1 /* 2 * Copyright (c) 2016 Intel Corporation 3 * 4 * Permission to use, copy, modify, distribute, and sell this software and its 5 * documentation for any purpose is hereby granted without fee, provided that 6 * the above copyright notice appear in all copies and that both that copyright 7 * notice and this permission notice appear in supporting documentation, and 8 * that the name of the copyright holders not be used in advertising or 9 * publicity pertaining to distribution of the software without specific, 10 * written prior permission. The copyright holders make no representations 11 * about the suitability of this software for any purpose. It is provided "as 12 * is" without express or implied warranty. 13 * 14 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 15 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 16 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR 17 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, 18 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 19 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE 20 * OF THIS SOFTWARE. 21 */ 22 23 #include <linux/export.h> 24 #include <linux/uaccess.h> 25 26 #include <drm/drm_atomic.h> 27 #include <drm/drm_atomic_uapi.h> 28 #include <drm/drm_auth.h> 29 #include <drm/drm_debugfs.h> 30 #include <drm/drm_drv.h> 31 #include <drm/drm_file.h> 32 #include <drm/drm_fourcc.h> 33 #include <drm/drm_framebuffer.h> 34 #include <drm/drm_print.h> 35 #include <drm/drm_util.h> 36 37 #include "drm_crtc_internal.h" 38 #include "drm_internal.h" 39 40 /** 41 * DOC: overview 42 * 43 * Frame buffers are abstract memory objects that provide a source of pixels to 44 * scanout to a CRTC. Applications explicitly request the creation of frame 45 * buffers through the DRM_IOCTL_MODE_ADDFB(2) ioctls and receive an opaque 46 * handle that can be passed to the KMS CRTC control, plane configuration and 47 * page flip functions. 48 * 49 * Frame buffers rely on the underlying memory manager for allocating backing 50 * storage. When creating a frame buffer applications pass a memory handle 51 * (or a list of memory handles for multi-planar formats) through the 52 * &struct drm_mode_fb_cmd2 argument. For drivers using GEM as their userspace 53 * buffer management interface this would be a GEM handle. Drivers are however 54 * free to use their own backing storage object handles, e.g. vmwgfx directly 55 * exposes special TTM handles to userspace and so expects TTM handles in the 56 * create ioctl and not GEM handles. 57 * 58 * Framebuffers are tracked with &struct drm_framebuffer. They are published 59 * using drm_framebuffer_init() - after calling that function userspace can use 60 * and access the framebuffer object. The helper function 61 * drm_helper_mode_fill_fb_struct() can be used to pre-fill the required 62 * metadata fields. 63 * 64 * The lifetime of a drm framebuffer is controlled with a reference count, 65 * drivers can grab additional references with drm_framebuffer_get() and drop 66 * them again with drm_framebuffer_put(). For driver-private framebuffers for 67 * which the last reference is never dropped (e.g. for the fbdev framebuffer 68 * when the struct &struct drm_framebuffer is embedded into the fbdev helper 69 * struct) drivers can manually clean up a framebuffer at module unload time 70 * with drm_framebuffer_unregister_private(). But doing this is not 71 * recommended, and it's better to have a normal free-standing &struct 72 * drm_framebuffer. 73 */ 74 75 int drm_framebuffer_check_src_coords(uint32_t src_x, uint32_t src_y, 76 uint32_t src_w, uint32_t src_h, 77 const struct drm_framebuffer *fb) 78 { 79 unsigned int fb_width, fb_height; 80 81 fb_width = fb->width << 16; 82 fb_height = fb->height << 16; 83 84 /* Make sure source coordinates are inside the fb. */ 85 if (src_w > fb_width || 86 src_x > fb_width - src_w || 87 src_h > fb_height || 88 src_y > fb_height - src_h) { 89 DRM_DEBUG_KMS("Invalid source coordinates " 90 "%u.%06ux%u.%06u+%u.%06u+%u.