xref: /netbsd-src/sys/external/bsd/drm2/dist/drm/drm_crtc.c (revision 2d8e86c2f207da6fbbd50f11b6f33765ebdfa0e9)
1 /*	$NetBSD: drm_crtc.c,v 1.11 2018/08/27 14:40:30 riastradh Exp $	*/
2 
3 /*
4  * Copyright (c) 2006-2008 Intel Corporation
5  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
6  * Copyright (c) 2008 Red Hat Inc.
7  *
8  * DRM core CRTC related functions
9  *
10  * Permission to use, copy, modify, distribute, and sell this software and its
11  * documentation for any purpose is hereby granted without fee, provided that
12  * the above copyright notice appear in all copies and that both that copyright
13  * notice and this permission notice appear in supporting documentation, and
14  * that the name of the copyright holders not be used in advertising or
15  * publicity pertaining to distribution of the software without specific,
16  * written prior permission.  The copyright holders make no representations
17  * about the suitability of this software for any purpose.  It is provided "as
18  * is" without express or implied warranty.
19  *
20  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
21  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
22  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
23  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
24  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
25  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
26  * OF THIS SOFTWARE.
27  *
28  * Authors:
29  *      Keith Packard
30  *	Eric Anholt <eric@anholt.net>
31  *      Dave Airlie <airlied@linux.ie>
32  *      Jesse Barnes <jesse.barnes@intel.com>
33  */
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: drm_crtc.c,v 1.11 2018/08/27 14:40:30 riastradh Exp $");
36 
37 #include <linux/err.h>
38 #include <linux/spinlock.h>
39 #include <linux/ctype.h>
40 #include <linux/list.h>
41 #include <linux/slab.h>
42 #include <linux/export.h>
43 #include <linux/errno.h>
44 #include <asm/bug.h>
45 #include <drm/drmP.h>
46 #include <drm/drm_crtc.h>
47 #include <drm/drm_edid.h>
48 #include <drm/drm_fourcc.h>
49 #include <drm/drm_modeset_lock.h>
50 #include <drm/drm_atomic.h>
51 
52 #include "drm_crtc_internal.h"
53 #include "drm_internal.h"
54 
55 static struct drm_framebuffer *
56 internal_framebuffer_create(struct drm_device *dev,
57 			    struct drm_mode_fb_cmd2 *r,
58 			    struct drm_file *file_priv);
59 
60 /* Avoid boilerplate.  I'm tired of typing. */
61 #define DRM_ENUM_NAME_FN(fnname, list)				\
62 	const char *fnname(int val)				\
63 	{							\
64 		int i;						\
65 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
66 			if (list[i].type == val)		\
67 				return list[i].name;		\
68 		}						\
69 		return "(unknown)";				\
70 	}
71 
72 /*
73  * Global properties
74  */
75 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
76 	{ DRM_MODE_DPMS_ON, "On" },
77 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
78 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
79 	{ DRM_MODE_DPMS_OFF, "Off" }
80 };
81 
82 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
83 
84 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
85 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
86 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
87 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
88 };
89 
90 /*
91  * Optional properties
92  */
93 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
94 	{ DRM_MODE_SCALE_NONE, "None" },
95 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
96 	{ DRM_MODE_SCALE_CENTER, "Center" },
97 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
98 };
99 
100 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
101 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
102 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
103 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
104 };
105 
106 /*
107  * Non-global properties, but "required" for certain connectors.
108  */
109 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
110 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
111 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
112 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
113 };
114 
115 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
116 
117 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
120 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
121 };
122 
123 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
124 		 drm_dvi_i_subconnector_enum_list)
125 
126 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
127 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
128 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
132 };
133 
134 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
135 
136 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
137 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
138 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
139 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
140 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
141 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
142 };
143 
144 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
145 		 drm_tv_subconnector_enum_list)
146 
147 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
148 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
149 	{ DRM_MODE_DIRTY_ON,       "On"       },
150 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
151 };
152 
153 struct drm_conn_prop_enum_list {
154 	int type;
155 	const char *name;
156 	struct ida ida;
157 };
158 
159 /*
160  * Connector and encoder types.
161  */
162 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
163 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
164 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
165 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
166 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
167 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
168 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
169 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
170 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
171 	{ DRM_MODE_CONNECTOR_Component, "Component" },
172 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
173 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
174 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
175 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
176 	{ DRM_MODE_CONNECTOR_TV, "TV" },
177 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
178 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
179 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
180 };
181 
182 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
183 	{ DRM_MODE_ENCODER_NONE, "None" },
184 	{ DRM_MODE_ENCODER_DAC, "DAC" },
185 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
186 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
187 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
188 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
189 	{ DRM_MODE_ENCODER_DSI, "DSI" },
190 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
191 };
192 
193 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
194 	{ SubPixelUnknown, "Unknown" },
195 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
196 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
197 	{ SubPixelVerticalRGB, "Vertical RGB" },
198 	{ SubPixelVerticalBGR, "Vertical BGR" },
199 	{ SubPixelNone, "None" },
200 };
201 
202 void drm_connector_ida_init(void)
203 {
204 	int i;
205 
206 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
207 		ida_init(&drm_connector_enum_list[i].ida);
208 }
209 
210 void drm_connector_ida_destroy(void)
211 {
212 	int i;
213 
214 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
215 		ida_destroy(&drm_connector_enum_list[i].ida);
216 }
217 
218 /**
219  * drm_get_connector_status_name - return a string for connector status
220  * @status: connector status to compute name of
221  *
222  * In contrast to the other drm_get_*_name functions this one here returns a
223  * const pointer and hence is threadsafe.
224  */
225 const char *drm_get_connector_status_name(enum drm_connector_status status)
226 {
227 	if (status == connector_status_connected)
228 		return "connected";
229 	else if (status == connector_status_disconnected)
230 		return "disconnected";
231 	else
232 		return "unknown";
233 }
234 EXPORT_SYMBOL(drm_get_connector_status_name);
235 
236 /**
237  * drm_get_subpixel_order_name - return a string for a given subpixel enum
238  * @order: enum of subpixel_order
239  *
240  * Note you could abuse this and return something out of bounds, but that
241  * would be a caller error.  No unscrubbed user data should make it here.
242  */
243 const char *drm_get_subpixel_order_name(enum subpixel_order order)
244 {
245 	return drm_subpixel_enum_list[order].name;
246 }
247 EXPORT_SYMBOL(drm_get_subpixel_order_name);
248 
249 static char printable_char(int c)
250 {
251 	return isascii(c) && isprint(c) ? c : '?';
252 }
253 
254 /**
255  * drm_get_format_name - return a string for drm fourcc format
256  * @format: format to compute name of
257  *
258  * Note that the buffer used by this function is globally shared and owned by
259  * the function itself.
260  *
261  * FIXME: This isn't really multithreading safe.
262  */
263 const char *drm_get_format_name(uint32_t format)
264 {
265 	static char buf[32];
266 
267 	snprintf(buf, sizeof(buf),
268 		 "%c%c%c%c %s-endian (0x%08x)",
269 		 printable_char(format & 0xff),
270 		 printable_char((format >> 8) & 0xff),
271 		 printable_char((format >> 16) & 0xff),
272 		 printable_char((format >> 24) & 0x7f),
273 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
274 		 format);
275 
276 	return buf;
277 }
278 EXPORT_SYMBOL(drm_get_format_name);
279 
280 /*
281  * Internal function to assign a slot in the object idr and optionally
282  * register the object into the idr.
283  */
284 static int drm_mode_object_get_reg(struct drm_device *dev,
285 				   struct drm_mode_object *obj,
286 				   uint32_t obj_type,
287 				   bool register_obj)
288 {
289 	int ret;
290 
291 	idr_preload(GFP_KERNEL);
292 	mutex_lock(&dev->mode_config.idr_mutex);
293 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
294 	if (ret >= 0) {
295 		/*
296 		 * Set up the object linking under the protection of the idr
297 		 * lock so that other users can't see inconsistent state.
298 		 */
299 		obj->id = ret;
300 		obj->type = obj_type;
301 	}
302 	mutex_unlock(&dev->mode_config.idr_mutex);
303 	idr_preload_end();
304 
305 	return ret < 0 ? ret : 0;
306 }
307 
308 /**
309  * drm_mode_object_get - allocate a new modeset identifier
310  * @dev: DRM device
311  * @obj: object pointer, used to generate unique ID
312  * @obj_type: object type
313  *
314  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
315  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
316  * modeset identifiers are _not_ reference counted. Hence don't use this for
317  * reference counted modeset objects like framebuffers.
318  *
319  * Returns:
320  * Zero on success, error code on failure.
321  */
322 int drm_mode_object_get(struct drm_device *dev,
323 			struct drm_mode_object *obj, uint32_t obj_type)
324 {
325 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
326 }
327 
328 static void drm_mode_object_register(struct drm_device *dev,
329 				     struct drm_mode_object *obj)
330 {
331 	mutex_lock(&dev->mode_config.idr_mutex);
332 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
333 	mutex_unlock(&dev->mode_config.idr_mutex);
334 }
335 
336 /**
337  * drm_mode_object_put - free a modeset identifer
338  * @dev: DRM device
339  * @object: object to free
340  *
341  * Free @id from @dev's unique identifier pool. Note that despite the _get
342  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
343  * for reference counted modeset objects like framebuffers.
