3249 
3250 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3251 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3252 			  r->width, config->min_width, config->max_width);
3253 		return ERR_PTR(-EINVAL);
3254 	}
3255 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3256 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3257 			  r->height, config->min_height, config->max_height);
3258 		return ERR_PTR(-EINVAL);
3259 	}
3260 
3261 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3262 	    !dev->mode_config.allow_fb_modifiers) {
3263 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3264 		return ERR_PTR(-EINVAL);
3265 	}
3266 
3267 	ret = framebuffer_check(r);
3268 	if (ret)
3269 		return ERR_PTR(ret);
3270 
3271 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3272 	if (IS_ERR(fb)) {
3273 		DRM_DEBUG_KMS("could not create framebuffer\n");
3274 		return fb;
3275 	}
3276 
3277 	return fb;
3278 }
3279 
3280 /**
3281  * drm_mode_addfb2 - add an FB to the graphics configuration
3282  * @dev: drm device for the ioctl
3283  * @data: data pointer for the ioctl
3284  * @file_priv: drm file for the ioctl call
3285  *
3286  * Add a new FB to the specified CRTC, given a user request with format. This is
3287  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3288  * and uses fourcc codes as pixel format specifiers.
3289  *
3290  * Called by the user via ioctl.
3291  *
3292  * Returns:
3293  * Zero on success, negative errno on failure.
3294  */
3295 int drm_mode_addfb2(struct drm_device *dev,
3296 		    void *data, struct drm_file *file_priv)
3297 {
3298 	struct drm_mode_fb_cmd2 *r = data;
3299 	struct drm_framebuffer *fb;
3300 
3301 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3302 		return -EINVAL;
3303 
3304 	fb = internal_framebuffer_create(dev, r, file_priv);
3305 	if (IS_ERR(fb))
3306 		return PTR_ERR(fb);
3307 
3308 	/* Transfer ownership to the filp for reaping on close */
3309 
3310 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3311 	mutex_lock(&file_priv->fbs_lock);
3312 	r->fb_id = fb->base.id;
3313 	list_add(&fb->filp_head, &file_priv->fbs);
3314 	mutex_unlock(&file_priv->fbs_lock);
3315 
3316 	return 0;
3317 }
3318 
3319 /**
3320  * drm_mode_rmfb - remove an FB from the configuration
3321  * @dev: drm device for the ioctl
3322  * @data: data pointer for the ioctl
3323  * @file_priv: drm file for the ioctl call
3324  *
3325  * Remove the FB specified by the user.
3326  *
3327  * Called by the user via ioctl.
3328  *
3329  * Returns:
3330  * Zero on success, negative errno on failure.
3331  */
3332 int drm_mode_rmfb(struct drm_device *dev,
3333 		   void *data, struct drm_file *file_priv)
3334 {
3335 	struct drm_framebuffer *fb = NULL;
3336 	struct drm_framebuffer *fbl = NULL;
3337 	uint32_t *id = data;
3338 	int found = 0;
3339 
3340 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3341 		return -EINVAL;
3342 
3343 	mutex_lock(&file_priv->fbs_lock);
3344 	mutex_lock(&dev->mode_config.fb_lock);
3345 	fb = __drm_framebuffer_lookup(dev, *id);
3346 	if (!fb)
3347 		goto fail_lookup;
3348 
3349 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3350 		if (fb == fbl)
3351 			found = 1;
3352 	if (!found)
3353 		goto fail_lookup;
3354 
3355 	list_del_init(&fb->filp_head);
3356 	mutex_unlock(&dev->mode_config.fb_lock);
3357 	mutex_unlock(&file_priv->fbs_lock);
3358 
3359 	drm_framebuffer_unreference(fb);
3360 
3361 	return 0;
3362 
3363 fail_lookup:
3364 	mutex_unlock(&dev->mode_config.fb_lock);
3365 	mutex_unlock(&file_priv->fbs_lock);
3366 
3367 	return -ENOENT;
3368 }
3369 
3370 /**
3371  * drm_mode_getfb - get FB info
3372  * @dev: drm device for the ioctl
3373  * @data: data pointer for the ioctl
3374  * @file_priv: drm file for the ioctl call
3375  *
3376  * Lookup the FB given its ID and return info about it.
3377  *
3378  * Called by the user via ioctl.
3379  *
3380  * Returns:
3381  * Zero on success, negative errno on failure.
3382  */
3383 int drm_mode_getfb(struct drm_device *dev,
3384 		   void *data, struct drm_file *file_priv)
3385 {
3386 	struct drm_mode_fb_cmd *r = data;
3387 	struct drm_framebuffer *fb;
3388 	int ret;
3389 
3390 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3391 		return -EINVAL;
3392 
3393 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3394 	if (!fb)
3395 		return -ENOENT;
3396 
3397 	r->height = fb->height;
3398 	r->width = fb->width;
3399 	r->depth = fb->depth;
3400 	r->bpp = fb->bits_per_pixel;
3401 	r->pitch = fb->pitches[0];
3402 	if (fb->funcs->create_handle) {
3403 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3404 		    drm_is_control_client(file_priv)) {
3405 			ret = fb->funcs->create_handle(fb, file_priv,
3406 						       &r->handle);
3407 		} else {
3408 			/* GET_FB() is an unprivileged ioctl so we must not
3409 			 * return a buffer-handle to non-master processes! For
3410 			 * backwards-compatibility reasons, we cannot make
3411 			 * GET_FB() privileged, so just return an invalid handle
3412 			 * for non-masters. */
3413 			r->handle = 0;
3414 			ret = 0;
3415 		}
3416 	} else {
3417 		ret = -ENODEV;
3418 	}
3419 
3420 	drm_framebuffer_unreference(fb);
3421 
3422 	return ret;
3423 }
3424 
3425 /**
3426  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3427  * @dev: drm device for the ioctl
3428  * @data: data pointer for the ioctl
3429  * @file_priv: drm file for the ioctl call
3430  *
3431  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3432  * rectangle list. Generic userspace which does frontbuffer rendering must call
3433  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3434  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3435  *
3436  * Modesetting drivers which always update the frontbuffer do not need to
3437  * implement the corresponding ->dirty framebuffer callback.
3438  *
3439  * Called by the user via ioctl.
3440  *
3441  * Returns:
3442  * Zero on success, negative errno on failure.
3443  */
3444 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3445 			   void *data, struct drm_file *file_priv)
3446 {
3447 	struct drm_clip_rect __user *clips_ptr;
3448 	struct drm_clip_rect *clips = NULL;
3449 	struct drm_mode_fb_dirty_cmd *r = data;
3450 	struct drm_framebuffer *fb;
3451 	unsigned flags;
3452 	int num_clips;
3453 	int ret;
3454 
3455 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3456 		return -EINVAL;
3457 
3458 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3459 	if (!fb)
3460 		return -ENOENT;
3461 
3462 	num_clips = r->num_clips;
3463 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3464 
3465 	if (!num_clips != !clips_ptr) {
3466 		ret = -EINVAL;
3467 		goto out_err1;
3468 	}
3469 
3470 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3471 
3472 	/* If userspace annotates copy, clips must come in pairs */
3473 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3474 		ret = -EINVAL;
3475 		goto out_err1;
3476 	}
3477 
3478 	if (num_clips && clips_ptr) {
3479 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3480 			ret = -EINVAL;
3481 			goto out_err1;
3482 		}
3483 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3484 		if (!clips) {
3485 			ret = -ENOMEM;
3486 			goto out_err1;
3487 		}
3488 
3489 		ret = copy_from_user(clips, clips_ptr,
3490 				     num_clips * sizeof(*clips));
3491 		if (ret) {
3492 			ret = -EFAULT;
3493 			goto out_err2;
3494 		}
3495 	}
3496 
3497 	if (fb->funcs->dirty) {
3498 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3499 				       clips, num_clips);
3500 	} else {
3501 		ret = -ENOSYS;
3502 	}
3503 
3504 out_err2:
3505 	kfree(clips);
3506 out_err1:
3507 	drm_framebuffer_unreference(fb);
3508 
3509 	return ret;
3510 }
3511 
3512 
3513 /**
3514  * drm_fb_release - remove and free the FBs on this file
3515  * @priv: drm file for the ioctl
3516  *
3517  * Destroy all the FBs associated with @filp.
3518  *
3519  * Called by the user via ioctl.
3520  *
3521  * Returns:
3522  * Zero on success, negative errno on failure.
3523  */
3524 void drm_fb_release(struct drm_file *priv)
3525 {
3526 	struct drm_framebuffer *fb, *tfb;
3527 
3528 	/*
3529 	 * When the file gets released that means no one else can access the fb
3530 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3531 	 * avoid upsetting lockdep since the universal cursor code adds a
3532 	 * framebuffer while holding mutex locks.
3533 	 *
3534 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3535 	 * locks is impossible here since no one else but this function can get
3536 	 * at it any more.
3537 	 */
3538 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3539 		list_del_init(&fb->filp_head);
3540 
3541 		/* This drops the fpriv->fbs reference. */
3542 		drm_framebuffer_unreference(fb);
3543 	}
3544 }
3545 
3546 /**
3547  * drm_property_create - create a new property type
3548  * @dev: drm device
3549  * @flags: flags specifying the property type
3550  * @name: name of the property
3551  * @num_values: number of pre-defined values
3552  *
3553  * This creates a new generic drm property which can then be attached to a drm
3554  * object with drm_object_attach_property. The returned property object must be
3555  * freed with drm_property_destroy.
3556  *
3557  * Note that the DRM core keeps a per-device list of properties and that, if
3558  * drm_mode_config_cleanup() is called, it will destroy all properties created
3559  * by the driver.
3560  *
3561  * Returns:
3562  * A pointer to the newly created property on success, NULL on failure.
3563  */
3564 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3565 					 const char *name, int num_values)
3566 {
3567 	struct drm_property *property = NULL;
3568 	int ret;
3569 
3570 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3571 	if (!property)
3572 		return NULL;
3573 
3574 	property->dev = dev;
3575 
3576 	if (num_values) {
3577 		property->values = kcalloc(num_values, sizeof(uint64_t),
3578 					   GFP_KERNEL);
3579 		if (!property->values)
3580 			goto fail;
3581 	}
3582 
3583 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3584 	if (ret)
3585 		goto fail;
3586 
3587 	property->flags = flags;
3588 	property->num_values = num_values;
3589 	INIT_LIST_HEAD(&property->enum_list);
3590 
3591 	if (name) {
3592 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3593 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3594 	}
3595 
3596 	list_add_tail(&property->head, &dev->mode_config.property_list);
3597 
3598 	WARN_ON(!drm_property_type_valid(property));
3599 
3600 	return property;
3601 fail:
3602 	kfree(property->values);
3603 	kfree(property);
3604 	return NULL;
3605 }
3606 EXPORT_SYMBOL(drm_property_create);
3607 
3608 /**
3609  * drm_property_create_enum - create a new enumeration property type
3610  * @dev: drm device
3611  * @flags: flags specifying the property type
3612  * @name: name of the property
3613  * @props: enumeration lists with property values
3614  * @num_values: number of pre-defined values
3615  *
3616  * This creates a new generic drm property which can then be attached to a drm
3617  * object with drm_object_attach_property. The returned property object must be
3618  * freed with drm_property_destroy.