%06u (fb %ux%u)\n", 91 src_w >> 16, ((src_w & 0xffff) * 15625) >> 10, 92 src_h >> 16, ((src_h & 0xffff) * 15625) >> 10, 93 src_x >> 16, ((src_x & 0xffff) * 15625) >> 10, 94 src_y >> 16, ((src_y & 0xffff) * 15625) >> 10, 95 fb->width, fb->height); 96 return -ENOSPC; 97 } 98 99 return 0; 100 } 101 102 /** 103 * drm_mode_addfb - add an FB to the graphics configuration 104 * @dev: drm device for the ioctl 105 * @or: pointer to request structure 106 * @file_priv: drm file 107 * 108 * Add a new FB to the specified CRTC, given a user request. This is the 109 * original addfb ioctl which only supported RGB formats. 110 * 111 * Called by the user via ioctl, or by an in-kernel client. 112 * 113 * Returns: 114 * Zero on success, negative errno on failure. 115 */ 116 int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or, 117 struct drm_file *file_priv) 118 { 119 struct drm_mode_fb_cmd2 r = {}; 120 int ret; 121 122 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 123 return -EOPNOTSUPP; 124 125 r.pixel_format = drm_driver_legacy_fb_format(dev, or->bpp, or->depth); 126 if (r.pixel_format == DRM_FORMAT_INVALID) { 127 DRM_DEBUG("bad {bpp:%d, depth:%d}\n", or->bpp, or->depth); 128 return -EINVAL; 129 } 130 131 /* convert to new format and call new ioctl */ 132 r.fb_id = or->fb_id; 133 r.width = or->width; 134 r.height = or->height; 135 r.pitches[0] = or->pitch; 136 r.handles[0] = or->handle; 137 138 ret = drm_mode_addfb2(dev, &r, file_priv); 139 if (ret) 140 return ret; 141 142 or->fb_id = r.fb_id; 143 144 return 0; 145 } 146 147 int drm_mode_addfb_ioctl(struct drm_device *dev, 148 void *data, struct drm_file *file_priv) 149 { 150 return drm_mode_addfb(dev, data, file_priv); 151 } 152 153 static int fb_plane_width(int width, 154 const struct drm_format_info *format, int plane) 155 { 156 if (plane == 0) 157 return width; 158 159 return DIV_ROUND_UP(width, format->hsub); 160 } 161 162 static int fb_plane_height(int height, 163 const struct drm_format_info *format, int plane) 164 { 165 if (plane == 0) 166 return height; 167 168 return DIV_ROUND_UP(height, format->vsub); 169 } 170 171 static int framebuffer_check(struct drm_device *dev, 172 const struct drm_mode_fb_cmd2 *r) 173 { 174 const struct drm_format_info *info; 175 int i; 176 177 /* check if the format is supported at all */ 178 info = __drm_format_info(r->pixel_format); 179 if (!info) { 180 struct drm_format_name_buf format_name; 181 182 DRM_DEBUG_KMS("bad framebuffer format %s\n", 183 drm_get_format_name(r->pixel_format, 184 &format_name)); 185 return -EINVAL; 186 } 187 188 /* now let the driver pick its own format info */ 189 info = drm_get_format_info(dev, r); 190 191 if (r->width == 0) { 192 DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width); 193 return -EINVAL; 194 } 195 196 if (r->height == 0) { 197 DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height); 198 return -EINVAL; 199 } 200 201 for (i = 0; i < info->num_planes; i++) { 202 unsigned int width = fb_plane_width(r->width, info, i); 203 unsigned int height = fb_plane_height(r->height, info, i); 204 unsigned int block_size = info->char_per_block[i]; 205 u64 min_pitch = drm_format_info_min_pitch(info, i, width); 206 207 if (!block_size && (r->modifier[i] == DRM_FORMAT_MOD_LINEAR)) { 208 DRM_DEBUG_KMS("Format requires non-linear modifier for plane %d\n", i); 209 return -EINVAL; 210 } 211 212 if (!r->handles[i]) { 213 DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i); 214 return -EINVAL; 215 } 216 217 if (min_pitch > UINT_MAX) 218 return -ERANGE; 219 220 if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX) 221 return -ERANGE; 222 223 if (block_size && r->pitches[i] < min_pitch) { 224 DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i); 225 return -EINVAL; 226 } 227 228 if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) { 229 DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n", 230 r->modifier[i], i); 231 return -EINVAL; 232 } 233 234 if (r->flags & DRM_MODE_FB_MODIFIERS && 235 r->modifier[i] != r->modifier[0]) { 236 DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n", 237 r->modifier[i], i); 238 return -EINVAL; 239 } 240 241 /* modifier specific checks: */ 242 switch (r->modifier[i]) { 243 case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE: 244 /* NOTE: the pitch restriction may be lifted later if it turns 245 * out that no hw has this restriction: 246 */ 247 if (r->pixel_format != DRM_FORMAT_NV12 || 248 width % 128 || height % 32 || 249 r->pitches[i] % 128) { 250 DRM_DEBUG_KMS("bad modifier data for plane %d\n", i); 251 return -EINVAL; 252 } 253 break; 254 255 default: 256 break; 257 } 258 } 259 260 for (i = info->num_planes; i < 4; i++) { 261 if (r->modifier[i]) { 262 DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i); 263 return -EINVAL; 264 } 265 266 /* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */ 267 if (!