344  */
345 void drm_mode_object_put(struct drm_device *dev,
346 			 struct drm_mode_object *object)
347 {
348 	mutex_lock(&dev->mode_config.idr_mutex);
349 	idr_remove(&dev->mode_config.crtc_idr, object->id);
350 	mutex_unlock(&dev->mode_config.idr_mutex);
351 }
352 
353 static struct drm_mode_object *_object_find(struct drm_device *dev,
354 		uint32_t id, uint32_t type)
355 {
356 	struct drm_mode_object *obj = NULL;
357 
358 	mutex_lock(&dev->mode_config.idr_mutex);
359 	obj = idr_find(&dev->mode_config.crtc_idr, id);
360 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
361 		obj = NULL;
362 	if (obj && obj->id != id)
363 		obj = NULL;
364 	/* don't leak out unref'd fb's */
365 	if (obj &&
366 	    (obj->type == DRM_MODE_OBJECT_FB ||
367 	     obj->type == DRM_MODE_OBJECT_BLOB))
368 		obj = NULL;
369 	mutex_unlock(&dev->mode_config.idr_mutex);
370 
371 	return obj;
372 }
373 
374 /**
375  * drm_mode_object_find - look up a drm object with static lifetime
376  * @dev: drm device
377  * @id: id of the mode object
378  * @type: type of the mode object
379  *
380  * Note that framebuffers cannot be looked up with this functions - since those
381  * are reference counted, they need special treatment.  Even with
382  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
383  * rather than WARN_ON()).
384  */
385 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
386 		uint32_t id, uint32_t type)
387 {
388 	struct drm_mode_object *obj = NULL;
389 
390 	/* Framebuffers are reference counted and need their own lookup
391 	 * function.*/
392 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
393 	obj = _object_find(dev, id, type);
394 	return obj;
395 }
396 EXPORT_SYMBOL(drm_mode_object_find);
397 
398 /**
399  * drm_framebuffer_init - initialize a framebuffer
400  * @dev: DRM device
401  * @fb: framebuffer to be initialized
402  * @funcs: ... with these functions
403  *
404  * Allocates an ID for the framebuffer's parent mode object, sets its mode
405  * functions & device file and adds it to the master fd list.
406  *
407  * IMPORTANT:
408  * This functions publishes the fb and makes it available for concurrent access
409  * by other users. Which means by this point the fb _must_ be fully set up -
410  * since all the fb attributes are invariant over its lifetime, no further
411  * locking but only correct reference counting is required.
412  *
413  * Returns:
414  * Zero on success, error code on failure.
415  */
416 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
417 			 const struct drm_framebuffer_funcs *funcs)
418 {
419 	int ret;
420 
421 	mutex_lock(&dev->mode_config.fb_lock);
422 	kref_init(&fb->refcount);
423 	INIT_LIST_HEAD(&fb->filp_head);
424 	fb->dev = dev;
425 	fb->funcs = funcs;
426 
427 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
428 	if (ret)
429 		goto out;
430 
431 	dev->mode_config.num_fb++;
432 	list_add(&fb->head, &dev->mode_config.fb_list);
433 out:
434 	mutex_unlock(&dev->mode_config.fb_lock);
435 
436 	return ret;
437 }
438 EXPORT_SYMBOL(drm_framebuffer_init);
439 
440 /* dev->mode_config.fb_lock must be held! */
441 static void __drm_framebuffer_unregister(struct drm_device *dev,
442 					 struct drm_framebuffer *fb)
443 {
444 	mutex_lock(&dev->mode_config.idr_mutex);
445 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
446 	mutex_unlock(&dev->mode_config.idr_mutex);
447 
448 	fb->base.id = 0;
449 }
450 
451 static void drm_framebuffer_free(struct kref *kref)
452 {
453 	struct drm_framebuffer *fb =
454 			container_of(kref, struct drm_framebuffer, refcount);
455 	struct drm_device *dev = fb->dev;
456 
457 	/*
458 	 * The lookup idr holds a weak reference, which has not necessarily been
459 	 * removed at this point. Check for that.
460 	 */
461 	mutex_lock(&dev->mode_config.fb_lock);
462 	if (fb->base.id) {
463 		/* Mark fb as reaped and drop idr ref. */
464 		__drm_framebuffer_unregister(dev, fb);
465 	}
466 	mutex_unlock(&dev->mode_config.fb_lock);
467 
468 	fb->funcs->destroy(fb);
469 }
470 
471 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
472 							uint32_t id)
473 {
474 	struct drm_mode_object *obj = NULL;
475 	struct drm_framebuffer *fb;
476 
477 	mutex_lock(&dev->mode_config.idr_mutex);
478 	obj = idr_find(&dev->mode_config.crtc_idr, id);
479 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
480 		fb = NULL;
481 	else
482 		fb = obj_to_fb(obj);
483 	mutex_unlock(&dev->mode_config.idr_mutex);
484 
485 	return fb;
486 }
487 
488 /**
489  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
490  * @dev: drm device
491  * @id: id of the fb object
492  *
493  * If successful, this grabs an additional reference to the framebuffer -
494  * callers need to make sure to eventually unreference the returned framebuffer
495  * again, using @drm_framebuffer_unreference.
496  */
497 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
498 					       uint32_t id)
499 {
500 	struct drm_framebuffer *fb;
501 
502 	mutex_lock(&dev->mode_config.fb_lock);
503 	fb = __drm_framebuffer_lookup(dev, id);
504 	if (fb) {
505 		if (!kref_get_unless_zero(&fb->refcount))
506 			fb = NULL;
507 	}
508 	mutex_unlock(&dev->mode_config.fb_lock);
509 
510 	return fb;
511 }
512 EXPORT_SYMBOL(drm_framebuffer_lookup);
513 
514 /**
515  * drm_framebuffer_unreference - unref a framebuffer
516  * @fb: framebuffer to unref
517  *
518  * This functions decrements the fb's refcount and frees it if it drops to zero.
519  */
520 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
521 {
522 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, fb->refcount.kr_count);
523 	kref_put(&fb->refcount, drm_framebuffer_free);
524 }
525 EXPORT_SYMBOL(drm_framebuffer_unreference);
526 
527 /**
528  * drm_framebuffer_reference - incr the fb refcnt
529  * @fb: framebuffer
530  *
531  * This functions increments the fb's refcount.
532  */
533 void drm_framebuffer_reference(struct drm_framebuffer *fb)
534 {
535 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, fb->refcount.kr_count);
536 	kref_get(&fb->refcount);
537 }
538 EXPORT_SYMBOL(drm_framebuffer_reference);
539 
540 /**
541  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
542  * @fb: fb to unregister
543  *
544  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
545  * those used for fbdev. Note that the caller must hold a reference of it's own,
546  * i.e. the object may not be destroyed through this call (since it'll lead to a
547  * locking inversion).
548  */
549 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
550 {
551 	struct drm_device *dev;
552 
553 	if (!fb)
554 		return;
555 
556 	dev = fb->dev;
557 
558 	mutex_lock(&dev->mode_config.fb_lock);
559 	/* Mark fb as reaped and drop idr ref. */
560 	__drm_framebuffer_unregister(dev, fb);
561 	mutex_unlock(&dev->mode_config.fb_lock);
562 }
563 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
564 
565 /**
566  * drm_framebuffer_cleanup - remove a framebuffer object
567  * @fb: framebuffer to remove
568  *
569  * Cleanup framebuffer. This function is intended to be used from the drivers
570  * ->destroy callback. It can also be used to clean up driver private
571  *  framebuffers embedded into a larger structure.
572  *
573  * Note that this function does not remove the fb from active usuage - if it is
574  * still used anywhere, hilarity can ensue since userspace could call getfb on
575  * the id and get back -EINVAL. Obviously no concern at driver unload time.
576  *
577  * Also, the framebuffer will not be removed from the lookup idr - for
578  * user-created framebuffers this will happen in in the rmfb ioctl. For
579  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
580  * drm_framebuffer_unregister_private.
581  */
582 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
583 {
584 	struct drm_device *dev = fb->dev;
585 
586 	mutex_lock(&dev->mode_config.fb_lock);
587 	list_del(&fb->head);
588 	dev->mode_config.num_fb--;
589 	mutex_unlock(&dev->mode_config.fb_lock);
590 }
591 EXPORT_SYMBOL(drm_framebuffer_cleanup);
592 
593 /**
594  * drm_framebuffer_remove - remove and unreference a framebuffer object
595  * @fb: framebuffer to remove
596  *
597  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
598  * using @fb, removes it, setting it to NULL. Then drops the reference to the
599  * passed-in framebuffer. Might take the modeset locks.
600  *
601  * Note that this function optimizes the cleanup away if the caller holds the
602  * last reference to the framebuffer. It is also guaranteed to not take the
603  * modeset locks in this case.
604  */
605 void drm_framebuffer_remove(struct drm_framebuffer *fb)
606 {
607 	struct drm_device *dev;
608 	struct drm_crtc *crtc;
609 	struct drm_plane *plane;
610 	struct drm_mode_set set;
611 	int ret;
612 
613 	if (!fb)
614 		return;
615 
616 	dev = fb->dev;
617 
618 	WARN_ON(!list_empty(&fb->filp_head));
619 
620 	/*
621 	 * drm ABI mandates that we remove any deleted framebuffers from active
622 	 * useage. But since most sane clients only remove framebuffers they no
623 	 * longer need, try to optimize this away.
624 	 *
625 	 * Since we're holding a reference ourselves, observing a refcount of 1
626 	 * means that we're the last holder and can skip it. Also, the refcount
627 	 * can never increase from 1 again, so we don't need any barriers or
628 	 * locks.
629 	 *
630 	 * Note that userspace could try to race with use and instate a new
631 	 * usage _after_ we've cleared all current ones. End result will be an
632 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
633 	 * in this manner.
