xref: /openbmc/linux/drivers/gpu/drm/drm_crtc.c (revision c819e2cf)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 
42 #include "drm_crtc_internal.h"
43 #include "drm_internal.h"
44 
45 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
46 							struct drm_mode_fb_cmd2 *r,
47 							struct drm_file *file_priv);
48 
49 /* Avoid boilerplate.  I'm tired of typing. */
50 #define DRM_ENUM_NAME_FN(fnname, list)				\
51 	const char *fnname(int val)				\
52 	{							\
53 		int i;						\
54 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
55 			if (list[i].type == val)		\
56 				return list[i].name;		\
57 		}						\
58 		return "(unknown)";				\
59 	}
60 
61 /*
62  * Global properties
63  */
64 static const struct drm_prop_enum_list drm_dpms_enum_list[] =
65 {	{ DRM_MODE_DPMS_ON, "On" },
66 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
67 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
68 	{ DRM_MODE_DPMS_OFF, "Off" }
69 };
70 
71 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
72 
73 static const struct drm_prop_enum_list drm_plane_type_enum_list[] =
74 {
75 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
76 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
77 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
78 };
79 
80 /*
81  * Optional properties
82  */
83 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] =
84 {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] =
101 {
102 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
103 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
104 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
105 };
106 
107 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
108 
109 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] =
110 {
111 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
112 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
113 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
114 };
115 
116 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
117 		 drm_dvi_i_subconnector_enum_list)
118 
119 static const struct drm_prop_enum_list drm_tv_select_enum_list[] =
120 {
121 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
123 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
124 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
125 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
126 };
127 
128 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
129 
130 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] =
131 {
132 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
133 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
134 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
135 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
136 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
137 };
138 
139 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
140 		 drm_tv_subconnector_enum_list)
141 
142 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
143 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
144 	{ DRM_MODE_DIRTY_ON,       "On"       },
145 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
146 };
147 
148 struct drm_conn_prop_enum_list {
149 	int type;
150 	const char *name;
151 	struct ida ida;
152 };
153 
154 /*
155  * Connector and encoder types.
156  */
157 static struct drm_conn_prop_enum_list drm_connector_enum_list[] =
158 {	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
159 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
160 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
161 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
162 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
163 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
164 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
165 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
166 	{ DRM_MODE_CONNECTOR_Component, "Component" },
167 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
168 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
169 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
170 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
171 	{ DRM_MODE_CONNECTOR_TV, "TV" },
172 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
173 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
174 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
175 };
176 
177 static const struct drm_prop_enum_list drm_encoder_enum_list[] =
178 {	{ DRM_MODE_ENCODER_NONE, "None" },
179 	{ DRM_MODE_ENCODER_DAC, "DAC" },
180 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
181 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
182 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
183 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
184 	{ DRM_MODE_ENCODER_DSI, "DSI" },
185 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
186 };
187 
188 static const struct drm_prop_enum_list drm_subpixel_enum_list[] =
189 {
190 	{ SubPixelUnknown, "Unknown" },
191 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
192 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
193 	{ SubPixelVerticalRGB, "Vertical RGB" },
194 	{ SubPixelVerticalBGR, "Vertical BGR" },
195 	{ SubPixelNone, "None" },
196 };
197 
198 void drm_connector_ida_init(void)
199 {
200 	int i;
201 
202 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
203 		ida_init(&drm_connector_enum_list[i].ida);
204 }
205 
206 void drm_connector_ida_destroy(void)
207 {
208 	int i;
209 
210 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
211 		ida_destroy(&drm_connector_enum_list[i].ida);
212 }
213 
214 /**
215  * drm_get_connector_status_name - return a string for connector status
216  * @status: connector status to compute name of
217  *
218  * In contrast to the other drm_get_*_name functions this one here returns a
219  * const pointer and hence is threadsafe.
220  */
221 const char *drm_get_connector_status_name(enum drm_connector_status status)
222 {
223 	if (status == connector_status_connected)
224 		return "connected";
225 	else if (status == connector_status_disconnected)
226 		return "disconnected";
227 	else
228 		return "unknown";
229 }
230 EXPORT_SYMBOL(drm_get_connector_status_name);
231 
232 /**
233  * drm_get_subpixel_order_name - return a string for a given subpixel enum
234  * @order: enum of subpixel_order
235  *
236  * Note you could abuse this and return something out of bounds, but that
237  * would be a caller error.  No unscrubbed user data should make it here.
238  */
239 const char *drm_get_subpixel_order_name(enum subpixel_order order)
240 {
241 	return drm_subpixel_enum_list[order].name;
242 }
243 EXPORT_SYMBOL(drm_get_subpixel_order_name);
244 
245 static char printable_char(int c)
246 {
247 	return isascii(c) && isprint(c) ? c : '?';
248 }
249 
250 /**
251  * drm_get_format_name - return a string for drm fourcc format
252  * @format: format to compute name of
253  *
254  * Note that the buffer used by this function is globally shared and owned by
255  * the function itself.
256  *
257  * FIXME: This isn't really multithreading safe.
258  */
259 const char *drm_get_format_name(uint32_t format)
260 {
261 	static char buf[32];
262 
263 	snprintf(buf, sizeof(buf),
264 		 "%c%c%c%c %s-endian (0x%08x)",
265 		 printable_char(format & 0xff),
266 		 printable_char((format >> 8) & 0xff),
267 		 printable_char((format >> 16) & 0xff),
268 		 printable_char((format >> 24) & 0x7f),
269 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
270 		 format);
271 
272 	return buf;
273 }
274 EXPORT_SYMBOL(drm_get_format_name);
275 
276 /*
277  * Internal function to assign a slot in the object idr and optionally
278  * register the object into the idr.
279  */
280 static int drm_mode_object_get_reg(struct drm_device *dev,
281 				   struct drm_mode_object *obj,
282 				   uint32_t obj_type,
283 				   bool register_obj)
284 {
285 	int ret;
286 
287 	mutex_lock(&dev->mode_config.idr_mutex);
288 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
289 	if (ret >= 0) {
290 		/*
291 		 * Set up the object linking under the protection of the idr
292 		 * lock so that other users can't see inconsistent state.
293 		 */
294 		obj->id = ret;
295 		obj->type = obj_type;
296 	}
297 	mutex_unlock(&dev->mode_config.idr_mutex);
298 
299 	return ret < 0 ? ret : 0;
300 }
301 
302 /**
303  * drm_mode_object_get - allocate a new modeset identifier
304  * @dev: DRM device
305  * @obj: object pointer, used to generate unique ID
306  * @obj_type: object type
307  *
308  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
309  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
310  * modeset identifiers are _not_ reference counted. Hence don't use this for
311  * reference counted modeset objects like framebuffers.
312  *
313  * Returns:
314  * New unique (relative to other objects in @dev) integer identifier for the
315  * object.
316  */
317 int drm_mode_object_get(struct drm_device *dev,
318 			struct drm_mode_object *obj, uint32_t obj_type)
319 {
320 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
321 }
322 
323 static void drm_mode_object_register(struct drm_device *dev,
324 				     struct drm_mode_object *obj)
325 {
326 	mutex_lock(&dev->mode_config.idr_mutex);
327 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
328 	mutex_unlock(&dev->mode_config.idr_mutex);
329 }
330 
331 /**
332  * drm_mode_object_put - free a modeset identifer
333  * @dev: DRM device
334  * @object: object to free
335  *
336  * Free @id from @dev's unique identifier pool. Note that despite the _get
337  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
338  * for reference counted modeset objects like framebuffers.
339  */
340 void drm_mode_object_put(struct drm_device *dev,
341 			 struct drm_mode_object *object)
342 {
343 	mutex_lock(&dev->mode_config.idr_mutex);
344 	idr_remove(&dev->mode_config.crtc_idr, object->id);
345 	mutex_unlock(&dev->mode_config.idr_mutex);
346 }
347 
348 static struct drm_mode_object *_object_find(struct drm_device *dev,
349 		uint32_t id, uint32_t type)
350 {
351 	struct drm_mode_object *obj = NULL;
352 
353 	mutex_lock(&dev->mode_config.idr_mutex);
354 	obj = idr_find(&dev->mode_config.crtc_idr, id);
355 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
356 		obj = NULL;
357 	if (obj && obj->id != id)
358 		obj = NULL;
359 	/* don't leak out unref'd fb's */
360 	if (obj && (obj->type == DRM_MODE_OBJECT_FB))
361 		obj = NULL;
362 	mutex_unlock(&dev->mode_config.idr_mutex);
363 
364 	return obj;
365 }
366 
367 /**
368  * drm_mode_object_find - look up a drm object with static lifetime
369  * @dev: drm device
370  * @id: id of the mode object
371  * @type: type of the mode object
372  *
373  * Note that framebuffers cannot be looked up with this functions - since those
374  * are reference counted, they need special treatment.  Even with
375  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
376  * rather than WARN_ON()).
377  */
378 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
379 		uint32_t id, uint32_t type)
380 {
381 	struct drm_mode_object *obj = NULL;
382 
383 	/* Framebuffers are reference counted and need their own lookup
384 	 * function.*/
385 	WARN_ON(type == DRM_MODE_OBJECT_FB);
386 	obj = _object_find(dev, id, type);
387 	return obj;
388 }
389 EXPORT_SYMBOL(drm_mode_object_find);
390 
391 /**
392  * drm_framebuffer_init - initialize a framebuffer
393  * @dev: DRM device
394  * @fb: framebuffer to be initialized
395  * @funcs: ... with these functions
396  *
397  * Allocates an ID for the framebuffer's parent mode object, sets its mode
398  * functions & device file and adds it to the master fd list.
399  *
400  * IMPORTANT:
401  * This functions publishes the fb and makes it available for concurrent access
402  * by other users. Which means by this point the fb _must_ be fully set up -
403  * since all the fb attributes are invariant over its lifetime, no further
404  * locking but only correct reference counting is required.
405  *
406  * Returns:
407  * Zero on success, error code on failure.
408  */
409 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
410 			 const struct drm_framebuffer_funcs *funcs)
411 {
412 	int ret;
413 
414 	mutex_lock(&dev->mode_config.fb_lock);
415 	kref_init(&fb->refcount);
416 	INIT_LIST_HEAD(&fb->filp_head);
417 	fb->dev = dev;
418 	fb->funcs = funcs;
419 
420 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
421 	if (ret)
422 		goto out;
423 
424 	dev->mode_config.num_fb++;
425 	list_add(&fb->head, &dev->mode_config.fb_list);
426 out:
427 	mutex_unlock(&dev->mode_config.fb_lock);
428 
429 	return 0;
430 }
431 EXPORT_SYMBOL(drm_framebuffer_init);
432 
433 /* dev->mode_config.fb_lock must be held! */
434 static void __drm_framebuffer_unregister(struct drm_device *dev,
435 					 struct drm_framebuffer *fb)
436 {
437 	mutex_lock(&dev->mode_config.idr_mutex);
438 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
439 	mutex_unlock(&dev->mode_config.idr_mutex);
440 
441 	fb->base.id = 0;
442 }
443 
444 static void drm_framebuffer_free(struct kref *kref)
445 {
446 	struct drm_framebuffer *fb =
447 			container_of(kref, struct drm_framebuffer, refcount);
448 	struct drm_device *dev = fb->dev;
449 
450 	/*
451 	 * The lookup idr holds a weak reference, which has not necessarily been
452 	 * removed at this point. Check for that.
453 	 */
454 	mutex_lock(&dev->mode_config.fb_lock);
455 	if (fb->base.id) {
456 		/* Mark fb as reaped and drop idr ref. */
457 		__drm_framebuffer_unregister(dev, fb);
458 	}
459 	mutex_unlock(&dev->mode_config.fb_lock);
460 
461 	fb->funcs->destroy(fb);
462 }
463 
464 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
465 							uint32_t id)
466 {
467 	struct drm_mode_object *obj = NULL;
468 	struct drm_framebuffer *fb;
469 
470 	mutex_lock(&dev->mode_config.idr_mutex);
471 	obj = idr_find(&dev->mode_config.crtc_idr, id);
472 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
473 		fb = NULL;
474 	else
475 		fb = obj_to_fb(obj);
476 	mutex_unlock(&dev->mode_config.idr_mutex);
477 
478 	return fb;
479 }
480 
481 /**
482  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
483  * @dev: drm device
484  * @id: id of the fb object
485  *
486  * If successful, this grabs an additional reference to the framebuffer -
487  * callers need to make sure to eventually unreference the returned framebuffer
488  * again, using @drm_framebuffer_unreference.
489  */
490 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
491 					       uint32_t id)
492 {
493 	struct drm_framebuffer *fb;
494 
495 	mutex_lock(&dev->mode_config.fb_lock);
496 	fb = __drm_framebuffer_lookup(dev, id);
497 	if (fb) {
498 		if (!kref_get_unless_zero(&fb->refcount))
499 			fb = NULL;
500 	}
501 	mutex_unlock(&dev->mode_config.fb_lock);
502 
503 	return fb;
504 }
505 EXPORT_SYMBOL(drm_framebuffer_lookup);
506 
507 /**
508  * drm_framebuffer_unreference - unref a framebuffer
509  * @fb: framebuffer to unref
510  *
511  * This functions decrements the fb's refcount and frees it if it drops to zero.
512  */
513 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
514 {
515 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
516 	kref_put(&fb->refcount, drm_framebuffer_free);
517 }
518 EXPORT_SYMBOL(drm_framebuffer_unreference);
519 
520 /**
521  * drm_framebuffer_reference - incr the fb refcnt
522  * @fb: framebuffer
523  *
524  * This functions increments the fb's refcount.
525  */
526 void drm_framebuffer_reference(struct drm_framebuffer *fb)
527 {
528 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
529 	kref_get(&fb->refcount);
530 }
531 EXPORT_SYMBOL(drm_framebuffer_reference);
532 
533 static void drm_framebuffer_free_bug(struct kref *kref)
534 {
535 	BUG();
536 }
537 
538 static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
539 {
540 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
541 	kref_put(&fb->refcount, drm_framebuffer_free_bug);
542 }
543 
544 /**
545  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
546  * @fb: fb to unregister
547  *
548  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
549  * those used for fbdev. Note that the caller must hold a reference of it's own,
550  * i.e. the object may not be destroyed through this call (since it'll lead to a
551  * locking inversion).
552  */
553 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
554 {
555 	struct drm_device *dev = fb->dev;
556 
557 	mutex_lock(&dev->mode_config.fb_lock);
558 	/* Mark fb as reaped and drop idr ref. */
559 	__drm_framebuffer_unregister(dev, fb);
560 	mutex_unlock(&dev->mode_config.fb_lock);
561 }
562 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
563 
564 /**
565  * drm_framebuffer_cleanup - remove a framebuffer object
566  * @fb: framebuffer to remove
567  *
568  * Cleanup framebuffer. This function is intended to be used from the drivers
569  * ->destroy callback. It can also be used to clean up driver private
570  *  framebuffers embedded into a larger structure.
571  *
572  * Note that this function does not remove the fb from active usuage - if it is
573  * still used anywhere, hilarity can ensue since userspace could call getfb on
574  * the id and get back -EINVAL. Obviously no concern at driver unload time.
575  *
576  * Also, the framebuffer will not be removed from the lookup idr - for
577  * user-created framebuffers this will happen in in the rmfb ioctl. For
578  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
579  * drm_framebuffer_unregister_private.
580  */
581 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
582 {
583 	struct drm_device *dev = fb->dev;
584 
585 	mutex_lock(&dev->mode_config.fb_lock);
586 	list_del(&fb->head);
587 	dev->mode_config.num_fb--;
588 	mutex_unlock(&dev->mode_config.fb_lock);
589 }
590 EXPORT_SYMBOL(drm_framebuffer_cleanup);
591 
592 /**
593  * drm_framebuffer_remove - remove and unreference a framebuffer object
594  * @fb: framebuffer to remove
595  *
596  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
597  * using @fb, removes it, setting it to NULL. Then drops the reference to the
598  * passed-in framebuffer. Might take the modeset locks.
599  *
600  * Note that this function optimizes the cleanup away if the caller holds the
601  * last reference to the framebuffer. It is also guaranteed to not take the
602  * modeset locks in this case.
603  */
604 void drm_framebuffer_remove(struct drm_framebuffer *fb)
605 {
606 	struct drm_device *dev = fb->dev;
607 	struct drm_crtc *crtc;
608 	struct drm_plane *plane;
609 	struct drm_mode_set set;
610 	int ret;
611 
612 	WARN_ON(!list_empty(&fb->filp_head));
613 
614 	/*
615 	 * drm ABI mandates that we remove any deleted framebuffers from active
616 	 * useage. But since most sane clients only remove framebuffers they no
617 	 * longer need, try to optimize this away.
618 	 *
619 	 * Since we're holding a reference ourselves, observing a refcount of 1
620 	 * means that we're the last holder and can skip it. Also, the refcount
621 	 * can never increase from 1 again, so we don't need any barriers or
622 	 * locks.
623 	 *
624 	 * Note that userspace could try to race with use and instate a new
625 	 * usage _after_ we've cleared all current ones. End result will be an
626 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
627 	 * in this manner.
628 	 */
629 	if (atomic_read(&fb->refcount.refcount) > 1) {
630 		drm_modeset_lock_all(dev);
631 		/* remove from any CRTC */
632 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
633 			if (crtc->primary->fb == fb) {
634 				/* should turn off the crtc */
635 				memset(&set, 0, sizeof(struct drm_mode_set));
636 				set.crtc = crtc;
637 				set.fb = NULL;
638 				ret = drm_mode_set_config_internal(&set);
639 				if (ret)
640 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
641 			}
642 		}
643 
644 		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
645 			if (plane->fb == fb)
646 				drm_plane_force_disable(plane);
647 		}
648 		drm_modeset_unlock_all(dev);
649 	}
650 
651 	drm_framebuffer_unreference(fb);
652 }
653 EXPORT_SYMBOL(drm_framebuffer_remove);
654 
655 DEFINE_WW_CLASS(crtc_ww_class);
656 
657 /**
658  * drm_crtc_init_with_planes - Initialise a new CRTC object with
659  *    specified primary and cursor planes.
660  * @dev: DRM device
661  * @crtc: CRTC object to init
662  * @primary: Primary plane for CRTC
663  * @cursor: Cursor plane for CRTC
664  * @funcs: callbacks for the new CRTC
665  *
666  * Inits a new object created as base part of a driver crtc object.
667  *
668  * Returns:
669  * Zero on success, error code on failure.
670  */
671 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
672 			      struct drm_plane *primary,
673 			      struct drm_plane *cursor,
674 			      const struct drm_crtc_funcs *funcs)
675 {
676 	struct drm_mode_config *config = &dev->mode_config;
677 	int ret;
678 
679 	crtc->dev = dev;
680 	crtc->funcs = funcs;
681 	crtc->invert_dimensions = false;
682 
683 	drm_modeset_lock_init(&crtc->mutex);
684 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
685 	if (ret)
686 		return ret;
687 
688 	crtc->base.properties = &crtc->properties;
689 
690 	list_add_tail(&crtc->head, &config->crtc_list);
691 	config->num_crtc++;
692 
693 	crtc->primary = primary;
694 	crtc->cursor = cursor;
695 	if (primary)
696 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
697 	if (cursor)
698 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
699 
700 	return 0;
701 }
702 EXPORT_SYMBOL(drm_crtc_init_with_planes);
703 
704 /**
705  * drm_crtc_cleanup - Clean up the core crtc usage
706  * @crtc: CRTC to cleanup
707  *
708  * This function cleans up @crtc and removes it from the DRM mode setting
709  * core. Note that the function does *not* free the crtc structure itself,
710  * this is the responsibility of the caller.
711  */
712 void drm_crtc_cleanup(struct drm_crtc *crtc)
713 {
714 	struct drm_device *dev = crtc->dev;
715 
716 	kfree(crtc->gamma_store);
717 	crtc->gamma_store = NULL;
718 
719 	drm_modeset_lock_fini(&crtc->mutex);
720 
721 	drm_mode_object_put(dev, &crtc->base);
722 	list_del(&crtc->head);
723 	dev->mode_config.num_crtc--;
724 
725 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
726 	if (crtc->state && crtc->funcs->atomic_destroy_state)
727 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
728 
729 	memset(crtc, 0, sizeof(*crtc));
730 }
731 EXPORT_SYMBOL(drm_crtc_cleanup);
732 
733 /**
734  * drm_crtc_index - find the index of a registered CRTC
735  * @crtc: CRTC to find index for
736  *
737  * Given a registered CRTC, return the index of that CRTC within a DRM
738  * device's list of CRTCs.
739  */
740 unsigned int drm_crtc_index(struct drm_crtc *crtc)
741 {
742 	unsigned int index = 0;
743 	struct drm_crtc *tmp;
744 
745 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
746 		if (tmp == crtc)
747 			return index;
748 
749 		index++;
750 	}
751 
752 	BUG();
753 }
754 EXPORT_SYMBOL(drm_crtc_index);
755 
756 /*
757  * drm_mode_remove - remove and free a mode
758  * @connector: connector list to modify
759  * @mode: mode to remove
760  *
761  * Remove @mode from @connector's mode list, then free it.