(r->flags & DRM_MODE_FB_MODIFIERS)) 268 continue; 269 270 if (r->handles[i]) { 271 DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i); 272 return -EINVAL; 273 } 274 275 if (r->pitches[i]) { 276 DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i); 277 return -EINVAL; 278 } 279 280 if (r->offsets[i]) { 281 DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i); 282 return -EINVAL; 283 } 284 } 285 286 return 0; 287 } 288 289 struct drm_framebuffer * 290 drm_internal_framebuffer_create(struct drm_device *dev, 291 const struct drm_mode_fb_cmd2 *r, 292 struct drm_file *file_priv) 293 { 294 struct drm_mode_config *config = &dev->mode_config; 295 struct drm_framebuffer *fb; 296 int ret; 297 298 if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) { 299 DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags); 300 return ERR_PTR(-EINVAL); 301 } 302 303 if ((config->min_width > r->width) || (r->width > config->max_width)) { 304 DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n", 305 r->width, config->min_width, config->max_width); 306 return ERR_PTR(-EINVAL); 307 } 308 if ((config->min_height > r->height) || (r->height > config->max_height)) { 309 DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n", 310 r->height, config->min_height, config->max_height); 311 return ERR_PTR(-EINVAL); 312 } 313 314 if (r->flags & DRM_MODE_FB_MODIFIERS && 315 !dev->mode_config.allow_fb_modifiers) { 316 DRM_DEBUG_KMS("driver does not support fb modifiers\n"); 317 return ERR_PTR(-EINVAL); 318 } 319 320 ret = framebuffer_check(dev, r); 321 if (ret) 322 return ERR_PTR(ret); 323 324 fb = dev->mode_config.funcs->fb_create(dev, file_priv, r); 325 if (IS_ERR(fb)) { 326 DRM_DEBUG_KMS("could not create framebuffer\n"); 327 return fb; 328 } 329 330 return fb; 331 } 332 EXPORT_SYMBOL_FOR_TESTS_ONLY(drm_internal_framebuffer_create); 333 334 /** 335 * drm_mode_addfb2 - add an FB to the graphics configuration 336 * @dev: drm device for the ioctl 337 * @data: data pointer for the ioctl 338 * @file_priv: drm file for the ioctl call 339 * 340 * Add a new FB to the specified CRTC, given a user request with format. This is 341 * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers 342 * and uses fourcc codes as pixel format specifiers. 343 * 344 * Called by the user via ioctl. 345 * 346 * Returns: 347 * Zero on success, negative errno on failure. 348 */ 349 int drm_mode_addfb2(struct drm_device *dev, 350 void *data, struct drm_file *file_priv) 351 { 352 struct drm_mode_fb_cmd2 *r = data; 353 struct drm_framebuffer *fb; 354 355 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 356 return -EOPNOTSUPP; 357 358 fb = drm_internal_framebuffer_create(dev, r, file_priv); 359 if (IS_ERR(fb)) 360 return PTR_ERR(fb); 361 362 DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id); 363 r->fb_id = fb->base.id; 364 365 /* Transfer ownership to the filp for reaping on close */ 366 mutex_lock(&file_priv->fbs_lock); 367 list_add(&fb->filp_head, &file_priv->fbs); 368 mutex_unlock(&file_priv->fbs_lock); 369 370 return 0; 371 } 372 373 int drm_mode_addfb2_ioctl(struct drm_device *dev, 374 void *data, struct drm_file *file_priv) 375 { 376 #ifdef __BIG_ENDIAN 377 if (!dev->mode_config.quirk_addfb_prefer_host_byte_order) { 378 /* 379 * Drivers must set the 380 * quirk_addfb_prefer_host_byte_order quirk to make 381 * the drm_mode_addfb() compat code work correctly on 382 * bigendian machines. 383 * 384 * If they don't they interpret pixel_format values 385 * incorrectly for bug compatibility, which in turn 386 * implies the ADDFB2 ioctl does not work correctly 387 * then. So block it to make userspace fallback to 388 * ADDFB. 