634 	 */
635 	if (!kref_exclusive_p(&fb->refcount)) {
636 		drm_modeset_lock_all(dev);
637 		/* remove from any CRTC */
638 		drm_for_each_crtc(crtc, dev) {
639 			if (crtc->primary->fb == fb) {
640 				/* should turn off the crtc */
641 				memset(&set, 0, sizeof(struct drm_mode_set));
642 				set.crtc = crtc;
643 				set.fb = NULL;
644 				ret = drm_mode_set_config_internal(&set);
645 				if (ret)
646 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
647 			}
648 		}
649 
650 		drm_for_each_plane(plane, dev) {
651 			if (plane->fb == fb)
652 				drm_plane_force_disable(plane);
653 		}
654 		drm_modeset_unlock_all(dev);
655 	}
656 
657 	drm_framebuffer_unreference(fb);
658 }
659 EXPORT_SYMBOL(drm_framebuffer_remove);
660 
661 DEFINE_WW_CLASS(crtc_ww_class);
662 
663 /**
664  * drm_crtc_init_with_planes - Initialise a new CRTC object with
665  *    specified primary and cursor planes.
666  * @dev: DRM device
667  * @crtc: CRTC object to init
668  * @primary: Primary plane for CRTC
669  * @cursor: Cursor plane for CRTC
670  * @funcs: callbacks for the new CRTC
671  *
672  * Inits a new object created as base part of a driver crtc object.
673  *
674  * Returns:
675  * Zero on success, error code on failure.
676  */
677 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
678 			      struct drm_plane *primary,
679 			      struct drm_plane *cursor,
680 			      const struct drm_crtc_funcs *funcs)
681 {
682 	struct drm_mode_config *config = &dev->mode_config;
683 	int ret;
684 
685 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
686 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
687 
688 	crtc->dev = dev;
689 	crtc->funcs = funcs;
690 
691 	drm_modeset_lock_init(&crtc->mutex);
692 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
693 	if (ret)
694 		return ret;
695 
696 	crtc->base.properties = &crtc->properties;
697 
698 	list_add_tail(&crtc->head, &config->crtc_list);
699 	config->num_crtc++;
700 
701 	crtc->primary = primary;
702 	crtc->cursor = cursor;
703 	if (primary)
704 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
705 	if (cursor)
706 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
707 
708 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
709 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
710 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
711 	}
712 
713 	return 0;
714 }
715 EXPORT_SYMBOL(drm_crtc_init_with_planes);
716 
717 /**
718  * drm_crtc_cleanup - Clean up the core crtc usage
719  * @crtc: CRTC to cleanup
720  *
721  * This function cleans up @crtc and removes it from the DRM mode setting
722  * core. Note that the function does *not* free the crtc structure itself,
723  * this is the responsibility of the caller.
724  */
725 void drm_crtc_cleanup(struct drm_crtc *crtc)
726 {
727 	struct drm_device *dev = crtc->dev;
728 
729 	kfree(crtc->gamma_store);
730 	crtc->gamma_store = NULL;
731 
732 	drm_modeset_lock_fini(&crtc->mutex);
733 
734 	drm_mode_object_put(dev, &crtc->base);
735 	list_del(&crtc->head);
736 	dev->mode_config.num_crtc--;
737 
738 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
739 	if (crtc->state && crtc->funcs->atomic_destroy_state)
740 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
741 
742 	memset(crtc, 0, sizeof(*crtc));
743 }
744 EXPORT_SYMBOL(drm_crtc_cleanup);
745 
746 /**
747  * drm_crtc_index - find the index of a registered CRTC
748  * @crtc: CRTC to find index for
749  *
750  * Given a registered CRTC, return the index of that CRTC within a DRM
751  * device's list of CRTCs.
752  */
753 unsigned int drm_crtc_index(struct drm_crtc *crtc)
754 {
755 	unsigned int index = 0;
756 	struct drm_crtc *tmp;
757 
758 	drm_for_each_crtc(tmp, crtc->dev) {
759 		if (tmp == crtc)
760 			return index;
761 
762 		index++;
763 	}
764 
765 	BUG();
766 }
767 EXPORT_SYMBOL(drm_crtc_index);
768 
769 /*
770  * drm_mode_remove - remove and free a mode
771  * @connector: connector list to modify
772  * @mode: mode to remove
773  *
774  * Remove @mode from @connector's mode list, then free it.
775  */
776 static void drm_mode_remove(struct drm_connector *connector,
777 			    struct drm_display_mode *mode)
778 {
779 	list_del(&mode->head);
780 	drm_mode_destroy(connector->dev, mode);
781 }
782 
783 /**
784  * drm_display_info_set_bus_formats - set the supported bus formats
785  * @info: display info to store bus formats in
786  * @formats: array containing the supported bus formats
787  * @num_formats: the number of entries in the fmts array
788  *
789  * Store the supported bus formats in display info structure.
790  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
791  * a full list of available formats.
792  */
793 int drm_display_info_set_bus_formats(struct drm_display_info *info,
794 				     const u32 *formats,
795 				     unsigned int num_formats)
796 {
797 	u32 *fmts = NULL;
798 
799 	if (!formats && num_formats)
800 		return -EINVAL;
801 
802 	if (formats && num_formats) {
803 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
804 			       GFP_KERNEL);
805 		if (!fmts)
806 			return -ENOMEM;
807 	}
808 
809 	kfree(info->bus_formats);
810 	info->bus_formats = fmts;
811 	info->num_bus_formats = num_formats;
812 
813 	return 0;
814 }
815 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
816 
817 /**
818  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
819  * @connector: connector to quwery
820  *
821  * The kernel supports per-connector configration of its consoles through
822  * use of the video= parameter. This function parses that option and
823  * extracts the user's specified mode (or enable/disable status) for a
824  * particular connector. This is typically only used during the early fbdev
825  * setup.
826  */
827 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
828 {
829 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
830 	char *option = NULL;
831 
832 #ifdef __NetBSD__
833 	prop_dictionary_t prop = device_properties(connector->dev->dev);
834 	if (!prop_dictionary_get_cstring(prop, connector->name, &option))
835 		return;
836 #else
837 	if (fb_get_options(connector->name, &option))
838 		return;
839 #endif
840 
841 	if (!drm_mode_parse_command_line_for_connector(option,
842 						       connector,
843 						       mode))
844 		return;
845 
846 	if (mode->force) {
847 		const char *s;
848 
849 		switch (mode->force) {
850 		case DRM_FORCE_OFF:
851 			s = "OFF";
852 			break;
853 		case DRM_FORCE_ON_DIGITAL:
854 			s = "ON - dig";
855 			break;
856 		default:
857 		case DRM_FORCE_ON:
858 			s = "ON";
859 			break;
860 		}
861 
862 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
863 		connector->force = mode->force;
864 	}
865 
866 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
867 		      connector->name,
868 		      mode->xres, mode->yres,
869 		      mode->refresh_specified ? mode->refresh : 60,
870 		      mode->rb ? " reduced blanking" : "",
871 		      mode->margins ? " with margins" : "",
872 		      mode->interlace ?  " interlaced" : "");
873 }
874 
875 /**
876  * drm_connector_init - Init a preallocated connector
877  * @dev: DRM device
878  * @connector: the connector to init
879  * @funcs: callbacks for this connector
880  * @connector_type: user visible type of the connector
881  *
882  * Initialises a preallocated connector. Connectors should be
883  * subclassed as part of driver connector objects.
884  *
885  * Returns:
886  * Zero on success, error code on failure.
887  */
888 int drm_connector_init(struct drm_device *dev,
889 		       struct drm_connector *connector,
890 		       const struct drm_connector_funcs *funcs,
891 		       int connector_type)
892 {
893 	struct drm_mode_config *config = &dev->mode_config;
894 	int ret;
895 	struct ida *connector_ida =
896 		&drm_connector_enum_list[connector_type].ida;
897 
898 	drm_modeset_lock_all(dev);
899 
900 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
901 	if (ret)
902 		goto out_unlock;
903 
904 	connector->base.properties = &connector->properties;
905 	connector->dev = dev;
906 	connector->kdev = dev->dev;
907 	connector->funcs = funcs;
908 	connector->connector_type = connector_type;
909 	connector->connector_type_id =
910 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
911 	if (connector->connector_type_id < 0) {
912 		ret = connector->connector_type_id;
913 		goto out_put;
914 	}
915 	connector->name =
916 		kasprintf(GFP_KERNEL, "%s-%d",
917 			  drm_connector_enum_list[connector_type].name,
918 			  connector->connector_type_id);
919 	if (!connector->name) {
920 		ret = -ENOMEM;
921 		goto out_put;
922 	}
923 
924 	INIT_LIST_HEAD(&connector->probed_modes);
925 	INIT_LIST_HEAD(&connector->modes);
926 	connector->edid_blob_ptr = NULL;
927 	connector->status = connector_status_unknown;
928 
929 	drm_connector_get_cmdline_mode(connector);
930 
931 	/* We should add connectors at the end to avoid upsetting the connector
932 	 * index too much. */
933 	list_add_tail(&connector->head, &config->connector_list);
934 	config->num_connector++;
935 
936 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
937 		drm_object_attach_property(&connector->base,
938 					      config->edid_property,
939 					      0);
940 
941 	drm_object_attach_property(&connector->base,
942 				      config->dpms_property, 0);
943 
944 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
945 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
946 	}
947 
948 	connector->debugfs_entry = NULL;
949 
950 out_put:
951 	if (ret)
952 		drm_mode_object_put(dev, &connector->base);
953 
954 out_unlock:
955 	drm_modeset_unlock_all(dev);
956 
957 	return ret;
958 }
959 EXPORT_SYMBOL(drm_connector_init);
960 
961 /**
962  * drm_connector_cleanup - cleans up an initialised connector
963  * @connector: connector to cleanup
964  *
965  * Cleans up the connector but doesn't free the object.