762  */
763 static void drm_mode_remove(struct drm_connector *connector,
764 			    struct drm_display_mode *mode)
765 {
766 	list_del(&mode->head);
767 	drm_mode_destroy(connector->dev, mode);
768 }
769 
770 /**
771  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
772  * @connector: connector to quwery
773  *
774  * The kernel supports per-connector configration of its consoles through
775  * use of the video= parameter. This function parses that option and
776  * extracts the user's specified mode (or enable/disable status) for a
777  * particular connector. This is typically only used during the early fbdev
778  * setup.
779  */
780 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
781 {
782 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
783 	char *option = NULL;
784 
785 	if (fb_get_options(connector->name, &option))
786 		return;
787 
788 	if (!drm_mode_parse_command_line_for_connector(option,
789 						       connector,
790 						       mode))
791 		return;
792 
793 	if (mode->force) {
794 		const char *s;
795 
796 		switch (mode->force) {
797 		case DRM_FORCE_OFF:
798 			s = "OFF";
799 			break;
800 		case DRM_FORCE_ON_DIGITAL:
801 			s = "ON - dig";
802 			break;
803 		default:
804 		case DRM_FORCE_ON:
805 			s = "ON";
806 			break;
807 		}
808 
809 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
810 		connector->force = mode->force;
811 	}
812 
813 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
814 		      connector->name,
815 		      mode->xres, mode->yres,
816 		      mode->refresh_specified ? mode->refresh : 60,
817 		      mode->rb ? " reduced blanking" : "",
818 		      mode->margins ? " with margins" : "",
819 		      mode->interlace ?  " interlaced" : "");
820 }
821 
822 /**
823  * drm_connector_init - Init a preallocated connector
824  * @dev: DRM device
825  * @connector: the connector to init
826  * @funcs: callbacks for this connector
827  * @connector_type: user visible type of the connector
828  *
829  * Initialises a preallocated connector. Connectors should be
830  * subclassed as part of driver connector objects.
831  *
832  * Returns:
833  * Zero on success, error code on failure.
834  */
835 int drm_connector_init(struct drm_device *dev,
836 		       struct drm_connector *connector,
837 		       const struct drm_connector_funcs *funcs,
838 		       int connector_type)
839 {
840 	int ret;
841 	struct ida *connector_ida =
842 		&drm_connector_enum_list[connector_type].ida;
843 
844 	drm_modeset_lock_all(dev);
845 
846 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
847 	if (ret)
848 		goto out_unlock;
849 
850 	connector->base.properties = &connector->properties;
851 	connector->dev = dev;
852 	connector->funcs = funcs;
853 	connector->connector_type = connector_type;
854 	connector->connector_type_id =
855 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
856 	if (connector->connector_type_id < 0) {
857 		ret = connector->connector_type_id;
858 		goto out_put;
859 	}
860 	connector->name =
861 		kasprintf(GFP_KERNEL, "%s-%d",
862 			  drm_connector_enum_list[connector_type].name,
863 			  connector->connector_type_id);
864 	if (!connector->name) {
865 		ret = -ENOMEM;
866 		goto out_put;
867 	}
868 
869 	INIT_LIST_HEAD(&connector->probed_modes);
870 	INIT_LIST_HEAD(&connector->modes);
871 	connector->edid_blob_ptr = NULL;
872 	connector->status = connector_status_unknown;
873 
874 	drm_connector_get_cmdline_mode(connector);
875 
876 	/* We should add connectors at the end to avoid upsetting the connector
877 	 * index too much. */
878 	list_add_tail(&connector->head, &dev->mode_config.connector_list);
879 	dev->mode_config.num_connector++;
880 
881 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
882 		drm_object_attach_property(&connector->base,
883 					      dev->mode_config.edid_property,
884 					      0);
885 
886 	drm_object_attach_property(&connector->base,
887 				      dev->mode_config.dpms_property, 0);
888 
889 	connector->debugfs_entry = NULL;
890 
891 out_put:
892 	if (ret)
893 		drm_mode_object_put(dev, &connector->base);
894 
895 out_unlock:
896 	drm_modeset_unlock_all(dev);
897 
898 	return ret;
899 }
900 EXPORT_SYMBOL(drm_connector_init);
901 
902 /**
903  * drm_connector_cleanup - cleans up an initialised connector
904  * @connector: connector to cleanup
905  *
906  * Cleans up the connector but doesn't free the object.
907  */
908 void drm_connector_cleanup(struct drm_connector *connector)
909 {
910 	struct drm_device *dev = connector->dev;
911 	struct drm_display_mode *mode, *t;
912 
913 	if (connector->tile_group) {
914 		drm_mode_put_tile_group(dev, connector->tile_group);
915 		connector->tile_group = NULL;
916 	}
917 
918 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
919 		drm_mode_remove(connector, mode);
920 
921 	list_for_each_entry_safe(mode, t, &connector->modes, head)
922 		drm_mode_remove(connector, mode);
923 
924 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
925 		   connector->connector_type_id);
926 
927 	drm_mode_object_put(dev, &connector->base);
928 	kfree(connector->name);
929 	connector->name = NULL;
930 	list_del(&connector->head);
931 	dev->mode_config.num_connector--;
932 
933 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
934 	if (connector->state && connector->funcs->atomic_destroy_state)
935 		connector->funcs->atomic_destroy_state(connector,
936 						       connector->state);
937 
938 	memset(connector, 0, sizeof(*connector));
939 }
940 EXPORT_SYMBOL(drm_connector_cleanup);
941 
942 /**
943  * drm_connector_index - find the index of a registered connector
944  * @connector: connector to find index for
945  *
946  * Given a registered connector, return the index of that connector within a DRM
947  * device's list of connectors.
948  */
949 unsigned int drm_connector_index(struct drm_connector *connector)
950 {
951 	unsigned int index = 0;
952 	struct drm_connector *tmp;
953 	struct drm_mode_config *config = &connector->dev->mode_config;
954 
955 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
956 
957 	list_for_each_entry(tmp, &connector->dev->mode_config.connector_list, head) {
958 		if (tmp == connector)
959 			return index;
960 
961 		index++;
962 	}
963 
964 	BUG();
965 }
966 EXPORT_SYMBOL(drm_connector_index);
967 
968 /**
969  * drm_connector_register - register a connector
970  * @connector: the connector to register
971  *
972  * Register userspace interfaces for a connector
973  *
974  * Returns:
975  * Zero on success, error code on failure.
976  */
977 int drm_connector_register(struct drm_connector *connector)
978 {
979 	int ret;
980 
981 	drm_mode_object_register(connector->dev, &connector->base);
982 
983 	ret = drm_sysfs_connector_add(connector);
984 	if (ret)
985 		return ret;
986 
987 	ret = drm_debugfs_connector_add(connector);
988 	if (ret) {
989 		drm_sysfs_connector_remove(connector);
990 		return ret;
991 	}
992 
993 	return 0;
994 }
995 EXPORT_SYMBOL(drm_connector_register);
996 
997 /**
998  * drm_connector_unregister - unregister a connector
999  * @connector: the connector to unregister
1000  *
1001  * Unregister userspace interfaces for a connector
1002  */
1003 void drm_connector_unregister(struct drm_connector *connector)
1004 {
1005 	drm_sysfs_connector_remove(connector);
1006 	drm_debugfs_connector_remove(connector);
1007 }
1008 EXPORT_SYMBOL(drm_connector_unregister);
1009 
1010 
1011 /**
1012  * drm_connector_unplug_all - unregister connector userspace interfaces
1013  * @dev: drm device
1014  *
1015  * This function unregisters all connector userspace interfaces in sysfs. Should
1016  * be call when the device is disconnected, e.g. from an usb driver's
1017  * ->disconnect callback.
1018  */
1019 void drm_connector_unplug_all(struct drm_device *dev)
1020 {
1021 	struct drm_connector *connector;
1022 
1023 	/* taking the mode config mutex ends up in a clash with sysfs */
1024 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1025 		drm_connector_unregister(connector);
1026 
1027 }
1028 EXPORT_SYMBOL(drm_connector_unplug_all);
1029 
1030 /**
1031  * drm_bridge_init - initialize a drm transcoder/bridge
1032  * @dev: drm device
1033  * @bridge: transcoder/bridge to set up
1034  * @funcs: bridge function table
1035  *
1036  * Initialises a preallocated bridge. Bridges should be
1037  * subclassed as part of driver connector objects.
1038  *
1039  * Returns:
1040  * Zero on success, error code on failure.
1041  */
1042 int drm_bridge_init(struct drm_device *dev, struct drm_bridge *bridge,
1043 		const struct drm_bridge_funcs *funcs)
1044 {
1045 	int ret;
1046 
1047 	drm_modeset_lock_all(dev);
1048 
1049 	ret = drm_mode_object_get(dev, &bridge->base, DRM_MODE_OBJECT_BRIDGE);
1050 	if (ret)
1051 		goto out;
1052 
1053 	bridge->dev = dev;
1054 	bridge->funcs = funcs;
1055 
1056 	list_add_tail(&bridge->head, &dev->mode_config.bridge_list);
1057 	dev->mode_config.num_bridge++;
1058 
1059  out:
1060 	drm_modeset_unlock_all(dev);
1061 	return ret;
1062 }
1063 EXPORT_SYMBOL(drm_bridge_init);
1064 
1065 /**
1066  * drm_bridge_cleanup - cleans up an initialised bridge
1067  * @bridge: bridge to cleanup
1068  *
1069  * Cleans up the bridge but doesn't free the object.
1070  */
1071 void drm_bridge_cleanup(struct drm_bridge *bridge)
1072 {
1073 	struct drm_device *dev = bridge->dev;
1074 
1075 	drm_modeset_lock_all(dev);
1076 	drm_mode_object_put(dev, &bridge->base);
1077 	list_del(&bridge->head);
1078 	dev->mode_config.num_bridge--;
1079 	drm_modeset_unlock_all(dev);
1080 
1081 	memset(bridge, 0, sizeof(*bridge));
1082 }
1083 EXPORT_SYMBOL(drm_bridge_cleanup);
1084 
1085 /**
1086  * drm_encoder_init - Init a preallocated encoder
1087  * @dev: drm device
1088  * @encoder: the encoder to init
1089  * @funcs: callbacks for this encoder
1090  * @encoder_type: user visible type of the encoder
1091  *
1092  * Initialises a preallocated encoder. Encoder should be
1093  * subclassed as part of driver encoder objects.
1094  *
1095  * Returns:
1096  * Zero on success, error code on failure.
1097  */
1098 int drm_encoder_init(struct drm_device *dev,
1099 		      struct drm_encoder *encoder,
1100 		      const struct drm_encoder_funcs *funcs,
1101 		      int encoder_type)
1102 {
1103 	int ret;
1104 
1105 	drm_modeset_lock_all(dev);
1106 
1107 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1108 	if (ret)
1109 		goto out_unlock;
1110 
1111 	encoder->dev = dev;
1112 	encoder->encoder_type = encoder_type;
1113 	encoder->funcs = funcs;
1114 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1115 				  drm_encoder_enum_list[encoder_type].name,
1116 				  encoder->base.id);
1117 	if (!encoder->name) {
1118 		ret = -ENOMEM;
1119 		goto out_put;
1120 	}
1121 
1122 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1123 	dev->mode_config.num_encoder++;
1124 
1125 out_put:
1126 	if (ret)
1127 		drm_mode_object_put(dev, &encoder->base);
1128 
1129 out_unlock:
1130 	drm_modeset_unlock_all(dev);
1131 
1132 	return ret;
1133 }
1134 EXPORT_SYMBOL(drm_encoder_init);
1135 
1136 /**
1137  * drm_encoder_cleanup - cleans up an initialised encoder
1138  * @encoder: encoder to cleanup
1139  *
1140  * Cleans up the encoder but doesn't free the object.
1141  */
1142 void drm_encoder_cleanup(struct drm_encoder *encoder)
1143 {
1144 	struct drm_device *dev = encoder->dev;
1145 	drm_modeset_lock_all(dev);
1146 	drm_mode_object_put(dev, &encoder->base);
1147 	kfree(encoder->name);
1148 	list_del(&encoder->head);
1149 	dev->mode_config.num_encoder--;
1150 	drm_modeset_unlock_all(dev);
1151 
1152 	memset(encoder, 0, sizeof(*encoder));
1153 }
1154 EXPORT_SYMBOL(drm_encoder_cleanup);
1155 
1156 /**
1157  * drm_universal_plane_init - Initialize a new universal plane object
1158  * @dev: DRM device
1159  * @plane: plane object to init
1160  * @possible_crtcs: bitmask of possible CRTCs
1161  * @funcs: callbacks for the new plane
1162  * @formats: array of supported formats (%DRM_FORMAT_*)
1163  * @format_count: number of elements in @formats
1164  * @type: type of plane (overlay, primary, cursor)
1165  *
1166  * Initializes a plane object of type @type.
1167  *
1168  * Returns:
1169  * Zero on success, error code on failure.
1170  */
1171 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1172 			     unsigned long possible_crtcs,
1173 			     const struct drm_plane_funcs *funcs,
1174 			     const uint32_t *formats, uint32_t format_count,
1175 			     enum drm_plane_type type)
1176 {
1177 	int ret;
1178 
1179 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1180 	if (ret)
1181 		return ret;
1182 
1183 	drm_modeset_lock_init(&plane->mutex);
1184 
1185 	plane->base.properties = &plane->properties;
1186 	plane->dev = dev;
1187 	plane->funcs = funcs;
1188 	plane->format_types = kmalloc(sizeof(uint32_t) * format_count,
1189 				      GFP_KERNEL);
1190 	if (!plane->format_types) {
1191 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1192 		drm_mode_object_put(dev, &plane->base);
1193 		return -ENOMEM;
1194 	}
1195 
1196 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1197 	plane->format_count = format_count;
1198 	plane->possible_crtcs = possible_crtcs;
1199 	plane->type = type;
1200 
1201 	list_add_tail(&plane->head, &dev->mode_config.plane_list);
1202 	dev->mode_config.num_total_plane++;
1203 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1204 		dev->mode_config.num_overlay_plane++;
1205 
1206 	drm_object_attach_property(&plane->base,
1207 				   dev->mode_config.plane_type_property,
1208 				   plane->type);
1209 
1210 	return 0;
1211 }
1212 EXPORT_SYMBOL(drm_universal_plane_init);
1213 
1214 /**
1215  * drm_plane_init - Initialize a legacy plane
1216  * @dev: DRM device
1217  * @plane: plane object to init
1218  * @possible_crtcs: bitmask of possible CRTCs
1219  * @funcs: callbacks for the new plane
1220  * @formats: array of supported formats (%DRM_FORMAT_*)
1221  * @format_count: number of elements in @formats
1222  * @is_primary: plane type (primary vs overlay)
1223  *
1224  * Legacy API to initialize a DRM plane.
1225  *
1226  * New drivers should call drm_universal_plane_init() instead.
1227  *
1228  * Returns:
1229  * Zero on success, error code on failure.
1230  */
1231 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1232 		   unsigned long possible_crtcs,
1233 		   const struct drm_plane_funcs *funcs,
1234 		   const uint32_t *formats, uint32_t format_count,
1235 		   bool is_primary)
1236 {
1237 	enum drm_plane_type type;
1238 
1239 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1240 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1241 					formats, format_count, type);
1242 }
1243 EXPORT_SYMBOL(drm_plane_init);
1244 
1245 /**
1246  * drm_plane_cleanup - Clean up the core plane usage
1247  * @plane: plane to cleanup
1248  *
1249  * This function cleans up @plane and removes it from the DRM mode setting
1250  * core. Note that the function does *not* free the plane structure itself,
1251  * this is the responsibility of the caller.
1252  */
1253 void drm_plane_cleanup(struct drm_plane *plane)
1254 {
1255 	struct drm_device *dev = plane->dev;
1256 
1257 	drm_modeset_lock_all(dev);
1258 	kfree(plane->format_types);
1259 	drm_mode_object_put(dev, &plane->base);
1260 
1261 	BUG_ON(list_empty(&plane->head));
1262 
1263 	list_del(&plane->head);
1264 	dev->mode_config.num_total_plane--;
1265 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1266 		dev->mode_config.num_overlay_plane--;
1267 	drm_modeset_unlock_all(dev);
1268 
1269 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1270 	if (plane->state && plane->funcs->atomic_destroy_state)
1271 		plane->funcs->atomic_destroy_state(plane, plane->state);
1272 
1273 	memset(plane, 0, sizeof(*plane));
1274 }
1275 EXPORT_SYMBOL(drm_plane_cleanup);
1276 
1277 /**
1278  * drm_plane_index - find the index of a registered plane
1279  * @plane: plane to find index for
1280  *
1281  * Given a registered plane, return the index of that CRTC within a DRM
1282  * device's list of planes.
1283  */
1284 unsigned int drm_plane_index(struct drm_plane *plane)
1285 {
1286 	unsigned int index = 0;
1287 	struct drm_plane *tmp;
1288 
1289 	list_for_each_entry(tmp, &plane->dev->mode_config.plane_list, head) {
1290 		if (tmp == plane)
1291 			return index;
1292 
1293 		index++;
1294 	}
1295 
1296 	BUG();
1297 }
1298 EXPORT_SYMBOL(drm_plane_index);
1299 
1300 /**
1301  * drm_plane_force_disable - Forcibly disable a plane
1302  * @plane: plane to disable
1303  *
1304  * Forces the plane to be disabled.
1305  *
1306  * Used when the plane's current framebuffer is destroyed,
1307  * and when restoring fbdev mode.
1308  */
1309 void drm_plane_force_disable(struct drm_plane *plane)
1310 {
1311 	int ret;
1312 
1313 	if (!plane->fb)
1314 		return;
1315 
1316 	plane->old_fb = plane->fb;
1317 	ret = plane->funcs->disable_plane(plane);
1318 	if (ret) {
1319 		DRM_ERROR("failed to disable plane with busy fb\n");
1320 		plane->old_fb = NULL;
1321 		return;
1322 	}
1323 	/* disconnect the plane from the fb and crtc: */
1324 	__drm_framebuffer_unreference(plane->old_fb);
1325 	plane->old_fb = NULL;
1326 	plane->fb = NULL;
1327 	plane->crtc = NULL;
1328 }
1329 EXPORT_SYMBOL(drm_plane_force_disable);
1330 
1331 static int drm_mode_create_standard_connector_properties(struct drm_device *dev)
1332 {
1333 	struct drm_property *edid;
1334 	struct drm_property *dpms;
1335 	struct drm_property *dev_path;
1336 
1337 	/*
1338 	 * Standard properties (apply to all connectors)
1339 	 */
1340 	edid = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1341 				   DRM_MODE_PROP_IMMUTABLE,
1342 				   "EDID", 0);
1343 	dev->mode_config.edid_property = edid;
1344 
1345 	dpms = drm_property_create_enum(dev, 0,
1346 				   "DPMS", drm_dpms_enum_list,
1347 				   ARRAY_SIZE(drm_dpms_enum_list));
1348 	dev->mode_config.dpms_property = dpms;
1349 
1350 	dev_path = drm_property_create(dev,
1351 				       DRM_MODE_PROP_BLOB |
1352 				       DRM_MODE_PROP_IMMUTABLE,
1353 				       "PATH", 0);
1354 	dev->mode_config.path_property = dev_path;
1355 
1356 	dev->mode_config.tile_property = drm_property_create(dev,
1357 							     DRM_MODE_PROP_BLOB |
1358 							     DRM_MODE_PROP_IMMUTABLE,
1359 							     "TILE", 0);
1360 
1361 	return 0;
1362 }
1363 
1364 static int drm_mode_create_standard_plane_properties(struct drm_device *dev)
1365 {
1366 	struct drm_property *type;
1367 
1368 	/*
1369 	 * Standard properties (apply to all planes)
1370 	 */
1371 	type = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1372 					"type", drm_plane_type_enum_list,
1373 					ARRAY_SIZE(drm_plane_type_enum_list));
1374 	dev->mode_config.plane_type_property = type;
1375 
1376 	return 0;
1377 }
1378 
1379 /**
1380  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1381  * @dev: DRM device
1382  *
1383  * Called by a driver the first time a DVI-I connector is made.
1384  */
1385 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1386 {
1387 	struct drm_property *dvi_i_selector;
1388 	struct drm_property *dvi_i_subconnector;
1389 
1390 	if (dev->mode_config.dvi_i_select_subconnector_property)
1391 		return 0;
1392 
1393 	dvi_i_selector =
1394 		drm_property_create_enum(dev, 0,
1395 				    "select subconnector",
1396 				    drm_dvi_i_select_enum_list,
1397 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1398 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1399 
1400 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1401 				    "subconnector",
1402 				    drm_dvi_i_subconnector_enum_list,
1403 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1404 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1405 
1406 	return 0;
1407 }
1408 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1409 
1410 /**
1411  * drm_create_tv_properties - create TV specific connector properties
1412  * @dev: DRM device
1413  * @num_modes: number of different TV formats (modes) supported
1414  * @modes: array of pointers to strings containing name of each format
1415  *
1416  * Called by a driver's TV initialization routine, this function creates
1417  * the TV specific connector properties for a given device.  Caller is
1418  * responsible for allocating a list of format names and passing them to
1419  * this routine.