3619  *
3620  * Userspace is only allowed to set one of the predefined values for enumeration
3621  * properties.
3622  *
3623  * Returns:
3624  * A pointer to the newly created property on success, NULL on failure.
3625  */
3626 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3627 					 const char *name,
3628 					 const struct drm_prop_enum_list *props,
3629 					 int num_values)
3630 {
3631 	struct drm_property *property;
3632 	int i, ret;
3633 
3634 	flags |= DRM_MODE_PROP_ENUM;
3635 
3636 	property = drm_property_create(dev, flags, name, num_values);
3637 	if (!property)
3638 		return NULL;
3639 
3640 	for (i = 0; i < num_values; i++) {
3641 		ret = drm_property_add_enum(property, i,
3642 				      props[i].type,
3643 				      props[i].name);
3644 		if (ret) {
3645 			drm_property_destroy(dev, property);
3646 			return NULL;
3647 		}
3648 	}
3649 
3650 	return property;
3651 }
3652 EXPORT_SYMBOL(drm_property_create_enum);
3653 
3654 /**
3655  * drm_property_create_bitmask - create a new bitmask property type
3656  * @dev: drm device
3657  * @flags: flags specifying the property type
3658  * @name: name of the property
3659  * @props: enumeration lists with property bitflags
3660  * @num_props: size of the @props array
3661  * @supported_bits: bitmask of all supported enumeration values
3662  *
3663  * This creates a new bitmask drm property which can then be attached to a drm
3664  * object with drm_object_attach_property. The returned property object must be
3665  * freed with drm_property_destroy.
3666  *
3667  * Compared to plain enumeration properties userspace is allowed to set any
3668  * or'ed together combination of the predefined property bitflag values
3669  *
3670  * Returns:
3671  * A pointer to the newly created property on success, NULL on failure.
3672  */
3673 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3674 					 int flags, const char *name,
3675 					 const struct drm_prop_enum_list *props,
3676 					 int num_props,
3677 					 uint64_t supported_bits)
3678 {
3679 	struct drm_property *property;
3680 	int i, ret, index = 0;
3681 	int num_values = hweight64(supported_bits);
3682 
3683 	flags |= DRM_MODE_PROP_BITMASK;
3684 
3685 	property = drm_property_create(dev, flags, name, num_values);
3686 	if (!property)
3687 		return NULL;
3688 	for (i = 0; i < num_props; i++) {
3689 		if (!(supported_bits & (1ULL << props[i].type)))
3690 			continue;
3691 
3692 		if (WARN_ON(index >= num_values)) {
3693 			drm_property_destroy(dev, property);
3694 			return NULL;
3695 		}
3696 
3697 		ret = drm_property_add_enum(property, index++,
3698 				      props[i].type,
3699 				      props[i].name);
3700 		if (ret) {
3701 			drm_property_destroy(dev, property);
3702 			return NULL;
3703 		}
3704 	}
3705 
3706 	return property;
3707 }
3708 EXPORT_SYMBOL(drm_property_create_bitmask);
3709 
3710 static struct drm_property *property_create_range(struct drm_device *dev,
3711 					 int flags, const char *name,
3712 					 uint64_t min, uint64_t max)
3713 {
3714 	struct drm_property *property;
3715 
3716 	property = drm_property_create(dev, flags, name, 2);
3717 	if (!property)
3718 		return NULL;
3719 
3720 	property->values[0] = min;
3721 	property->values[1] = max;
3722 
3723 	return property;
3724 }
3725 
3726 /**
3727  * drm_property_create_range - create a new unsigned ranged property type
3728  * @dev: drm device
3729  * @flags: flags specifying the property type
3730  * @name: name of the property
3731  * @min: minimum value of the property
3732  * @max: maximum value of the property
3733  *
3734  * This creates a new generic drm property which can then be attached to a drm
3735  * object with drm_object_attach_property. The returned property object must be
3736  * freed with drm_property_destroy.
3737  *
3738  * Userspace is allowed to set any unsigned integer value in the (min, max)
3739  * range inclusive.
3740  *
3741  * Returns:
3742  * A pointer to the newly created property on success, NULL on failure.
3743  */
3744 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3745 					 const char *name,
3746 					 uint64_t min, uint64_t max)
3747 {
3748 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3749 			name, min, max);
3750 }
3751 EXPORT_SYMBOL(drm_property_create_range);
3752 
3753 /**
3754  * drm_property_create_signed_range - create a new signed ranged property type
3755  * @dev: drm device
3756  * @flags: flags specifying the property type
3757  * @name: name of the property
3758  * @min: minimum value of the property
3759  * @max: maximum value of the property
3760  *
3761  * This creates a new generic drm property which can then be attached to a drm
3762  * object with drm_object_attach_property. The returned property object must be
3763  * freed with drm_property_destroy.
3764  *
3765  * Userspace is allowed to set any signed integer value in the (min, max)
3766  * range inclusive.
3767  *
3768  * Returns:
3769  * A pointer to the newly created property on success, NULL on failure.
3770  */
3771 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3772 					 int flags, const char *name,
3773 					 int64_t min, int64_t max)
3774 {
3775 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3776 			name, I642U64(min), I642U64(max));
3777 }
3778 EXPORT_SYMBOL(drm_property_create_signed_range);
3779 
3780 /**
3781  * drm_property_create_object - create a new object property type
3782  * @dev: drm device
3783  * @flags: flags specifying the property type
3784  * @name: name of the property
3785  * @type: object type from DRM_MODE_OBJECT_* defines
3786  *
3787  * This creates a new generic drm property which can then be attached to a drm
3788  * object with drm_object_attach_property. The returned property object must be
3789  * freed with drm_property_destroy.
3790  *
3791  * Userspace is only allowed to set this to any property value of the given
3792  * @type. Only useful for atomic properties, which is enforced.
3793  *
3794  * Returns:
3795  * A pointer to the newly created property on success, NULL on failure.
3796  */
3797 struct drm_property *drm_property_create_object(struct drm_device *dev,
3798 					 int flags, const char *name, uint32_t type)
3799 {
3800 	struct drm_property *property;
3801 
3802 	flags |= DRM_MODE_PROP_OBJECT;
3803 
3804 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3805 		return NULL;
3806 
3807 	property = drm_property_create(dev, flags, name, 1);
3808 	if (!property)
3809 		return NULL;
3810 
3811 	property->values[0] = type;
3812 
3813 	return property;
3814 }
3815 EXPORT_SYMBOL(drm_property_create_object);
3816 
3817 /**
3818  * drm_property_create_bool - create a new boolean property type
3819  * @dev: drm device
3820  * @flags: flags specifying the property type
3821  * @name: name of the property
3822  *
3823  * This creates a new generic drm property which can then be attached to a drm
3824  * object with drm_object_attach_property. The returned property object must be
3825  * freed with drm_property_destroy.
3826  *
3827  * This is implemented as a ranged property with only {0, 1} as valid values.
3828  *
3829  * Returns:
3830  * A pointer to the newly created property on success, NULL on failure.
3831  */
3832 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3833 					 const char *name)
3834 {
3835 	return drm_property_create_range(dev, flags, name, 0, 1);
3836 }
3837 EXPORT_SYMBOL(drm_property_create_bool);
3838 
3839 /**
3840  * drm_property_add_enum - add a possible value to an enumeration property
3841  * @property: enumeration property to change
3842  * @index: index of the new enumeration
3843  * @value: value of the new enumeration
3844  * @name: symbolic name of the new enumeration
3845  *
3846  * This functions adds enumerations to a property.
3847  *
3848  * It's use is deprecated, drivers should use one of the more specific helpers
3849  * to directly create the property with all enumerations already attached.
3850  *
3851  * Returns:
3852  * Zero on success, error code on failure.
3853  */
3854 int drm_property_add_enum(struct drm_property *property, int index,
3855 			  uint64_t value, const char *name)
3856 {
3857 	struct drm_property_enum *prop_enum;
3858 
3859 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3860 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3861 		return -EINVAL;
3862 
3863 	/*
3864 	 * Bitmask enum properties have the additional constraint of values
3865 	 * from 0 to 63
3866 	 */
3867 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3868 			(value > 63))
3869 		return -EINVAL;
3870 
3871 	if (!list_empty(&property->enum_list)) {
3872 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3873 			if (prop_enum->value == value) {
3874 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3875 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3876 				return 0;
3877 			}
3878 		}
3879 	}
3880 
3881 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3882 	if (!prop_enum)
3883 		return -ENOMEM;
3884 
3885 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3886 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3887 	prop_enum->value = value;
3888 
3889 	property->values[index] = value;
3890 	list_add_tail(&prop_enum->head, &property->enum_list);
3891 	return 0;
3892 }
3893 EXPORT_SYMBOL(drm_property_add_enum);
3894 
3895 /**
3896  * drm_property_destroy - destroy a drm property
3897  * @dev: drm device
3898  * @property: property to destry
3899  *
3900  * This function frees a property including any attached resources like
3901  * enumeration values.
3902  */
3903 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3904 {
3905 	struct drm_property_enum *prop_enum, *pt;
3906 
3907 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3908 		list_del(&prop_enum->head);
3909 		kfree(prop_enum);
3910 	}
3911 
3912 	if (property->num_values)
3913 		kfree(property->values);
3914 	drm_mode_object_put(dev, &property->base);
3915 	list_del(&property->head);
3916 	kfree(property);
3917 }
3918 EXPORT_SYMBOL(drm_property_destroy);
3919 
3920 /**
3921  * drm_object_attach_property - attach a property to a modeset object
3922  * @obj: drm modeset object
3923  * @property: property to attach
3924  * @init_val: initial value of the property
3925  *
3926  * This attaches the given property to the modeset object with the given initial
3927  * value. Currently this function cannot fail since the properties are stored in
3928  * a statically sized array.