966  */
967 void drm_connector_cleanup(struct drm_connector *connector)
968 {
969 	struct drm_device *dev = connector->dev;
970 	struct drm_display_mode *mode, *t;
971 
972 	if (connector->tile_group) {
973 		drm_mode_put_tile_group(dev, connector->tile_group);
974 		connector->tile_group = NULL;
975 	}
976 
977 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
978 		drm_mode_remove(connector, mode);
979 
980 	list_for_each_entry_safe(mode, t, &connector->modes, head)
981 		drm_mode_remove(connector, mode);
982 
983 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
984 		   connector->connector_type_id);
985 
986 	kfree(connector->display_info.bus_formats);
987 	drm_mode_object_put(dev, &connector->base);
988 	kfree(connector->name);
989 	connector->name = NULL;
990 	list_del(&connector->head);
991 	dev->mode_config.num_connector--;
992 
993 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
994 	if (connector->state && connector->funcs->atomic_destroy_state)
995 		connector->funcs->atomic_destroy_state(connector,
996 						       connector->state);
997 
998 	memset(connector, 0, sizeof(*connector));
999 }
1000 EXPORT_SYMBOL(drm_connector_cleanup);
1001 
1002 /**
1003  * drm_connector_index - find the index of a registered connector
1004  * @connector: connector to find index for
1005  *
1006  * Given a registered connector, return the index of that connector within a DRM
1007  * device's list of connectors.
1008  */
1009 unsigned int drm_connector_index(struct drm_connector *connector)
1010 {
1011 	unsigned int index = 0;
1012 	struct drm_connector *tmp;
1013 	struct drm_mode_config *config = &connector->dev->mode_config;
1014 
1015 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
1016 
1017 	drm_for_each_connector(tmp, connector->dev) {
1018 		if (tmp == connector)
1019 			return index;
1020 
1021 		index++;
1022 	}
1023 
1024 	BUG();
1025 }
1026 EXPORT_SYMBOL(drm_connector_index);
1027 
1028 /**
1029  * drm_connector_register - register a connector
1030  * @connector: the connector to register
1031  *
1032  * Register userspace interfaces for a connector
1033  *
1034  * Returns:
1035  * Zero on success, error code on failure.
1036  */
1037 int drm_connector_register(struct drm_connector *connector)
1038 {
1039 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
1040 	int ret;
1041 #endif
1042 
1043 	drm_mode_object_register(connector->dev, &connector->base);
1044 
1045 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
1046 	ret = drm_sysfs_connector_add(connector);
1047 	if (ret)
1048 		return ret;
1049 
1050 	ret = drm_debugfs_connector_add(connector);
1051 	if (ret) {
1052 		drm_sysfs_connector_remove(connector);
1053 		return ret;
1054 	}
1055 #endif
1056 
1057 	return 0;
1058 }
1059 EXPORT_SYMBOL(drm_connector_register);
1060 
1061 /**
1062  * drm_connector_unregister - unregister a connector
1063  * @connector: the connector to unregister
1064  *
1065  * Unregister userspace interfaces for a connector
1066  */
1067 void drm_connector_unregister(struct drm_connector *connector)
1068 {
1069 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
1070 	drm_sysfs_connector_remove(connector);
1071 	drm_debugfs_connector_remove(connector);
1072 #endif
1073 }
1074 EXPORT_SYMBOL(drm_connector_unregister);
1075 
1076 
1077 /**
1078  * drm_connector_unplug_all - unregister connector userspace interfaces
1079  * @dev: drm device
1080  *
1081  * This function unregisters all connector userspace interfaces in sysfs. Should
1082  * be call when the device is disconnected, e.g. from an usb driver's
1083  * ->disconnect callback.
1084  */
1085 void drm_connector_unplug_all(struct drm_device *dev)
1086 {
1087 	struct drm_connector *connector;
1088 
1089 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1090 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1091 		drm_connector_unregister(connector);
1092 
1093 }
1094 EXPORT_SYMBOL(drm_connector_unplug_all);
1095 
1096 /**
1097  * drm_encoder_init - Init a preallocated encoder
1098  * @dev: drm device
1099  * @encoder: the encoder to init
1100  * @funcs: callbacks for this encoder
1101  * @encoder_type: user visible type of the encoder
1102  *
1103  * Initialises a preallocated encoder. Encoder should be
1104  * subclassed as part of driver encoder objects.
1105  *
1106  * Returns:
1107  * Zero on success, error code on failure.
1108  */
1109 int drm_encoder_init(struct drm_device *dev,
1110 		      struct drm_encoder *encoder,
1111 		      const struct drm_encoder_funcs *funcs,
1112 		      int encoder_type)
1113 {
1114 	int ret;
1115 
1116 	drm_modeset_lock_all(dev);
1117 
1118 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1119 	if (ret)
1120 		goto out_unlock;
1121 
1122 	encoder->dev = dev;
1123 	encoder->encoder_type = encoder_type;
1124 	encoder->funcs = funcs;
1125 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1126 				  drm_encoder_enum_list[encoder_type].name,
1127 				  encoder->base.id);
1128 	if (!encoder->name) {
1129 		ret = -ENOMEM;
1130 		goto out_put;
1131 	}
1132 
1133 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1134 	dev->mode_config.num_encoder++;
1135 
1136 out_put:
1137 	if (ret)
1138 		drm_mode_object_put(dev, &encoder->base);
1139 
1140 out_unlock:
1141 	drm_modeset_unlock_all(dev);
1142 
1143 	return ret;
1144 }
1145 EXPORT_SYMBOL(drm_encoder_init);
1146 
1147 /**
1148  * drm_encoder_cleanup - cleans up an initialised encoder
1149  * @encoder: encoder to cleanup
1150  *
1151  * Cleans up the encoder but doesn't free the object.
1152  */
1153 void drm_encoder_cleanup(struct drm_encoder *encoder)
1154 {
1155 	struct drm_device *dev = encoder->dev;
1156 
1157 	drm_modeset_lock_all(dev);
1158 	drm_mode_object_put(dev, &encoder->base);
1159 	kfree(encoder->name);
1160 	list_del(&encoder->head);
1161 	dev->mode_config.num_encoder--;
1162 	drm_modeset_unlock_all(dev);
1163 
1164 	memset(encoder, 0, sizeof(*encoder));
1165 }
1166 EXPORT_SYMBOL(drm_encoder_cleanup);
1167 
1168 /**
1169  * drm_universal_plane_init - Initialize a new universal plane object
1170  * @dev: DRM device
1171  * @plane: plane object to init
1172  * @possible_crtcs: bitmask of possible CRTCs
1173  * @funcs: callbacks for the new plane
1174  * @formats: array of supported formats (%DRM_FORMAT_*)
1175  * @format_count: number of elements in @formats
1176  * @type: type of plane (overlay, primary, cursor)
1177  *
1178  * Initializes a plane object of type @type.
1179  *
1180  * Returns:
1181  * Zero on success, error code on failure.
1182  */
1183 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1184 			     unsigned long possible_crtcs,
1185 			     const struct drm_plane_funcs *funcs,
1186 			     const uint32_t *formats, unsigned int format_count,
1187 			     enum drm_plane_type type)
1188 {
1189 	struct drm_mode_config *config = &dev->mode_config;
1190 	int ret;
1191 
1192 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1193 	if (ret)
1194 		return ret;
1195 
1196 	drm_modeset_lock_init(&plane->mutex);
1197 
1198 	plane->base.properties = &plane->properties;
1199 	plane->dev = dev;
1200 	plane->funcs = funcs;
1201 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1202 					    GFP_KERNEL);
1203 	if (!plane->format_types) {
1204 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1205 		drm_mode_object_put(dev, &plane->base);
1206 		return -ENOMEM;
1207 	}
1208 
1209 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1210 	plane->format_count = format_count;
1211 	plane->possible_crtcs = possible_crtcs;
1212 	plane->type = type;
1213 
1214 	list_add_tail(&plane->head, &config->plane_list);
1215 	config->num_total_plane++;
1216 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1217 		config->num_overlay_plane++;
1218 
1219 	drm_object_attach_property(&plane->base,
1220 				   config->plane_type_property,
1221 				   plane->type);
1222 
1223 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1224 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1225 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1226 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1227 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1228 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1229 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1230 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1231 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1232 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1233 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1234 	}
1235 
1236 	return 0;
1237 }
1238 EXPORT_SYMBOL(drm_universal_plane_init);
1239 
1240 /**
1241  * drm_plane_init - Initialize a legacy plane
1242  * @dev: DRM device
1243  * @plane: plane object to init
1244  * @possible_crtcs: bitmask of possible CRTCs
1245  * @funcs: callbacks for the new plane
1246  * @formats: array of supported formats (%DRM_FORMAT_*)
1247  * @format_count: number of elements in @formats
1248  * @is_primary: plane type (primary vs overlay)
1249  *
1250  * Legacy API to initialize a DRM plane.
1251  *
1252  * New drivers should call drm_universal_plane_init() instead.
1253  *
1254  * Returns:
1255  * Zero on success, error code on failure.
1256  */
1257 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1258 		   unsigned long possible_crtcs,
1259 		   const struct drm_plane_funcs *funcs,
1260 		   const uint32_t *formats, unsigned int format_count,
1261 		   bool is_primary)
1262 {
1263 	enum drm_plane_type type;
1264 
1265 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1266 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1267 					formats, format_count, type);
1268 }
1269 EXPORT_SYMBOL(drm_plane_init);
1270 
1271 /**
1272  * drm_plane_cleanup - Clean up the core plane usage
1273  * @plane: plane to cleanup
1274  *
1275  * This function cleans up @plane and removes it from the DRM mode setting
1276  * core. Note that the function does *not* free the plane structure itself,
1277  * this is the responsibility of the caller.