1420  */
1421 int drm_mode_create_tv_properties(struct drm_device *dev,
1422 				  unsigned int num_modes,
1423 				  char *modes[])
1424 {
1425 	struct drm_property *tv_selector;
1426 	struct drm_property *tv_subconnector;
1427 	unsigned int i;
1428 
1429 	if (dev->mode_config.tv_select_subconnector_property)
1430 		return 0;
1431 
1432 	/*
1433 	 * Basic connector properties
1434 	 */
1435 	tv_selector = drm_property_create_enum(dev, 0,
1436 					  "select subconnector",
1437 					  drm_tv_select_enum_list,
1438 					  ARRAY_SIZE(drm_tv_select_enum_list));
1439 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1440 
1441 	tv_subconnector =
1442 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1443 				    "subconnector",
1444 				    drm_tv_subconnector_enum_list,
1445 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1446 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1447 
1448 	/*
1449 	 * Other, TV specific properties: margins & TV modes.
1450 	 */
1451 	dev->mode_config.tv_left_margin_property =
1452 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1453 
1454 	dev->mode_config.tv_right_margin_property =
1455 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1456 
1457 	dev->mode_config.tv_top_margin_property =
1458 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1459 
1460 	dev->mode_config.tv_bottom_margin_property =
1461 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1462 
1463 	dev->mode_config.tv_mode_property =
1464 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1465 				    "mode", num_modes);
1466 	for (i = 0; i < num_modes; i++)
1467 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1468 				      i, modes[i]);
1469 
1470 	dev->mode_config.tv_brightness_property =
1471 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1472 
1473 	dev->mode_config.tv_contrast_property =
1474 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1475 
1476 	dev->mode_config.tv_flicker_reduction_property =
1477 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1478 
1479 	dev->mode_config.tv_overscan_property =
1480 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1481 
1482 	dev->mode_config.tv_saturation_property =
1483 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1484 
1485 	dev->mode_config.tv_hue_property =
1486 		drm_property_create_range(dev, 0, "hue", 0, 100);
1487 
1488 	return 0;
1489 }
1490 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1491 
1492 /**
1493  * drm_mode_create_scaling_mode_property - create scaling mode property
1494  * @dev: DRM device
1495  *
1496  * Called by a driver the first time it's needed, must be attached to desired
1497  * connectors.
1498  */
1499 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1500 {
1501 	struct drm_property *scaling_mode;
1502 
1503 	if (dev->mode_config.scaling_mode_property)
1504 		return 0;
1505 
1506 	scaling_mode =
1507 		drm_property_create_enum(dev, 0, "scaling mode",
1508 				drm_scaling_mode_enum_list,
1509 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1510 
1511 	dev->mode_config.scaling_mode_property = scaling_mode;
1512 
1513 	return 0;
1514 }
1515 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1516 
1517 /**
1518  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1519  * @dev: DRM device
1520  *
1521  * Called by a driver the first time it's needed, must be attached to desired
1522  * connectors.
1523  *
1524  * Returns:
1525  * Zero on success, negative errno on failure.
1526  */
1527 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1528 {
1529 	if (dev->mode_config.aspect_ratio_property)
1530 		return 0;
1531 
1532 	dev->mode_config.aspect_ratio_property =
1533 		drm_property_create_enum(dev, 0, "aspect ratio",
1534 				drm_aspect_ratio_enum_list,
1535 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1536 
1537 	if (dev->mode_config.aspect_ratio_property == NULL)
1538 		return -ENOMEM;
1539 
1540 	return 0;
1541 }
1542 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1543 
1544 /**
1545  * drm_mode_create_dirty_property - create dirty property
1546  * @dev: DRM device
1547  *
1548  * Called by a driver the first time it's needed, must be attached to desired
1549  * connectors.
1550  */
1551 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1552 {
1553 	struct drm_property *dirty_info;
1554 
1555 	if (dev->mode_config.dirty_info_property)
1556 		return 0;
1557 
1558 	dirty_info =
1559 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1560 				    "dirty",
1561 				    drm_dirty_info_enum_list,
1562 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1563 	dev->mode_config.dirty_info_property = dirty_info;
1564 
1565 	return 0;
1566 }
1567 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1568 
1569 /**
1570  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1571  * @dev: DRM device
1572  *
1573  * Create the the suggested x/y offset property for connectors.
1574  */
1575 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1576 {
1577 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1578 		return 0;
1579 
1580 	dev->mode_config.suggested_x_property =
1581 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1582 
1583 	dev->mode_config.suggested_y_property =
1584 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1585 
1586 	if (dev->mode_config.suggested_x_property == NULL ||
1587 	    dev->mode_config.suggested_y_property == NULL)
1588 		return -ENOMEM;
1589 	return 0;
1590 }
1591 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1592 
1593 static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
1594 {
1595 	uint32_t total_objects = 0;
1596 
1597 	total_objects += dev->mode_config.num_crtc;
1598 	total_objects += dev->mode_config.num_connector;
1599 	total_objects += dev->mode_config.num_encoder;
1600 	total_objects += dev->mode_config.num_bridge;
1601 
1602 	group->id_list = kzalloc(total_objects * sizeof(uint32_t), GFP_KERNEL);
1603 	if (!group->id_list)
1604 		return -ENOMEM;
1605 
1606 	group->num_crtcs = 0;
1607 	group->num_connectors = 0;
1608 	group->num_encoders = 0;
1609 	group->num_bridges = 0;
1610 	return 0;
1611 }
1612 
1613 void drm_mode_group_destroy(struct drm_mode_group *group)
1614 {
1615 	kfree(group->id_list);
1616 	group->id_list = NULL;
1617 }
1618 
1619 /*
1620  * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
1621  * the drm core's responsibility to set up mode control groups.
1622  */
1623 int drm_mode_group_init_legacy_group(struct drm_device *dev,
1624 				     struct drm_mode_group *group)
1625 {
1626 	struct drm_crtc *crtc;
1627 	struct drm_encoder *encoder;
1628 	struct drm_connector *connector;
1629 	struct drm_bridge *bridge;
1630 	int ret;
1631 
1632 	if ((ret = drm_mode_group_init(dev, group)))
1633 		return ret;
1634 
1635 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
1636 		group->id_list[group->num_crtcs++] = crtc->base.id;
1637 
1638 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
1639 		group->id_list[group->num_crtcs + group->num_encoders++] =
1640 		encoder->base.id;
1641 
1642 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1643 		group->id_list[group->num_crtcs + group->num_encoders +
1644 			       group->num_connectors++] = connector->base.id;
1645 
1646 	list_for_each_entry(bridge, &dev->mode_config.bridge_list, head)
1647 		group->id_list[group->num_crtcs + group->num_encoders +
1648 			       group->num_connectors + group->num_bridges++] =
1649 					bridge->base.id;
1650 
1651 	return 0;
1652 }
1653 EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
1654 
1655 void drm_reinit_primary_mode_group(struct drm_device *dev)
1656 {
1657 	drm_modeset_lock_all(dev);
1658 	drm_mode_group_destroy(&dev->primary->mode_group);
1659 	drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
1660 	drm_modeset_unlock_all(dev);
1661 }
1662 EXPORT_SYMBOL(drm_reinit_primary_mode_group);
1663 
1664 /**
1665  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
1666  * @out: drm_mode_modeinfo struct to return to the user
1667  * @in: drm_display_mode to use
1668  *
1669  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
1670  * the user.
1671  */
1672 static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
1673 				      const struct drm_display_mode *in)
1674 {
1675 	WARN(in->hdisplay > USHRT_MAX || in->hsync_start > USHRT_MAX ||
1676 	     in->hsync_end > USHRT_MAX || in->htotal > USHRT_MAX ||
1677 	     in->hskew > USHRT_MAX || in->vdisplay > USHRT_MAX ||
1678 	     in->vsync_start > USHRT_MAX || in->vsync_end > USHRT_MAX ||
1679 	     in->vtotal > USHRT_MAX || in->vscan > USHRT_MAX,
1680 	     "timing values too large for mode info\n");
1681 
1682 	out->clock = in->clock;
1683 	out->hdisplay = in->hdisplay;
1684 	out->hsync_start = in->hsync_start;
1685 	out->hsync_end = in->hsync_end;
1686 	out->htotal = in->htotal;
1687 	out->hskew = in->hskew;
1688 	out->vdisplay = in->vdisplay;
1689 	out->vsync_start = in->vsync_start;
1690 	out->vsync_end = in->vsync_end;
1691 	out->vtotal = in->vtotal;
1692 	out->vscan = in->vscan;
1693 	out->vrefresh = in->vrefresh;
1694 	out->flags = in->flags;
1695 	out->type = in->type;
1696 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1697 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1698 }
1699 
1700 /**
1701  * drm_crtc_convert_umode - convert a modeinfo into a drm_display_mode
1702  * @out: drm_display_mode to return to the user
1703  * @in: drm_mode_modeinfo to use
1704  *
1705  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
1706  * the caller.
1707  *
1708  * Returns:
1709  * Zero on success, negative errno on failure.
1710  */
1711 static int drm_crtc_convert_umode(struct drm_display_mode *out,
1712 				  const struct drm_mode_modeinfo *in)
1713 {
1714 	if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
1715 		return -ERANGE;
1716 
1717 	if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
1718 		return -EINVAL;
1719 
1720 	out->clock = in->clock;
1721 	out->hdisplay = in->hdisplay;
1722 	out->hsync_start = in->hsync_start;
1723 	out->hsync_end = in->hsync_end;
1724 	out->htotal = in->htotal;
1725 	out->hskew = in->hskew;
1726 	out->vdisplay = in->vdisplay;
1727 	out->vsync_start = in->vsync_start;
1728 	out->vsync_end = in->vsync_end;
1729 	out->vtotal = in->vtotal;
1730 	out->vscan = in->vscan;
1731 	out->vrefresh = in->vrefresh;
1732 	out->flags = in->flags;
1733 	out->type = in->type;
1734 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1735 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1736 
1737 	return 0;
1738 }
1739 
1740 /**
1741  * drm_mode_getresources - get graphics configuration
1742  * @dev: drm device for the ioctl
1743  * @data: data pointer for the ioctl
1744  * @file_priv: drm file for the ioctl call
1745  *
1746  * Construct a set of configuration description structures and return
1747  * them to the user, including CRTC, connector and framebuffer configuration.
1748  *
1749  * Called by the user via ioctl.
1750  *
1751  * Returns:
1752  * Zero on success, negative errno on failure.
1753  */
1754 int drm_mode_getresources(struct drm_device *dev, void *data,
1755 			  struct drm_file *file_priv)
1756 {
1757 	struct drm_mode_card_res *card_res = data;
1758 	struct list_head *lh;
1759 	struct drm_framebuffer *fb;
1760 	struct drm_connector *connector;
1761 	struct drm_crtc *crtc;
1762 	struct drm_encoder *encoder;
1763 	int ret = 0;
1764 	int connector_count = 0;
1765 	int crtc_count = 0;
1766 	int fb_count = 0;
1767 	int encoder_count = 0;
1768 	int copied = 0, i;
1769 	uint32_t __user *fb_id;
1770 	uint32_t __user *crtc_id;
1771 	uint32_t __user *connector_id;
1772 	uint32_t __user *encoder_id;
1773 	struct drm_mode_group *mode_group;
1774 
1775 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1776 		return -EINVAL;
1777 
1778 
1779 	mutex_lock(&file_priv->fbs_lock);
1780 	/*
1781 	 * For the non-control nodes we need to limit the list of resources
1782 	 * by IDs in the group list for this node
1783 	 */
1784 	list_for_each(lh, &file_priv->fbs)
1785 		fb_count++;
1786 
1787 	/* handle this in 4 parts */
1788 	/* FBs */
1789 	if (card_res->count_fbs >= fb_count) {
1790 		copied = 0;
1791 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1792 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1793 			if (put_user(fb->base.id, fb_id + copied)) {
1794 				mutex_unlock(&file_priv->fbs_lock);
1795 				return -EFAULT;
1796 			}
1797 			copied++;
1798 		}
1799 	}
1800 	card_res->count_fbs = fb_count;
1801 	mutex_unlock(&file_priv->fbs_lock);
1802 
1803 	/* mode_config.mutex protects the connector list against e.g. DP MST
1804 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1805 	mutex_lock(&dev->mode_config.mutex);
1806 	if (!drm_is_primary_client(file_priv)) {
1807 
1808 		mode_group = NULL;
1809 		list_for_each(lh, &dev->mode_config.crtc_list)
1810 			crtc_count++;
1811 
1812 		list_for_each(lh, &dev->mode_config.connector_list)
1813 			connector_count++;
1814 
1815 		list_for_each(lh, &dev->mode_config.encoder_list)
1816 			encoder_count++;
1817 	} else {
1818 
1819 		mode_group = &file_priv->master->minor->mode_group;
1820 		crtc_count = mode_group->num_crtcs;
1821 		connector_count = mode_group->num_connectors;
1822 		encoder_count = mode_group->num_encoders;
1823 	}
1824 
1825 	card_res->max_height = dev->mode_config.max_height;
1826 	card_res->min_height = dev->mode_config.min_height;
1827 	card_res->max_width = dev->mode_config.max_width;
1828 	card_res->min_width = dev->mode_config.min_width;
1829 
1830 	/* CRTCs */
1831 	if (card_res->count_crtcs >= crtc_count) {
1832 		copied = 0;
1833 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1834 		if (!mode_group) {
1835 			list_for_each_entry(crtc, &dev->mode_config.crtc_list,
1836 					    head) {
1837 				DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1838 				if (put_user(crtc->base.id, crtc_id + copied)) {
1839 					ret = -EFAULT;
1840 					goto out;
1841 				}
1842 				copied++;
1843 			}
1844 		} else {
1845 			for (i = 0; i < mode_group->num_crtcs; i++) {
1846 				if (put_user(mode_group->id_list[i],
1847 					     crtc_id + copied)) {
1848 					ret = -EFAULT;
1849 					goto out;
1850 				}
1851 				copied++;
1852 			}
1853 		}
1854 	}
1855 	card_res->count_crtcs = crtc_count;
1856 
1857 	/* Encoders */
1858 	if (card_res->count_encoders >= encoder_count) {
1859 		copied = 0;
1860 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1861 		if (!mode_group) {
1862 			list_for_each_entry(encoder,
1863 					    &dev->mode_config.encoder_list,
1864 					    head) {
1865 				DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1866 						encoder->name);
1867 				if (put_user(encoder->base.id, encoder_id +
1868 					     copied)) {
1869 					ret = -EFAULT;
1870 					goto out;
1871 				}
1872 				copied++;
1873 			}
1874 		} else {
1875 			for (i = mode_group->num_crtcs; i < mode_group->num_crtcs + mode_group->num_encoders; i++) {
1876 				if (put_user(mode_group->id_list[i],
1877 					     encoder_id + copied)) {
1878 					ret = -EFAULT;
1879 					goto out;
1880 				}
1881 				copied++;
1882 			}
1883 
1884 		}
1885 	}
1886 	card_res->count_encoders = encoder_count;
1887 
1888 	/* Connectors */
1889 	if (card_res->count_connectors >= connector_count) {
1890 		copied = 0;
1891 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1892 		if (!mode_group) {
1893 			list_for_each_entry(connector,
1894 					    &dev->mode_config.connector_list,
1895 					    head) {
1896 				DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1897 					connector->base.id,
1898 					connector->name);
1899 				if (put_user(connector->base.id,
1900 					     connector_id + copied)) {
1901 					ret = -EFAULT;
1902 					goto out;
1903 				}
1904 				copied++;
1905 			}
1906 		} else {
1907 			int start = mode_group->num_crtcs +
1908 				mode_group->num_encoders;
1909 			for (i = start; i < start + mode_group->num_connectors; i++) {
1910 				if (put_user(mode_group->id_list[i],
1911 					     connector_id + copied)) {
1912 					ret = -EFAULT;
1913 					goto out;
1914 				}
1915 				copied++;
1916 			}
1917 		}
1918 	}
1919 	card_res->count_connectors = connector_count;
1920 
1921 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1922 		  card_res->count_connectors, card_res->count_encoders);
1923 
1924 out:
1925 	mutex_unlock(&dev->mode_config.mutex);
1926 	return ret;
1927 }
1928 
1929 /**
1930  * drm_mode_getcrtc - get CRTC configuration
1931  * @dev: drm device for the ioctl
1932  * @data: data pointer for the ioctl
1933  * @file_priv: drm file for the ioctl call
1934  *
1935  * Construct a CRTC configuration structure to return to the user.
1936  *
1937  * Called by the user via ioctl.
1938  *
1939  * Returns:
1940  * Zero on success, negative errno on failure.
1941  */
1942 int drm_mode_getcrtc(struct drm_device *dev,
1943 		     void *data, struct drm_file *file_priv)
1944 {
1945 	struct drm_mode_crtc *crtc_resp = data;
1946 	struct drm_crtc *crtc;
1947 
1948 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1949 		return -EINVAL;
1950 
1951 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1952 	if (!crtc)
1953 		return -ENOENT;
1954 
1955 	drm_modeset_lock_crtc(crtc, crtc->primary);
1956 	crtc_resp->x = crtc->x;
1957 	crtc_resp->y = crtc->y;
1958 	crtc_resp->gamma_size = crtc->gamma_size;
1959 	if (crtc->primary->fb)
1960 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1961 	else
1962 		crtc_resp->fb_id = 0;
1963 
1964 	if (crtc->enabled) {
1965 
1966 		drm_crtc_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1967 		crtc_resp->mode_valid = 1;
1968 
1969 	} else {
1970 		crtc_resp->mode_valid = 0;
1971 	}
1972 	drm_modeset_unlock_crtc(crtc);
1973 
1974 	return 0;
1975 }
1976 
1977 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1978 					 const struct drm_file *file_priv)
1979 {
1980 	/*
1981 	 * If user-space hasn't configured the driver to expose the stereo 3D
1982 	 * modes, don't expose them.
1983 	 */
1984 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1985 		return false;
1986 
1987 	return true;
1988 }
1989 
1990 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
1991 {
1992 	/* For atomic drivers only state objects are synchronously updated and
1993 	 * protected by modeset locks, so check those first. */
1994 	if (connector->state)
1995 		return connector->state->best_encoder;
1996 	return connector->encoder;
1997 }
1998 
1999 /**
2000  * drm_mode_getconnector - get connector configuration
2001  * @dev: drm device for the ioctl
2002  * @data: data pointer for the ioctl
2003  * @file_priv: drm file for the ioctl call
2004  *
2005  * Construct a connector configuration structure to return to the user.
2006  *
2007  * Called by the user via ioctl.
2008  *
2009  * Returns:
2010  * Zero on success, negative errno on failure.
2011  */
2012 int drm_mode_getconnector(struct drm_device *dev, void *data,
2013 			  struct drm_file *file_priv)
2014 {
2015 	struct drm_mode_get_connector *out_resp = data;
2016 	struct drm_connector *connector;
2017 	struct drm_encoder *encoder;
2018 	struct drm_display_mode *mode;
2019 	int mode_count = 0;
2020 	int props_count = 0;
2021 	int encoders_count = 0;
2022 	int ret = 0;
2023 	int copied = 0;
2024 	int i;
2025 	struct drm_mode_modeinfo u_mode;
2026 	struct drm_mode_modeinfo __user *mode_ptr;
2027 	uint32_t __user *prop_ptr;
2028 	uint64_t __user *prop_values;
2029 	uint32_t __user *encoder_ptr;
2030 
2031 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2032 		return -EINVAL;
2033 
2034 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2035 
2036 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2037 
2038 	mutex_lock(&dev->mode_config.mutex);
2039 
2040 	connector = drm_connector_find(dev, out_resp->connector_id);
2041 	if (!connector) {
2042 		ret = -ENOENT;
2043 		goto out;
2044 	}
2045 
2046 	props_count = connector->properties.count;
2047 
2048 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2049 		if (connector->encoder_ids[i] != 0) {
2050 			encoders_count++;
2051 		}
2052 	}
2053 
2054 	if (out_resp->count_modes == 0) {
2055 		connector->funcs->fill_modes(connector,
2056 					     dev->mode_config.max_width,
2057 					     dev->mode_config.max_height);
2058 	}
2059 
2060 	/* delayed so we get modes regardless of pre-fill_modes state */
2061 	list_for_each_entry(mode, &connector->modes, head)
2062 		if (drm_mode_expose_to_userspace(mode, file_priv))
2063 			mode_count++;
2064 
2065 	out_resp->connector_id = connector->base.id;
2066 	out_resp->connector_type = connector->connector_type;
2067 	out_resp->connector_type_id = connector->connector_type_id;
2068 	out_resp->mm_width = connector->display_info.width_mm;
2069 	out_resp->mm_height = connector->display_info.height_mm;
2070 	out_resp->subpixel = connector->display_info.subpixel_order;
2071 	out_resp->connection = connector->status;
2072 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2073 
2074 	encoder = drm_connector_get_encoder(connector);
2075 	if (encoder)
2076 		out_resp->encoder_id = encoder->base.id;
2077 	else
2078 		out_resp->encoder_id = 0;
2079 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2080 
2081 	/*
2082 	 * This ioctl is called twice, once to determine how much space is
2083 	 * needed, and the 2nd time to fill it.