3929  */
3930 void drm_object_attach_property(struct drm_mode_object *obj,
3931 				struct drm_property *property,
3932 				uint64_t init_val)
3933 {
3934 	int count = obj->properties->count;
3935 
3936 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3937 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3938 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3939 			"you see this message on the same object type.\n",
3940 			obj->type);
3941 		return;
3942 	}
3943 
3944 	obj->properties->properties[count] = property;
3945 	obj->properties->values[count] = init_val;
3946 	obj->properties->count++;
3947 	if (property->flags & DRM_MODE_PROP_ATOMIC)
3948 		obj->properties->atomic_count++;
3949 }
3950 EXPORT_SYMBOL(drm_object_attach_property);
3951 
3952 /**
3953  * drm_object_property_set_value - set the value of a property
3954  * @obj: drm mode object to set property value for
3955  * @property: property to set
3956  * @val: value the property should be set to
3957  *
3958  * This functions sets a given property on a given object. This function only
3959  * changes the software state of the property, it does not call into the
3960  * driver's ->set_property callback.
3961  *
3962  * Returns:
3963  * Zero on success, error code on failure.
3964  */
3965 int drm_object_property_set_value(struct drm_mode_object *obj,
3966 				  struct drm_property *property, uint64_t val)
3967 {
3968 	int i;
3969 
3970 	for (i = 0; i < obj->properties->count; i++) {
3971 		if (obj->properties->properties[i] == property) {
3972 			obj->properties->values[i] = val;
3973 			return 0;
3974 		}
3975 	}
3976 
3977 	return -EINVAL;
3978 }
3979 EXPORT_SYMBOL(drm_object_property_set_value);
3980 
3981 /**
3982  * drm_object_property_get_value - retrieve the value of a property
3983  * @obj: drm mode object to get property value from
3984  * @property: property to retrieve
3985  * @val: storage for the property value
3986  *
3987  * This function retrieves the softare state of the given property for the given
3988  * property. Since there is no driver callback to retrieve the current property
3989  * value this might be out of sync with the hardware, depending upon the driver
3990  * and property.
3991  *
3992  * Returns:
3993  * Zero on success, error code on failure.
3994  */
3995 int drm_object_property_get_value(struct drm_mode_object *obj,
3996 				  struct drm_property *property, uint64_t *val)
3997 {
3998 	int i;
3999 
4000 	/* read-only properties bypass atomic mechanism and still store
4001 	 * their value in obj->properties->values[].. mostly to avoid
4002 	 * having to deal w/ EDID and similar props in atomic paths:
4003 	 */
4004 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4005 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4006 		return drm_atomic_get_property(obj, property, val);
4007 
4008 	for (i = 0; i < obj->properties->count; i++) {
4009 		if (obj->properties->properties[i] == property) {
4010 			*val = obj->properties->values[i];
4011 			return 0;
4012 		}
4013 	}
4014 
4015 	return -EINVAL;
4016 }
4017 EXPORT_SYMBOL(drm_object_property_get_value);
4018 
4019 /**
4020  * drm_mode_getproperty_ioctl - get the property metadata
4021  * @dev: DRM device
4022  * @data: ioctl data
4023  * @file_priv: DRM file info
4024  *
4025  * This function retrieves the metadata for a given property, like the different
4026  * possible values for an enum property or the limits for a range property.
4027  *
4028  * Blob properties are special
4029  *
4030  * Called by the user via ioctl.
4031  *
4032  * Returns:
4033  * Zero on success, negative errno on failure.
4034  */
4035 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4036 			       void *data, struct drm_file *file_priv)
4037 {
4038 	struct drm_mode_get_property *out_resp = data;
4039 	struct drm_property *property;
4040 	int enum_count = 0;
4041 	int value_count = 0;
4042 	int ret = 0, i;
4043 	int copied;
4044 	struct drm_property_enum *prop_enum;
4045 	struct drm_mode_property_enum __user *enum_ptr;
4046 	uint64_t __user *values_ptr;
4047 
4048 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4049 		return -EINVAL;
4050 
4051 	drm_modeset_lock_all(dev);
4052 	property = drm_property_find(dev, out_resp->prop_id);
4053 	if (!property) {
4054 		ret = -ENOENT;
4055 		goto done;
4056 	}
4057 
4058 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4059 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4060 		list_for_each_entry(prop_enum, &property->enum_list, head)
4061 			enum_count++;
4062 	}
4063 
4064 	value_count = property->num_values;
4065 
4066 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4067 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4068 	out_resp->flags = property->flags;
4069 
4070 	if ((out_resp->count_values >= value_count) && value_count) {
4071 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4072 		for (i = 0; i < value_count; i++) {
4073 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4074 				ret = -EFAULT;
4075 				goto done;
4076 			}
4077 		}
4078 	}
4079 	out_resp->count_values = value_count;
4080 
4081 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4082 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4083 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4084 			copied = 0;
4085 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4086 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4087 
4088 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4089 					ret = -EFAULT;
4090 					goto done;
4091 				}
4092 
4093 				if (copy_to_user(&enum_ptr[copied].name,
4094 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4095 					ret = -EFAULT;
4096 					goto done;
4097 				}
4098 				copied++;
4099 			}
4100 		}
4101 		out_resp->count_enum_blobs = enum_count;
4102 	}
4103 
4104 	/*
4105 	 * NOTE: The idea seems to have been to use this to read all the blob
4106 	 * property values. But nothing ever added them to the corresponding
4107 	 * list, userspace always used the special-purpose get_blob ioctl to
4108 	 * read the value for a blob property. It also doesn't make a lot of
4109 	 * sense to return values here when everything else is just metadata for
4110 	 * the property itself.
4111 	 */
4112 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4113 		out_resp->count_enum_blobs = 0;
4114 done:
4115 	drm_modeset_unlock_all(dev);
4116 	return ret;
4117 }
4118 
4119 /**
4120  * drm_property_create_blob - Create new blob property
4121  *
4122  * Creates a new blob property for a specified DRM device, optionally
4123  * copying data.
4124  *
4125  * @dev: DRM device to create property for
4126  * @length: Length to allocate for blob data
4127  * @data: If specified, copies data into blob
4128  *
4129  * Returns:
4130  * New blob property with a single reference on success, or an ERR_PTR
4131  * value on failure.
4132  */
4133 struct drm_property_blob *
4134 drm_property_create_blob(struct drm_device *dev, size_t length,
4135 			 const void *data)
4136 {
4137 	struct drm_property_blob *blob;
4138 	int ret;
4139 
4140 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
4141 		return ERR_PTR(-EINVAL);
4142 
4143 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4144 	if (!blob)
4145 		return ERR_PTR(-ENOMEM);
4146 
4147 	/* This must be explicitly initialised, so we can safely call list_del
4148 	 * on it in the removal handler, even if it isn't in a file list. */
4149 	INIT_LIST_HEAD(&blob->head_file);
4150 	blob->length = length;
4151 	blob->dev = dev;
4152 
4153 	if (data)
4154 		memcpy(blob->data, data, length);
4155 
4156 	mutex_lock(&dev->mode_config.blob_lock);
4157 
4158 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4159 	if (ret) {
4160 		kfree(blob);
4161 		mutex_unlock(&dev->mode_config.blob_lock);
4162 		return ERR_PTR(-EINVAL);
4163 	}
4164 
4165 	kref_init(&blob->refcount);
4166 
4167 	list_add_tail(&blob->head_global,
4168 	              &dev->mode_config.property_blob_list);
4169 
4170 	mutex_unlock(&dev->mode_config.blob_lock);
4171 
4172 	return blob;
4173 }
4174 EXPORT_SYMBOL(drm_property_create_blob);
4175 
4176 /**
4177  * drm_property_free_blob - Blob property destructor
4178  *
4179  * Internal free function for blob properties; must not be used directly.
4180  *
4181  * @kref: Reference
4182  */
4183 static void drm_property_free_blob(struct kref *kref)
4184 {
4185 	struct drm_property_blob *blob =
4186 		container_of(kref, struct drm_property_blob, refcount);
4187 
4188 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
4189 
4190 	list_del(&blob->head_global);
4191 	list_del(&blob->head_file);
4192 	drm_mode_object_put(blob->dev, &blob->base);
4193 
4194 	kfree(blob);
4195 }
4196 
4197 /**
4198  * drm_property_unreference_blob - Unreference a blob property
4199  *
4200  * Drop a reference on a blob property. May free the object.
4201  *
4202  * @blob: Pointer to blob property
4203  */
4204 void drm_property_unreference_blob(struct drm_property_blob *blob)
4205 {
4206 	struct drm_device *dev;
4207 
4208 	if (!blob)
4209 		return;
4210 
4211 	dev = blob->dev;
4212 
4213 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4214 
4215 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
4216 			   &dev->mode_config.blob_lock))
4217 		mutex_unlock(&dev->mode_config.blob_lock);
4218 	else
4219 		might_lock(&dev->mode_config.blob_lock);
4220 }
4221 EXPORT_SYMBOL(drm_property_unreference_blob);
4222 
4223 /**
4224  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
4225  *
4226  * Drop a reference on a blob property. May free the object. This must be
4227  * called with blob_lock held.
4228  *
4229  * @blob: Pointer to blob property
4230  */
4231 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
4232 {
4233 	if (!blob)
4234 		return;
4235 
4236 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4237 
4238 	kref_put(&blob->refcount, drm_property_free_blob);
4239 }
4240 
4241 /**
4242  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4243  * @dev:       DRM device
4244  * @file_priv: destroy all blobs owned by this file handle
4245  */
4246 void drm_property_destroy_user_blobs(struct drm_device *dev,
4247 				     struct drm_file *file_priv)
4248 {
4249 	struct drm_property_blob *blob, *bt;
4250 
4251 	mutex_lock(&dev->mode_config.blob_lock);
4252 
4253 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4254 		list_del_init(&blob->head_file);
4255 		drm_property_unreference_blob_locked(blob);
4256 	}
4257 
4258 	mutex_unlock(&dev->mode_config.blob_lock);
4259 }
4260 
4261 /**
4262  * drm_property_reference_blob - Take a reference on an existing property
4263  *
4264  * Take a new reference on an existing blob property.
4265  *
4266  * @blob: Pointer to blob property
4267  */
4268 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4269 {
4270 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4271 	kref_get(&blob->refcount);
4272 	return blob;
4273 }
4274 EXPORT_SYMBOL(drm_property_reference_blob);
4275 
4276 /*
4277  * Like drm_property_lookup_blob, but does not return an additional reference.
4278  * Must be called with blob_lock held.