1278  */
1279 void drm_plane_cleanup(struct drm_plane *plane)
1280 {
1281 	struct drm_device *dev = plane->dev;
1282 
1283 	drm_modeset_lock_all(dev);
1284 	kfree(plane->format_types);
1285 	drm_mode_object_put(dev, &plane->base);
1286 
1287 	BUG_ON(list_empty(&plane->head));
1288 
1289 	list_del(&plane->head);
1290 	dev->mode_config.num_total_plane--;
1291 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1292 		dev->mode_config.num_overlay_plane--;
1293 	drm_modeset_unlock_all(dev);
1294 
1295 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1296 	if (plane->state && plane->funcs->atomic_destroy_state)
1297 		plane->funcs->atomic_destroy_state(plane, plane->state);
1298 	drm_modeset_lock_fini(&plane->mutex);
1299 
1300 	memset(plane, 0, sizeof(*plane));
1301 }
1302 EXPORT_SYMBOL(drm_plane_cleanup);
1303 
1304 /**
1305  * drm_plane_index - find the index of a registered plane
1306  * @plane: plane to find index for
1307  *
1308  * Given a registered plane, return the index of that CRTC within a DRM
1309  * device's list of planes.
1310  */
1311 unsigned int drm_plane_index(struct drm_plane *plane)
1312 {
1313 	unsigned int index = 0;
1314 	struct drm_plane *tmp;
1315 
1316 	drm_for_each_plane(tmp, plane->dev) {
1317 		if (tmp == plane)
1318 			return index;
1319 
1320 		index++;
1321 	}
1322 
1323 	BUG();
1324 }
1325 EXPORT_SYMBOL(drm_plane_index);
1326 
1327 /**
1328  * drm_plane_from_index - find the registered plane at an index
1329  * @dev: DRM device
1330  * @idx: index of registered plane to find for
1331  *
1332  * Given a plane index, return the registered plane from DRM device's
1333  * list of planes with matching index.
1334  */
1335 struct drm_plane *
1336 drm_plane_from_index(struct drm_device *dev, int idx)
1337 {
1338 	struct drm_plane *plane;
1339 	unsigned int i = 0;
1340 
1341 	drm_for_each_plane(plane, dev) {
1342 		if (i == idx)
1343 			return plane;
1344 		i++;
1345 	}
1346 	return NULL;
1347 }
1348 EXPORT_SYMBOL(drm_plane_from_index);
1349 
1350 /**
1351  * drm_plane_force_disable - Forcibly disable a plane
1352  * @plane: plane to disable
1353  *
1354  * Forces the plane to be disabled.
1355  *
1356  * Used when the plane's current framebuffer is destroyed,
1357  * and when restoring fbdev mode.
1358  */
1359 void drm_plane_force_disable(struct drm_plane *plane)
1360 {
1361 	int ret;
1362 
1363 	if (!plane->fb)
1364 		return;
1365 
1366 	plane->old_fb = plane->fb;
1367 	ret = plane->funcs->disable_plane(plane);
1368 	if (ret) {
1369 		DRM_ERROR("failed to disable plane with busy fb\n");
1370 		plane->old_fb = NULL;
1371 		return;
1372 	}
1373 	/* disconnect the plane from the fb and crtc: */
1374 	drm_framebuffer_unreference(plane->old_fb);
1375 	plane->old_fb = NULL;
1376 	plane->fb = NULL;
1377 	plane->crtc = NULL;
1378 }
1379 EXPORT_SYMBOL(drm_plane_force_disable);
1380 
1381 static int drm_mode_create_standard_properties(struct drm_device *dev)
1382 {
1383 	struct drm_property *prop;
1384 
1385 	/*
1386 	 * Standard properties (apply to all connectors)
1387 	 */
1388 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1389 				   DRM_MODE_PROP_IMMUTABLE,
1390 				   "EDID", 0);
1391 	if (!prop)
1392 		return -ENOMEM;
1393 	dev->mode_config.edid_property = prop;
1394 
1395 	prop = drm_property_create_enum(dev, 0,
1396 				   "DPMS", drm_dpms_enum_list,
1397 				   ARRAY_SIZE(drm_dpms_enum_list));
1398 	if (!prop)
1399 		return -ENOMEM;
1400 	dev->mode_config.dpms_property = prop;
1401 
1402 	prop = drm_property_create(dev,
1403 				   DRM_MODE_PROP_BLOB |
1404 				   DRM_MODE_PROP_IMMUTABLE,
1405 				   "PATH", 0);
1406 	if (!prop)
1407 		return -ENOMEM;
1408 	dev->mode_config.path_property = prop;
1409 
1410 	prop = drm_property_create(dev,
1411 				   DRM_MODE_PROP_BLOB |
1412 				   DRM_MODE_PROP_IMMUTABLE,
1413 				   "TILE", 0);
1414 	if (!prop)
1415 		return -ENOMEM;
1416 	dev->mode_config.tile_property = prop;
1417 
1418 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1419 					"type", drm_plane_type_enum_list,
1420 					ARRAY_SIZE(drm_plane_type_enum_list));
1421 	if (!prop)
1422 		return -ENOMEM;
1423 	dev->mode_config.plane_type_property = prop;
1424 
1425 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1426 			"SRC_X", 0, UINT_MAX);
1427 	if (!prop)
1428 		return -ENOMEM;
1429 	dev->mode_config.prop_src_x = prop;
1430 
1431 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1432 			"SRC_Y", 0, UINT_MAX);
1433 	if (!prop)
1434 		return -ENOMEM;
1435 	dev->mode_config.prop_src_y = prop;
1436 
1437 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1438 			"SRC_W", 0, UINT_MAX);
1439 	if (!prop)
1440 		return -ENOMEM;
1441 	dev->mode_config.prop_src_w = prop;
1442 
1443 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1444 			"SRC_H", 0, UINT_MAX);
1445 	if (!prop)
1446 		return -ENOMEM;
1447 	dev->mode_config.prop_src_h = prop;
1448 
1449 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1450 			"CRTC_X", INT_MIN, INT_MAX);
1451 	if (!prop)
1452 		return -ENOMEM;
1453 	dev->mode_config.prop_crtc_x = prop;
1454 
1455 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1456 			"CRTC_Y", INT_MIN, INT_MAX);
1457 	if (!prop)
1458 		return -ENOMEM;
1459 	dev->mode_config.prop_crtc_y = prop;
1460 
1461 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1462 			"CRTC_W", 0, INT_MAX);
1463 	if (!prop)
1464 		return -ENOMEM;
1465 	dev->mode_config.prop_crtc_w = prop;
1466 
1467 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1468 			"CRTC_H", 0, INT_MAX);
1469 	if (!prop)
1470 		return -ENOMEM;
1471 	dev->mode_config.prop_crtc_h = prop;
1472 
1473 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1474 			"FB_ID", DRM_MODE_OBJECT_FB);
1475 	if (!prop)
1476 		return -ENOMEM;
1477 	dev->mode_config.prop_fb_id = prop;
1478 
1479 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1480 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1481 	if (!prop)
1482 		return -ENOMEM;
1483 	dev->mode_config.prop_crtc_id = prop;
1484 
1485 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1486 			"ACTIVE");
1487 	if (!prop)
1488 		return -ENOMEM;
1489 	dev->mode_config.prop_active = prop;
1490 
1491 	prop = drm_property_create(dev,
1492 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1493 			"MODE_ID", 0);
1494 	if (!prop)
1495 		return -ENOMEM;
1496 	dev->mode_config.prop_mode_id = prop;
1497 
1498 	return 0;
1499 }
1500 
1501 /**
1502  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1503  * @dev: DRM device
1504  *
1505  * Called by a driver the first time a DVI-I connector is made.
1506  */
1507 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1508 {
1509 	struct drm_property *dvi_i_selector;
1510 	struct drm_property *dvi_i_subconnector;
1511 
1512 	if (dev->mode_config.dvi_i_select_subconnector_property)
1513 		return 0;
1514 
1515 	dvi_i_selector =
1516 		drm_property_create_enum(dev, 0,
1517 				    "select subconnector",
1518 				    drm_dvi_i_select_enum_list,
1519 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1520 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1521 
1522 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1523 				    "subconnector",
1524 				    drm_dvi_i_subconnector_enum_list,
1525 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1526 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1527 
1528 	return 0;
1529 }
1530 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1531 
1532 /**
1533  * drm_create_tv_properties - create TV specific connector properties
1534  * @dev: DRM device
1535  * @num_modes: number of different TV formats (modes) supported
1536  * @modes: array of pointers to strings containing name of each format
1537  *
1538  * Called by a driver's TV initialization routine, this function creates
1539  * the TV specific connector properties for a given device.  Caller is
1540  * responsible for allocating a list of format names and passing them to
1541  * this routine.
1542  */
1543 int drm_mode_create_tv_properties(struct drm_device *dev,
1544 				  unsigned int num_modes,
1545 				  const char * const modes[])
1546 {
1547 	struct drm_property *tv_selector;
1548 	struct drm_property *tv_subconnector;
1549 	unsigned int i;
1550 
1551 	if (dev->mode_config.tv_select_subconnector_property)
1552 		return 0;
1553 
1554 	/*
1555 	 * Basic connector properties
1556 	 */
1557 	tv_selector = drm_property_create_enum(dev, 0,
1558 					  "select subconnector",
1559 					  drm_tv_select_enum_list,
1560 					  ARRAY_SIZE(drm_tv_select_enum_list));
1561 	if (!tv_selector)
1562 		goto nomem;
1563 
1564 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1565 
1566 	tv_subconnector =
1567 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1568 				    "subconnector",
1569 				    drm_tv_subconnector_enum_list,
1570 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1571 	if (!tv_subconnector)
1572 		goto nomem;
1573 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1574 
1575 	/*
1576 	 * Other, TV specific properties: margins & TV modes.