389 */ 390 DRM_DEBUG_KMS("addfb2 broken on bigendian"); 391 return -EOPNOTSUPP; 392 } 393 #endif 394 return drm_mode_addfb2(dev, data, file_priv); 395 } 396 397 struct drm_mode_rmfb_work { 398 struct work_struct work; 399 struct list_head fbs; 400 }; 401 402 static void drm_mode_rmfb_work_fn(struct work_struct *w) 403 { 404 struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work); 405 406 while (!list_empty(&arg->fbs)) { 407 struct drm_framebuffer *fb = 408 list_first_entry(&arg->fbs, typeof(*fb), filp_head); 409 410 list_del_init(&fb->filp_head); 411 drm_framebuffer_remove(fb); 412 } 413 } 414 415 /** 416 * drm_mode_rmfb - remove an FB from the configuration 417 * @dev: drm device 418 * @fb_id: id of framebuffer to remove 419 * @file_priv: drm file 420 * 421 * Remove the specified FB. 422 * 423 * Called by the user via ioctl, or by an in-kernel client. 424 * 425 * Returns: 426 * Zero on success, negative errno on failure. 427 */ 428 int drm_mode_rmfb(struct drm_device *dev, u32 fb_id, 429 struct drm_file *file_priv) 430 { 431 struct drm_framebuffer *fb = NULL; 432 struct drm_framebuffer *fbl = NULL; 433 int found = 0; 434 435 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 436 return -EOPNOTSUPP; 437 438 fb = drm_framebuffer_lookup(dev, file_priv, fb_id); 439 if (!fb) 440 return -ENOENT; 441 442 mutex_lock(&file_priv->fbs_lock); 443 list_for_each_entry(fbl, &file_priv->fbs, filp_head) 444 if (fb == fbl) 445 found = 1; 446 if (!found) { 447 mutex_unlock(&file_priv->fbs_lock); 448 goto fail_unref; 449 } 450 451 list_del_init(&fb->filp_head); 452 mutex_unlock(&file_priv->fbs_lock); 453 454 /* drop the reference we picked up in framebuffer lookup */ 455 drm_framebuffer_put(fb); 456 457 /* 458 * we now own the reference that was stored in the fbs list 459 * 460 * drm_framebuffer_remove may fail with -EINTR on pending signals, 461 * so run this in a separate stack as there's no way to correctly 462 * handle this after the fb is already removed from the lookup table. 463 */ 464 if (drm_framebuffer_read_refcount(fb) > 1) { 465 struct drm_mode_rmfb_work arg; 466 467 INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn); 468 INIT_LIST_HEAD(&arg.fbs); 469 list_add_tail(&fb->filp_head, &arg.fbs); 470 471 schedule_work(&arg.work); 472 flush_work(&arg.work); 473 destroy_work_on_stack(&arg.work); 474 } else 475 drm_framebuffer_put(fb); 476 477 return 0; 478 479 fail_unref: 480 drm_framebuffer_put(fb); 481 return -ENOENT; 482 } 483 484 int drm_mode_rmfb_ioctl(struct drm_device *dev, 485 void *data, struct drm_file *file_priv) 486 { 487 uint32_t *fb_id = data; 488 489 return drm_mode_rmfb(dev, *fb_id, file_priv); 490 } 491 492 /** 493 * drm_mode_getfb - get FB info 494 * @dev: drm device for the ioctl 495 * @data: data pointer for the ioctl 496 * @file_priv: drm file for the ioctl call 497 * 498 * Lookup the FB given its ID and return info about it. 499 * 500 * Called by the user via ioctl. 501 * 502 * Returns: 503 * Zero on success, negative errno on failure. 504 */ 505 int drm_mode_getfb(struct drm_device *dev, 506 void *data, struct drm_file *file_priv) 507 { 508 struct drm_mode_fb_cmd *r = data; 509 struct drm_framebuffer *fb; 510 int ret; 511 512 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 513 return -EOPNOTSUPP; 514 515 fb = drm_framebuffer_lookup(dev, file_priv, r->fb_id); 516 if (!fb) 517 return -ENOENT; 518 519 /* Multi-planar framebuffers need getfb2. */ 520 if (fb->format->num_planes > 1) { 521 ret = -EINVAL; 522 goto out; 523 } 524 525 if (!fb->funcs->create_handle) { 526 ret = -ENODEV; 527 goto out; 528 } 529 530 r->height = fb->height; 531 r->width = fb->width; 532 r->depth = fb->format->depth; 533 r->bpp = fb->format->cpp[0] * 8; 534 r->pitch = fb->pitches[0]; 535 536 /* GET_FB() is an unprivileged ioctl so we must not return a 537 * buffer-handle to non-master processes! For 538 * backwards-compatibility reasons, we cannot make GET_FB() privileged, 539 * so just return an invalid handle for non-masters. 