4279  */
4280 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
4281 							    uint32_t id)
4282 {
4283 	struct drm_mode_object *obj = NULL;
4284 	struct drm_property_blob *blob;
4285 
4286 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
4287 
4288 	mutex_lock(&dev->mode_config.idr_mutex);
4289 	obj = idr_find(&dev->mode_config.crtc_idr, id);
4290 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
4291 		blob = NULL;
4292 	else
4293 		blob = obj_to_blob(obj);
4294 	mutex_unlock(&dev->mode_config.idr_mutex);
4295 
4296 	return blob;
4297 }
4298 
4299 /**
4300  * drm_property_lookup_blob - look up a blob property and take a reference
4301  * @dev: drm device
4302  * @id: id of the blob property
4303  *
4304  * If successful, this takes an additional reference to the blob property.
4305  * callers need to make sure to eventually unreference the returned property
4306  * again, using @drm_property_unreference_blob.
4307  */
4308 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4309 					           uint32_t id)
4310 {
4311 	struct drm_property_blob *blob;
4312 
4313 	mutex_lock(&dev->mode_config.blob_lock);
4314 	blob = __drm_property_lookup_blob(dev, id);
4315 	if (blob) {
4316 		if (!kref_get_unless_zero(&blob->refcount))
4317 			blob = NULL;
4318 	}
4319 	mutex_unlock(&dev->mode_config.blob_lock);
4320 
4321 	return blob;
4322 }
4323 EXPORT_SYMBOL(drm_property_lookup_blob);
4324 
4325 /**
4326  * drm_property_replace_global_blob - atomically replace existing blob property
4327  * @dev: drm device
4328  * @replace: location of blob property pointer to be replaced
4329  * @length: length of data for new blob, or 0 for no data
4330  * @data: content for new blob, or NULL for no data
4331  * @obj_holds_id: optional object for property holding blob ID
4332  * @prop_holds_id: optional property holding blob ID
4333  * @return 0 on success or error on failure
4334  *
4335  * This function will atomically replace a global property in the blob list,
4336  * optionally updating a property which holds the ID of that property. It is
4337  * guaranteed to be atomic: no caller will be allowed to see intermediate
4338  * results, and either the entire operation will succeed and clean up the
4339  * previous property, or it will fail and the state will be unchanged.
4340  *
4341  * If length is 0 or data is NULL, no new blob will be created, and the holding
4342  * property, if specified, will be set to 0.
4343  *
4344  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4345  * by holding the relevant modesetting object lock for its parent.
4346  *
4347  * For example, a drm_connector has a 'PATH' property, which contains the ID
4348  * of a blob property with the value of the MST path information. Calling this
4349  * function with replace pointing to the connector's path_blob_ptr, length and
4350  * data set for the new path information, obj_holds_id set to the connector's
4351  * base object, and prop_holds_id set to the path property name, will perform
4352  * a completely atomic update. The access to path_blob_ptr is protected by the
4353  * caller holding a lock on the connector.
4354  */
4355 static int drm_property_replace_global_blob(struct drm_device *dev,
4356                                             struct drm_property_blob **replace,
4357                                             size_t length,
4358                                             const void *data,
4359                                             struct drm_mode_object *obj_holds_id,
4360                                             struct drm_property *prop_holds_id)
4361 {
4362 	struct drm_property_blob *new_blob = NULL;
4363 	struct drm_property_blob *old_blob = NULL;
4364 	int ret;
4365 
4366 	WARN_ON(replace == NULL);
4367 
4368 	old_blob = *replace;
4369 
4370 	if (length && data) {
4371 		new_blob = drm_property_create_blob(dev, length, data);
4372 		if (IS_ERR(new_blob))
4373 			return PTR_ERR(new_blob);
4374 	}
4375 
4376 	/* This does not need to be synchronised with blob_lock, as the
4377 	 * get_properties ioctl locks all modesetting objects, and
4378 	 * obj_holds_id must be locked before calling here, so we cannot
4379 	 * have its value out of sync with the list membership modified
4380 	 * below under blob_lock. */
4381 	if (obj_holds_id) {
4382 		ret = drm_object_property_set_value(obj_holds_id,
4383 						    prop_holds_id,
4384 						    new_blob ?
4385 						        new_blob->base.id : 0);
4386 		if (ret != 0)
4387 			goto err_created;
4388 	}
4389 
4390 	drm_property_unreference_blob(old_blob);
4391 	*replace = new_blob;
4392 
4393 	return 0;
4394 
4395 err_created:
4396 	drm_property_unreference_blob(new_blob);
4397 	return ret;
4398 }
4399 
4400 /**
4401  * drm_mode_getblob_ioctl - get the contents of a blob property value
4402  * @dev: DRM device
4403  * @data: ioctl data
4404  * @file_priv: DRM file info
4405  *
4406  * This function retrieves the contents of a blob property. The value stored in
4407  * an object's blob property is just a normal modeset object id.
4408  *
4409  * Called by the user via ioctl.
4410  *
4411  * Returns:
4412  * Zero on success, negative errno on failure.
4413  */
4414 int drm_mode_getblob_ioctl(struct drm_device *dev,
4415 			   void *data, struct drm_file *file_priv)
4416 {
4417 	struct drm_mode_get_blob *out_resp = data;
4418 	struct drm_property_blob *blob;
4419 	int ret = 0;
4420 	void __user *blob_ptr;
4421 
4422 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4423 		return -EINVAL;
4424 
4425 	drm_modeset_lock_all(dev);
4426 	mutex_lock(&dev->mode_config.blob_lock);
4427 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4428 	if (!blob) {
4429 		ret = -ENOENT;
4430 		goto done;
4431 	}
4432 
4433 	if (out_resp->length == blob->length) {
4434 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4435 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4436 			ret = -EFAULT;
4437 			goto done;
4438 		}
4439 	}
4440 	out_resp->length = blob->length;
4441 
4442 done:
4443 	mutex_unlock(&dev->mode_config.blob_lock);
4444 	drm_modeset_unlock_all(dev);
4445 	return ret;
4446 }
4447 
4448 /**
4449  * drm_mode_createblob_ioctl - create a new blob property
4450  * @dev: DRM device
4451  * @data: ioctl data
4452  * @file_priv: DRM file info
4453  *
4454  * This function creates a new blob property with user-defined values. In order
4455  * to give us sensible validation and checking when creating, rather than at
4456  * every potential use, we also require a type to be provided upfront.
4457  *
4458  * Called by the user via ioctl.
4459  *
4460  * Returns:
4461  * Zero on success, negative errno on failure.
4462  */
4463 int drm_mode_createblob_ioctl(struct drm_device *dev,
4464 			      void *data, struct drm_file *file_priv)
4465 {
4466 	struct drm_mode_create_blob *out_resp = data;
4467 	struct drm_property_blob *blob;
4468 	void __user *blob_ptr;
4469 	int ret = 0;
4470 
4471 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4472 		return -EINVAL;
4473 
4474 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4475 	if (IS_ERR(blob))
4476 		return PTR_ERR(blob);
4477 
4478 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4479 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4480 		ret = -EFAULT;
4481 		goto out_blob;
4482 	}
4483 
4484 	/* Dropping the lock between create_blob and our access here is safe
4485 	 * as only the same file_priv can remove the blob; at this point, it is
4486 	 * not associated with any file_priv. */
4487 	mutex_lock(&dev->mode_config.blob_lock);
4488 	out_resp->blob_id = blob->base.id;
4489 	list_add_tail(&blob->head_file, &file_priv->blobs);
4490 	mutex_unlock(&dev->mode_config.blob_lock);
4491 
4492 	return 0;
4493 
4494 out_blob:
4495 	drm_property_unreference_blob(blob);
4496 	return ret;
4497 }
4498 
4499 /**
4500  * drm_mode_destroyblob_ioctl - destroy a user blob property
4501  * @dev: DRM device
4502  * @data: ioctl data
4503  * @file_priv: DRM file info
4504  *
4505  * Destroy an existing user-defined blob property.
4506  *
4507  * Called by the user via ioctl.
4508  *
4509  * Returns:
4510  * Zero on success, negative errno on failure.
4511  */
4512 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4513 			       void *data, struct drm_file *file_priv)
4514 {
4515 	struct drm_mode_destroy_blob *out_resp = data;
4516 	struct drm_property_blob *blob = NULL, *bt;
4517 	bool found = false;
4518 	int ret = 0;
4519 
4520 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4521 		return -EINVAL;
4522 
4523 	mutex_lock(&dev->mode_config.blob_lock);
4524 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4525 	if (!blob) {
4526 		ret = -ENOENT;
4527 		goto err;
4528 	}
4529 
4530 	/* Ensure the property was actually created by this user. */
4531 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4532 		if (bt == blob) {
4533 			found = true;
4534 			break;
4535 		}
4536 	}
4537 
4538 	if (!found) {
4539 		ret = -EPERM;
4540 		goto err;
4541 	}
4542 
4543 	/* We must drop head_file here, because we may not be the last
4544 	 * reference on the blob. */
4545 	list_del_init(&blob->head_file);
4546 	drm_property_unreference_blob_locked(blob);
4547 	mutex_unlock(&dev->mode_config.blob_lock);
4548 
4549 	return 0;
4550 
4551 err:
4552 	mutex_unlock(&dev->mode_config.blob_lock);
4553 	return ret;
4554 }
4555 
4556 /**
4557  * drm_mode_connector_set_path_property - set tile property on connector
4558  * @connector: connector to set property on.
4559  * @path: path to use for property; must not be NULL.
4560  *
4561  * This creates a property to expose to userspace to specify a
4562  * connector path. This is mainly used for DisplayPort MST where
4563  * connectors have a topology and we want to allow userspace to give
4564  * them more meaningful names.
4565  *
4566  * Returns:
4567  * Zero on success, negative errno on failure.
4568  */
4569 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4570 					 const char *path)
4571 {
4572 	struct drm_device *dev = connector->dev;
4573 	int ret;
4574 
4575 	ret = drm_property_replace_global_blob(dev,
4576 	                                       &connector->path_blob_ptr,
4577 	                                       strlen(path) + 1,
4578 	                                       path,
4579 	                                       &connector->base,
4580 	                                       dev->mode_config.path_property);
4581 	return ret;
4582 }
4583 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4584 
4585 /**
4586  * drm_mode_connector_set_tile_property - set tile property on connector
4587  * @connector: connector to set property on.
4588  *
4589  * This looks up the tile information for a connector, and creates a
4590  * property for userspace to parse if it exists. The property is of
4591  * the form of 8 integers using ':' as a separator.
4592  *
4593  * Returns:
4594  * Zero on success, errno on failure.