1577 	 */
1578 	dev->mode_config.tv_left_margin_property =
1579 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1580 	if (!dev->mode_config.tv_left_margin_property)
1581 		goto nomem;
1582 
1583 	dev->mode_config.tv_right_margin_property =
1584 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1585 	if (!dev->mode_config.tv_right_margin_property)
1586 		goto nomem;
1587 
1588 	dev->mode_config.tv_top_margin_property =
1589 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1590 	if (!dev->mode_config.tv_top_margin_property)
1591 		goto nomem;
1592 
1593 	dev->mode_config.tv_bottom_margin_property =
1594 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1595 	if (!dev->mode_config.tv_bottom_margin_property)
1596 		goto nomem;
1597 
1598 	dev->mode_config.tv_mode_property =
1599 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1600 				    "mode", num_modes);
1601 	if (!dev->mode_config.tv_mode_property)
1602 		goto nomem;
1603 
1604 	for (i = 0; i < num_modes; i++)
1605 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1606 				      i, modes[i]);
1607 
1608 	dev->mode_config.tv_brightness_property =
1609 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1610 	if (!dev->mode_config.tv_brightness_property)
1611 		goto nomem;
1612 
1613 	dev->mode_config.tv_contrast_property =
1614 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1615 	if (!dev->mode_config.tv_contrast_property)
1616 		goto nomem;
1617 
1618 	dev->mode_config.tv_flicker_reduction_property =
1619 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1620 	if (!dev->mode_config.tv_flicker_reduction_property)
1621 		goto nomem;
1622 
1623 	dev->mode_config.tv_overscan_property =
1624 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1625 	if (!dev->mode_config.tv_overscan_property)
1626 		goto nomem;
1627 
1628 	dev->mode_config.tv_saturation_property =
1629 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1630 	if (!dev->mode_config.tv_saturation_property)
1631 		goto nomem;
1632 
1633 	dev->mode_config.tv_hue_property =
1634 		drm_property_create_range(dev, 0, "hue", 0, 100);
1635 	if (!dev->mode_config.tv_hue_property)
1636 		goto nomem;
1637 
1638 	return 0;
1639 nomem:
1640 	return -ENOMEM;
1641 }
1642 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1643 
1644 /**
1645  * drm_mode_create_scaling_mode_property - create scaling mode property
1646  * @dev: DRM device
1647  *
1648  * Called by a driver the first time it's needed, must be attached to desired
1649  * connectors.
1650  */
1651 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1652 {
1653 	struct drm_property *scaling_mode;
1654 
1655 	if (dev->mode_config.scaling_mode_property)
1656 		return 0;
1657 
1658 	scaling_mode =
1659 		drm_property_create_enum(dev, 0, "scaling mode",
1660 				drm_scaling_mode_enum_list,
1661 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1662 
1663 	dev->mode_config.scaling_mode_property = scaling_mode;
1664 
1665 	return 0;
1666 }
1667 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1668 
1669 /**
1670  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1671  * @dev: DRM device
1672  *
1673  * Called by a driver the first time it's needed, must be attached to desired
1674  * connectors.
1675  *
1676  * Returns:
1677  * Zero on success, negative errno on failure.
1678  */
1679 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1680 {
1681 	if (dev->mode_config.aspect_ratio_property)
1682 		return 0;
1683 
1684 	dev->mode_config.aspect_ratio_property =
1685 		drm_property_create_enum(dev, 0, "aspect ratio",
1686 				drm_aspect_ratio_enum_list,
1687 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1688 
1689 	if (dev->mode_config.aspect_ratio_property == NULL)
1690 		return -ENOMEM;
1691 
1692 	return 0;
1693 }
1694 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1695 
1696 /**
1697  * drm_mode_create_dirty_property - create dirty property
1698  * @dev: DRM device
1699  *
1700  * Called by a driver the first time it's needed, must be attached to desired
1701  * connectors.
1702  */
1703 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1704 {
1705 	struct drm_property *dirty_info;
1706 
1707 	if (dev->mode_config.dirty_info_property)
1708 		return 0;
1709 
1710 	dirty_info =
1711 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1712 				    "dirty",
1713 				    drm_dirty_info_enum_list,
1714 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1715 	dev->mode_config.dirty_info_property = dirty_info;
1716 
1717 	return 0;
1718 }
1719 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1720 
1721 /**
1722  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1723  * @dev: DRM device
1724  *
1725  * Create the the suggested x/y offset property for connectors.
1726  */
1727 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1728 {
1729 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1730 		return 0;
1731 
1732 	dev->mode_config.suggested_x_property =
1733 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1734 
1735 	dev->mode_config.suggested_y_property =
1736 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1737 
1738 	if (dev->mode_config.suggested_x_property == NULL ||
1739 	    dev->mode_config.suggested_y_property == NULL)
1740 		return -ENOMEM;
1741 	return 0;
1742 }
1743 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1744 
1745 /**
1746  * drm_mode_getresources - get graphics configuration
1747  * @dev: drm device for the ioctl
1748  * @data: data pointer for the ioctl
1749  * @file_priv: drm file for the ioctl call
1750  *
1751  * Construct a set of configuration description structures and return
1752  * them to the user, including CRTC, connector and framebuffer configuration.
1753  *
1754  * Called by the user via ioctl.
1755  *
1756  * Returns:
1757  * Zero on success, negative errno on failure.
1758  */
1759 int drm_mode_getresources(struct drm_device *dev, void *data,
1760 			  struct drm_file *file_priv)
1761 {
1762 	struct drm_mode_card_res *card_res = data;
1763 	struct list_head *lh;
1764 	struct drm_framebuffer *fb;
1765 	struct drm_connector *connector;
1766 	struct drm_crtc *crtc;
1767 	struct drm_encoder *encoder;
1768 	int ret = 0;
1769 	int connector_count = 0;
1770 	int crtc_count = 0;
1771 	int fb_count = 0;
1772 	int encoder_count = 0;
1773 	int copied = 0;
1774 	uint32_t __user *fb_id;
1775 	uint32_t __user *crtc_id;
1776 	uint32_t __user *connector_id;
1777 	uint32_t __user *encoder_id;
1778 
1779 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1780 		return -EINVAL;
1781 
1782 
1783 	mutex_lock(&file_priv->fbs_lock);
1784 	/*
1785 	 * For the non-control nodes we need to limit the list of resources
1786 	 * by IDs in the group list for this node
1787 	 */
1788 	list_for_each(lh, &file_priv->fbs)
1789 		fb_count++;
1790 
1791 	/* handle this in 4 parts */
1792 	/* FBs */
1793 	if (card_res->count_fbs >= fb_count) {
1794 		copied = 0;
1795 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1796 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1797 			if (put_user(fb->base.id, fb_id + copied)) {
1798 				mutex_unlock(&file_priv->fbs_lock);
1799 				return -EFAULT;
1800 			}
1801 			copied++;
1802 		}
1803 	}
1804 	card_res->count_fbs = fb_count;
1805 	mutex_unlock(&file_priv->fbs_lock);
1806 
1807 	/* mode_config.mutex protects the connector list against e.g. DP MST
1808 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1809 	mutex_lock(&dev->mode_config.mutex);
1810 	drm_for_each_crtc(crtc, dev)
1811 		crtc_count++;
1812 
1813 	drm_for_each_connector(connector, dev)
1814 		connector_count++;
1815 
1816 	drm_for_each_encoder(encoder, dev)
1817 		encoder_count++;
1818 
1819 	card_res->max_height = dev->mode_config.max_height;
1820 	card_res->min_height = dev->mode_config.min_height;
1821 	card_res->max_width = dev->mode_config.max_width;
1822 	card_res->min_width = dev->mode_config.min_width;
1823 
1824 	/* CRTCs */
1825 	if (card_res->count_crtcs >= crtc_count) {
1826 		copied = 0;
1827 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1828 		drm_for_each_crtc(crtc, dev) {
1829 			DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1830 			if (put_user(crtc->base.id, crtc_id + copied)) {
1831 				ret = -EFAULT;
1832 				goto out;
1833 			}
1834 			copied++;
1835 		}
1836 	}
1837 	card_res->count_crtcs = crtc_count;
1838 
1839 	/* Encoders */
1840 	if (card_res->count_encoders >= encoder_count) {
1841 		copied = 0;
1842 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1843 		drm_for_each_encoder(encoder, dev) {
1844 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1845 					encoder->name);
1846 			if (put_user(encoder->base.id, encoder_id +
1847 				     copied)) {
1848 				ret = -EFAULT;
1849 				goto out;
1850 			}
1851 			copied++;
1852 		}
1853 	}
1854 	card_res->count_encoders = encoder_count;
1855 
1856 	/* Connectors */
1857 	if (card_res->count_connectors >= connector_count) {
1858 		copied = 0;
1859 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1860 		drm_for_each_connector(connector, dev) {
1861 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1862 				connector->base.id,
1863 				connector->name);
1864 			if (put_user(connector->base.id,
1865 				     connector_id + copied)) {
1866 				ret = -EFAULT;
1867 				goto out;
1868 			}
1869 			copied++;
1870 		}
1871 	}
1872 	card_res->count_connectors = connector_count;
1873 
1874 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1875 		  card_res->count_connectors, card_res->count_encoders);
1876 
1877 out:
1878 	mutex_unlock(&dev->mode_config.mutex);
1879 	return ret;
1880 }
1881 
1882 /**
1883  * drm_mode_getcrtc - get CRTC configuration
1884  * @dev: drm device for the ioctl
1885  * @data: data pointer for the ioctl
1886  * @file_priv: drm file for the ioctl call
1887  *
1888  * Construct a CRTC configuration structure to return to the user.
1889  *
1890  * Called by the user via ioctl.
1891  *
1892  * Returns:
1893  * Zero on success, negative errno on failure.