2084 	 */
2085 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2086 		copied = 0;
2087 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2088 		list_for_each_entry(mode, &connector->modes, head) {
2089 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2090 				continue;
2091 
2092 			drm_crtc_convert_to_umode(&u_mode, mode);
2093 			if (copy_to_user(mode_ptr + copied,
2094 					 &u_mode, sizeof(u_mode))) {
2095 				ret = -EFAULT;
2096 				goto out;
2097 			}
2098 			copied++;
2099 		}
2100 	}
2101 	out_resp->count_modes = mode_count;
2102 
2103 	if ((out_resp->count_props >= props_count) && props_count) {
2104 		copied = 0;
2105 		prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
2106 		prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
2107 		for (i = 0; i < connector->properties.count; i++) {
2108 			if (put_user(connector->properties.ids[i],
2109 				     prop_ptr + copied)) {
2110 				ret = -EFAULT;
2111 				goto out;
2112 			}
2113 
2114 			if (put_user(connector->properties.values[i],
2115 				     prop_values + copied)) {
2116 				ret = -EFAULT;
2117 				goto out;
2118 			}
2119 			copied++;
2120 		}
2121 	}
2122 	out_resp->count_props = props_count;
2123 
2124 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2125 		copied = 0;
2126 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2127 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2128 			if (connector->encoder_ids[i] != 0) {
2129 				if (put_user(connector->encoder_ids[i],
2130 					     encoder_ptr + copied)) {
2131 					ret = -EFAULT;
2132 					goto out;
2133 				}
2134 				copied++;
2135 			}
2136 		}
2137 	}
2138 	out_resp->count_encoders = encoders_count;
2139 
2140 out:
2141 	mutex_unlock(&dev->mode_config.mutex);
2142 
2143 	return ret;
2144 }
2145 
2146 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2147 {
2148 	struct drm_connector *connector;
2149 	struct drm_device *dev = encoder->dev;
2150 	bool uses_atomic = false;
2151 
2152 	/* For atomic drivers only state objects are synchronously updated and
2153 	 * protected by modeset locks, so check those first. */
2154 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
2155 		if (!connector->state)
2156 			continue;
2157 
2158 		uses_atomic = true;
2159 
2160 		if (connector->state->best_encoder != encoder)
2161 			continue;
2162 
2163 		return connector->state->crtc;
2164 	}
2165 
2166 	/* Don't return stale data (e.g. pending async disable). */
2167 	if (uses_atomic)
2168 		return NULL;
2169 
2170 	return encoder->crtc;
2171 }
2172 
2173 /**
2174  * drm_mode_getencoder - get encoder configuration
2175  * @dev: drm device for the ioctl
2176  * @data: data pointer for the ioctl
2177  * @file_priv: drm file for the ioctl call
2178  *
2179  * Construct a encoder configuration structure to return to the user.
2180  *
2181  * Called by the user via ioctl.
2182  *
2183  * Returns:
2184  * Zero on success, negative errno on failure.
2185  */
2186 int drm_mode_getencoder(struct drm_device *dev, void *data,
2187 			struct drm_file *file_priv)
2188 {
2189 	struct drm_mode_get_encoder *enc_resp = data;
2190 	struct drm_encoder *encoder;
2191 	struct drm_crtc *crtc;
2192 
2193 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2194 		return -EINVAL;
2195 
2196 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2197 	if (!encoder)
2198 		return -ENOENT;
2199 
2200 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2201 	crtc = drm_encoder_get_crtc(encoder);
2202 	if (crtc)
2203 		enc_resp->crtc_id = crtc->base.id;
2204 	else if (encoder->crtc)
2205 		enc_resp->crtc_id = encoder->crtc->base.id;
2206 	else
2207 		enc_resp->crtc_id = 0;
2208 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2209 
2210 	enc_resp->encoder_type = encoder->encoder_type;
2211 	enc_resp->encoder_id = encoder->base.id;
2212 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2213 	enc_resp->possible_clones = encoder->possible_clones;
2214 
2215 	return 0;
2216 }
2217 
2218 /**
2219  * drm_mode_getplane_res - enumerate all plane resources
2220  * @dev: DRM device
2221  * @data: ioctl data
2222  * @file_priv: DRM file info
2223  *
2224  * Construct a list of plane ids to return to the user.
2225  *
2226  * Called by the user via ioctl.
2227  *
2228  * Returns:
2229  * Zero on success, negative errno on failure.
2230  */
2231 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2232 			  struct drm_file *file_priv)
2233 {
2234 	struct drm_mode_get_plane_res *plane_resp = data;
2235 	struct drm_mode_config *config;
2236 	struct drm_plane *plane;
2237 	uint32_t __user *plane_ptr;
2238 	int copied = 0;
2239 	unsigned num_planes;
2240 
2241 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2242 		return -EINVAL;
2243 
2244 	config = &dev->mode_config;
2245 
2246 	if (file_priv->universal_planes)
2247 		num_planes = config->num_total_plane;
2248 	else
2249 		num_planes = config->num_overlay_plane;
2250 
2251 	/*
2252 	 * This ioctl is called twice, once to determine how much space is
2253 	 * needed, and the 2nd time to fill it.
2254 	 */
2255 	if (num_planes &&
2256 	    (plane_resp->count_planes >= num_planes)) {
2257 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2258 
2259 		/* Plane lists are invariant, no locking needed. */
2260 		list_for_each_entry(plane, &config->plane_list, head) {
2261 			/*
2262 			 * Unless userspace set the 'universal planes'
2263 			 * capability bit, only advertise overlays.
2264 			 */
2265 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2266 			    !file_priv->universal_planes)
2267 				continue;
2268 
2269 			if (put_user(plane->base.id, plane_ptr + copied))
2270 				return -EFAULT;
2271 			copied++;
2272 		}
2273 	}
2274 	plane_resp->count_planes = num_planes;
2275 
2276 	return 0;
2277 }
2278 
2279 /**
2280  * drm_mode_getplane - get plane configuration
2281  * @dev: DRM device
2282  * @data: ioctl data
2283  * @file_priv: DRM file info
2284  *
2285  * Construct a plane configuration structure to return to the user.
2286  *
2287  * Called by the user via ioctl.
2288  *
2289  * Returns:
2290  * Zero on success, negative errno on failure.
2291  */
2292 int drm_mode_getplane(struct drm_device *dev, void *data,
2293 		      struct drm_file *file_priv)
2294 {
2295 	struct drm_mode_get_plane *plane_resp = data;
2296 	struct drm_plane *plane;
2297 	uint32_t __user *format_ptr;
2298 
2299 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2300 		return -EINVAL;
2301 
2302 	plane = drm_plane_find(dev, plane_resp->plane_id);
2303 	if (!plane)
2304 		return -ENOENT;
2305 
2306 	drm_modeset_lock(&plane->mutex, NULL);
2307 	if (plane->crtc)
2308 		plane_resp->crtc_id = plane->crtc->base.id;
2309 	else
2310 		plane_resp->crtc_id = 0;
2311 
2312 	if (plane->fb)
2313 		plane_resp->fb_id = plane->fb->base.id;
2314 	else
2315 		plane_resp->fb_id = 0;
2316 	drm_modeset_unlock(&plane->mutex);
2317 
2318 	plane_resp->plane_id = plane->base.id;
2319 	plane_resp->possible_crtcs = plane->possible_crtcs;
2320 	plane_resp->gamma_size = 0;
2321 
2322 	/*
2323 	 * This ioctl is called twice, once to determine how much space is
2324 	 * needed, and the 2nd time to fill it.
2325 	 */
2326 	if (plane->format_count &&
2327 	    (plane_resp->count_format_types >= plane->format_count)) {
2328 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2329 		if (copy_to_user(format_ptr,
2330 				 plane->format_types,
2331 				 sizeof(uint32_t) * plane->format_count)) {
2332 			return -EFAULT;
2333 		}
2334 	}
2335 	plane_resp->count_format_types = plane->format_count;
2336 
2337 	return 0;
2338 }
2339 
2340 /*
2341  * setplane_internal - setplane handler for internal callers
2342  *
2343  * Note that we assume an extra reference has already been taken on fb.  If the
2344  * update fails, this reference will be dropped before return; if it succeeds,
2345  * the previous framebuffer (if any) will be unreferenced instead.
2346  *
2347  * src_{x,y,w,h} are provided in 16.16 fixed point format
2348  */
2349 static int __setplane_internal(struct drm_plane *plane,
2350 			       struct drm_crtc *crtc,
2351 			       struct drm_framebuffer *fb,
2352 			       int32_t crtc_x, int32_t crtc_y,
2353 			       uint32_t crtc_w, uint32_t crtc_h,
2354 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2355 			       uint32_t src_x, uint32_t src_y,
2356 			       uint32_t src_w, uint32_t src_h)
2357 {
2358 	int ret = 0;
2359 	unsigned int fb_width, fb_height;
2360 	unsigned int i;
2361 
2362 	/* No fb means shut it down */
2363 	if (!fb) {
2364 		plane->old_fb = plane->fb;
2365 		ret = plane->funcs->disable_plane(plane);
2366 		if (!ret) {
2367 			plane->crtc = NULL;
2368 			plane->fb = NULL;
2369 		} else {
2370 			plane->old_fb = NULL;
2371 		}
2372 		goto out;
2373 	}
2374 
2375 	/* Check whether this plane is usable on this CRTC */
2376 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2377 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2378 		ret = -EINVAL;
2379 		goto out;
2380 	}
2381 
2382 	/* Check whether this plane supports the fb pixel format. */
2383 	for (i = 0; i < plane->format_count; i++)
2384 		if (fb->pixel_format == plane->format_types[i])
2385 			break;
2386 	if (i == plane->format_count) {
2387 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2388 			      drm_get_format_name(fb->pixel_format));
2389 		ret = -EINVAL;
2390 		goto out;
2391 	}
2392 
2393 	fb_width = fb->width << 16;
2394 	fb_height = fb->height << 16;
2395 
2396 	/* Make sure source coordinates are inside the fb. */
2397 	if (src_w > fb_width ||
2398 	    src_x > fb_width - src_w ||
2399 	    src_h > fb_height ||
2400 	    src_y > fb_height - src_h) {
2401 		DRM_DEBUG_KMS("Invalid source coordinates "
2402 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2403 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2404 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2405 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2406 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2407 		ret = -ENOSPC;
2408 		goto out;
2409 	}
2410 
2411 	plane->old_fb = plane->fb;
2412 	ret = plane->funcs->update_plane(plane, crtc, fb,
2413 					 crtc_x, crtc_y, crtc_w, crtc_h,
2414 					 src_x, src_y, src_w, src_h);
2415 	if (!ret) {
2416 		plane->crtc = crtc;
2417 		plane->fb = fb;
2418 		fb = NULL;
2419 	} else {
2420 		plane->old_fb = NULL;
2421 	}
2422 
2423 out:
2424 	if (fb)
2425 		drm_framebuffer_unreference(fb);
2426 	if (plane->old_fb)
2427 		drm_framebuffer_unreference(plane->old_fb);
2428 	plane->old_fb = NULL;
2429 
2430 	return ret;
2431 }
2432 
2433 static int setplane_internal(struct drm_plane *plane,
2434 			     struct drm_crtc *crtc,
2435 			     struct drm_framebuffer *fb,
2436 			     int32_t crtc_x, int32_t crtc_y,
2437 			     uint32_t crtc_w, uint32_t crtc_h,
2438 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2439 			     uint32_t src_x, uint32_t src_y,
2440 			     uint32_t src_w, uint32_t src_h)
2441 {
2442 	int ret;
2443 
2444 	drm_modeset_lock_all(plane->dev);
2445 	ret = __setplane_internal(plane, crtc, fb,
2446 				  crtc_x, crtc_y, crtc_w, crtc_h,
2447 				  src_x, src_y, src_w, src_h);
2448 	drm_modeset_unlock_all(plane->dev);
2449 
2450 	return ret;
2451 }
2452 
2453 /**
2454  * drm_mode_setplane - configure a plane's configuration
2455  * @dev: DRM device
2456  * @data: ioctl data*
2457  * @file_priv: DRM file info
2458  *
2459  * Set plane configuration, including placement, fb, scaling, and other factors.
2460  * Or pass a NULL fb to disable (planes may be disabled without providing a
2461  * valid crtc).
2462  *
2463  * Returns:
2464  * Zero on success, negative errno on failure.
2465  */
2466 int drm_mode_setplane(struct drm_device *dev, void *data,
2467 		      struct drm_file *file_priv)
2468 {
2469 	struct drm_mode_set_plane *plane_req = data;
2470 	struct drm_plane *plane;
2471 	struct drm_crtc *crtc = NULL;
2472 	struct drm_framebuffer *fb = NULL;
2473 
2474 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2475 		return -EINVAL;
2476 
2477 	/* Give drivers some help against integer overflows */
2478 	if (plane_req->crtc_w > INT_MAX ||
2479 	    plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
2480 	    plane_req->crtc_h > INT_MAX ||
2481 	    plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
2482 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2483 			      plane_req->crtc_w, plane_req->crtc_h,
2484 			      plane_req->crtc_x, plane_req->crtc_y);
2485 		return -ERANGE;
2486 	}
2487 
2488 	/*
2489 	 * First, find the plane, crtc, and fb objects.  If not available,
2490 	 * we don't bother to call the driver.
2491 	 */
2492 	plane = drm_plane_find(dev, plane_req->plane_id);
2493 	if (!plane) {
2494 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2495 			      plane_req->plane_id);
2496 		return -ENOENT;
2497 	}
2498 
2499 	if (plane_req->fb_id) {
2500 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2501 		if (!fb) {
2502 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2503 				      plane_req->fb_id);
2504 			return -ENOENT;
2505 		}
2506 
2507 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2508 		if (!crtc) {
2509 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2510 				      plane_req->crtc_id);
2511 			return -ENOENT;
2512 		}
2513 	}
2514 
2515 	/*
2516 	 * setplane_internal will take care of deref'ing either the old or new
2517 	 * framebuffer depending on success.
2518 	 */
2519 	return setplane_internal(plane, crtc, fb,
2520 				 plane_req->crtc_x, plane_req->crtc_y,
2521 				 plane_req->crtc_w, plane_req->crtc_h,
2522 				 plane_req->src_x, plane_req->src_y,
2523 				 plane_req->src_w, plane_req->src_h);
2524 }
2525 
2526 /**
2527  * drm_mode_set_config_internal - helper to call ->set_config
2528  * @set: modeset config to set
2529  *
2530  * This is a little helper to wrap internal calls to the ->set_config driver
2531  * interface. The only thing it adds is correct refcounting dance.
2532  *
2533  * Returns:
2534  * Zero on success, negative errno on failure.
2535  */
2536 int drm_mode_set_config_internal(struct drm_mode_set *set)
2537 {
2538 	struct drm_crtc *crtc = set->crtc;
2539 	struct drm_framebuffer *fb;
2540 	struct drm_crtc *tmp;
2541 	int ret;
2542 
2543 	/*
2544 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2545 	 * connectors from it), hence we need to refcount the fbs across all
2546 	 * crtcs. Atomic modeset will have saner semantics ...
2547 	 */
2548 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head)
2549 		tmp->primary->old_fb = tmp->primary->fb;
2550 
2551 	fb = set->fb;
2552 
2553 	ret = crtc->funcs->set_config(set);
2554 	if (ret == 0) {
2555 		crtc->primary->crtc = crtc;
2556 		crtc->primary->fb = fb;
2557 	}
2558 
2559 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
2560 		if (tmp->primary->fb)
2561 			drm_framebuffer_reference(tmp->primary->fb);
2562 		if (tmp->primary->old_fb)
2563 			drm_framebuffer_unreference(tmp->primary->old_fb);
2564 		tmp->primary->old_fb = NULL;
2565 	}
2566 
2567 	return ret;
2568 }
2569 EXPORT_SYMBOL(drm_mode_set_config_internal);
2570 
2571 /**
2572  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2573  *     CRTC viewport
2574  * @crtc: CRTC that framebuffer will be displayed on
2575  * @x: x panning
2576  * @y: y panning
2577  * @mode: mode that framebuffer will be displayed under
2578  * @fb: framebuffer to check size of
2579  */
2580 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2581 			    int x, int y,
2582 			    const struct drm_display_mode *mode,
2583 			    const struct drm_framebuffer *fb)
2584 
2585 {
2586 	int hdisplay, vdisplay;
2587 
2588 	hdisplay = mode->hdisplay;
2589 	vdisplay = mode->vdisplay;
2590 
2591 	if (drm_mode_is_stereo(mode)) {
2592 		struct drm_display_mode adjusted = *mode;
2593 
2594 		drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE);
2595 		hdisplay = adjusted.crtc_hdisplay;
2596 		vdisplay = adjusted.crtc_vdisplay;
2597 	}
2598 
2599 	if (crtc->invert_dimensions)
2600 		swap(hdisplay, vdisplay);
2601 
2602 	if (hdisplay > fb->width ||
2603 	    vdisplay > fb->height ||
2604 	    x > fb->width - hdisplay ||
2605 	    y > fb->height - vdisplay) {
2606 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2607 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2608 			      crtc->invert_dimensions ? " (inverted)" : "");
2609 		return -ENOSPC;
2610 	}
2611 
2612 	return 0;
2613 }
2614 EXPORT_SYMBOL(drm_crtc_check_viewport);
2615 
2616 /**
2617  * drm_mode_setcrtc - set CRTC configuration
2618  * @dev: drm device for the ioctl
2619  * @data: data pointer for the ioctl
2620  * @file_priv: drm file for the ioctl call
2621  *
2622  * Build a new CRTC configuration based on user request.
2623  *
2624  * Called by the user via ioctl.
2625  *
2626  * Returns:
2627  * Zero on success, negative errno on failure.
2628  */
2629 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2630 		     struct drm_file *file_priv)
2631 {
2632 	struct drm_mode_config *config = &dev->mode_config;
2633 	struct drm_mode_crtc *crtc_req = data;
2634 	struct drm_crtc *crtc;
2635 	struct drm_connector **connector_set = NULL, *connector;
2636 	struct drm_framebuffer *fb = NULL;
2637 	struct drm_display_mode *mode = NULL;
2638 	struct drm_mode_set set;
2639 	uint32_t __user *set_connectors_ptr;
2640 	int ret;
2641 	int i;
2642 
2643 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2644 		return -EINVAL;
2645 
2646 	/* For some reason crtc x/y offsets are signed internally. */
2647 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
2648 		return -ERANGE;
2649 
2650 	drm_modeset_lock_all(dev);
2651 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2652 	if (!crtc) {
2653 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2654 		ret = -ENOENT;
2655 		goto out;
2656 	}
2657 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2658 
2659 	if (crtc_req->mode_valid) {
2660 		/* If we have a mode we need a framebuffer. */
2661 		/* If we pass -1, set the mode with the currently bound fb */
2662 		if (crtc_req->fb_id == -1) {
2663 			if (!crtc->primary->fb) {
2664 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2665 				ret = -EINVAL;
2666 				goto out;
2667 			}
2668 			fb = crtc->primary->fb;
2669 			/* Make refcounting symmetric with the lookup path. */
2670 			drm_framebuffer_reference(fb);
2671 		} else {
2672 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2673 			if (!fb) {
2674 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2675 						crtc_req->fb_id);
2676 				ret = -ENOENT;
2677 				goto out;
2678 			}
2679 		}
2680 
2681 		mode = drm_mode_create(dev);
2682 		if (!mode) {
2683 			ret = -ENOMEM;
2684 			goto out;
2685 		}
2686 
2687 		ret = drm_crtc_convert_umode(mode, &crtc_req->mode);
2688 		if (ret) {
2689 			DRM_DEBUG_KMS("Invalid mode\n");
2690 			goto out;
2691 		}
2692 
2693 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2694 
2695 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2696 					      mode, fb);
2697 		if (ret)
2698 			goto out;
2699 
2700 	}
2701 
2702 	if (crtc_req->count_connectors == 0 && mode) {
2703 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2704 		ret = -EINVAL;
2705 		goto out;
2706 	}
2707 
2708 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2709 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2710 			  crtc_req->count_connectors);
2711 		ret = -EINVAL;
2712 		goto out;
2713 	}
2714 
2715 	if (crtc_req->count_connectors > 0) {
2716 		u32 out_id;
2717 
2718 		/* Avoid unbounded kernel memory allocation */
2719 		if (crtc_req->count_connectors > config->num_connector) {
2720 			ret = -EINVAL;
2721 			goto out;
2722 		}
2723 
2724 		connector_set = kmalloc(crtc_req->count_connectors *
2725 					sizeof(struct drm_connector *),
2726 					GFP_KERNEL);
2727 		if (!connector_set) {
2728 			ret = -ENOMEM;
2729 			goto out;
2730 		}
2731 
2732 		for (i = 0; i < crtc_req->count_connectors; i++) {
2733 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2734 			if (get_user(out_id, &set_connectors_ptr[i])) {
2735 				ret = -EFAULT;
2736 				goto out;
2737 			}
2738 
2739 			connector = drm_connector_find(dev, out_id);
2740 			if (!connector) {
2741 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2742 						out_id);
2743 				ret = -ENOENT;
2744 				goto out;
2745 			}
2746 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2747 					connector->base.id,
2748 					connector->name);
2749 
2750 			connector_set[i] = connector;
2751 		}
2752 	}
2753 
2754 	set.crtc = crtc;
2755 	set.x = crtc_req->x;
2756 	set.y = crtc_req->y;
2757 	set.mode = mode;
2758 	set.connectors = connector_set;
2759 	set.num_connectors = crtc_req->count_connectors;
2760 	set.fb = fb;
2761 	ret = drm_mode_set_config_internal(&set);
2762 
2763 out:
2764 	if (fb)
2765 		drm_framebuffer_unreference(fb);
2766 
2767 	kfree(connector_set);
2768 	drm_mode_destroy(dev, mode);
2769 	drm_modeset_unlock_all(dev);
2770 	return ret;
2771 }
2772 
2773 /**
2774  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2775  *     universal plane handler call
2776  * @crtc: crtc to update cursor for
2777  * @req: data pointer for the ioctl
2778  * @file_priv: drm file for the ioctl call
2779  *
2780  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2781  * translate legacy ioctl calls into universal plane handler calls, we need to
2782  * wrap the native buffer handle in a drm_framebuffer.