4595  */
4596 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4597 {
4598 	struct drm_device *dev = connector->dev;
4599 	char tile[256];
4600 	int ret;
4601 
4602 	if (!connector->has_tile) {
4603 		ret  = drm_property_replace_global_blob(dev,
4604 		                                        &connector->tile_blob_ptr,
4605 		                                        0,
4606 		                                        NULL,
4607 		                                        &connector->base,
4608 		                                        dev->mode_config.tile_property);
4609 		return ret;
4610 	}
4611 
4612 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4613 		 connector->tile_group->id, connector->tile_is_single_monitor,
4614 		 connector->num_h_tile, connector->num_v_tile,
4615 		 connector->tile_h_loc, connector->tile_v_loc,
4616 		 connector->tile_h_size, connector->tile_v_size);
4617 
4618 	ret = drm_property_replace_global_blob(dev,
4619 	                                       &connector->tile_blob_ptr,
4620 	                                       strlen(tile) + 1,
4621 	                                       tile,
4622 	                                       &connector->base,
4623 	                                       dev->mode_config.tile_property);
4624 	return ret;
4625 }
4626 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4627 
4628 /**
4629  * drm_mode_connector_update_edid_property - update the edid property of a connector
4630  * @connector: drm connector
4631  * @edid: new value of the edid property
4632  *
4633  * This function creates a new blob modeset object and assigns its id to the
4634  * connector's edid property.
4635  *
4636  * Returns:
4637  * Zero on success, negative errno on failure.
4638  */
4639 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4640 					    const struct edid *edid)
4641 {
4642 	struct drm_device *dev = connector->dev;
4643 	size_t size = 0;
4644 	int ret;
4645 
4646 	/* ignore requests to set edid when overridden */
4647 	if (connector->override_edid)
4648 		return 0;
4649 
4650 	if (edid)
4651 		size = EDID_LENGTH * (1 + edid->extensions);
4652 
4653 	ret = drm_property_replace_global_blob(dev,
4654 					       &connector->edid_blob_ptr,
4655 	                                       size,
4656 	                                       edid,
4657 	                                       &connector->base,
4658 	                                       dev->mode_config.edid_property);
4659 	return ret;
4660 }
4661 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4662 
4663 /* Some properties could refer to dynamic refcnt'd objects, or things that
4664  * need special locking to handle lifetime issues (ie. to ensure the prop
4665  * value doesn't become invalid part way through the property update due to
4666  * race).  The value returned by reference via 'obj' should be passed back
4667  * to drm_property_change_valid_put() after the property is set (and the
4668  * object to which the property is attached has a chance to take it's own
4669  * reference).
4670  */
4671 bool drm_property_change_valid_get(struct drm_property *property,
4672 					 uint64_t value, struct drm_mode_object **ref)
4673 {
4674 	int i;
4675 
4676 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4677 		return false;
4678 
4679 	*ref = NULL;
4680 
4681 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4682 		if (value < property->values[0] || value > property->values[1])
4683 			return false;
4684 		return true;
4685 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4686 		int64_t svalue = U642I64(value);
4687 
4688 		if (svalue < U642I64(property->values[0]) ||
4689 				svalue > U642I64(property->values[1]))
4690 			return false;
4691 		return true;
4692 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4693 		uint64_t valid_mask = 0;
4694 
4695 		for (i = 0; i < property->num_values; i++)
4696 			valid_mask |= (1ULL << property->values[i]);
4697 		return !(value & ~valid_mask);
4698 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4699 		struct drm_property_blob *blob;
4700 
4701 		if (value == 0)
4702 			return true;
4703 
4704 		blob = drm_property_lookup_blob(property->dev, value);
4705 		if (blob) {
4706 			*ref = &blob->base;
4707 			return true;
4708 		} else {
4709 			return false;
4710 		}
4711 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4712 		/* a zero value for an object property translates to null: */
4713 		if (value == 0)
4714 			return true;
4715 
4716 		/* handle refcnt'd objects specially: */
4717 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4718 			struct drm_framebuffer *fb;
4719 			fb = drm_framebuffer_lookup(property->dev, value);
4720 			if (fb) {
4721 				*ref = &fb->base;
4722 				return true;
4723 			} else {
4724 				return false;
4725 			}
4726 		} else {
4727 			return _object_find(property->dev, value, property->values[0]) != NULL;
4728 		}
4729 	}
4730 
4731 	for (i = 0; i < property->num_values; i++)
4732 		if (property->values[i] == value)
4733 			return true;
4734 	return false;
4735 }
4736 
4737 void drm_property_change_valid_put(struct drm_property *property,
4738 		struct drm_mode_object *ref)
4739 {
4740 	if (!ref)
4741 		return;
4742 
4743 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4744 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4745 			drm_framebuffer_unreference(obj_to_fb(ref));
4746 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4747 		drm_property_unreference_blob(obj_to_blob(ref));
4748 }
4749 
4750 /**
4751  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4752  * @dev: DRM device
4753  * @data: ioctl data
4754  * @file_priv: DRM file info
4755  *
4756  * This function sets the current value for a connectors's property. It also
4757  * calls into a driver's ->set_property callback to update the hardware state
4758  *
4759  * Called by the user via ioctl.
4760  *
4761  * Returns:
4762  * Zero on success, negative errno on failure.
4763  */
4764 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4765 				       void *data, struct drm_file *file_priv)
4766 {
4767 	struct drm_mode_connector_set_property *conn_set_prop = data;
4768 	struct drm_mode_obj_set_property obj_set_prop = {
4769 		.value = conn_set_prop->value,
4770 		.prop_id = conn_set_prop->prop_id,
4771 		.obj_id = conn_set_prop->connector_id,
4772 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4773 	};
4774 
4775 	/* It does all the locking and checking we need */
4776 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4777 }
4778 
4779 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4780 					   struct drm_property *property,
4781 					   uint64_t value)
4782 {
4783 	int ret = -EINVAL;
4784 	struct drm_connector *connector = obj_to_connector(obj);
4785 
4786 	/* Do DPMS ourselves */
4787 	if (property == connector->dev->mode_config.dpms_property) {
4788 		ret = 0;
4789 		if (connector->funcs->dpms)
4790 			ret = (*connector->funcs->dpms)(connector, (int)value);
4791 	} else if (connector->funcs->set_property)
4792 		ret = connector->funcs->set_property(connector, property, value);
4793 
4794 	/* store the property value if successful */
4795 	if (!ret)
4796 		drm_object_property_set_value(&connector->base, property, value);
4797 	return ret;
4798 }
4799 
4800 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4801 				      struct drm_property *property,
4802 				      uint64_t value)
4803 {
4804 	int ret = -EINVAL;
4805 	struct drm_crtc *crtc = obj_to_crtc(obj);
4806 
4807 	if (crtc->funcs->set_property)
4808 		ret = crtc->funcs->set_property(crtc, property, value);
4809 	if (!ret)
4810 		drm_object_property_set_value(obj, property, value);
4811 
4812 	return ret;
4813 }
4814 
4815 /**
4816  * drm_mode_plane_set_obj_prop - set the value of a property
4817  * @plane: drm plane object to set property value for
4818  * @property: property to set
4819  * @value: value the property should be set to
4820  *
4821  * This functions sets a given property on a given plane object. This function
4822  * calls the driver's ->set_property callback and changes the software state of
4823  * the property if the callback succeeds.
4824  *
4825  * Returns:
4826  * Zero on success, error code on failure.
4827  */
4828 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4829 				struct drm_property *property,
4830 				uint64_t value)
4831 {
4832 	int ret = -EINVAL;
4833 	struct drm_mode_object *obj = &plane->base;
4834 
4835 	if (plane->funcs->set_property)
4836 		ret = plane->funcs->set_property(plane, property, value);
4837 	if (!ret)
4838 		drm_object_property_set_value(obj, property, value);
4839 
4840 	return ret;
4841 }
4842 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4843 
4844 /**
4845  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4846  * @dev: DRM device
4847  * @data: ioctl data
4848  * @file_priv: DRM file info
4849  *
4850  * This function retrieves the current value for an object's property. Compared
4851  * to the connector specific ioctl this one is extended to also work on crtc and
4852  * plane objects.
4853  *
4854  * Called by the user via ioctl.
4855  *
4856  * Returns:
4857  * Zero on success, negative errno on failure.
4858  */
4859 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4860 				      struct drm_file *file_priv)
4861 {
4862 	struct drm_mode_obj_get_properties *arg = data;
4863 	struct drm_mode_object *obj;
4864 	int ret = 0;
4865 
4866 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4867 		return -EINVAL;
4868 
4869 	drm_modeset_lock_all(dev);
4870 
4871 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4872 	if (!obj) {
4873 		ret = -ENOENT;
4874 		goto out;
4875 	}
4876 	if (!obj->properties) {
4877 		ret = -EINVAL;
4878 		goto out;
4879 	}
4880 
4881 	ret = get_properties(obj, file_priv->atomic,
4882 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4883 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4884 			&arg->count_props);
4885 
4886 out:
4887 	drm_modeset_unlock_all(dev);
4888 	return ret;
4889 }
4890 
4891 /**
4892  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4893  * @dev: DRM device
4894  * @data: ioctl data
4895  * @file_priv: DRM file info
4896  *
4897  * This function sets the current value for an object's property. It also calls
4898  * into a driver's ->set_property callback to update the hardware state.
4899  * Compared to the connector specific ioctl this one is extended to also work on
4900  * crtc and plane objects.
4901  *
4902  * Called by the user via ioctl.
4903  *
4904  * Returns:
4905  * Zero on success, negative errno on failure.
4906  */
4907 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4908 				    struct drm_file *file_priv)
4909 {
4910 	struct drm_mode_obj_set_property *arg = data;
4911 	struct drm_mode_object *arg_obj;
4912 	struct drm_mode_object *prop_obj;
4913 	struct drm_property *property;
4914 	int i, ret = -EINVAL;
4915 	struct drm_mode_object *ref;
4916 
4917 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4918 		return -EINVAL;
4919 
4920 	drm_modeset_lock_all(dev);
4921 
4922 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4923 	if (!arg_obj) {
4924 		ret = -ENOENT;
4925 		goto out;
4926 	}
4927 	if (!arg_obj->properties)
4928 		goto out;
4929 
4930 	for (i = 0; i < arg_obj->properties->count; i++)
4931 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
4932 			break;
4933 
4934 	if (i == arg_obj->properties->count)
4935 		goto out;
4936 
4937 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4938 					DRM_MODE_OBJECT_PROPERTY);
4939 	if (!prop_obj) {
4940 		ret = -ENOENT;
4941 		goto out;
4942 	}
4943 	property = obj_to_property(prop_obj);
4944 
4945 	if (!drm_property_change_valid_get(property, arg->value, &ref))
4946 		goto out;
4947 
4948 	switch (arg_obj->type) {
4949 	case DRM_MODE_OBJECT_CONNECTOR:
4950 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4951 						      arg->value);
4952 		break;
4953 	case DRM_MODE_OBJECT_CRTC:
4954 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4955 		break;
4956 	case DRM_MODE_OBJECT_PLANE:
4957 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4958 						  property, arg->value);
4959 		break;
4960 	}
4961 
4962 	drm_property_change_valid_put(property, ref);
4963 
4964 out:
4965 	drm_modeset_unlock_all(dev);
4966 	return ret;
4967 }
4968 
4969 /**
4970  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4971  * @connector: connector to attach
4972  * @encoder: encoder to attach @connector to
4973  *
4974  * This function links up a connector to an encoder. Note that the routing
4975  * restrictions between encoders and crtcs are exposed to userspace through the
4976  * possible_clones and possible_crtcs bitmasks.