1894  */
1895 int drm_mode_getcrtc(struct drm_device *dev,
1896 		     void *data, struct drm_file *file_priv)
1897 {
1898 	struct drm_mode_crtc *crtc_resp = data;
1899 	struct drm_crtc *crtc;
1900 
1901 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1902 		return -EINVAL;
1903 
1904 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1905 	if (!crtc)
1906 		return -ENOENT;
1907 
1908 	drm_modeset_lock_crtc(crtc, crtc->primary);
1909 	crtc_resp->gamma_size = crtc->gamma_size;
1910 	if (crtc->primary->fb)
1911 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1912 	else
1913 		crtc_resp->fb_id = 0;
1914 
1915 	if (crtc->state) {
1916 		crtc_resp->x = crtc->primary->state->src_x >> 16;
1917 		crtc_resp->y = crtc->primary->state->src_y >> 16;
1918 		if (crtc->state->enable) {
1919 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
1920 			crtc_resp->mode_valid = 1;
1921 
1922 		} else {
1923 			crtc_resp->mode_valid = 0;
1924 		}
1925 	} else {
1926 		crtc_resp->x = crtc->x;
1927 		crtc_resp->y = crtc->y;
1928 		if (crtc->enabled) {
1929 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1930 			crtc_resp->mode_valid = 1;
1931 
1932 		} else {
1933 			crtc_resp->mode_valid = 0;
1934 		}
1935 	}
1936 	drm_modeset_unlock_crtc(crtc);
1937 
1938 	return 0;
1939 }
1940 
1941 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1942 					 const struct drm_file *file_priv)
1943 {
1944 	/*
1945 	 * If user-space hasn't configured the driver to expose the stereo 3D
1946 	 * modes, don't expose them.
1947 	 */
1948 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1949 		return false;
1950 
1951 	return true;
1952 }
1953 
1954 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
1955 {
1956 	/* For atomic drivers only state objects are synchronously updated and
1957 	 * protected by modeset locks, so check those first. */
1958 	if (connector->state)
1959 		return connector->state->best_encoder;
1960 	return connector->encoder;
1961 }
1962 
1963 /* helper for getconnector and getproperties ioctls */
1964 static int get_properties(struct drm_mode_object *obj, bool atomic,
1965 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
1966 		uint32_t *arg_count_props)
1967 {
1968 	int props_count;
1969 	int i, ret, copied;
1970 
1971 	props_count = obj->properties->count;
1972 	if (!atomic)
1973 		props_count -= obj->properties->atomic_count;
1974 
1975 	if ((*arg_count_props >= props_count) && props_count) {
1976 		for (i = 0, copied = 0; copied < props_count; i++) {
1977 			struct drm_property *prop = obj->properties->properties[i];
1978 			uint64_t val;
1979 
1980 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
1981 				continue;
1982 
1983 			ret = drm_object_property_get_value(obj, prop, &val);
1984 			if (ret)
1985 				return ret;
1986 
1987 			if (put_user(prop->base.id, prop_ptr + copied))
1988 				return -EFAULT;
1989 
1990 			if (put_user(val, prop_values + copied))
1991 				return -EFAULT;
1992 
1993 			copied++;
1994 		}
1995 	}
1996 	*arg_count_props = props_count;
1997 
1998 	return 0;
1999 }
2000 
2001 /**
2002  * drm_mode_getconnector - get connector configuration
2003  * @dev: drm device for the ioctl
2004  * @data: data pointer for the ioctl
2005  * @file_priv: drm file for the ioctl call
2006  *
2007  * Construct a connector configuration structure to return to the user.
2008  *
2009  * Called by the user via ioctl.
2010  *
2011  * Returns:
2012  * Zero on success, negative errno on failure.
2013  */
2014 int drm_mode_getconnector(struct drm_device *dev, void *data,
2015 			  struct drm_file *file_priv)
2016 {
2017 	struct drm_mode_get_connector *out_resp = data;
2018 	struct drm_connector *connector;
2019 	struct drm_encoder *encoder;
2020 	struct drm_display_mode *mode;
2021 	int mode_count = 0;
2022 	int encoders_count = 0;
2023 	int ret = 0;
2024 	int copied = 0;
2025 	int i;
2026 	struct drm_mode_modeinfo u_mode;
2027 	struct drm_mode_modeinfo __user *mode_ptr;
2028 	uint32_t __user *encoder_ptr;
2029 
2030 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2031 		return -EINVAL;
2032 
2033 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2034 
2035 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2036 
2037 	mutex_lock(&dev->mode_config.mutex);
2038 
2039 	connector = drm_connector_find(dev, out_resp->connector_id);
2040 	if (!connector) {
2041 		ret = -ENOENT;
2042 		goto out_unlock;
2043 	}
2044 
2045 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2046 		if (connector->encoder_ids[i] != 0)
2047 			encoders_count++;
2048 
2049 	if (out_resp->count_modes == 0) {
2050 		connector->funcs->fill_modes(connector,
2051 					     dev->mode_config.max_width,
2052 					     dev->mode_config.max_height);
2053 	}
2054 
2055 	/* delayed so we get modes regardless of pre-fill_modes state */
2056 	list_for_each_entry(mode, &connector->modes, head)
2057 		if (drm_mode_expose_to_userspace(mode, file_priv))
2058 			mode_count++;
2059 
2060 	out_resp->connector_id = connector->base.id;
2061 	out_resp->connector_type = connector->connector_type;
2062 	out_resp->connector_type_id = connector->connector_type_id;
2063 	out_resp->mm_width = connector->display_info.width_mm;
2064 	out_resp->mm_height = connector->display_info.height_mm;
2065 	out_resp->subpixel = connector->display_info.subpixel_order;
2066 	out_resp->connection = connector->status;
2067 
2068 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2069 	encoder = drm_connector_get_encoder(connector);
2070 	if (encoder)
2071 		out_resp->encoder_id = encoder->base.id;
2072 	else
2073 		out_resp->encoder_id = 0;
2074 
2075 	/*
2076 	 * This ioctl is called twice, once to determine how much space is
2077 	 * needed, and the 2nd time to fill it.
2078 	 */
2079 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2080 		copied = 0;
2081 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2082 		list_for_each_entry(mode, &connector->modes, head) {
2083 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2084 				continue;
2085 
2086 			drm_mode_convert_to_umode(&u_mode, mode);
2087 			if (copy_to_user(mode_ptr + copied,
2088 					 &u_mode, sizeof(u_mode))) {
2089 				ret = -EFAULT;
2090 				goto out;
2091 			}
2092 			copied++;
2093 		}
2094 	}
2095 	out_resp->count_modes = mode_count;
2096 
2097 	ret = get_properties(&connector->base, file_priv->atomic,
2098 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2099 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2100 			&out_resp->count_props);
2101 	if (ret)
2102 		goto out;
2103 
2104 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2105 		copied = 0;
2106 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2107 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2108 			if (connector->encoder_ids[i] != 0) {
2109 				if (put_user(connector->encoder_ids[i],
2110 					     encoder_ptr + copied)) {
2111 					ret = -EFAULT;
2112 					goto out;
2113 				}
2114 				copied++;
2115 			}
2116 		}
2117 	}
2118 	out_resp->count_encoders = encoders_count;
2119 
2120 out:
2121 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2122 
2123 out_unlock:
2124 	mutex_unlock(&dev->mode_config.mutex);
2125 
2126 	return ret;
2127 }
2128 
2129 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2130 {
2131 	struct drm_connector *connector;
2132 	struct drm_device *dev = encoder->dev;
2133 	bool uses_atomic = false;
2134 
2135 	/* For atomic drivers only state objects are synchronously updated and
2136 	 * protected by modeset locks, so check those first. */
2137 	drm_for_each_connector(connector, dev) {
2138 		if (!connector->state)
2139 			continue;
2140 
2141 		uses_atomic = true;
2142 
2143 		if (connector->state->best_encoder != encoder)
2144 			continue;
2145 
2146 		return connector->state->crtc;
2147 	}
2148 
2149 	/* Don't return stale data (e.g. pending async disable). */
2150 	if (uses_atomic)
2151 		return NULL;
2152 
2153 	return encoder->crtc;
2154 }
2155 
2156 /**
2157  * drm_mode_getencoder - get encoder configuration
2158  * @dev: drm device for the ioctl
2159  * @data: data pointer for the ioctl
2160  * @file_priv: drm file for the ioctl call
2161  *
2162  * Construct a encoder configuration structure to return to the user.
2163  *
2164  * Called by the user via ioctl.
2165  *
2166  * Returns:
2167  * Zero on success, negative errno on failure.
2168  */
2169 int drm_mode_getencoder(struct drm_device *dev, void *data,
2170 			struct drm_file *file_priv)
2171 {
2172 	struct drm_mode_get_encoder *enc_resp = data;
2173 	struct drm_encoder *encoder;
2174 	struct drm_crtc *crtc;
2175 
2176 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2177 		return -EINVAL;
2178 
2179 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2180 	if (!encoder)
2181 		return -ENOENT;
2182 
2183 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2184 	crtc = drm_encoder_get_crtc(encoder);
2185 	if (crtc)
2186 		enc_resp->crtc_id = crtc->base.id;
2187 	else
2188 		enc_resp->crtc_id = 0;
2189 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2190 
2191 	enc_resp->encoder_type = encoder->encoder_type;
2192 	enc_resp->encoder_id = encoder->base.id;
2193 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2194 	enc_resp->possible_clones = encoder->possible_clones;
2195 
2196 	return 0;
2197 }
2198 
2199 /**
2200  * drm_mode_getplane_res - enumerate all plane resources
2201  * @dev: DRM device
2202  * @data: ioctl data
2203  * @file_priv: DRM file info
2204  *
2205  * Construct a list of plane ids to return to the user.
2206  *
2207  * Called by the user via ioctl.
2208  *
2209  * Returns:
2210  * Zero on success, negative errno on failure.
2211  */
2212 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2213 			  struct drm_file *file_priv)
2214 {
2215 	struct drm_mode_get_plane_res *plane_resp = data;
2216 	struct drm_mode_config *config;
2217 	struct drm_plane *plane;
2218 	uint32_t __user *plane_ptr;
2219 	int copied = 0;
2220 	unsigned num_planes;
2221 
2222 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2223 		return -EINVAL;
2224 
2225 	config = &dev->mode_config;
2226 
2227 	if (file_priv->universal_planes)
2228 		num_planes = config->num_total_plane;
2229 	else
2230 		num_planes = config->num_overlay_plane;
2231 
2232 	/*
2233 	 * This ioctl is called twice, once to determine how much space is
2234 	 * needed, and the 2nd time to fill it.