540 */ 541 if (!drm_is_current_master(file_priv) && !capable(CAP_SYS_ADMIN)) { 542 r->handle = 0; 543 ret = 0; 544 goto out; 545 } 546 547 ret = fb->funcs->create_handle(fb, file_priv, &r->handle); 548 549 out: 550 drm_framebuffer_put(fb); 551 552 return ret; 553 } 554 555 /** 556 * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB 557 * @dev: drm device for the ioctl 558 * @data: data pointer for the ioctl 559 * @file_priv: drm file for the ioctl call 560 * 561 * Lookup the FB and flush out the damaged area supplied by userspace as a clip 562 * rectangle list. Generic userspace which does frontbuffer rendering must call 563 * this ioctl to flush out the changes on manual-update display outputs, e.g. 564 * usb display-link, mipi manual update panels or edp panel self refresh modes. 565 * 566 * Modesetting drivers which always update the frontbuffer do not need to 567 * implement the corresponding &drm_framebuffer_funcs.dirty callback. 568 * 569 * Called by the user via ioctl. 570 * 571 * Returns: 572 * Zero on success, negative errno on failure. 573 */ 574 int drm_mode_dirtyfb_ioctl(struct drm_device *dev, 575 void *data, struct drm_file *file_priv) 576 { 577 struct drm_clip_rect __user *clips_ptr; 578 struct drm_clip_rect *clips = NULL; 579 struct drm_mode_fb_dirty_cmd *r = data; 580 struct drm_framebuffer *fb; 581 unsigned flags; 582 int num_clips; 583 int ret; 584 585 if (!drm_core_check_feature(dev, DRIVER_MODESET)) 586 return -EOPNOTSUPP; 587 588 fb = drm_framebuffer_lookup(dev, file_priv, r->fb_id); 589 if (!fb) 590 return -ENOENT; 591 592 num_clips = r->num_clips; 593 clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr; 594 595 if (!num_clips != !clips_ptr) { 596 ret = -EINVAL; 597 goto out_err1; 598 } 599 600 flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags; 601 602 /* If userspace annotates copy, clips must come in pairs */ 603 if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) { 604 ret = -EINVAL; 605 goto out_err1; 606 } 607 608 if (num_clips && clips_ptr) { 609 if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) { 610 ret = -EINVAL; 611 goto out_err1; 612 } 613 clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL); 614 if (!clips) { 615 ret = -ENOMEM; 616 goto out_err1; 617 } 618 619 ret = copy_from_user(clips, clips_ptr, 620 num_clips * sizeof(*clips)); 621 if (ret) { 622 ret = -EFAULT; 623 goto out_err2; 624 } 625 } 626 627 if (fb->funcs->dirty) { 628 ret = fb->funcs->dirty(fb, file_priv, flags, r->color, 629 clips, num_clips); 630 } else { 631 ret = -ENOSYS; 632 } 633 634 out_err2: 635 kfree(clips); 636 out_err1: 637 drm_framebuffer_put(fb); 638 639 return ret; 640 } 641 642 /** 643 * drm_fb_release - remove and free the FBs on this file 644 * @priv: drm file for the ioctl 645 * 646 * Destroy all the FBs associated with @filp. 647 * 648 * Called by the user via ioctl. 649 * 650 * Returns: 651 * Zero on success, negative errno on failure. 652 */ 653 void drm_fb_release(struct drm_file *priv) 654 { 655 struct drm_framebuffer *fb, *tfb; 656 struct drm_mode_rmfb_work arg; 657 658 INIT_LIST_HEAD(&arg.fbs); 659 660 /* 661 * When the file gets released that means no one else can access the fb 662 * list any more, so no need to grab fpriv->fbs_lock. And we need to 663 * avoid upsetting lockdep since the universal cursor code adds a 664 * framebuffer while holding mutex locks. 665 * 666 * Note that a real deadlock between fpriv->fbs_lock and the modeset 667 * locks is impossible here since no one else but this function can get 668 * at it any more. 669 */ 670 list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) { 671 if (drm_framebuffer_read_refcount(fb) > 1) { 672 list_move_tail(&fb->filp_head, &arg.fbs); 673 } else { 674 list_del_init(&fb->filp_head); 675 676 /* This drops the fpriv->fbs reference. */ 677 drm_framebuffer_put(fb); 678 } 679 } 680 681 if (!list_empty(&arg.fbs)) { 682 INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn); 683 684 schedule_work(&arg.work); 685 flush_work(&arg.work); 686 destroy_work_on_stack(&arg.work); 687 } 688 } 689 690 void drm_framebuffer_free(struct kref *kref) 691 { 692 struct drm_framebuffer *fb = 693 container_of(kref, struct drm_framebuffer, base.refcount); 694 struct drm_device *dev = fb->dev; 695 696 /* 697 * The