2783  *
2784  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2785  * buffer with a pitch of 4*width; the universal plane interface should be used
2786  * directly in cases where the hardware can support other buffer settings and
2787  * userspace wants to make use of these capabilities.
2788  *
2789  * Returns:
2790  * Zero on success, negative errno on failure.
2791  */
2792 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2793 				     struct drm_mode_cursor2 *req,
2794 				     struct drm_file *file_priv)
2795 {
2796 	struct drm_device *dev = crtc->dev;
2797 	struct drm_framebuffer *fb = NULL;
2798 	struct drm_mode_fb_cmd2 fbreq = {
2799 		.width = req->width,
2800 		.height = req->height,
2801 		.pixel_format = DRM_FORMAT_ARGB8888,
2802 		.pitches = { req->width * 4 },
2803 		.handles = { req->handle },
2804 	};
2805 	int32_t crtc_x, crtc_y;
2806 	uint32_t crtc_w = 0, crtc_h = 0;
2807 	uint32_t src_w = 0, src_h = 0;
2808 	int ret = 0;
2809 
2810 	BUG_ON(!crtc->cursor);
2811 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2812 
2813 	/*
2814 	 * Obtain fb we'll be using (either new or existing) and take an extra
2815 	 * reference to it if fb != null.  setplane will take care of dropping
2816 	 * the reference if the plane update fails.
2817 	 */
2818 	if (req->flags & DRM_MODE_CURSOR_BO) {
2819 		if (req->handle) {
2820 			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
2821 			if (IS_ERR(fb)) {
2822 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2823 				return PTR_ERR(fb);
2824 			}
2825 
2826 			drm_framebuffer_reference(fb);
2827 		} else {
2828 			fb = NULL;
2829 		}
2830 	} else {
2831 		fb = crtc->cursor->fb;
2832 		if (fb)
2833 			drm_framebuffer_reference(fb);
2834 	}
2835 
2836 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2837 		crtc_x = req->x;
2838 		crtc_y = req->y;
2839 	} else {
2840 		crtc_x = crtc->cursor_x;
2841 		crtc_y = crtc->cursor_y;
2842 	}
2843 
2844 	if (fb) {
2845 		crtc_w = fb->width;
2846 		crtc_h = fb->height;
2847 		src_w = fb->width << 16;
2848 		src_h = fb->height << 16;
2849 	}
2850 
2851 	/*
2852 	 * setplane_internal will take care of deref'ing either the old or new
2853 	 * framebuffer depending on success.
2854 	 */
2855 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2856 				crtc_x, crtc_y, crtc_w, crtc_h,
2857 				0, 0, src_w, src_h);
2858 
2859 	/* Update successful; save new cursor position, if necessary */
2860 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2861 		crtc->cursor_x = req->x;
2862 		crtc->cursor_y = req->y;
2863 	}
2864 
2865 	return ret;
2866 }
2867 
2868 static int drm_mode_cursor_common(struct drm_device *dev,
2869 				  struct drm_mode_cursor2 *req,
2870 				  struct drm_file *file_priv)
2871 {
2872 	struct drm_crtc *crtc;
2873 	int ret = 0;
2874 
2875 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2876 		return -EINVAL;
2877 
2878 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2879 		return -EINVAL;
2880 
2881 	crtc = drm_crtc_find(dev, req->crtc_id);
2882 	if (!crtc) {
2883 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2884 		return -ENOENT;
2885 	}
2886 
2887 	/*
2888 	 * If this crtc has a universal cursor plane, call that plane's update
2889 	 * handler rather than using legacy cursor handlers.
2890 	 */
2891 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2892 	if (crtc->cursor) {
2893 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2894 		goto out;
2895 	}
2896 
2897 	if (req->flags & DRM_MODE_CURSOR_BO) {
2898 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2899 			ret = -ENXIO;
2900 			goto out;
2901 		}
2902 		/* Turns off the cursor if handle is 0 */
2903 		if (crtc->funcs->cursor_set2)
2904 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2905 						      req->width, req->height, req->hot_x, req->hot_y);
2906 		else
2907 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2908 						      req->width, req->height);
2909 	}
2910 
2911 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2912 		if (crtc->funcs->cursor_move) {
2913 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2914 		} else {
2915 			ret = -EFAULT;
2916 			goto out;
2917 		}
2918 	}
2919 out:
2920 	drm_modeset_unlock_crtc(crtc);
2921 
2922 	return ret;
2923 
2924 }
2925 
2926 
2927 /**
2928  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2929  * @dev: drm device for the ioctl
2930  * @data: data pointer for the ioctl
2931  * @file_priv: drm file for the ioctl call
2932  *
2933  * Set the cursor configuration based on user request.
2934  *
2935  * Called by the user via ioctl.
2936  *
2937  * Returns:
2938  * Zero on success, negative errno on failure.
2939  */
2940 int drm_mode_cursor_ioctl(struct drm_device *dev,
2941 			  void *data, struct drm_file *file_priv)
2942 {
2943 	struct drm_mode_cursor *req = data;
2944 	struct drm_mode_cursor2 new_req;
2945 
2946 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2947 	new_req.hot_x = new_req.hot_y = 0;
2948 
2949 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2950 }
2951 
2952 /**
2953  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2954  * @dev: drm device for the ioctl
2955  * @data: data pointer for the ioctl
2956  * @file_priv: drm file for the ioctl call
2957  *
2958  * Set the cursor configuration based on user request. This implements the 2nd
2959  * version of the cursor ioctl, which allows userspace to additionally specify
2960  * the hotspot of the pointer.
2961  *
2962  * Called by the user via ioctl.
2963  *
2964  * Returns:
2965  * Zero on success, negative errno on failure.
2966  */
2967 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2968 			   void *data, struct drm_file *file_priv)
2969 {
2970 	struct drm_mode_cursor2 *req = data;
2971 	return drm_mode_cursor_common(dev, req, file_priv);
2972 }
2973 
2974 /**
2975  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
2976  * @bpp: bits per pixels
2977  * @depth: bit depth per pixel
2978  *
2979  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
2980  * Useful in fbdev emulation code, since that deals in those values.
2981  */
2982 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
2983 {
2984 	uint32_t fmt;
2985 
2986 	switch (bpp) {
2987 	case 8:
2988 		fmt = DRM_FORMAT_C8;
2989 		break;
2990 	case 16:
2991 		if (depth == 15)
2992 			fmt = DRM_FORMAT_XRGB1555;
2993 		else
2994 			fmt = DRM_FORMAT_RGB565;
2995 		break;
2996 	case 24:
2997 		fmt = DRM_FORMAT_RGB888;
2998 		break;
2999 	case 32:
3000 		if (depth == 24)
3001 			fmt = DRM_FORMAT_XRGB8888;
3002 		else if (depth == 30)
3003 			fmt = DRM_FORMAT_XRGB2101010;
3004 		else
3005 			fmt = DRM_FORMAT_ARGB8888;
3006 		break;
3007 	default:
3008 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3009 		fmt = DRM_FORMAT_XRGB8888;
3010 		break;
3011 	}
3012 
3013 	return fmt;
3014 }
3015 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3016 
3017 /**
3018  * drm_mode_addfb - add an FB to the graphics configuration
3019  * @dev: drm device for the ioctl
3020  * @data: data pointer for the ioctl
3021  * @file_priv: drm file for the ioctl call
3022  *
3023  * Add a new FB to the specified CRTC, given a user request. This is the
3024  * original addfb ioctl which only supported RGB formats.
3025  *
3026  * Called by the user via ioctl.
3027  *
3028  * Returns:
3029  * Zero on success, negative errno on failure.
3030  */
3031 int drm_mode_addfb(struct drm_device *dev,
3032 		   void *data, struct drm_file *file_priv)
3033 {
3034 	struct drm_mode_fb_cmd *or = data;
3035 	struct drm_mode_fb_cmd2 r = {};
3036 	int ret;
3037 
3038 	/* convert to new format and call new ioctl */
3039 	r.fb_id = or->fb_id;
3040 	r.width = or->width;
3041 	r.height = or->height;
3042 	r.pitches[0] = or->pitch;
3043 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3044 	r.handles[0] = or->handle;
3045 
3046 	ret = drm_mode_addfb2(dev, &r, file_priv);
3047 	if (ret)
3048 		return ret;
3049 
3050 	or->fb_id = r.fb_id;
3051 
3052 	return 0;
3053 }
3054 
3055 static int format_check(const struct drm_mode_fb_cmd2 *r)
3056 {
3057 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3058 
3059 	switch (format) {
3060 	case DRM_FORMAT_C8:
3061 	case DRM_FORMAT_RGB332:
3062 	case DRM_FORMAT_BGR233:
3063 	case DRM_FORMAT_XRGB4444:
3064 	case DRM_FORMAT_XBGR4444:
3065 	case DRM_FORMAT_RGBX4444:
3066 	case DRM_FORMAT_BGRX4444:
3067 	case DRM_FORMAT_ARGB4444:
3068 	case DRM_FORMAT_ABGR4444:
3069 	case DRM_FORMAT_RGBA4444:
3070 	case DRM_FORMAT_BGRA4444:
3071 	case DRM_FORMAT_XRGB1555:
3072 	case DRM_FORMAT_XBGR1555:
3073 	case DRM_FORMAT_RGBX5551:
3074 	case DRM_FORMAT_BGRX5551:
3075 	case DRM_FORMAT_ARGB1555:
3076 	case DRM_FORMAT_ABGR1555:
3077 	case DRM_FORMAT_RGBA5551:
3078 	case DRM_FORMAT_BGRA5551:
3079 	case DRM_FORMAT_RGB565:
3080 	case DRM_FORMAT_BGR565:
3081 	case DRM_FORMAT_RGB888:
3082 	case DRM_FORMAT_BGR888:
3083 	case DRM_FORMAT_XRGB8888:
3084 	case DRM_FORMAT_XBGR8888:
3085 	case DRM_FORMAT_RGBX8888:
3086 	case DRM_FORMAT_BGRX8888:
3087 	case DRM_FORMAT_ARGB8888:
3088 	case DRM_FORMAT_ABGR8888:
3089 	case DRM_FORMAT_RGBA8888:
3090 	case DRM_FORMAT_BGRA8888:
3091 	case DRM_FORMAT_XRGB2101010:
3092 	case DRM_FORMAT_XBGR2101010:
3093 	case DRM_FORMAT_RGBX1010102:
3094 	case DRM_FORMAT_BGRX1010102:
3095 	case DRM_FORMAT_ARGB2101010:
3096 	case DRM_FORMAT_ABGR2101010:
3097 	case DRM_FORMAT_RGBA1010102:
3098 	case DRM_FORMAT_BGRA1010102:
3099 	case DRM_FORMAT_YUYV:
3100 	case DRM_FORMAT_YVYU:
3101 	case DRM_FORMAT_UYVY:
3102 	case DRM_FORMAT_VYUY:
3103 	case DRM_FORMAT_AYUV:
3104 	case DRM_FORMAT_NV12:
3105 	case DRM_FORMAT_NV21:
3106 	case DRM_FORMAT_NV16:
3107 	case DRM_FORMAT_NV61:
3108 	case DRM_FORMAT_NV24:
3109 	case DRM_FORMAT_NV42:
3110 	case DRM_FORMAT_YUV410:
3111 	case DRM_FORMAT_YVU410:
3112 	case DRM_FORMAT_YUV411:
3113 	case DRM_FORMAT_YVU411:
3114 	case DRM_FORMAT_YUV420:
3115 	case DRM_FORMAT_YVU420:
3116 	case DRM_FORMAT_YUV422:
3117 	case DRM_FORMAT_YVU422:
3118 	case DRM_FORMAT_YUV444:
3119 	case DRM_FORMAT_YVU444:
3120 		return 0;
3121 	default:
3122 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3123 			      drm_get_format_name(r->pixel_format));
3124 		return -EINVAL;
3125 	}
3126 }
3127 
3128 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3129 {
3130 	int ret, hsub, vsub, num_planes, i;
3131 
3132 	ret = format_check(r);
3133 	if (ret) {
3134 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3135 			      drm_get_format_name(r->pixel_format));
3136 		return ret;
3137 	}
3138 
3139 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3140 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3141 	num_planes = drm_format_num_planes(r->pixel_format);
3142 
3143 	if (r->width == 0 || r->width % hsub) {
3144 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3145 		return -EINVAL;
3146 	}
3147 
3148 	if (r->height == 0 || r->height % vsub) {
3149 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3150 		return -EINVAL;
3151 	}
3152 
3153 	for (i = 0; i < num_planes; i++) {
3154 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3155 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3156 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3157 
3158 		if (!r->handles[i]) {
3159 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3160 			return -EINVAL;
3161 		}
3162 
3163 		if ((uint64_t) width * cpp > UINT_MAX)
3164 			return -ERANGE;
3165 
3166 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3167 			return -ERANGE;
3168 
3169 		if (r->pitches[i] < width * cpp) {
3170 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3171 			return -EINVAL;
3172 		}
3173 	}
3174 
3175 	return 0;
3176 }
3177 
3178 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
3179 							struct drm_mode_fb_cmd2 *r,
3180 							struct drm_file *file_priv)
3181 {
3182 	struct drm_mode_config *config = &dev->mode_config;
3183 	struct drm_framebuffer *fb;
3184 	int ret;
3185 
3186 	if (r->flags & ~DRM_MODE_FB_INTERLACED) {
3187 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3188 		return ERR_PTR(-EINVAL);
3189 	}
3190 
3191 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3192 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3193 			  r->width, config->min_width, config->max_width);
3194 		return ERR_PTR(-EINVAL);
3195 	}
3196 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3197 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3198 			  r->height, config->min_height, config->max_height);
3199 		return ERR_PTR(-EINVAL);
3200 	}
3201 
3202 	ret = framebuffer_check(r);
3203 	if (ret)
3204 		return ERR_PTR(ret);
3205 
3206 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3207 	if (IS_ERR(fb)) {
3208 		DRM_DEBUG_KMS("could not create framebuffer\n");
3209 		return fb;
3210 	}
3211 
3212 	mutex_lock(&file_priv->fbs_lock);
3213 	r->fb_id = fb->base.id;
3214 	list_add(&fb->filp_head, &file_priv->fbs);
3215 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3216 	mutex_unlock(&file_priv->fbs_lock);
3217 
3218 	return fb;
3219 }
3220 
3221 /**
3222  * drm_mode_addfb2 - add an FB to the graphics configuration
3223  * @dev: drm device for the ioctl
3224  * @data: data pointer for the ioctl
3225  * @file_priv: drm file for the ioctl call
3226  *
3227  * Add a new FB to the specified CRTC, given a user request with format. This is
3228  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3229  * and uses fourcc codes as pixel format specifiers.
3230  *
3231  * Called by the user via ioctl.
3232  *
3233  * Returns:
3234  * Zero on success, negative errno on failure.
3235  */
3236 int drm_mode_addfb2(struct drm_device *dev,
3237 		    void *data, struct drm_file *file_priv)
3238 {
3239 	struct drm_framebuffer *fb;
3240 
3241 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3242 		return -EINVAL;
3243 
3244 	fb = add_framebuffer_internal(dev, data, file_priv);
3245 	if (IS_ERR(fb))
3246 		return PTR_ERR(fb);
3247 
3248 	return 0;
3249 }
3250 
3251 /**
3252  * drm_mode_rmfb - remove an FB from the configuration
3253  * @dev: drm device for the ioctl
3254  * @data: data pointer for the ioctl
3255  * @file_priv: drm file for the ioctl call
3256  *
3257  * Remove the FB specified by the user.
3258  *
3259  * Called by the user via ioctl.
3260  *
3261  * Returns:
3262  * Zero on success, negative errno on failure.
3263  */
3264 int drm_mode_rmfb(struct drm_device *dev,
3265 		   void *data, struct drm_file *file_priv)
3266 {
3267 	struct drm_framebuffer *fb = NULL;
3268 	struct drm_framebuffer *fbl = NULL;
3269 	uint32_t *id = data;
3270 	int found = 0;
3271 
3272 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3273 		return -EINVAL;
3274 
3275 	mutex_lock(&file_priv->fbs_lock);
3276 	mutex_lock(&dev->mode_config.fb_lock);
3277 	fb = __drm_framebuffer_lookup(dev, *id);
3278 	if (!fb)
3279 		goto fail_lookup;
3280 
3281 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3282 		if (fb == fbl)
3283 			found = 1;
3284 	if (!found)
3285 		goto fail_lookup;
3286 
3287 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3288 	__drm_framebuffer_unregister(dev, fb);
3289 
3290 	list_del_init(&fb->filp_head);
3291 	mutex_unlock(&dev->mode_config.fb_lock);
3292 	mutex_unlock(&file_priv->fbs_lock);
3293 
3294 	drm_framebuffer_remove(fb);
3295 
3296 	return 0;
3297 
3298 fail_lookup:
3299 	mutex_unlock(&dev->mode_config.fb_lock);
3300 	mutex_unlock(&file_priv->fbs_lock);
3301 
3302 	return -ENOENT;
3303 }
3304 
3305 /**
3306  * drm_mode_getfb - get FB info
3307  * @dev: drm device for the ioctl
3308  * @data: data pointer for the ioctl
3309  * @file_priv: drm file for the ioctl call
3310  *
3311  * Lookup the FB given its ID and return info about it.
3312  *
3313  * Called by the user via ioctl.
3314  *
3315  * Returns:
3316  * Zero on success, negative errno on failure.
3317  */
3318 int drm_mode_getfb(struct drm_device *dev,
3319 		   void *data, struct drm_file *file_priv)
3320 {
3321 	struct drm_mode_fb_cmd *r = data;
3322 	struct drm_framebuffer *fb;
3323 	int ret;
3324 
3325 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3326 		return -EINVAL;
3327 
3328 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3329 	if (!fb)
3330 		return -ENOENT;
3331 
3332 	r->height = fb->height;
3333 	r->width = fb->width;
3334 	r->depth = fb->depth;
3335 	r->bpp = fb->bits_per_pixel;
3336 	r->pitch = fb->pitches[0];
3337 	if (fb->funcs->create_handle) {
3338 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3339 		    drm_is_control_client(file_priv)) {
3340 			ret = fb->funcs->create_handle(fb, file_priv,
3341 						       &r->handle);
3342 		} else {
3343 			/* GET_FB() is an unprivileged ioctl so we must not
3344 			 * return a buffer-handle to non-master processes! For
3345 			 * backwards-compatibility reasons, we cannot make
3346 			 * GET_FB() privileged, so just return an invalid handle
3347 			 * for non-masters. */
3348 			r->handle = 0;
3349 			ret = 0;
3350 		}
3351 	} else {
3352 		ret = -ENODEV;
3353 	}
3354 
3355 	drm_framebuffer_unreference(fb);
3356 
3357 	return ret;
3358 }
3359 
3360 /**
3361  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3362  * @dev: drm device for the ioctl
3363  * @data: data pointer for the ioctl
3364  * @file_priv: drm file for the ioctl call
3365  *
3366  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3367  * rectangle list. Generic userspace which does frontbuffer rendering must call
3368  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3369  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3370  *
3371  * Modesetting drivers which always update the frontbuffer do not need to
3372  * implement the corresponding ->dirty framebuffer callback.
3373  *
3374  * Called by the user via ioctl.
3375  *
3376  * Returns:
3377  * Zero on success, negative errno on failure.
3378  */
3379 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3380 			   void *data, struct drm_file *file_priv)
3381 {
3382 	struct drm_clip_rect __user *clips_ptr;
3383 	struct drm_clip_rect *clips = NULL;
3384 	struct drm_mode_fb_dirty_cmd *r = data;
3385 	struct drm_framebuffer *fb;
3386 	unsigned flags;
3387 	int num_clips;
3388 	int ret;
3389 
3390 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3391 		return -EINVAL;
3392 
3393 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3394 	if (!fb)
3395 		return -ENOENT;
3396 
3397 	num_clips = r->num_clips;
3398 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3399 
3400 	if (!num_clips != !clips_ptr) {
3401 		ret = -EINVAL;
3402 		goto out_err1;
3403 	}
3404 
3405 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3406 
3407 	/* If userspace annotates copy, clips must come in pairs */
3408 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3409 		ret = -EINVAL;
3410 		goto out_err1;
3411 	}
3412 
3413 	if (num_clips && clips_ptr) {
3414 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3415 			ret = -EINVAL;
3416 			goto out_err1;
3417 		}
3418 		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
3419 		if (!clips) {
3420 			ret = -ENOMEM;
3421 			goto out_err1;
3422 		}
3423 
3424 		ret = copy_from_user(clips, clips_ptr,
3425 				     num_clips * sizeof(*clips));
3426 		if (ret) {
3427 			ret = -EFAULT;
3428 			goto out_err2;
3429 		}
3430 	}
3431 
3432 	if (fb->funcs->dirty) {
3433 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3434 				       clips, num_clips);
3435 	} else {
3436 		ret = -ENOSYS;
3437 	}
3438 
3439 out_err2:
3440 	kfree(clips);
3441 out_err1:
3442 	drm_framebuffer_unreference(fb);
3443 
3444 	return ret;
3445 }
3446 
3447 
3448 /**
3449  * drm_fb_release - remove and free the FBs on this file
3450  * @priv: drm file for the ioctl
3451  *
3452  * Destroy all the FBs associated with @filp.