4977  *
4978  * Returns:
4979  * Zero on success, negative errno on failure.
4980  */
4981 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4982 				      struct drm_encoder *encoder)
4983 {
4984 	int i;
4985 
4986 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4987 		if (connector->encoder_ids[i] == 0) {
4988 			connector->encoder_ids[i] = encoder->base.id;
4989 			return 0;
4990 		}
4991 	}
4992 	return -ENOMEM;
4993 }
4994 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4995 
4996 /**
4997  * drm_mode_crtc_set_gamma_size - set the gamma table size
4998  * @crtc: CRTC to set the gamma table size for
4999  * @gamma_size: size of the gamma table
5000  *
5001  * Drivers which support gamma tables should set this to the supported gamma
5002  * table size when initializing the CRTC. Currently the drm core only supports a
5003  * fixed gamma table size.
5004  *
5005  * Returns:
5006  * Zero on success, negative errno on failure.
5007  */
5008 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
5009 				 int gamma_size)
5010 {
5011 	crtc->gamma_size = gamma_size;
5012 
5013 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
5014 				    GFP_KERNEL);
5015 	if (!crtc->gamma_store) {
5016 		crtc->gamma_size = 0;
5017 		return -ENOMEM;
5018 	}
5019 
5020 	return 0;
5021 }
5022 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
5023 
5024 /**
5025  * drm_mode_gamma_set_ioctl - set the gamma table
5026  * @dev: DRM device
5027  * @data: ioctl data
5028  * @file_priv: DRM file info
5029  *
5030  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
5031  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5032  *
5033  * Called by the user via ioctl.
5034  *
5035  * Returns:
5036  * Zero on success, negative errno on failure.
5037  */
5038 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5039 			     void *data, struct drm_file *file_priv)
5040 {
5041 	struct drm_mode_crtc_lut *crtc_lut = data;
5042 	struct drm_crtc *crtc;
5043 	void *r_base, *g_base, *b_base;
5044 	int size;
5045 	int ret = 0;
5046 
5047 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5048 		return -EINVAL;
5049 
5050 	drm_modeset_lock_all(dev);
5051 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5052 	if (!crtc) {
5053 		ret = -ENOENT;
5054 		goto out;
5055 	}
5056 
5057 	if (crtc->funcs->gamma_set == NULL) {
5058 		ret = -ENOSYS;
5059 		goto out;
5060 	}
5061 
5062 	/* memcpy into gamma store */
5063 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5064 		ret = -EINVAL;
5065 		goto out;
5066 	}
5067 
5068 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5069 	r_base = crtc->gamma_store;
5070 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5071 		ret = -EFAULT;
5072 		goto out;
5073 	}
5074 
5075 	g_base = r_base + size;
5076 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5077 		ret = -EFAULT;
5078 		goto out;
5079 	}
5080 
5081 	b_base = g_base + size;
5082 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5083 		ret = -EFAULT;
5084 		goto out;
5085 	}
5086 
5087 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
5088 
5089 out:
5090 	drm_modeset_unlock_all(dev);
5091 	return ret;
5092 
5093 }
5094 
5095 /**
5096  * drm_mode_gamma_get_ioctl - get the gamma table
5097  * @dev: DRM device
5098  * @data: ioctl data
5099  * @file_priv: DRM file info
5100  *
5101  * Copy the current gamma table into the storage provided. This also provides
5102  * the gamma table size the driver expects, which can be used to size the
5103  * allocated storage.
5104  *
5105  * Called by the user via ioctl.
5106  *
5107  * Returns:
5108  * Zero on success, negative errno on failure.
5109  */
5110 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5111 			     void *data, struct drm_file *file_priv)
5112 {
5113 	struct drm_mode_crtc_lut *crtc_lut = data;
5114 	struct drm_crtc *crtc;
5115 	void *r_base, *g_base, *b_base;
5116 	int size;
5117 	int ret = 0;
5118 
5119 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5120 		return -EINVAL;
5121 
5122 	drm_modeset_lock_all(dev);
5123 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5124 	if (!crtc) {
5125 		ret = -ENOENT;
5126 		goto out;
5127 	}
5128 
5129 	/* memcpy into gamma store */
5130 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5131 		ret = -EINVAL;
5132 		goto out;
5133 	}
5134 
5135 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5136 	r_base = crtc->gamma_store;
5137 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5138 		ret = -EFAULT;
5139 		goto out;
5140 	}
5141 
5142 	g_base = r_base + size;
5143 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5144 		ret = -EFAULT;
5145 		goto out;
5146 	}
5147 
5148 	b_base = g_base + size;
5149 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5150 		ret = -EFAULT;
5151 		goto out;
5152 	}
5153 out:
5154 	drm_modeset_unlock_all(dev);
5155 	return ret;
5156 }
5157 
5158 /**
5159  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5160  * @dev: DRM device
5161  * @data: ioctl data
5162  * @file_priv: DRM file info
5163  *
5164  * This schedules an asynchronous update on a given CRTC, called page flip.
5165  * Optionally a drm event is generated to signal the completion of the event.
5166  * Generic drivers cannot assume that a pageflip with changed framebuffer
5167  * properties (including driver specific metadata like tiling layout) will work,
5168  * but some drivers support e.g. pixel format changes through the pageflip
5169  * ioctl.
5170  *
5171  * Called by the user via ioctl.
5172  *
5173  * Returns:
5174  * Zero on success, negative errno on failure.
5175  */
5176 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5177 			     void *data, struct drm_file *file_priv)
5178 {
5179 	struct drm_mode_crtc_page_flip *page_flip = data;
5180 	struct drm_crtc *crtc;
5181 	struct drm_framebuffer *fb = NULL;
5182 	struct drm_pending_vblank_event *e = NULL;
5183 	unsigned long flags;
5184 	int ret = -EINVAL;
5185 
5186 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5187 	    page_flip->reserved != 0)
5188 		return -EINVAL;
5189 
5190 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5191 		return -EINVAL;
5192 
5193 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5194 	if (!crtc)
5195 		return -ENOENT;
5196 
5197 	drm_modeset_lock_crtc(crtc, crtc->primary);
5198 	if (crtc->primary->fb == NULL) {
5199 		/* The framebuffer is currently unbound, presumably
5200 		 * due to a hotplug event, that userspace has not
5201 		 * yet discovered.
5202 		 */
5203 		ret = -EBUSY;
5204 		goto out;
5205 	}
5206 
5207 	if (crtc->funcs->page_flip == NULL)
5208 		goto out;
5209 
5210 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5211 	if (!fb) {
5212 		ret = -ENOENT;
5213 		goto out;
5214 	}
5215 
5216 	if (crtc->state) {
5217 		const struct drm_plane_state *state = crtc->primary->state;
5218 
5219 		ret = check_src_coords(state->src_x, state->src_y,
5220 				       state->src_w, state->src_h, fb);
5221 	} else {
5222 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5223 	}
5224 	if (ret)
5225 		goto out;
5226 
5227 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5228 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5229 		ret = -EINVAL;
5230 		goto out;
5231 	}
5232 
5233 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5234 		ret = -ENOMEM;
5235 		spin_lock_irqsave(&dev->event_lock, flags);
5236 		if (file_priv->event_space < sizeof(e->event)) {
5237 			spin_unlock_irqrestore(&dev->event_lock, flags);
5238 			goto out;
5239 		}
5240 		file_priv->event_space -= sizeof(e->event);
5241 		spin_unlock_irqrestore(&dev->event_lock, flags);
5242 
5243 		e = kzalloc(sizeof(*e), GFP_KERNEL);
5244 		if (e == NULL) {
5245 			spin_lock_irqsave(&dev->event_lock, flags);
5246 			file_priv->event_space += sizeof(e->event);
5247 			spin_unlock_irqrestore(&dev->event_lock, flags);
5248 			goto out;
5249 		}
5250 
5251 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5252 		e->event.base.length = sizeof(e->event);
5253 		e->event.user_data = page_flip->user_data;
5254 		e->base.event = &e->event.base;
5255 		e->base.file_priv = file_priv;
5256 		e->base.destroy =
5257 			(void (*) (struct drm_pending_event *)) kfree;
5258 	}
5259 
5260 	crtc->primary->old_fb = crtc->primary->fb;
5261 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5262 	if (ret) {
5263 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5264 			spin_lock_irqsave(&dev->event_lock, flags);
5265 			file_priv->event_space += sizeof(e->event);
5266 			spin_unlock_irqrestore(&dev->event_lock, flags);
5267 			kfree(e);
5268 		}
5269 		/* Keep the old fb, don't unref it. */
5270 		crtc->primary->old_fb = NULL;
5271 	} else {
5272 		crtc->primary->fb = fb;
5273 		/* Unref only the old framebuffer. */
5274 		fb = NULL;
5275 	}
5276 
5277 out:
5278 	if (fb)
5279 		drm_framebuffer_unreference(fb);
5280 	if (crtc->primary->old_fb)
5281 		drm_framebuffer_unreference(crtc->primary->old_fb);
5282 	crtc->primary->old_fb = NULL;
5283 	drm_modeset_unlock_crtc(crtc);
5284 
5285 	return ret;
5286 }
5287 
5288 /**
5289  * drm_mode_config_reset - call ->reset callbacks
5290  * @dev: drm device
5291  *
5292  * This functions calls all the crtc's, encoder's and connector's ->reset
5293  * callback. Drivers can use this in e.g. their driver load or resume code to
5294  * reset hardware and software state.