lookup idr holds a weak reference, which has not necessarily been 698 * removed at this point. Check for that. 699 */ 700 drm_mode_object_unregister(dev, &fb->base); 701 702 fb->funcs->destroy(fb); 703 } 704 705 /** 706 * drm_framebuffer_init - initialize a framebuffer 707 * @dev: DRM device 708 * @fb: framebuffer to be initialized 709 * @funcs: ... with these functions 710 * 711 * Allocates an ID for the framebuffer's parent mode object, sets its mode 712 * functions & device file and adds it to the master fd list. 713 * 714 * IMPORTANT: 715 * This functions publishes the fb and makes it available for concurrent access 716 * by other users. Which means by this point the fb _must_ be fully set up - 717 * since all the fb attributes are invariant over its lifetime, no further 718 * locking but only correct reference counting is required. 719 * 720 * Returns: 721 * Zero on success, error code on failure. 722 */ 723 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, 724 const struct drm_framebuffer_funcs *funcs) 725 { 726 int ret; 727 728 if (WARN_ON_ONCE(fb->dev != dev || !fb->format)) 729 return -EINVAL; 730 731 INIT_LIST_HEAD(&fb->filp_head); 732 733 fb->funcs = funcs; 734 strcpy(fb->comm, current->comm); 735 736 ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB, 737 false, drm_framebuffer_free); 738 if (ret) 739 goto out; 740 741 mutex_lock(&dev->mode_config.fb_lock); 742 dev->mode_config.num_fb++; 743 list_add(&fb->head, &dev->mode_config.fb_list); 744 mutex_unlock(&dev->mode_config.fb_lock); 745 746 drm_mode_object_register(dev, &fb->base); 747 out: 748 return ret; 749 } 750 EXPORT_SYMBOL(drm_framebuffer_init); 751 752 /** 753 * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference 754 * @dev: drm device 755 * @file_priv: drm file to check for lease against. 756 * @id: id of the fb object 757 * 758 * If successful, this grabs an additional reference to the framebuffer - 759 * callers need to make sure to eventually unreference the returned framebuffer 760 * again, using drm_framebuffer_put(). 761 */ 762 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev, 763 struct drm_file *file_priv, 764 uint32_t id) 765 { 766 struct drm_mode_object *obj; 767 struct drm_framebuffer *fb = NULL; 768 769 obj = __drm_mode_object_find(dev, file_priv, id, DRM_MODE_OBJECT_FB); 770 if (obj) 771 fb = obj_to_fb(obj); 772 return fb; 773 } 774 EXPORT_SYMBOL(drm_framebuffer_lookup); 775 776 /** 777 * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr 778 * @fb: fb to unregister 779 * 780 * Drivers need to call this when cleaning up driver-private framebuffers, e.g. 781 * those used for fbdev. Note that the caller must hold a reference of its own, 782 * i.e. the object may not be destroyed through this call (since it'll lead to a 783 * locking inversion). 784 * 785 * NOTE: This function is deprecated. For driver-private framebuffers it is not 786 * recommended to embed a framebuffer struct info fbdev struct, instead, a 787 * framebuffer pointer is preferred and drm_framebuffer_put() should be called 788 * when the framebuffer is to be cleaned up. 789 */ 790 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb) 791 { 792 struct drm_device *dev; 793 794 if (!fb) 795 return; 796 797 dev = fb->dev; 798 799 /* Mark fb as reaped and drop idr ref. */ 800 drm_mode_object_unregister(dev, &fb->base); 801 } 802 EXPORT_SYMBOL(drm_framebuffer_unregister_private); 803 804 /** 805 * drm_framebuffer_cleanup - remove a framebuffer object 806 * @fb: framebuffer to remove 807 * 808 * Cleanup framebuffer. This function is intended to be used from the drivers 809 * &drm_framebuffer_funcs.destroy callback. It can also be used to clean up 810 * driver private framebuffers embedded into a larger structure. 811 * 812 * Note that this function does not remove the fb from active usage - if it is 813 * still used anywhere, hilarity can ensue since userspace could call getfb on 814 * the id and get back -EINVAL. Obviously no concern at driver unload time. 815 * 816 * Also, the framebuffer will not be removed from the lookup idr - for 817 * user-created framebuffers this will happen in in the rmfb ioctl. For 818 * driver-private objects (e.g. for fbdev) drivers need to explicitly call 819 * drm_framebuffer_unregister_private. 