3453  *
3454  * Called by the user via ioctl.
3455  *
3456  * Returns:
3457  * Zero on success, negative errno on failure.
3458  */
3459 void drm_fb_release(struct drm_file *priv)
3460 {
3461 	struct drm_device *dev = priv->minor->dev;
3462 	struct drm_framebuffer *fb, *tfb;
3463 
3464 	/*
3465 	 * When the file gets released that means no one else can access the fb
3466 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3467 	 * avoid upsetting lockdep since the universal cursor code adds a
3468 	 * framebuffer while holding mutex locks.
3469 	 *
3470 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3471 	 * locks is impossible here since no one else but this function can get
3472 	 * at it any more.
3473 	 */
3474 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3475 
3476 		mutex_lock(&dev->mode_config.fb_lock);
3477 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3478 		__drm_framebuffer_unregister(dev, fb);
3479 		mutex_unlock(&dev->mode_config.fb_lock);
3480 
3481 		list_del_init(&fb->filp_head);
3482 
3483 		/* This will also drop the fpriv->fbs reference. */
3484 		drm_framebuffer_remove(fb);
3485 	}
3486 }
3487 
3488 /**
3489  * drm_property_create - create a new property type
3490  * @dev: drm device
3491  * @flags: flags specifying the property type
3492  * @name: name of the property
3493  * @num_values: number of pre-defined values
3494  *
3495  * This creates a new generic drm property which can then be attached to a drm
3496  * object with drm_object_attach_property. The returned property object must be
3497  * freed with drm_property_destroy.
3498  *
3499  * Note that the DRM core keeps a per-device list of properties and that, if
3500  * drm_mode_config_cleanup() is called, it will destroy all properties created
3501  * by the driver.
3502  *
3503  * Returns:
3504  * A pointer to the newly created property on success, NULL on failure.
3505  */
3506 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3507 					 const char *name, int num_values)
3508 {
3509 	struct drm_property *property = NULL;
3510 	int ret;
3511 
3512 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3513 	if (!property)
3514 		return NULL;
3515 
3516 	property->dev = dev;
3517 
3518 	if (num_values) {
3519 		property->values = kzalloc(sizeof(uint64_t)*num_values, GFP_KERNEL);
3520 		if (!property->values)
3521 			goto fail;
3522 	}
3523 
3524 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3525 	if (ret)
3526 		goto fail;
3527 
3528 	property->flags = flags;
3529 	property->num_values = num_values;
3530 	INIT_LIST_HEAD(&property->enum_list);
3531 
3532 	if (name) {
3533 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3534 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3535 	}
3536 
3537 	list_add_tail(&property->head, &dev->mode_config.property_list);
3538 
3539 	WARN_ON(!drm_property_type_valid(property));
3540 
3541 	return property;
3542 fail:
3543 	kfree(property->values);
3544 	kfree(property);
3545 	return NULL;
3546 }
3547 EXPORT_SYMBOL(drm_property_create);
3548 
3549 /**
3550  * drm_property_create_enum - create a new enumeration property type
3551  * @dev: drm device
3552  * @flags: flags specifying the property type
3553  * @name: name of the property
3554  * @props: enumeration lists with property values
3555  * @num_values: number of pre-defined values
3556  *
3557  * This creates a new generic drm property which can then be attached to a drm
3558  * object with drm_object_attach_property. The returned property object must be
3559  * freed with drm_property_destroy.
3560  *
3561  * Userspace is only allowed to set one of the predefined values for enumeration
3562  * properties.
3563  *
3564  * Returns:
3565  * A pointer to the newly created property on success, NULL on failure.
3566  */
3567 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3568 					 const char *name,
3569 					 const struct drm_prop_enum_list *props,
3570 					 int num_values)
3571 {
3572 	struct drm_property *property;
3573 	int i, ret;
3574 
3575 	flags |= DRM_MODE_PROP_ENUM;
3576 
3577 	property = drm_property_create(dev, flags, name, num_values);
3578 	if (!property)
3579 		return NULL;
3580 
3581 	for (i = 0; i < num_values; i++) {
3582 		ret = drm_property_add_enum(property, i,
3583 				      props[i].type,
3584 				      props[i].name);
3585 		if (ret) {
3586 			drm_property_destroy(dev, property);
3587 			return NULL;
3588 		}
3589 	}
3590 
3591 	return property;
3592 }
3593 EXPORT_SYMBOL(drm_property_create_enum);
3594 
3595 /**
3596  * drm_property_create_bitmask - create a new bitmask property type
3597  * @dev: drm device
3598  * @flags: flags specifying the property type
3599  * @name: name of the property
3600  * @props: enumeration lists with property bitflags
3601  * @num_props: size of the @props array
3602  * @supported_bits: bitmask of all supported enumeration values
3603  *
3604  * This creates a new bitmask drm property which can then be attached to a drm
3605  * object with drm_object_attach_property. The returned property object must be
3606  * freed with drm_property_destroy.
3607  *
3608  * Compared to plain enumeration properties userspace is allowed to set any
3609  * or'ed together combination of the predefined property bitflag values
3610  *
3611  * Returns:
3612  * A pointer to the newly created property on success, NULL on failure.
3613  */
3614 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3615 					 int flags, const char *name,
3616 					 const struct drm_prop_enum_list *props,
3617 					 int num_props,
3618 					 uint64_t supported_bits)
3619 {
3620 	struct drm_property *property;
3621 	int i, ret, index = 0;
3622 	int num_values = hweight64(supported_bits);
3623 
3624 	flags |= DRM_MODE_PROP_BITMASK;
3625 
3626 	property = drm_property_create(dev, flags, name, num_values);
3627 	if (!property)
3628 		return NULL;
3629 	for (i = 0; i < num_props; i++) {
3630 		if (!(supported_bits & (1ULL << props[i].type)))
3631 			continue;
3632 
3633 		if (WARN_ON(index >= num_values)) {
3634 			drm_property_destroy(dev, property);
3635 			return NULL;
3636 		}
3637 
3638 		ret = drm_property_add_enum(property, index++,
3639 				      props[i].type,
3640 				      props[i].name);
3641 		if (ret) {
3642 			drm_property_destroy(dev, property);
3643 			return NULL;
3644 		}
3645 	}
3646 
3647 	return property;
3648 }
3649 EXPORT_SYMBOL(drm_property_create_bitmask);
3650 
3651 static struct drm_property *property_create_range(struct drm_device *dev,
3652 					 int flags, const char *name,
3653 					 uint64_t min, uint64_t max)
3654 {
3655 	struct drm_property *property;
3656 
3657 	property = drm_property_create(dev, flags, name, 2);
3658 	if (!property)
3659 		return NULL;
3660 
3661 	property->values[0] = min;
3662 	property->values[1] = max;
3663 
3664 	return property;
3665 }
3666 
3667 /**
3668  * drm_property_create_range - create a new ranged property type
3669  * @dev: drm device
3670  * @flags: flags specifying the property type
3671  * @name: name of the property
3672  * @min: minimum value of the property
3673  * @max: maximum value of the property
3674  *
3675  * This creates a new generic drm property which can then be attached to a drm
3676  * object with drm_object_attach_property. The returned property object must be
3677  * freed with drm_property_destroy.
3678  *
3679  * Userspace is allowed to set any integer value in the (min, max) range
3680  * inclusive.
3681  *
3682  * Returns:
3683  * A pointer to the newly created property on success, NULL on failure.
3684  */
3685 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3686 					 const char *name,
3687 					 uint64_t min, uint64_t max)
3688 {
3689 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3690 			name, min, max);
3691 }
3692 EXPORT_SYMBOL(drm_property_create_range);
3693 
3694 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3695 					 int flags, const char *name,
3696 					 int64_t min, int64_t max)
3697 {
3698 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3699 			name, I642U64(min), I642U64(max));
3700 }
3701 EXPORT_SYMBOL(drm_property_create_signed_range);
3702 
3703 struct drm_property *drm_property_create_object(struct drm_device *dev,
3704 					 int flags, const char *name, uint32_t type)
3705 {
3706 	struct drm_property *property;
3707 
3708 	flags |= DRM_MODE_PROP_OBJECT;
3709 
3710 	property = drm_property_create(dev, flags, name, 1);
3711 	if (!property)
3712 		return NULL;
3713 
3714 	property->values[0] = type;
3715 
3716 	return property;
3717 }
3718 EXPORT_SYMBOL(drm_property_create_object);
3719 
3720 /**
3721  * drm_property_add_enum - add a possible value to an enumeration property
3722  * @property: enumeration property to change
3723  * @index: index of the new enumeration
3724  * @value: value of the new enumeration
3725  * @name: symbolic name of the new enumeration
3726  *
3727  * This functions adds enumerations to a property.
3728  *
3729  * It's use is deprecated, drivers should use one of the more specific helpers
3730  * to directly create the property with all enumerations already attached.
3731  *
3732  * Returns:
3733  * Zero on success, error code on failure.
3734  */
3735 int drm_property_add_enum(struct drm_property *property, int index,
3736 			  uint64_t value, const char *name)
3737 {
3738 	struct drm_property_enum *prop_enum;
3739 
3740 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3741 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3742 		return -EINVAL;
3743 
3744 	/*
3745 	 * Bitmask enum properties have the additional constraint of values
3746 	 * from 0 to 63
3747 	 */
3748 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3749 			(value > 63))
3750 		return -EINVAL;
3751 
3752 	if (!list_empty(&property->enum_list)) {
3753 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3754 			if (prop_enum->value == value) {
3755 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3756 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3757 				return 0;
3758 			}
3759 		}
3760 	}
3761 
3762 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3763 	if (!prop_enum)
3764 		return -ENOMEM;
3765 
3766 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3767 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3768 	prop_enum->value = value;
3769 
3770 	property->values[index] = value;
3771 	list_add_tail(&prop_enum->head, &property->enum_list);
3772 	return 0;
3773 }
3774 EXPORT_SYMBOL(drm_property_add_enum);
3775 
3776 /**
3777  * drm_property_destroy - destroy a drm property
3778  * @dev: drm device
3779  * @property: property to destry
3780  *
3781  * This function frees a property including any attached resources like
3782  * enumeration values.
3783  */
3784 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3785 {
3786 	struct drm_property_enum *prop_enum, *pt;
3787 
3788 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3789 		list_del(&prop_enum->head);
3790 		kfree(prop_enum);
3791 	}
3792 
3793 	if (property->num_values)
3794 		kfree(property->values);
3795 	drm_mode_object_put(dev, &property->base);
3796 	list_del(&property->head);
3797 	kfree(property);
3798 }
3799 EXPORT_SYMBOL(drm_property_destroy);
3800 
3801 /**
3802  * drm_object_attach_property - attach a property to a modeset object
3803  * @obj: drm modeset object
3804  * @property: property to attach
3805  * @init_val: initial value of the property
3806  *
3807  * This attaches the given property to the modeset object with the given initial
3808  * value. Currently this function cannot fail since the properties are stored in
3809  * a statically sized array.
3810  */
3811 void drm_object_attach_property(struct drm_mode_object *obj,
3812 				struct drm_property *property,
3813 				uint64_t init_val)
3814 {
3815 	int count = obj->properties->count;
3816 
3817 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3818 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3819 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3820 			"you see this message on the same object type.\n",
3821 			obj->type);
3822 		return;
3823 	}
3824 
3825 	obj->properties->ids[count] = property->base.id;
3826 	obj->properties->values[count] = init_val;
3827 	obj->properties->count++;
3828 }
3829 EXPORT_SYMBOL(drm_object_attach_property);
3830 
3831 /**
3832  * drm_object_property_set_value - set the value of a property
3833  * @obj: drm mode object to set property value for
3834  * @property: property to set
3835  * @val: value the property should be set to
3836  *
3837  * This functions sets a given property on a given object. This function only
3838  * changes the software state of the property, it does not call into the
3839  * driver's ->set_property callback.
3840  *
3841  * Returns:
3842  * Zero on success, error code on failure.
3843  */
3844 int drm_object_property_set_value(struct drm_mode_object *obj,
3845 				  struct drm_property *property, uint64_t val)
3846 {
3847 	int i;
3848 
3849 	for (i = 0; i < obj->properties->count; i++) {
3850 		if (obj->properties->ids[i] == property->base.id) {
3851 			obj->properties->values[i] = val;
3852 			return 0;
3853 		}
3854 	}
3855 
3856 	return -EINVAL;
3857 }
3858 EXPORT_SYMBOL(drm_object_property_set_value);
3859 
3860 /**
3861  * drm_object_property_get_value - retrieve the value of a property
3862  * @obj: drm mode object to get property value from
3863  * @property: property to retrieve
3864  * @val: storage for the property value
3865  *
3866  * This function retrieves the softare state of the given property for the given
3867  * property. Since there is no driver callback to retrieve the current property
3868  * value this might be out of sync with the hardware, depending upon the driver
3869  * and property.
3870  *
3871  * Returns:
3872  * Zero on success, error code on failure.
3873  */
3874 int drm_object_property_get_value(struct drm_mode_object *obj,
3875 				  struct drm_property *property, uint64_t *val)
3876 {
3877 	int i;
3878 
3879 	for (i = 0; i < obj->properties->count; i++) {
3880 		if (obj->properties->ids[i] == property->base.id) {
3881 			*val = obj->properties->values[i];
3882 			return 0;
3883 		}
3884 	}
3885 
3886 	return -EINVAL;
3887 }
3888 EXPORT_SYMBOL(drm_object_property_get_value);
3889 
3890 /**
3891  * drm_mode_getproperty_ioctl - get the property metadata
3892  * @dev: DRM device
3893  * @data: ioctl data
3894  * @file_priv: DRM file info
3895  *
3896  * This function retrieves the metadata for a given property, like the different
3897  * possible values for an enum property or the limits for a range property.
3898  *
3899  * Blob properties are special
3900  *
3901  * Called by the user via ioctl.
3902  *
3903  * Returns:
3904  * Zero on success, negative errno on failure.
3905  */
3906 int drm_mode_getproperty_ioctl(struct drm_device *dev,
3907 			       void *data, struct drm_file *file_priv)
3908 {
3909 	struct drm_mode_get_property *out_resp = data;
3910 	struct drm_property *property;
3911 	int enum_count = 0;
3912 	int value_count = 0;
3913 	int ret = 0, i;
3914 	int copied;
3915 	struct drm_property_enum *prop_enum;
3916 	struct drm_mode_property_enum __user *enum_ptr;
3917 	uint64_t __user *values_ptr;
3918 
3919 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3920 		return -EINVAL;
3921 
3922 	drm_modeset_lock_all(dev);
3923 	property = drm_property_find(dev, out_resp->prop_id);
3924 	if (!property) {
3925 		ret = -ENOENT;
3926 		goto done;
3927 	}
3928 
3929 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3930 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3931 		list_for_each_entry(prop_enum, &property->enum_list, head)
3932 			enum_count++;
3933 	}
3934 
3935 	value_count = property->num_values;
3936 
3937 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
3938 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
3939 	out_resp->flags = property->flags;
3940 
3941 	if ((out_resp->count_values >= value_count) && value_count) {
3942 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
3943 		for (i = 0; i < value_count; i++) {
3944 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
3945 				ret = -EFAULT;
3946 				goto done;
3947 			}
3948 		}
3949 	}
3950 	out_resp->count_values = value_count;
3951 
3952 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3953 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3954 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
3955 			copied = 0;
3956 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
3957 			list_for_each_entry(prop_enum, &property->enum_list, head) {
3958 
3959 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
3960 					ret = -EFAULT;
3961 					goto done;
3962 				}
3963 
3964 				if (copy_to_user(&enum_ptr[copied].name,
3965 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
3966 					ret = -EFAULT;
3967 					goto done;
3968 				}
3969 				copied++;
3970 			}
3971 		}
3972 		out_resp->count_enum_blobs = enum_count;
3973 	}
3974 
3975 	/*
3976 	 * NOTE: The idea seems to have been to use this to read all the blob
3977 	 * property values. But nothing ever added them to the corresponding
3978 	 * list, userspace always used the special-purpose get_blob ioctl to
3979 	 * read the value for a blob property. It also doesn't make a lot of
3980 	 * sense to return values here when everything else is just metadata for
3981 	 * the property itself.
3982 	 */
3983 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
3984 		out_resp->count_enum_blobs = 0;
3985 done:
3986 	drm_modeset_unlock_all(dev);
3987 	return ret;
3988 }
3989 
3990 static struct drm_property_blob *
3991 drm_property_create_blob(struct drm_device *dev, size_t length,
3992 			 const void *data)
3993 {
3994 	struct drm_property_blob *blob;
3995 	int ret;
3996 
3997 	if (!length || !data)
3998 		return NULL;
3999 
4000 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4001 	if (!blob)
4002 		return NULL;
4003 
4004 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4005 	if (ret) {
4006 		kfree(blob);
4007 		return NULL;
4008 	}
4009 
4010 	blob->length = length;
4011 
4012 	memcpy(blob->data, data, length);
4013 
4014 	list_add_tail(&blob->head, &dev->mode_config.property_blob_list);
4015 	return blob;
4016 }
4017 
4018 static void drm_property_destroy_blob(struct drm_device *dev,
4019 			       struct drm_property_blob *blob)
4020 {
4021 	drm_mode_object_put(dev, &blob->base);
4022 	list_del(&blob->head);
4023 	kfree(blob);
4024 }
4025 
4026 /**
4027  * drm_mode_getblob_ioctl - get the contents of a blob property value
4028  * @dev: DRM device
4029  * @data: ioctl data
4030  * @file_priv: DRM file info
4031  *
4032  * This function retrieves the contents of a blob property. The value stored in
4033  * an object's blob property is just a normal modeset object id.
4034  *
4035  * Called by the user via ioctl.
4036  *
4037  * Returns:
4038  * Zero on success, negative errno on failure.
4039  */
4040 int drm_mode_getblob_ioctl(struct drm_device *dev,
4041 			   void *data, struct drm_file *file_priv)
4042 {
4043 	struct drm_mode_get_blob *out_resp = data;
4044 	struct drm_property_blob *blob;
4045 	int ret = 0;
4046 	void __user *blob_ptr;
4047 
4048 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4049 		return -EINVAL;
4050 
4051 	drm_modeset_lock_all(dev);
4052 	blob = drm_property_blob_find(dev, out_resp->blob_id);
4053 	if (!blob) {
4054 		ret = -ENOENT;
4055 		goto done;
4056 	}
4057 
4058 	if (out_resp->length == blob->length) {
4059 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4060 		if (copy_to_user(blob_ptr, blob->data, blob->length)){
4061 			ret = -EFAULT;
4062 			goto done;
4063 		}
4064 	}
4065 	out_resp->length = blob->length;
4066 
4067 done:
4068 	drm_modeset_unlock_all(dev);
4069 	return ret;
4070 }
4071 
4072 /**
4073  * drm_mode_connector_set_path_property - set tile property on connector
4074  * @connector: connector to set property on.
4075  * @path: path to use for property.
4076  *
4077  * This creates a property to expose to userspace to specify a
4078  * connector path. This is mainly used for DisplayPort MST where
4079  * connectors have a topology and we want to allow userspace to give
4080  * them more meaningful names.
4081  *
4082  * Returns:
4083  * Zero on success, negative errno on failure.
4084  */
4085 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4086 					 const char *path)
4087 {
4088 	struct drm_device *dev = connector->dev;
4089 	size_t size = strlen(path) + 1;
4090 	int ret;
4091 
4092 	connector->path_blob_ptr = drm_property_create_blob(connector->dev,
4093 							    size, path);
4094 	if (!connector->path_blob_ptr)
4095 		return -EINVAL;
4096 
4097 	ret = drm_object_property_set_value(&connector->base,
4098 					    dev->mode_config.path_property,
4099 					    connector->path_blob_ptr->base.id);
4100 	return ret;
4101 }
4102 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4103 
4104 /**
4105  * drm_mode_connector_set_tile_property - set tile property on connector
4106  * @connector: connector to set property on.
4107  *
4108  * This looks up the tile information for a connector, and creates a
4109  * property for userspace to parse if it exists. The property is of
4110  * the form of 8 integers using ':' as a separator.
4111  *
4112  * Returns:
4113  * Zero on success, errno on failure.