5295  */
5296 void drm_mode_config_reset(struct drm_device *dev)
5297 {
5298 	struct drm_crtc *crtc;
5299 	struct drm_plane *plane;
5300 	struct drm_encoder *encoder;
5301 	struct drm_connector *connector;
5302 
5303 	drm_for_each_plane(plane, dev)
5304 		if (plane->funcs->reset)
5305 			plane->funcs->reset(plane);
5306 
5307 	drm_for_each_crtc(crtc, dev)
5308 		if (crtc->funcs->reset)
5309 			crtc->funcs->reset(crtc);
5310 
5311 	drm_for_each_encoder(encoder, dev)
5312 		if (encoder->funcs->reset)
5313 			encoder->funcs->reset(encoder);
5314 
5315 	mutex_lock(&dev->mode_config.mutex);
5316 	drm_for_each_connector(connector, dev)
5317 		if (connector->funcs->reset)
5318 			connector->funcs->reset(connector);
5319 	mutex_unlock(&dev->mode_config.mutex);
5320 }
5321 EXPORT_SYMBOL(drm_mode_config_reset);
5322 
5323 /**
5324  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5325  * @dev: DRM device
5326  * @data: ioctl data
5327  * @file_priv: DRM file info
5328  *
5329  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5330  * TTM or something else entirely) and returns the resulting buffer handle. This
5331  * handle can then be wrapped up into a framebuffer modeset object.
5332  *
5333  * Note that userspace is not allowed to use such objects for render
5334  * acceleration - drivers must create their own private ioctls for such a use
5335  * case.
5336  *
5337  * Called by the user via ioctl.
5338  *
5339  * Returns:
5340  * Zero on success, negative errno on failure.
5341  */
5342 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5343 			       void *data, struct drm_file *file_priv)
5344 {
5345 	struct drm_mode_create_dumb *args = data;
5346 	u32 cpp, stride, size;
5347 
5348 	if (!dev->driver->dumb_create)
5349 		return -ENOSYS;
5350 	if (!args->width || !args->height || !args->bpp)
5351 		return -EINVAL;
5352 
5353 	/* overflow checks for 32bit size calculations */
5354 	/* NOTE: DIV_ROUND_UP() can overflow */
5355 	cpp = DIV_ROUND_UP(args->bpp, 8);
5356 	if (!cpp || cpp > 0xffffffffU / args->width)
5357 		return -EINVAL;
5358 	stride = cpp * args->width;
5359 	if (args->height > 0xffffffffU / stride)
5360 		return -EINVAL;
5361 
5362 	/* test for wrap-around */
5363 	size = args->height * stride;
5364 	if (PAGE_ALIGN(size) == 0)
5365 		return -EINVAL;
5366 
5367 	/*
5368 	 * handle, pitch and size are output parameters. Zero them out to
5369 	 * prevent drivers from accidentally using uninitialized data. Since
5370 	 * not all existing userspace is clearing these fields properly we
5371 	 * cannot reject IOCTL with garbage in them.
5372 	 */
5373 	args->handle = 0;
5374 	args->pitch = 0;
5375 	args->size = 0;
5376 
5377 	return dev->driver->dumb_create(file_priv, dev, args);
5378 }
5379 
5380 /**
5381  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5382  * @dev: DRM device
5383  * @data: ioctl data
5384  * @file_priv: DRM file info
5385  *
5386  * Allocate an offset in the drm device node's address space to be able to
5387  * memory map a dumb buffer.
5388  *
5389  * Called by the user via ioctl.
5390  *
5391  * Returns:
5392  * Zero on success, negative errno on failure.
5393  */
5394 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5395 			     void *data, struct drm_file *file_priv)
5396 {
5397 	struct drm_mode_map_dumb *args = data;
5398 
5399 	/* call driver ioctl to get mmap offset */
5400 	if (!dev->driver->dumb_map_offset)
5401 		return -ENOSYS;
5402 
5403 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5404 }
5405 
5406 /**
5407  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5408  * @dev: DRM device
5409  * @data: ioctl data
5410  * @file_priv: DRM file info
5411  *
5412  * This destroys the userspace handle for the given dumb backing storage buffer.
5413  * Since buffer objects must be reference counted in the kernel a buffer object
5414  * won't be immediately freed if a framebuffer modeset object still uses it.
5415  *
5416  * Called by the user via ioctl.
5417  *
5418  * Returns:
5419  * Zero on success, negative errno on failure.
5420  */
5421 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5422 				void *data, struct drm_file *file_priv)
5423 {
5424 	struct drm_mode_destroy_dumb *args = data;
5425 
5426 	if (!dev->driver->dumb_destroy)
5427 		return -ENOSYS;
5428 
5429 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5430 }
5431 
5432 /**
5433  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5434  * @format: pixel format (DRM_FORMAT_*)
5435  * @depth: storage for the depth value
5436  * @bpp: storage for the bpp value
5437  *
5438  * This only supports RGB formats here for compat with code that doesn't use
5439  * pixel formats directly yet.
5440  */
5441 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5442 			  int *bpp)
5443 {
5444 	switch (format) {
5445 	case DRM_FORMAT_C8:
5446 	case DRM_FORMAT_RGB332:
5447 	case DRM_FORMAT_BGR233:
5448 		*depth = 8;
5449 		*bpp = 8;
5450 		break;
5451 	case DRM_FORMAT_XRGB1555:
5452 	case DRM_FORMAT_XBGR1555:
5453 	case DRM_FORMAT_RGBX5551:
5454 	case DRM_FORMAT_BGRX5551:
5455 	case DRM_FORMAT_ARGB1555:
5456 	case DRM_FORMAT_ABGR1555:
5457 	case DRM_FORMAT_RGBA5551:
5458 	case DRM_FORMAT_BGRA5551:
5459 		*depth = 15;
5460 		*bpp = 16;
5461 		break;
5462 	case DRM_FORMAT_RGB565:
5463 	case DRM_FORMAT_BGR565:
5464 		*depth = 16;
5465 		*bpp = 16;
5466 		break;
5467 	case DRM_FORMAT_RGB888:
5468 	case DRM_FORMAT_BGR888:
5469 		*depth = 24;
5470 		*bpp = 24;
5471 		break;
5472 	case DRM_FORMAT_XRGB8888:
5473 	case DRM_FORMAT_XBGR8888:
5474 	case DRM_FORMAT_RGBX8888:
5475 	case DRM_FORMAT_BGRX8888:
5476 		*depth = 24;
5477 		*bpp = 32;
5478 		break;
5479 	case DRM_FORMAT_XRGB2101010:
5480 	case DRM_FORMAT_XBGR2101010:
5481 	case DRM_FORMAT_RGBX1010102:
5482 	case DRM_FORMAT_BGRX1010102:
5483 	case DRM_FORMAT_ARGB2101010:
5484 	case DRM_FORMAT_ABGR2101010:
5485 	case DRM_FORMAT_RGBA1010102:
5486 	case DRM_FORMAT_BGRA1010102:
5487 		*depth = 30;
5488 		*bpp = 32;
5489 		break;
5490 	case DRM_FORMAT_ARGB8888:
5491 	case DRM_FORMAT_ABGR8888:
5492 	case DRM_FORMAT_RGBA8888:
5493 	case DRM_FORMAT_BGRA8888:
5494 		*depth = 32;
5495 		*bpp = 32;
5496 		break;
5497 	default:
5498 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5499 			      drm_get_format_name(format));
5500 		*depth = 0;
5501 		*bpp = 0;
5502 		break;
5503 	}
5504 }
5505 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5506 
5507 /**
5508  * drm_format_num_planes - get the number of planes for format
5509  * @format: pixel format (DRM_FORMAT_*)
5510  *
5511  * Returns:
5512  * The number of planes used by the specified pixel format.
5513  */
5514 int drm_format_num_planes(uint32_t format)
5515 {
5516 	switch (format) {
5517 	case DRM_FORMAT_YUV410:
5518 	case DRM_FORMAT_YVU410:
5519 	case DRM_FORMAT_YUV411:
5520 	case DRM_FORMAT_YVU411:
5521 	case DRM_FORMAT_YUV420:
5522 	case DRM_FORMAT_YVU420:
5523 	case DRM_FORMAT_YUV422:
5524 	case DRM_FORMAT_YVU422:
5525 	case DRM_FORMAT_YUV444:
5526 	case DRM_FORMAT_YVU444:
5527 		return 3;
5528 	case DRM_FORMAT_NV12:
5529 	case DRM_FORMAT_NV21:
5530 	case DRM_FORMAT_NV16:
5531 	case DRM_FORMAT_NV61:
5532 	case DRM_FORMAT_NV24:
5533 	case DRM_FORMAT_NV42:
5534 		return 2;
5535 	default:
5536 		return 1;
5537 	}
5538 }
5539 EXPORT_SYMBOL(drm_format_num_planes);
5540 
5541 /**
5542  * drm_format_plane_cpp - determine the bytes per pixel value
5543  * @format: pixel format (DRM_FORMAT_*)
5544  * @plane: plane index
5545  *
5546  * Returns:
5547  * The bytes per pixel value for the specified plane.
5548  */
5549 int drm_format_plane_cpp(uint32_t format, int plane)
5550 {
5551 	unsigned int depth;
5552 	int bpp;
5553 
5554 	if (plane >= drm_format_num_planes(format))
5555 		return 0;
5556 
5557 	switch (format) {
5558 	case DRM_FORMAT_YUYV:
5559 	case DRM_FORMAT_YVYU:
5560 	case DRM_FORMAT_UYVY:
5561 	case DRM_FORMAT_VYUY:
5562 		return 2;
5563 	case DRM_FORMAT_NV12:
5564 	case DRM_FORMAT_NV21:
5565 	case DRM_FORMAT_NV16:
5566 	case DRM_FORMAT_NV61:
5567 	case DRM_FORMAT_NV24:
5568 	case DRM_FORMAT_NV42:
5569 		return plane ? 2 : 1;
5570 	case DRM_FORMAT_YUV410:
5571 	case DRM_FORMAT_YVU410:
5572 	case DRM_FORMAT_YUV411:
5573 	case DRM_FORMAT_YVU411:
5574 	case DRM_FORMAT_YUV420:
5575 	case DRM_FORMAT_YVU420:
5576 	case DRM_FORMAT_YUV422:
5577 	case DRM_FORMAT_YVU422:
5578 	case DRM_FORMAT_YUV444:
5579 	case DRM_FORMAT_YVU444:
5580 		return 1;
5581 	default:
5582 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5583 		return bpp >> 3;
5584 	}
5585 }
5586 EXPORT_SYMBOL(drm_format_plane_cpp);
5587 
5588 /**
5589  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5590  * @format: pixel format (DRM_FORMAT_*)
5591  *
5592  * Returns:
5593  * The horizontal chroma subsampling factor for the
5594  * specified pixel format.