820 */ 821 void drm_framebuffer_cleanup(struct drm_framebuffer *fb) 822 { 823 struct drm_device *dev = fb->dev; 824 825 mutex_lock(&dev->mode_config.fb_lock); 826 list_del(&fb->head); 827 dev->mode_config.num_fb--; 828 mutex_unlock(&dev->mode_config.fb_lock); 829 } 830 EXPORT_SYMBOL(drm_framebuffer_cleanup); 831 832 static int atomic_remove_fb(struct drm_framebuffer *fb) 833 { 834 struct drm_modeset_acquire_ctx ctx; 835 struct drm_device *dev = fb->dev; 836 struct drm_atomic_state *state; 837 struct drm_plane *plane; 838 struct drm_connector *conn __maybe_unused; 839 struct drm_connector_state *conn_state; 840 int i, ret; 841 unsigned plane_mask; 842 bool disable_crtcs = false; 843 844 retry_disable: 845 drm_modeset_acquire_init(&ctx, 0); 846 847 state = drm_atomic_state_alloc(dev); 848 if (!state) { 849 ret = -ENOMEM; 850 goto out; 851 } 852 state->acquire_ctx = &ctx; 853 854 retry: 855 plane_mask = 0; 856 ret = drm_modeset_lock_all_ctx(dev, &ctx); 857 if (ret) 858 goto unlock; 859 860 drm_for_each_plane(plane, dev) { 861 struct drm_plane_state *plane_state; 862 863 if (plane->state->fb != fb) 864 continue; 865 866 plane_state = drm_atomic_get_plane_state(state, plane); 867 if (IS_ERR(plane_state)) { 868 ret = PTR_ERR(plane_state); 869 goto unlock; 870 } 871 872 if (disable_crtcs && plane_state->crtc->primary == plane) { 873 struct drm_crtc_state *crtc_state; 874 875 crtc_state = drm_atomic_get_existing_crtc_state(state, plane_state->crtc); 876 877 ret = drm_atomic_add_affected_connectors(state, plane_state->crtc); 878 if (ret) 879 goto unlock; 880 881 crtc_state->active = false; 882 ret = drm_atomic_set_mode_for_crtc(crtc_state, NULL); 883 if (ret) 884 goto unlock; 885 } 886 887 drm_atomic_set_fb_for_plane(plane_state, NULL); 888 ret = drm_atomic_set_crtc_for_plane(plane_state, NULL); 889 if (ret) 890 goto unlock; 891 892 plane_mask |= drm_plane_mask(plane); 893 } 894 895 /* This list is only filled when disable_crtcs is set. */ 896 for_each_new_connector_in_state(state, conn, conn_state, i) { 897 ret = drm_atomic_set_crtc_for_connector(conn_state, NULL); 898 899 if (ret) 900 goto unlock; 901 } 902 903 if (plane_mask) 904 ret = drm_atomic_commit(state); 905 906 unlock: 907 if (ret == -EDEADLK) { 908 drm_atomic_state_clear(state); 909 drm_modeset_backoff(&ctx); 910 goto retry; 911 } 912 913 drm_atomic_state_put(state); 914 915 out: 916 drm_modeset_drop_locks(&ctx); 917 drm_modeset_acquire_fini(&ctx); 918 919 if (ret == -EINVAL && !disable_crtcs) { 920 disable_crtcs = true; 921 goto retry_disable; 922 } 923 924 return ret; 925 } 926 927 static void legacy_remove_fb(struct drm_framebuffer *fb) 928 { 929 struct drm_device *dev = fb->dev; 930 struct drm_crtc *crtc; 931 struct drm_plane *plane; 932 933 drm_modeset_lock_all(dev); 934 /* remove from any CRTC */ 935 drm_for_each_crtc(crtc, dev) { 936 if (crtc->primary->fb == fb) { 937 /* should turn off the crtc */ 938 if (drm_crtc_force_disable(crtc)) 939 DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc); 940 } 941 } 942 943 drm_for_each_plane(plane, dev) { 944 if (plane->fb == fb) 945 drm_plane_force_disable(plane); 946 } 947 drm_modeset_unlock_all(dev); 948 } 949 950 /** 951 * drm_framebuffer_remove - remove and unreference a framebuffer object 952 * @fb: framebuffer to remove 953 * 954 * Scans all the CRTCs and planes in @dev's mode_config. If they're 955 * using @fb, removes it, setting it to NULL. Then drops the reference to the 956 * passed-in framebuffer. Might take the modeset locks. 957 * 958 * Note that this function optimizes the cleanup away if the caller holds the 959 * last reference to the framebuffer. It is also guaranteed to not take the 960 * modeset locks in this case. 961 */ 962 void drm_framebuffer_remove(struct drm_framebuffer *fb) 963 { 964 struct drm_device *dev; 965 966 if (!fb) 967 return; 968 969 dev = fb->dev; 970 971 WARN_ON(!list_empty(&fb->filp_head)); 972 973 /* 974 * drm ABI mandates that we remove any deleted framebuffers from active 975 * useage. But since most sane clients only remove framebuffers they no 976 * longer need, try to optimize this away. 977 * 978 * Since we're holding a reference ourselves, observing a refcount of 1 979 * means that we're the last holder and can skip it. Also, the refcount 980 * can never increase from 1 again, so we don't need any barriers or 981 * locks. 