4114  */
4115 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4116 {
4117 	struct drm_device *dev = connector->dev;
4118 	int ret, size;
4119 	char tile[256];
4120 
4121 	if (connector->tile_blob_ptr)
4122 		drm_property_destroy_blob(dev, connector->tile_blob_ptr);
4123 
4124 	if (!connector->has_tile) {
4125 		connector->tile_blob_ptr = NULL;
4126 		ret = drm_object_property_set_value(&connector->base,
4127 						    dev->mode_config.tile_property, 0);
4128 		return ret;
4129 	}
4130 
4131 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4132 		 connector->tile_group->id, connector->tile_is_single_monitor,
4133 		 connector->num_h_tile, connector->num_v_tile,
4134 		 connector->tile_h_loc, connector->tile_v_loc,
4135 		 connector->tile_h_size, connector->tile_v_size);
4136 	size = strlen(tile) + 1;
4137 
4138 	connector->tile_blob_ptr = drm_property_create_blob(connector->dev,
4139 							    size, tile);
4140 	if (!connector->tile_blob_ptr)
4141 		return -EINVAL;
4142 
4143 	ret = drm_object_property_set_value(&connector->base,
4144 					    dev->mode_config.tile_property,
4145 					    connector->tile_blob_ptr->base.id);
4146 	return ret;
4147 }
4148 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4149 
4150 /**
4151  * drm_mode_connector_update_edid_property - update the edid property of a connector
4152  * @connector: drm connector
4153  * @edid: new value of the edid property
4154  *
4155  * This function creates a new blob modeset object and assigns its id to the
4156  * connector's edid property.
4157  *
4158  * Returns:
4159  * Zero on success, negative errno on failure.
4160  */
4161 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4162 					    const struct edid *edid)
4163 {
4164 	struct drm_device *dev = connector->dev;
4165 	size_t size;
4166 	int ret;
4167 
4168 	/* ignore requests to set edid when overridden */
4169 	if (connector->override_edid)
4170 		return 0;
4171 
4172 	if (connector->edid_blob_ptr)
4173 		drm_property_destroy_blob(dev, connector->edid_blob_ptr);
4174 
4175 	/* Delete edid, when there is none. */
4176 	if (!edid) {
4177 		connector->edid_blob_ptr = NULL;
4178 		ret = drm_object_property_set_value(&connector->base, dev->mode_config.edid_property, 0);
4179 		return ret;
4180 	}
4181 
4182 	size = EDID_LENGTH * (1 + edid->extensions);
4183 	connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
4184 							    size, edid);
4185 	if (!connector->edid_blob_ptr)
4186 		return -EINVAL;
4187 
4188 	ret = drm_object_property_set_value(&connector->base,
4189 					       dev->mode_config.edid_property,
4190 					       connector->edid_blob_ptr->base.id);
4191 
4192 	return ret;
4193 }
4194 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4195 
4196 static bool drm_property_change_is_valid(struct drm_property *property,
4197 					 uint64_t value)
4198 {
4199 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4200 		return false;
4201 
4202 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4203 		if (value < property->values[0] || value > property->values[1])
4204 			return false;
4205 		return true;
4206 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4207 		int64_t svalue = U642I64(value);
4208 		if (svalue < U642I64(property->values[0]) ||
4209 				svalue > U642I64(property->values[1]))
4210 			return false;
4211 		return true;
4212 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4213 		int i;
4214 		uint64_t valid_mask = 0;
4215 		for (i = 0; i < property->num_values; i++)
4216 			valid_mask |= (1ULL << property->values[i]);
4217 		return !(value & ~valid_mask);
4218 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4219 		/* Only the driver knows */
4220 		return true;
4221 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4222 		struct drm_mode_object *obj;
4223 		/* a zero value for an object property translates to null: */
4224 		if (value == 0)
4225 			return true;
4226 		/*
4227 		 * NOTE: use _object_find() directly to bypass restriction on
4228 		 * looking up refcnt'd objects (ie. fb's).  For a refcnt'd
4229 		 * object this could race against object finalization, so it
4230 		 * simply tells us that the object *was* valid.  Which is good
4231 		 * enough.
4232 		 */
4233 		obj = _object_find(property->dev, value, property->values[0]);
4234 		return obj != NULL;
4235 	} else {
4236 		int i;
4237 		for (i = 0; i < property->num_values; i++)
4238 			if (property->values[i] == value)
4239 				return true;
4240 		return false;
4241 	}
4242 }
4243 
4244 /**
4245  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4246  * @dev: DRM device
4247  * @data: ioctl data
4248  * @file_priv: DRM file info
4249  *
4250  * This function sets the current value for a connectors's property. It also
4251  * calls into a driver's ->set_property callback to update the hardware state
4252  *
4253  * Called by the user via ioctl.
4254  *
4255  * Returns:
4256  * Zero on success, negative errno on failure.
4257  */
4258 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4259 				       void *data, struct drm_file *file_priv)
4260 {
4261 	struct drm_mode_connector_set_property *conn_set_prop = data;
4262 	struct drm_mode_obj_set_property obj_set_prop = {
4263 		.value = conn_set_prop->value,
4264 		.prop_id = conn_set_prop->prop_id,
4265 		.obj_id = conn_set_prop->connector_id,
4266 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4267 	};
4268 
4269 	/* It does all the locking and checking we need */
4270 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4271 }
4272 
4273 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4274 					   struct drm_property *property,
4275 					   uint64_t value)
4276 {
4277 	int ret = -EINVAL;
4278 	struct drm_connector *connector = obj_to_connector(obj);
4279 
4280 	/* Do DPMS ourselves */
4281 	if (property == connector->dev->mode_config.dpms_property) {
4282 		if (connector->funcs->dpms)
4283 			(*connector->funcs->dpms)(connector, (int)value);
4284 		ret = 0;
4285 	} else if (connector->funcs->set_property)
4286 		ret = connector->funcs->set_property(connector, property, value);
4287 
4288 	/* store the property value if successful */
4289 	if (!ret)
4290 		drm_object_property_set_value(&connector->base, property, value);
4291 	return ret;
4292 }
4293 
4294 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4295 				      struct drm_property *property,
4296 				      uint64_t value)
4297 {
4298 	int ret = -EINVAL;
4299 	struct drm_crtc *crtc = obj_to_crtc(obj);
4300 
4301 	if (crtc->funcs->set_property)
4302 		ret = crtc->funcs->set_property(crtc, property, value);
4303 	if (!ret)
4304 		drm_object_property_set_value(obj, property, value);
4305 
4306 	return ret;
4307 }
4308 
4309 /**
4310  * drm_mode_plane_set_obj_prop - set the value of a property
4311  * @plane: drm plane object to set property value for
4312  * @property: property to set
4313  * @value: value the property should be set to
4314  *
4315  * This functions sets a given property on a given plane object. This function
4316  * calls the driver's ->set_property callback and changes the software state of
4317  * the property if the callback succeeds.
4318  *
4319  * Returns:
4320  * Zero on success, error code on failure.
4321  */
4322 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4323 				struct drm_property *property,
4324 				uint64_t value)
4325 {
4326 	int ret = -EINVAL;
4327 	struct drm_mode_object *obj = &plane->base;
4328 
4329 	if (plane->funcs->set_property)
4330 		ret = plane->funcs->set_property(plane, property, value);
4331 	if (!ret)
4332 		drm_object_property_set_value(obj, property, value);
4333 
4334 	return ret;
4335 }
4336 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4337 
4338 /**
4339  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4340  * @dev: DRM device
4341  * @data: ioctl data
4342  * @file_priv: DRM file info
4343  *
4344  * This function retrieves the current value for an object's property. Compared
4345  * to the connector specific ioctl this one is extended to also work on crtc and
4346  * plane objects.
4347  *
4348  * Called by the user via ioctl.
4349  *
4350  * Returns:
4351  * Zero on success, negative errno on failure.
4352  */
4353 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4354 				      struct drm_file *file_priv)
4355 {
4356 	struct drm_mode_obj_get_properties *arg = data;
4357 	struct drm_mode_object *obj;
4358 	int ret = 0;
4359 	int i;
4360 	int copied = 0;
4361 	int props_count = 0;
4362 	uint32_t __user *props_ptr;
4363 	uint64_t __user *prop_values_ptr;
4364 
4365 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4366 		return -EINVAL;
4367 
4368 	drm_modeset_lock_all(dev);
4369 
4370 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4371 	if (!obj) {
4372 		ret = -ENOENT;
4373 		goto out;
4374 	}
4375 	if (!obj->properties) {
4376 		ret = -EINVAL;
4377 		goto out;
4378 	}
4379 
4380 	props_count = obj->properties->count;
4381 
4382 	/* This ioctl is called twice, once to determine how much space is
4383 	 * needed, and the 2nd time to fill it. */
4384 	if ((arg->count_props >= props_count) && props_count) {
4385 		copied = 0;
4386 		props_ptr = (uint32_t __user *)(unsigned long)(arg->props_ptr);
4387 		prop_values_ptr = (uint64_t __user *)(unsigned long)
4388 				  (arg->prop_values_ptr);
4389 		for (i = 0; i < props_count; i++) {
4390 			if (put_user(obj->properties->ids[i],
4391 				     props_ptr + copied)) {
4392 				ret = -EFAULT;
4393 				goto out;
4394 			}
4395 			if (put_user(obj->properties->values[i],
4396 				     prop_values_ptr + copied)) {
4397 				ret = -EFAULT;
4398 				goto out;
4399 			}
4400 			copied++;
4401 		}
4402 	}
4403 	arg->count_props = props_count;
4404 out:
4405 	drm_modeset_unlock_all(dev);
4406 	return ret;
4407 }
4408 
4409 /**
4410  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4411  * @dev: DRM device
4412  * @data: ioctl data
4413  * @file_priv: DRM file info
4414  *
4415  * This function sets the current value for an object's property. It also calls
4416  * into a driver's ->set_property callback to update the hardware state.
4417  * Compared to the connector specific ioctl this one is extended to also work on
4418  * crtc and plane objects.
4419  *
4420  * Called by the user via ioctl.
4421  *
4422  * Returns:
4423  * Zero on success, negative errno on failure.
4424  */
4425 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4426 				    struct drm_file *file_priv)
4427 {
4428 	struct drm_mode_obj_set_property *arg = data;
4429 	struct drm_mode_object *arg_obj;
4430 	struct drm_mode_object *prop_obj;
4431 	struct drm_property *property;
4432 	int ret = -EINVAL;
4433 	int i;
4434 
4435 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4436 		return -EINVAL;
4437 
4438 	drm_modeset_lock_all(dev);
4439 
4440 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4441 	if (!arg_obj) {
4442 		ret = -ENOENT;
4443 		goto out;
4444 	}
4445 	if (!arg_obj->properties)
4446 		goto out;
4447 
4448 	for (i = 0; i < arg_obj->properties->count; i++)
4449 		if (arg_obj->properties->ids[i] == arg->prop_id)
4450 			break;
4451 
4452 	if (i == arg_obj->properties->count)
4453 		goto out;
4454 
4455 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4456 					DRM_MODE_OBJECT_PROPERTY);
4457 	if (!prop_obj) {
4458 		ret = -ENOENT;
4459 		goto out;
4460 	}
4461 	property = obj_to_property(prop_obj);
4462 
4463 	if (!drm_property_change_is_valid(property, arg->value))
4464 		goto out;
4465 
4466 	switch (arg_obj->type) {
4467 	case DRM_MODE_OBJECT_CONNECTOR:
4468 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4469 						      arg->value);
4470 		break;
4471 	case DRM_MODE_OBJECT_CRTC:
4472 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4473 		break;
4474 	case DRM_MODE_OBJECT_PLANE:
4475 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4476 						  property, arg->value);
4477 		break;
4478 	}
4479 
4480 out:
4481 	drm_modeset_unlock_all(dev);
4482 	return ret;
4483 }
4484 
4485 /**
4486  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4487  * @connector: connector to attach
4488  * @encoder: encoder to attach @connector to
4489  *
4490  * This function links up a connector to an encoder. Note that the routing
4491  * restrictions between encoders and crtcs are exposed to userspace through the
4492  * possible_clones and possible_crtcs bitmasks.
4493  *
4494  * Returns:
4495  * Zero on success, negative errno on failure.
4496  */
4497 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4498 				      struct drm_encoder *encoder)
4499 {
4500 	int i;
4501 
4502 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4503 		if (connector->encoder_ids[i] == 0) {
4504 			connector->encoder_ids[i] = encoder->base.id;
4505 			return 0;
4506 		}
4507 	}
4508 	return -ENOMEM;
4509 }
4510 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4511 
4512 /**
4513  * drm_mode_crtc_set_gamma_size - set the gamma table size
4514  * @crtc: CRTC to set the gamma table size for
4515  * @gamma_size: size of the gamma table
4516  *
4517  * Drivers which support gamma tables should set this to the supported gamma
4518  * table size when initializing the CRTC. Currently the drm core only supports a
4519  * fixed gamma table size.
4520  *
4521  * Returns:
4522  * Zero on success, negative errno on failure.
4523  */
4524 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4525 				 int gamma_size)
4526 {
4527 	crtc->gamma_size = gamma_size;
4528 
4529 	crtc->gamma_store = kzalloc(gamma_size * sizeof(uint16_t) * 3, GFP_KERNEL);
4530 	if (!crtc->gamma_store) {
4531 		crtc->gamma_size = 0;
4532 		return -ENOMEM;
4533 	}
4534 
4535 	return 0;
4536 }
4537 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4538 
4539 /**
4540  * drm_mode_gamma_set_ioctl - set the gamma table
4541  * @dev: DRM device
4542  * @data: ioctl data
4543  * @file_priv: DRM file info
4544  *
4545  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4546  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
4547  *
4548  * Called by the user via ioctl.
4549  *
4550  * Returns:
4551  * Zero on success, negative errno on failure.
4552  */
4553 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
4554 			     void *data, struct drm_file *file_priv)
4555 {
4556 	struct drm_mode_crtc_lut *crtc_lut = data;
4557 	struct drm_crtc *crtc;
4558 	void *r_base, *g_base, *b_base;
4559 	int size;
4560 	int ret = 0;
4561 
4562 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4563 		return -EINVAL;
4564 
4565 	drm_modeset_lock_all(dev);
4566 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4567 	if (!crtc) {
4568 		ret = -ENOENT;
4569 		goto out;
4570 	}
4571 
4572 	if (crtc->funcs->gamma_set == NULL) {
4573 		ret = -ENOSYS;
4574 		goto out;
4575 	}
4576 
4577 	/* memcpy into gamma store */
4578 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4579 		ret = -EINVAL;
4580 		goto out;
4581 	}
4582 
4583 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4584 	r_base = crtc->gamma_store;
4585 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
4586 		ret = -EFAULT;
4587 		goto out;
4588 	}
4589 
4590 	g_base = r_base + size;
4591 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
4592 		ret = -EFAULT;
4593 		goto out;
4594 	}
4595 
4596 	b_base = g_base + size;
4597 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
4598 		ret = -EFAULT;
4599 		goto out;
4600 	}
4601 
4602 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
4603 
4604 out:
4605 	drm_modeset_unlock_all(dev);
4606 	return ret;
4607 
4608 }
4609 
4610 /**
4611  * drm_mode_gamma_get_ioctl - get the gamma table
4612  * @dev: DRM device
4613  * @data: ioctl data
4614  * @file_priv: DRM file info
4615  *
4616  * Copy the current gamma table into the storage provided. This also provides
4617  * the gamma table size the driver expects, which can be used to size the
4618  * allocated storage.
4619  *
4620  * Called by the user via ioctl.
4621  *
4622  * Returns:
4623  * Zero on success, negative errno on failure.
4624  */
4625 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
4626 			     void *data, struct drm_file *file_priv)
4627 {
4628 	struct drm_mode_crtc_lut *crtc_lut = data;
4629 	struct drm_crtc *crtc;
4630 	void *r_base, *g_base, *b_base;
4631 	int size;
4632 	int ret = 0;
4633 
4634 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4635 		return -EINVAL;
4636 
4637 	drm_modeset_lock_all(dev);
4638 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4639 	if (!crtc) {
4640 		ret = -ENOENT;
4641 		goto out;
4642 	}
4643 
4644 	/* memcpy into gamma store */
4645 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4646 		ret = -EINVAL;
4647 		goto out;
4648 	}
4649 
4650 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4651 	r_base = crtc->gamma_store;
4652 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
4653 		ret = -EFAULT;
4654 		goto out;
4655 	}
4656 
4657 	g_base = r_base + size;
4658 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
4659 		ret = -EFAULT;
4660 		goto out;
4661 	}
4662 
4663 	b_base = g_base + size;
4664 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
4665 		ret = -EFAULT;
4666 		goto out;
4667 	}
4668 out:
4669 	drm_modeset_unlock_all(dev);
4670 	return ret;
4671 }
4672 
4673 /**
4674  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
4675  * @dev: DRM device
4676  * @data: ioctl data
4677  * @file_priv: DRM file info
4678  *
4679  * This schedules an asynchronous update on a given CRTC, called page flip.
4680  * Optionally a drm event is generated to signal the completion of the event.
4681  * Generic drivers cannot assume that a pageflip with changed framebuffer
4682  * properties (including driver specific metadata like tiling layout) will work,
4683  * but some drivers support e.g. pixel format changes through the pageflip
4684  * ioctl.
4685  *
4686  * Called by the user via ioctl.
4687  *
4688  * Returns:
4689  * Zero on success, negative errno on failure.
4690  */
4691 int drm_mode_page_flip_ioctl(struct drm_device *dev,
4692 			     void *data, struct drm_file *file_priv)
4693 {
4694 	struct drm_mode_crtc_page_flip *page_flip = data;
4695 	struct drm_crtc *crtc;
4696 	struct drm_framebuffer *fb = NULL;
4697 	struct drm_pending_vblank_event *e = NULL;
4698 	unsigned long flags;
4699 	int ret = -EINVAL;
4700 
4701 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
4702 	    page_flip->reserved != 0)
4703 		return -EINVAL;
4704 
4705 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
4706 		return -EINVAL;
4707 
4708 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
4709 	if (!crtc)
4710 		return -ENOENT;
4711 
4712 	drm_modeset_lock_crtc(crtc, crtc->primary);
4713 	if (crtc->primary->fb == NULL) {
4714 		/* The framebuffer is currently unbound, presumably
4715 		 * due to a hotplug event, that userspace has not
4716 		 * yet discovered.
4717 		 */
4718 		ret = -EBUSY;
4719 		goto out;
4720 	}
4721 
4722 	if (crtc->funcs->page_flip == NULL)
4723 		goto out;
4724 
4725 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
4726 	if (!fb) {
4727 		ret = -ENOENT;
4728 		goto out;
4729 	}
4730 
4731 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
4732 	if (ret)
4733 		goto out;
4734 
4735 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
4736 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
4737 		ret = -EINVAL;
4738 		goto out;
4739 	}
4740 
4741 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4742 		ret = -ENOMEM;
4743 		spin_lock_irqsave(&dev->event_lock, flags);
4744 		if (file_priv->event_space < sizeof e->event) {
4745 			spin_unlock_irqrestore(&dev->event_lock, flags);
4746 			goto out;
4747 		}
4748 		file_priv->event_space -= sizeof e->event;
4749 		spin_unlock_irqrestore(&dev->event_lock, flags);
4750 
4751 		e = kzalloc(sizeof *e, GFP_KERNEL);
4752 		if (e == NULL) {
4753 			spin_lock_irqsave(&dev->event_lock, flags);
4754 			file_priv->event_space += sizeof e->event;
4755 			spin_unlock_irqrestore(&dev->event_lock, flags);
4756 			goto out;
4757 		}
4758 
4759 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
4760 		e->event.base.length = sizeof e->event;
4761 		e->event.user_data = page_flip->user_data;
4762 		e->base.event = &e->event.base;
4763 		e->base.file_priv = file_priv;
4764 		e->base.destroy =
4765 			(void (*) (struct drm_pending_event *)) kfree;
4766 	}
4767 
4768 	crtc->primary->old_fb = crtc->primary->fb;
4769 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
4770 	if (ret) {
4771 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4772 			spin_lock_irqsave(&dev->event_lock, flags);
4773 			file_priv->event_space += sizeof e->event;
4774 			spin_unlock_irqrestore(&dev->event_lock, flags);
4775 			kfree(e);
4776 		}
4777 		/* Keep the old fb, don't unref it. */
4778 		crtc->primary->old_fb = NULL;
4779 	} else {
4780 		/*
4781 		 * Warn if the driver hasn't properly updated the crtc->fb
4782 		 * field to reflect that the new framebuffer is now used.
4783 		 * Failing to do so will screw with the reference counting
4784 		 * on framebuffers.
4785 		 */
4786 		WARN_ON(crtc->primary->fb != fb);
4787 		/* Unref only the old framebuffer. */
4788 		fb = NULL;
4789 	}
4790 
4791 out:
4792 	if (fb)
4793 		drm_framebuffer_unreference(fb);
4794 	if (crtc->primary->old_fb)
4795 		drm_framebuffer_unreference(crtc->primary->old_fb);
4796 	crtc->primary->old_fb = NULL;
4797 	drm_modeset_unlock_crtc(crtc);
4798 
4799 	return ret;
4800 }
4801 
4802 /**
4803  * drm_mode_config_reset - call ->reset callbacks
4804  * @dev: drm device
4805  *
4806  * This functions calls all the crtc's, encoder's and connector's ->reset
4807  * callback. Drivers can use this in e.g. their driver load or resume code to
4808  * reset hardware and software state.