5595  */
5596 int drm_format_horz_chroma_subsampling(uint32_t format)
5597 {
5598 	switch (format) {
5599 	case DRM_FORMAT_YUV411:
5600 	case DRM_FORMAT_YVU411:
5601 	case DRM_FORMAT_YUV410:
5602 	case DRM_FORMAT_YVU410:
5603 		return 4;
5604 	case DRM_FORMAT_YUYV:
5605 	case DRM_FORMAT_YVYU:
5606 	case DRM_FORMAT_UYVY:
5607 	case DRM_FORMAT_VYUY:
5608 	case DRM_FORMAT_NV12:
5609 	case DRM_FORMAT_NV21:
5610 	case DRM_FORMAT_NV16:
5611 	case DRM_FORMAT_NV61:
5612 	case DRM_FORMAT_YUV422:
5613 	case DRM_FORMAT_YVU422:
5614 	case DRM_FORMAT_YUV420:
5615 	case DRM_FORMAT_YVU420:
5616 		return 2;
5617 	default:
5618 		return 1;
5619 	}
5620 }
5621 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5622 
5623 /**
5624  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5625  * @format: pixel format (DRM_FORMAT_*)
5626  *
5627  * Returns:
5628  * The vertical chroma subsampling factor for the
5629  * specified pixel format.
5630  */
5631 int drm_format_vert_chroma_subsampling(uint32_t format)
5632 {
5633 	switch (format) {
5634 	case DRM_FORMAT_YUV410:
5635 	case DRM_FORMAT_YVU410:
5636 		return 4;
5637 	case DRM_FORMAT_YUV420:
5638 	case DRM_FORMAT_YVU420:
5639 	case DRM_FORMAT_NV12:
5640 	case DRM_FORMAT_NV21:
5641 		return 2;
5642 	default:
5643 		return 1;
5644 	}
5645 }
5646 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5647 
5648 /**
5649  * drm_rotation_simplify() - Try to simplify the rotation
5650  * @rotation: Rotation to be simplified
5651  * @supported_rotations: Supported rotations
5652  *
5653  * Attempt to simplify the rotation to a form that is supported.
5654  * Eg. if the hardware supports everything except DRM_REFLECT_X
5655  * one could call this function like this:
5656  *
5657  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5658  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5659  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5660  *
5661  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5662  * transforms the hardware supports, this function may not
5663  * be able to produce a supported transform, so the caller should
5664  * check the result afterwards.
5665  */
5666 unsigned int drm_rotation_simplify(unsigned int rotation,
5667 				   unsigned int supported_rotations)
5668 {
5669 	if (rotation & ~supported_rotations) {
5670 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5671 		rotation = (rotation & DRM_REFLECT_MASK) |
5672 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
5673 	}
5674 
5675 	return rotation;
5676 }
5677 EXPORT_SYMBOL(drm_rotation_simplify);
5678 
5679 /**
5680  * drm_mode_config_init - initialize DRM mode_configuration structure
5681  * @dev: DRM device
5682  *
5683  * Initialize @dev's mode_config structure, used for tracking the graphics
5684  * configuration of @dev.
5685  *
5686  * Since this initializes the modeset locks, no locking is possible. Which is no
5687  * problem, since this should happen single threaded at init time. It is the
5688  * driver's problem to ensure this guarantee.
5689  *
5690  */
5691 void drm_mode_config_init(struct drm_device *dev)
5692 {
5693 	mutex_init(&dev->mode_config.mutex);
5694 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5695 	mutex_init(&dev->mode_config.idr_mutex);
5696 	mutex_init(&dev->mode_config.fb_lock);
5697 	mutex_init(&dev->mode_config.blob_lock);
5698 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5699 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5700 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5701 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5702 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5703 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5704 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5705 	idr_init(&dev->mode_config.crtc_idr);
5706 	idr_init(&dev->mode_config.tile_idr);
5707 
5708 	drm_modeset_lock_all(dev);
5709 	drm_mode_create_standard_properties(dev);
5710 	drm_modeset_unlock_all(dev);
5711 
5712 	/* Just to be sure */
5713 	dev->mode_config.num_fb = 0;
5714 	dev->mode_config.num_connector = 0;
5715 	dev->mode_config.num_crtc = 0;
5716 	dev->mode_config.num_encoder = 0;
5717 	dev->mode_config.num_overlay_plane = 0;
5718 	dev->mode_config.num_total_plane = 0;
5719 }
5720 EXPORT_SYMBOL(drm_mode_config_init);
5721 
5722 /**
5723  * drm_mode_config_cleanup - free up DRM mode_config info
5724  * @dev: DRM device
5725  *
5726  * Free up all the connectors and CRTCs associated with this DRM device, then
5727  * free up the framebuffers and associated buffer objects.
5728  *
5729  * Note that since this /should/ happen single-threaded at driver/device
5730  * teardown time, no locking is required. It's the driver's job to ensure that
5731  * this guarantee actually holds true.
5732  *
5733  * FIXME: cleanup any dangling user buffer objects too
5734  */
5735 void drm_mode_config_cleanup(struct drm_device *dev)
5736 {
5737 	struct drm_connector *connector, *ot;
5738 	struct drm_crtc *crtc, *ct;
5739 	struct drm_encoder *encoder, *enct;
5740 	struct drm_framebuffer *fb, *fbt;
5741 	struct drm_property *property, *pt;
5742 	struct drm_property_blob *blob, *bt;
5743 	struct drm_plane *plane, *plt;
5744 
5745 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5746 				 head) {
5747 		encoder->funcs->destroy(encoder);
5748 	}
5749 
5750 	list_for_each_entry_safe(connector, ot,
5751 				 &dev->mode_config.connector_list, head) {
5752 		connector->funcs->destroy(connector);
5753 	}
5754 
5755 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5756 				 head) {
5757 		drm_property_destroy(dev, property);
5758 	}
5759 
5760 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5761 				 head_global) {
5762 		drm_property_unreference_blob(blob);
5763 	}
5764 
5765 	/*
5766 	 * Single-threaded teardown context, so it's not required to grab the
5767 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5768 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5769 	 *
5770 	 * Also, if there are any framebuffers left, that's a driver leak now,
5771 	 * so politely WARN about this.
5772 	 */
5773 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5774 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5775 		drm_framebuffer_free(&fb->refcount);
5776 	}
5777 
5778 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5779 				 head) {
5780 		plane->funcs->destroy(plane);
5781 	}
5782 
5783 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5784 		crtc->funcs->destroy(crtc);
5785 	}
5786 
5787 	idr_destroy(&dev->mode_config.tile_idr);
5788 	idr_destroy(&dev->mode_config.crtc_idr);
5789 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5790 }
5791 EXPORT_SYMBOL(drm_mode_config_cleanup);
5792 
5793 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5794 						       unsigned int supported_rotations)
5795 {
5796 	static const struct drm_prop_enum_list props[] = {
5797 		{ DRM_ROTATE_0,   "rotate-0" },
5798 		{ DRM_ROTATE_90,  "rotate-90" },
5799 		{ DRM_ROTATE_180, "rotate-180" },
5800 		{ DRM_ROTATE_270, "rotate-270" },
5801 		{ DRM_REFLECT_X,  "reflect-x" },
5802 		{ DRM_REFLECT_Y,  "reflect-y" },
5803 	};
5804 
5805 	return drm_property_create_bitmask(dev, 0, "rotation",
5806 					   props, ARRAY_SIZE(props),
5807 					   supported_rotations);
5808 }
5809 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5810 
5811 /**
5812  * DOC: Tile group
5813  *
5814  * Tile groups are used to represent tiled monitors with a unique
5815  * integer identifier. Tiled monitors using DisplayID v1.3 have
5816  * a unique 8-byte handle, we store this in a tile group, so we
5817  * have a common identifier for all tiles in a monitor group.
5818  */
5819 static void drm_tile_group_free(struct kref *kref)
5820 {
5821 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5822 	struct drm_device *dev = tg->dev;
5823 	mutex_lock(&dev->mode_config.idr_mutex);
5824 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5825 	mutex_unlock(&dev->mode_config.idr_mutex);
5826 	kfree(tg);
5827 }
5828 
5829 /**
5830  * drm_mode_put_tile_group - drop a reference to a tile group.
5831  * @dev: DRM device
5832  * @tg: tile group to drop reference to.
5833  *
5834  * drop reference to tile group and free if 0.
5835  */
5836 void drm_mode_put_tile_group(struct drm_device *dev,
5837 			     struct drm_tile_group *tg)
5838 {
5839 	kref_put(&tg->refcount, drm_tile_group_free);
5840 }
5841 
5842 /**
5843  * drm_mode_get_tile_group - get a reference to an existing tile group
5844  * @dev: DRM device
5845  * @topology: 8-bytes unique per monitor.
5846  *
5847  * Use the unique bytes to get a reference to an existing tile group.
5848  *
5849  * RETURNS:
5850  * tile group or NULL if not found.
5851  */
5852 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5853 					       char topology[8])
5854 {
5855 	struct drm_tile_group *tg;
5856 	int id;
5857 	mutex_lock(&dev->mode_config.idr_mutex);
5858 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5859 		if (!memcmp(tg->group_data, topology, 8)) {
5860 			if (!kref_get_unless_zero(&tg->refcount))
5861 				tg = NULL;
5862 			mutex_unlock(&dev->mode_config.idr_mutex);
5863 			return tg;
5864 		}
5865 	}
5866 	mutex_unlock(&dev->mode_config.idr_mutex);
5867 	return NULL;
5868 }
5869 EXPORT_SYMBOL(drm_mode_get_tile_group);
5870 
5871 /**
5872  * drm_mode_create_tile_group - create a tile group from a displayid description
5873  * @dev: DRM device
5874  * @topology: 8-bytes unique per monitor.
5875  *
5876  * Create a tile group for the unique monitor, and get a unique
5877  * identifier for the tile group.
5878  *
5879  * RETURNS:
5880  * new tile group or error.
5881  */
5882 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5883 						  char topology[8])
5884 {
5885 	struct drm_tile_group *tg;
5886 	int ret;
5887 
5888 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5889 	if (!tg)
5890 		return ERR_PTR(-ENOMEM);
5891 
5892 	kref_init(&tg->refcount);
5893 	memcpy(tg->group_data, topology, 8);
5894 	tg->dev = dev;
5895 
5896 	mutex_lock(&dev->mode_config.idr_mutex);
5897 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5898 	if (ret >= 0) {
5899 		tg->id = ret;
5900 	} else {
5901 		kfree(tg);
5902 		tg = ERR_PTR(ret);
5903 	}
5904 
5905 	mutex_unlock(&dev->mode_config.idr_mutex);
5906 	return tg;
5907 }
5908 EXPORT_SYMBOL(drm_mode_create_tile_group);
5909