982 * 983 * Note that userspace could try to race with use and instate a new 984 * usage _after_ we've cleared all current ones. End result will be an 985 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot 986 * in this manner. 987 */ 988 if (drm_framebuffer_read_refcount(fb) > 1) { 989 if (drm_drv_uses_atomic_modeset(dev)) { 990 int ret = atomic_remove_fb(fb); 991 WARN(ret, "atomic remove_fb failed with %i\n", ret); 992 } else 993 legacy_remove_fb(fb); 994 } 995 996 drm_framebuffer_put(fb); 997 } 998 EXPORT_SYMBOL(drm_framebuffer_remove); 999 1000 /** 1001 * drm_framebuffer_plane_width - width of the plane given the first plane 1002 * @width: width of the first plane 1003 * @fb: the framebuffer 1004 * @plane: plane index 1005 * 1006 * Returns: 1007 * The width of @plane, given that the width of the first plane is @width. 1008 */ 1009 int drm_framebuffer_plane_width(int width, 1010 const struct drm_framebuffer *fb, int plane) 1011 { 1012 if (plane >= fb->format->num_planes) 1013 return 0; 1014 1015 return fb_plane_width(width, fb->format, plane); 1016 } 1017 EXPORT_SYMBOL(drm_framebuffer_plane_width); 1018 1019 /** 1020 * drm_framebuffer_plane_height - height of the plane given the first plane 1021 * @height: height of the first plane 1022 * @fb: the framebuffer 1023 * @plane: plane index 1024 * 1025 * Returns: 1026 * The height of @plane, given that the height of the first plane is @height. 1027 */ 1028 int drm_framebuffer_plane_height(int height, 1029 const struct drm_framebuffer *fb, int plane) 1030 { 1031 if (plane >= fb->format->num_planes) 1032 return 0; 1033 1034 return fb_plane_height(height, fb->format, plane); 1035 } 1036 EXPORT_SYMBOL(drm_framebuffer_plane_height); 1037 1038 void drm_framebuffer_print_info(struct drm_printer *p, unsigned int indent, 1039 const struct drm_framebuffer *fb) 1040 { 1041 struct drm_format_name_buf format_name; 1042 unsigned int i; 1043 1044 drm_printf_indent(p, indent, "allocated by = %s\n", fb->comm); 1045 drm_printf_indent(p, indent, "refcount=%u\n", 1046 drm_framebuffer_read_refcount(fb)); 1047 drm_printf_indent(p, indent, "format=%s\n", 1048 drm_get_format_name(fb->format->format, &format_name)); 1049 drm_printf_indent(p, indent, "modifier=0x%llx\n", fb->modifier); 1050 drm_printf_indent(p, indent, "size=%ux%u\n", fb->width, fb->height); 1051 drm_printf_indent(p, indent, "layers:\n"); 1052 1053 for (i = 0; i < fb->format->num_planes; i++) { 1054 drm_printf_indent(p, indent + 1, "size[%u]=%dx%d\n", i, 1055 drm_framebuffer_plane_width(fb->width, fb, i), 1056 drm_framebuffer_plane_height(fb->height, fb, i)); 1057 drm_printf_indent(p, indent + 1, "pitch[%u]=%u\n", i, fb->pitches[i]); 1058 drm_printf_indent(p, indent + 1, "offset[%u]=%u\n", i, fb->offsets[i]); 1059 drm_printf_indent(p, indent + 1, "obj[%u]:%s\n", i, 1060 fb->obj[i] ? "" : "(null)"); 1061 if (fb->obj[i]) 1062 drm_gem_print_info(p, indent + 2, fb->obj[i]); 1063 } 1064 } 1065 1066 #ifdef CONFIG_DEBUG_FS 1067 static int drm_framebuffer_info(struct seq_file *m, void *data) 1068 { 1069 struct drm_info_node *node = m->private; 1070 struct drm_device *dev = node->minor->dev; 1071 struct drm_printer p = drm_seq_file_printer(m); 1072 struct drm_framebuffer *fb; 1073 1074 mutex_lock(&dev->mode_config.fb_lock); 1075 drm_for_each_fb(fb, dev) { 1076 drm_printf(&p, "framebuffer[%u]:\n", fb->base.id); 1077 drm_framebuffer_print_info(&p, 1, fb); 1078 } 1079 mutex_unlock(&dev->mode_config.fb_lock); 1080 1081 return 0; 1082 } 1083 1084 static const struct drm_info_list drm_framebuffer_debugfs_list[] = { 1085 { "framebuffer", drm_framebuffer_info, 0 }, 1086 }; 1087 1088 int drm_framebuffer_debugfs_init(struct drm_minor *minor) 1089 { 1090 return drm_debugfs_create_files(drm_framebuffer_debugfs_list, 1091 ARRAY_SIZE(drm_framebuffer_debugfs_list), 1092 minor->debugfs_root, minor); 1093 } 1094 #endif 1095