4809  */
4810 void drm_mode_config_reset(struct drm_device *dev)
4811 {
4812 	struct drm_crtc *crtc;
4813 	struct drm_plane *plane;
4814 	struct drm_encoder *encoder;
4815 	struct drm_connector *connector;
4816 
4817 	list_for_each_entry(plane, &dev->mode_config.plane_list, head)
4818 		if (plane->funcs->reset)
4819 			plane->funcs->reset(plane);
4820 
4821 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
4822 		if (crtc->funcs->reset)
4823 			crtc->funcs->reset(crtc);
4824 
4825 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
4826 		if (encoder->funcs->reset)
4827 			encoder->funcs->reset(encoder);
4828 
4829 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
4830 		connector->status = connector_status_unknown;
4831 
4832 		if (connector->funcs->reset)
4833 			connector->funcs->reset(connector);
4834 	}
4835 }
4836 EXPORT_SYMBOL(drm_mode_config_reset);
4837 
4838 /**
4839  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
4840  * @dev: DRM device
4841  * @data: ioctl data
4842  * @file_priv: DRM file info
4843  *
4844  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
4845  * TTM or something else entirely) and returns the resulting buffer handle. This
4846  * handle can then be wrapped up into a framebuffer modeset object.
4847  *
4848  * Note that userspace is not allowed to use such objects for render
4849  * acceleration - drivers must create their own private ioctls for such a use
4850  * case.
4851  *
4852  * Called by the user via ioctl.
4853  *
4854  * Returns:
4855  * Zero on success, negative errno on failure.
4856  */
4857 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
4858 			       void *data, struct drm_file *file_priv)
4859 {
4860 	struct drm_mode_create_dumb *args = data;
4861 	u32 cpp, stride, size;
4862 
4863 	if (!dev->driver->dumb_create)
4864 		return -ENOSYS;
4865 	if (!args->width || !args->height || !args->bpp)
4866 		return -EINVAL;
4867 
4868 	/* overflow checks for 32bit size calculations */
4869 	/* NOTE: DIV_ROUND_UP() can overflow */
4870 	cpp = DIV_ROUND_UP(args->bpp, 8);
4871 	if (!cpp || cpp > 0xffffffffU / args->width)
4872 		return -EINVAL;
4873 	stride = cpp * args->width;
4874 	if (args->height > 0xffffffffU / stride)
4875 		return -EINVAL;
4876 
4877 	/* test for wrap-around */
4878 	size = args->height * stride;
4879 	if (PAGE_ALIGN(size) == 0)
4880 		return -EINVAL;
4881 
4882 	/*
4883 	 * handle, pitch and size are output parameters. Zero them out to
4884 	 * prevent drivers from accidentally using uninitialized data. Since
4885 	 * not all existing userspace is clearing these fields properly we
4886 	 * cannot reject IOCTL with garbage in them.
4887 	 */
4888 	args->handle = 0;
4889 	args->pitch = 0;
4890 	args->size = 0;
4891 
4892 	return dev->driver->dumb_create(file_priv, dev, args);
4893 }
4894 
4895 /**
4896  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
4897  * @dev: DRM device
4898  * @data: ioctl data
4899  * @file_priv: DRM file info
4900  *
4901  * Allocate an offset in the drm device node's address space to be able to
4902  * memory map a dumb buffer.
4903  *
4904  * Called by the user via ioctl.
4905  *
4906  * Returns:
4907  * Zero on success, negative errno on failure.
4908  */
4909 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
4910 			     void *data, struct drm_file *file_priv)
4911 {
4912 	struct drm_mode_map_dumb *args = data;
4913 
4914 	/* call driver ioctl to get mmap offset */
4915 	if (!dev->driver->dumb_map_offset)
4916 		return -ENOSYS;
4917 
4918 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
4919 }
4920 
4921 /**
4922  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
4923  * @dev: DRM device
4924  * @data: ioctl data
4925  * @file_priv: DRM file info
4926  *
4927  * This destroys the userspace handle for the given dumb backing storage buffer.
4928  * Since buffer objects must be reference counted in the kernel a buffer object
4929  * won't be immediately freed if a framebuffer modeset object still uses it.
4930  *
4931  * Called by the user via ioctl.
4932  *
4933  * Returns:
4934  * Zero on success, negative errno on failure.
4935  */
4936 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
4937 				void *data, struct drm_file *file_priv)
4938 {
4939 	struct drm_mode_destroy_dumb *args = data;
4940 
4941 	if (!dev->driver->dumb_destroy)
4942 		return -ENOSYS;
4943 
4944 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
4945 }
4946 
4947 /**
4948  * drm_fb_get_bpp_depth - get the bpp/depth values for format
4949  * @format: pixel format (DRM_FORMAT_*)
4950  * @depth: storage for the depth value
4951  * @bpp: storage for the bpp value
4952  *
4953  * This only supports RGB formats here for compat with code that doesn't use
4954  * pixel formats directly yet.
4955  */
4956 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
4957 			  int *bpp)
4958 {
4959 	switch (format) {
4960 	case DRM_FORMAT_C8:
4961 	case DRM_FORMAT_RGB332:
4962 	case DRM_FORMAT_BGR233:
4963 		*depth = 8;
4964 		*bpp = 8;
4965 		break;
4966 	case DRM_FORMAT_XRGB1555:
4967 	case DRM_FORMAT_XBGR1555:
4968 	case DRM_FORMAT_RGBX5551:
4969 	case DRM_FORMAT_BGRX5551:
4970 	case DRM_FORMAT_ARGB1555:
4971 	case DRM_FORMAT_ABGR1555:
4972 	case DRM_FORMAT_RGBA5551:
4973 	case DRM_FORMAT_BGRA5551:
4974 		*depth = 15;
4975 		*bpp = 16;
4976 		break;
4977 	case DRM_FORMAT_RGB565:
4978 	case DRM_FORMAT_BGR565:
4979 		*depth = 16;
4980 		*bpp = 16;
4981 		break;
4982 	case DRM_FORMAT_RGB888:
4983 	case DRM_FORMAT_BGR888:
4984 		*depth = 24;
4985 		*bpp = 24;
4986 		break;
4987 	case DRM_FORMAT_XRGB8888:
4988 	case DRM_FORMAT_XBGR8888:
4989 	case DRM_FORMAT_RGBX8888:
4990 	case DRM_FORMAT_BGRX8888:
4991 		*depth = 24;
4992 		*bpp = 32;
4993 		break;
4994 	case DRM_FORMAT_XRGB2101010:
4995 	case DRM_FORMAT_XBGR2101010:
4996 	case DRM_FORMAT_RGBX1010102:
4997 	case DRM_FORMAT_BGRX1010102:
4998 	case DRM_FORMAT_ARGB2101010:
4999 	case DRM_FORMAT_ABGR2101010:
5000 	case DRM_FORMAT_RGBA1010102:
5001 	case DRM_FORMAT_BGRA1010102:
5002 		*depth = 30;
5003 		*bpp = 32;
5004 		break;
5005 	case DRM_FORMAT_ARGB8888:
5006 	case DRM_FORMAT_ABGR8888:
5007 	case DRM_FORMAT_RGBA8888:
5008 	case DRM_FORMAT_BGRA8888:
5009 		*depth = 32;
5010 		*bpp = 32;
5011 		break;
5012 	default:
5013 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5014 			      drm_get_format_name(format));
5015 		*depth = 0;
5016 		*bpp = 0;
5017 		break;
5018 	}
5019 }
5020 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5021 
5022 /**
5023  * drm_format_num_planes - get the number of planes for format
5024  * @format: pixel format (DRM_FORMAT_*)
5025  *
5026  * Returns:
5027  * The number of planes used by the specified pixel format.
5028  */
5029 int drm_format_num_planes(uint32_t format)
5030 {
5031 	switch (format) {
5032 	case DRM_FORMAT_YUV410:
5033 	case DRM_FORMAT_YVU410:
5034 	case DRM_FORMAT_YUV411:
5035 	case DRM_FORMAT_YVU411:
5036 	case DRM_FORMAT_YUV420:
5037 	case DRM_FORMAT_YVU420:
5038 	case DRM_FORMAT_YUV422:
5039 	case DRM_FORMAT_YVU422:
5040 	case DRM_FORMAT_YUV444:
5041 	case DRM_FORMAT_YVU444:
5042 		return 3;
5043 	case DRM_FORMAT_NV12:
5044 	case DRM_FORMAT_NV21:
5045 	case DRM_FORMAT_NV16:
5046 	case DRM_FORMAT_NV61:
5047 	case DRM_FORMAT_NV24:
5048 	case DRM_FORMAT_NV42:
5049 		return 2;
5050 	default:
5051 		return 1;
5052 	}
5053 }
5054 EXPORT_SYMBOL(drm_format_num_planes);
5055 
5056 /**
5057  * drm_format_plane_cpp - determine the bytes per pixel value
5058  * @format: pixel format (DRM_FORMAT_*)
5059  * @plane: plane index
5060  *
5061  * Returns:
5062  * The bytes per pixel value for the specified plane.
5063  */
5064 int drm_format_plane_cpp(uint32_t format, int plane)
5065 {
5066 	unsigned int depth;
5067 	int bpp;
5068 
5069 	if (plane >= drm_format_num_planes(format))
5070 		return 0;
5071 
5072 	switch (format) {
5073 	case DRM_FORMAT_YUYV:
5074 	case DRM_FORMAT_YVYU:
5075 	case DRM_FORMAT_UYVY:
5076 	case DRM_FORMAT_VYUY:
5077 		return 2;
5078 	case DRM_FORMAT_NV12:
5079 	case DRM_FORMAT_NV21:
5080 	case DRM_FORMAT_NV16:
5081 	case DRM_FORMAT_NV61:
5082 	case DRM_FORMAT_NV24:
5083 	case DRM_FORMAT_NV42:
5084 		return plane ? 2 : 1;
5085 	case DRM_FORMAT_YUV410:
5086 	case DRM_FORMAT_YVU410:
5087 	case DRM_FORMAT_YUV411:
5088 	case DRM_FORMAT_YVU411:
5089 	case DRM_FORMAT_YUV420:
5090 	case DRM_FORMAT_YVU420:
5091 	case DRM_FORMAT_YUV422:
5092 	case DRM_FORMAT_YVU422:
5093 	case DRM_FORMAT_YUV444:
5094 	case DRM_FORMAT_YVU444:
5095 		return 1;
5096 	default:
5097 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5098 		return bpp >> 3;
5099 	}
5100 }
5101 EXPORT_SYMBOL(drm_format_plane_cpp);
5102 
5103 /**
5104  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5105  * @format: pixel format (DRM_FORMAT_*)
5106  *
5107  * Returns:
5108  * The horizontal chroma subsampling factor for the
5109  * specified pixel format.
5110  */
5111 int drm_format_horz_chroma_subsampling(uint32_t format)
5112 {
5113 	switch (format) {
5114 	case DRM_FORMAT_YUV411:
5115 	case DRM_FORMAT_YVU411:
5116 	case DRM_FORMAT_YUV410:
5117 	case DRM_FORMAT_YVU410:
5118 		return 4;
5119 	case DRM_FORMAT_YUYV:
5120 	case DRM_FORMAT_YVYU:
5121 	case DRM_FORMAT_UYVY:
5122 	case DRM_FORMAT_VYUY:
5123 	case DRM_FORMAT_NV12:
5124 	case DRM_FORMAT_NV21:
5125 	case DRM_FORMAT_NV16:
5126 	case DRM_FORMAT_NV61:
5127 	case DRM_FORMAT_YUV422:
5128 	case DRM_FORMAT_YVU422:
5129 	case DRM_FORMAT_YUV420:
5130 	case DRM_FORMAT_YVU420:
5131 		return 2;
5132 	default:
5133 		return 1;
5134 	}
5135 }
5136 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5137 
5138 /**
5139  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5140  * @format: pixel format (DRM_FORMAT_*)
5141  *
5142  * Returns:
5143  * The vertical chroma subsampling factor for the
5144  * specified pixel format.
5145  */
5146 int drm_format_vert_chroma_subsampling(uint32_t format)
5147 {
5148 	switch (format) {
5149 	case DRM_FORMAT_YUV410:
5150 	case DRM_FORMAT_YVU410:
5151 		return 4;
5152 	case DRM_FORMAT_YUV420:
5153 	case DRM_FORMAT_YVU420:
5154 	case DRM_FORMAT_NV12:
5155 	case DRM_FORMAT_NV21:
5156 		return 2;
5157 	default:
5158 		return 1;
5159 	}
5160 }
5161 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5162 
5163 /**
5164  * drm_rotation_simplify() - Try to simplify the rotation
5165  * @rotation: Rotation to be simplified
5166  * @supported_rotations: Supported rotations
5167  *
5168  * Attempt to simplify the rotation to a form that is supported.
5169  * Eg. if the hardware supports everything except DRM_REFLECT_X
5170  * one could call this function like this:
5171  *
5172  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5173  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5174  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5175  *
5176  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5177  * transforms the hardware supports, this function may not
5178  * be able to produce a supported transform, so the caller should
5179  * check the result afterwards.
5180  */
5181 unsigned int drm_rotation_simplify(unsigned int rotation,
5182 				   unsigned int supported_rotations)
5183 {
5184 	if (rotation & ~supported_rotations) {
5185 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5186 		rotation = (rotation & ~0xf) | BIT((ffs(rotation & 0xf) + 1) % 4);
5187 	}
5188 
5189 	return rotation;
5190 }
5191 EXPORT_SYMBOL(drm_rotation_simplify);
5192 
5193 /**
5194  * drm_mode_config_init - initialize DRM mode_configuration structure
5195  * @dev: DRM device
5196  *
5197  * Initialize @dev's mode_config structure, used for tracking the graphics
5198  * configuration of @dev.
5199  *
5200  * Since this initializes the modeset locks, no locking is possible. Which is no
5201  * problem, since this should happen single threaded at init time. It is the
5202  * driver's problem to ensure this guarantee.
5203  *
5204  */
5205 void drm_mode_config_init(struct drm_device *dev)
5206 {
5207 	mutex_init(&dev->mode_config.mutex);
5208 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5209 	mutex_init(&dev->mode_config.idr_mutex);
5210 	mutex_init(&dev->mode_config.fb_lock);
5211 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5212 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5213 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5214 	INIT_LIST_HEAD(&dev->mode_config.bridge_list);
5215 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5216 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5217 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5218 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5219 	idr_init(&dev->mode_config.crtc_idr);
5220 	idr_init(&dev->mode_config.tile_idr);
5221 
5222 	drm_modeset_lock_all(dev);
5223 	drm_mode_create_standard_connector_properties(dev);
5224 	drm_mode_create_standard_plane_properties(dev);
5225 	drm_modeset_unlock_all(dev);
5226 
5227 	/* Just to be sure */
5228 	dev->mode_config.num_fb = 0;
5229 	dev->mode_config.num_connector = 0;
5230 	dev->mode_config.num_crtc = 0;
5231 	dev->mode_config.num_encoder = 0;
5232 	dev->mode_config.num_overlay_plane = 0;
5233 	dev->mode_config.num_total_plane = 0;
5234 }
5235 EXPORT_SYMBOL(drm_mode_config_init);
5236 
5237 /**
5238  * drm_mode_config_cleanup - free up DRM mode_config info
5239  * @dev: DRM device
5240  *
5241  * Free up all the connectors and CRTCs associated with this DRM device, then
5242  * free up the framebuffers and associated buffer objects.
5243  *
5244  * Note that since this /should/ happen single-threaded at driver/device
5245  * teardown time, no locking is required. It's the driver's job to ensure that
5246  * this guarantee actually holds true.
5247  *
5248  * FIXME: cleanup any dangling user buffer objects too
5249  */
5250 void drm_mode_config_cleanup(struct drm_device *dev)
5251 {
5252 	struct drm_connector *connector, *ot;
5253 	struct drm_crtc *crtc, *ct;
5254 	struct drm_encoder *encoder, *enct;
5255 	struct drm_bridge *bridge, *brt;
5256 	struct drm_framebuffer *fb, *fbt;
5257 	struct drm_property *property, *pt;
5258 	struct drm_property_blob *blob, *bt;
5259 	struct drm_plane *plane, *plt;
5260 
5261 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5262 				 head) {
5263 		encoder->funcs->destroy(encoder);
5264 	}
5265 
5266 	list_for_each_entry_safe(bridge, brt,
5267 				 &dev->mode_config.bridge_list, head) {
5268 		bridge->funcs->destroy(bridge);
5269 	}
5270 
5271 	list_for_each_entry_safe(connector, ot,
5272 				 &dev->mode_config.connector_list, head) {
5273 		connector->funcs->destroy(connector);
5274 	}
5275 
5276 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5277 				 head) {
5278 		drm_property_destroy(dev, property);
5279 	}
5280 
5281 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5282 				 head) {
5283 		drm_property_destroy_blob(dev, blob);
5284 	}
5285 
5286 	/*
5287 	 * Single-threaded teardown context, so it's not required to grab the
5288 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5289 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5290 	 *
5291 	 * Also, if there are any framebuffers left, that's a driver leak now,
5292 	 * so politely WARN about this.
5293 	 */
5294 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5295 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5296 		drm_framebuffer_remove(fb);
5297 	}
5298 
5299 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5300 				 head) {
5301 		plane->funcs->destroy(plane);
5302 	}
5303 
5304 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5305 		crtc->funcs->destroy(crtc);
5306 	}
5307 
5308 	idr_destroy(&dev->mode_config.tile_idr);
5309 	idr_destroy(&dev->mode_config.crtc_idr);
5310 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5311 }
5312 EXPORT_SYMBOL(drm_mode_config_cleanup);
5313 
5314 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5315 						       unsigned int supported_rotations)
5316 {
5317 	static const struct drm_prop_enum_list props[] = {
5318 		{ DRM_ROTATE_0,   "rotate-0" },
5319 		{ DRM_ROTATE_90,  "rotate-90" },
5320 		{ DRM_ROTATE_180, "rotate-180" },
5321 		{ DRM_ROTATE_270, "rotate-270" },
5322 		{ DRM_REFLECT_X,  "reflect-x" },
5323 		{ DRM_REFLECT_Y,  "reflect-y" },
5324 	};
5325 
5326 	return drm_property_create_bitmask(dev, 0, "rotation",
5327 					   props, ARRAY_SIZE(props),
5328 					   supported_rotations);
5329 }
5330 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5331 
5332 /**
5333  * DOC: Tile group
5334  *
5335  * Tile groups are used to represent tiled monitors with a unique
5336  * integer identifier. Tiled monitors using DisplayID v1.3 have
5337  * a unique 8-byte handle, we store this in a tile group, so we
5338  * have a common identifier for all tiles in a monitor group.
5339  */
5340 static void drm_tile_group_free(struct kref *kref)
5341 {
5342 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5343 	struct drm_device *dev = tg->dev;
5344 	mutex_lock(&dev->mode_config.idr_mutex);
5345 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5346 	mutex_unlock(&dev->mode_config.idr_mutex);
5347 	kfree(tg);
5348 }
5349 
5350 /**
5351  * drm_mode_put_tile_group - drop a reference to a tile group.
5352  * @dev: DRM device
5353  * @tg: tile group to drop reference to.
5354  *
5355  * drop reference to tile group and free if 0.
5356  */
5357 void drm_mode_put_tile_group(struct drm_device *dev,
5358 			     struct drm_tile_group *tg)
5359 {
5360 	kref_put(&tg->refcount, drm_tile_group_free);
5361 }
5362 
5363 /**
5364  * drm_mode_get_tile_group - get a reference to an existing tile group
5365  * @dev: DRM device
5366  * @topology: 8-bytes unique per monitor.
5367  *
5368  * Use the unique bytes to get a reference to an existing tile group.
5369  *
5370  * RETURNS:
5371  * tile group or NULL if not found.
5372  */
5373 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5374 					       char topology[8])
5375 {
5376 	struct drm_tile_group *tg;
5377 	int id;
5378 	mutex_lock(&dev->mode_config.idr_mutex);
5379 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5380 		if (!memcmp(tg->group_data, topology, 8)) {
5381 			if (!kref_get_unless_zero(&tg->refcount))
5382 				tg = NULL;
5383 			mutex_unlock(&dev->mode_config.idr_mutex);
5384 			return tg;
5385 		}
5386 	}
5387 	mutex_unlock(&dev->mode_config.idr_mutex);
5388 	return NULL;
5389 }
5390 
5391 /**
5392  * drm_mode_create_tile_group - create a tile group from a displayid description
5393  * @dev: DRM device
5394  * @topology: 8-bytes unique per monitor.
5395  *
5396  * Create a tile group for the unique monitor, and get a unique
5397  * identifier for the tile group.
5398  *
5399  * RETURNS:
5400  * new tile group or error.
5401  */
5402 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5403 						  char topology[8])
5404 {
5405 	struct drm_tile_group *tg;
5406 	int ret;
5407 
5408 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5409 	if (!tg)
5410 		return ERR_PTR(-ENOMEM);
5411 
5412 	kref_init(&tg->refcount);
5413 	memcpy(tg->group_data, topology, 8);
5414 	tg->dev = dev;
5415 
5416 	mutex_lock(&dev->mode_config.idr_mutex);
5417 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5418 	if (ret >= 0) {
5419 		tg->id = ret;
5420 	} else {
5421 		kfree(tg);
5422 		tg = ERR_PTR(ret);
5423 	}
5424 
5425 	mutex_unlock(&dev->mode_config.idr_mutex);
5426 	return tg;
5427 }
5428