2235 	 */
2236 	if (num_planes &&
2237 	    (plane_resp->count_planes >= num_planes)) {
2238 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2239 
2240 		/* Plane lists are invariant, no locking needed. */
2241 		drm_for_each_plane(plane, dev) {
2242 			/*
2243 			 * Unless userspace set the 'universal planes'
2244 			 * capability bit, only advertise overlays.
2245 			 */
2246 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2247 			    !file_priv->universal_planes)
2248 				continue;
2249 
2250 			if (put_user(plane->base.id, plane_ptr + copied))
2251 				return -EFAULT;
2252 			copied++;
2253 		}
2254 	}
2255 	plane_resp->count_planes = num_planes;
2256 
2257 	return 0;
2258 }
2259 
2260 /**
2261  * drm_mode_getplane - get plane configuration
2262  * @dev: DRM device
2263  * @data: ioctl data
2264  * @file_priv: DRM file info
2265  *
2266  * Construct a plane configuration structure to return to the user.
2267  *
2268  * Called by the user via ioctl.
2269  *
2270  * Returns:
2271  * Zero on success, negative errno on failure.
2272  */
2273 int drm_mode_getplane(struct drm_device *dev, void *data,
2274 		      struct drm_file *file_priv)
2275 {
2276 	struct drm_mode_get_plane *plane_resp = data;
2277 	struct drm_plane *plane;
2278 	uint32_t __user *format_ptr;
2279 
2280 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2281 		return -EINVAL;
2282 
2283 	plane = drm_plane_find(dev, plane_resp->plane_id);
2284 	if (!plane)
2285 		return -ENOENT;
2286 
2287 	drm_modeset_lock(&plane->mutex, NULL);
2288 	if (plane->crtc)
2289 		plane_resp->crtc_id = plane->crtc->base.id;
2290 	else
2291 		plane_resp->crtc_id = 0;
2292 
2293 	if (plane->fb)
2294 		plane_resp->fb_id = plane->fb->base.id;
2295 	else
2296 		plane_resp->fb_id = 0;
2297 	drm_modeset_unlock(&plane->mutex);
2298 
2299 	plane_resp->plane_id = plane->base.id;
2300 	plane_resp->possible_crtcs = plane->possible_crtcs;
2301 	plane_resp->gamma_size = 0;
2302 
2303 	/*
2304 	 * This ioctl is called twice, once to determine how much space is
2305 	 * needed, and the 2nd time to fill it.
2306 	 */
2307 	if (plane->format_count &&
2308 	    (plane_resp->count_format_types >= plane->format_count)) {
2309 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2310 		if (copy_to_user(format_ptr,
2311 				 plane->format_types,
2312 				 sizeof(uint32_t) * plane->format_count)) {
2313 			return -EFAULT;
2314 		}
2315 	}
2316 	plane_resp->count_format_types = plane->format_count;
2317 
2318 	return 0;
2319 }
2320 
2321 /**
2322  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2323  * @plane: plane to check for format support
2324  * @format: the pixel format
2325  *
2326  * Returns:
2327  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2328  * otherwise.
2329  */
2330 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2331 {
2332 	unsigned int i;
2333 
2334 	for (i = 0; i < plane->format_count; i++) {
2335 		if (format == plane->format_types[i])
2336 			return 0;
2337 	}
2338 
2339 	return -EINVAL;
2340 }
2341 
2342 static int check_src_coords(uint32_t src_x, uint32_t src_y,
2343 			    uint32_t src_w, uint32_t src_h,
2344 			    const struct drm_framebuffer *fb)
2345 {
2346 	unsigned int fb_width, fb_height;
2347 
2348 	fb_width = fb->width << 16;
2349 	fb_height = fb->height << 16;
2350 
2351 	/* Make sure source coordinates are inside the fb. */
2352 	if (src_w > fb_width ||
2353 	    src_x > fb_width - src_w ||
2354 	    src_h > fb_height ||
2355 	    src_y > fb_height - src_h) {
2356 		DRM_DEBUG_KMS("Invalid source coordinates "
2357 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2358 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2359 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2360 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2361 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2362 		return -ENOSPC;
2363 	}
2364 
2365 	return 0;
2366 }
2367 
2368 /*
2369  * setplane_internal - setplane handler for internal callers
2370  *
2371  * Note that we assume an extra reference has already been taken on fb.  If the
2372  * update fails, this reference will be dropped before return; if it succeeds,
2373  * the previous framebuffer (if any) will be unreferenced instead.
2374  *
2375  * src_{x,y,w,h} are provided in 16.16 fixed point format
2376  */
2377 static int __setplane_internal(struct drm_plane *plane,
2378 			       struct drm_crtc *crtc,
2379 			       struct drm_framebuffer *fb,
2380 			       int32_t crtc_x, int32_t crtc_y,
2381 			       uint32_t crtc_w, uint32_t crtc_h,
2382 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2383 			       uint32_t src_x, uint32_t src_y,
2384 			       uint32_t src_w, uint32_t src_h)
2385 {
2386 	int ret = 0;
2387 
2388 	/* No fb means shut it down */
2389 	if (!fb) {
2390 		plane->old_fb = plane->fb;
2391 		ret = plane->funcs->disable_plane(plane);
2392 		if (!ret) {
2393 			plane->crtc = NULL;
2394 			plane->fb = NULL;
2395 		} else {
2396 			plane->old_fb = NULL;
2397 		}
2398 		goto out;
2399 	}
2400 
2401 	/* Check whether this plane is usable on this CRTC */
2402 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2403 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2404 		ret = -EINVAL;
2405 		goto out;
2406 	}
2407 
2408 	/* Check whether this plane supports the fb pixel format. */
2409 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2410 	if (ret) {
2411 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2412 			      drm_get_format_name(fb->pixel_format));
2413 		goto out;
2414 	}
2415 
2416 	/* Give drivers some help against integer overflows */
2417 	if (crtc_w > INT_MAX ||
2418 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2419 	    crtc_h > INT_MAX ||
2420 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2421 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2422 			      crtc_w, crtc_h, crtc_x, crtc_y);
2423 		ret = -ERANGE;
2424 		goto out;
2425 	}
2426 
2427 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
2428 	if (ret)
2429 		goto out;
2430 
2431 	plane->old_fb = plane->fb;
2432 	ret = plane->funcs->update_plane(plane, crtc, fb,
2433 					 crtc_x, crtc_y, crtc_w, crtc_h,
2434 					 src_x, src_y, src_w, src_h);
2435 	if (!ret) {
2436 		plane->crtc = crtc;
2437 		plane->fb = fb;
2438 		fb = NULL;
2439 	} else {
2440 		plane->old_fb = NULL;
2441 	}
2442 
2443 out:
2444 	if (fb)
2445 		drm_framebuffer_unreference(fb);
2446 	if (plane->old_fb)
2447 		drm_framebuffer_unreference(plane->old_fb);
2448 	plane->old_fb = NULL;
2449 
2450 	return ret;
2451 }
2452 
2453 static int setplane_internal(struct drm_plane *plane,
2454 			     struct drm_crtc *crtc,
2455 			     struct drm_framebuffer *fb,
2456 			     int32_t crtc_x, int32_t crtc_y,
2457 			     uint32_t crtc_w, uint32_t crtc_h,
2458 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2459 			     uint32_t src_x, uint32_t src_y,
2460 			     uint32_t src_w, uint32_t src_h)
2461 {
2462 	int ret;
2463 
2464 	drm_modeset_lock_all(plane->dev);
2465 	ret = __setplane_internal(plane, crtc, fb,
2466 				  crtc_x, crtc_y, crtc_w, crtc_h,
2467 				  src_x, src_y, src_w, src_h);
2468 	drm_modeset_unlock_all(plane->dev);
2469 
2470 	return ret;
2471 }
2472 
2473 /**
2474  * drm_mode_setplane - configure a plane's configuration
2475  * @dev: DRM device
2476  * @data: ioctl data*
2477  * @file_priv: DRM file info
2478  *
2479  * Set plane configuration, including placement, fb, scaling, and other factors.
2480  * Or pass a NULL fb to disable (planes may be disabled without providing a
2481  * valid crtc).
2482  *
2483  * Returns:
2484  * Zero on success, negative errno on failure.
2485  */
2486 int drm_mode_setplane(struct drm_device *dev, void *data,
2487 		      struct drm_file *file_priv)
2488 {
2489 	struct drm_mode_set_plane *plane_req = data;
2490 	struct drm_plane *plane;
2491 	struct drm_crtc *crtc = NULL;
2492 	struct drm_framebuffer *fb = NULL;
2493 
2494 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2495 		return -EINVAL;
2496 
2497 	/*
2498 	 * First, find the plane, crtc, and fb objects.  If not available,
2499 	 * we don't bother to call the driver.
2500 	 */
2501 	plane = drm_plane_find(dev, plane_req->plane_id);
2502 	if (!plane) {
2503 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2504 			      plane_req->plane_id);
2505 		return -ENOENT;
2506 	}
2507 
2508 	if (plane_req->fb_id) {
2509 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2510 		if (!fb) {
2511 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2512 				      plane_req->fb_id);
2513 			return -ENOENT;
2514 		}
2515 
2516 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2517 		if (!crtc) {
2518 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2519 				      plane_req->crtc_id);
2520 			return -ENOENT;
2521 		}
2522 	}
2523 
2524 	/*
2525 	 * setplane_internal will take care of deref'ing either the old or new
2526 	 * framebuffer depending on success.
2527 	 */
2528 	return setplane_internal(plane, crtc, fb,
2529 				 plane_req->crtc_x, plane_req->crtc_y,
2530 				 plane_req->crtc_w, plane_req->crtc_h,
2531 				 plane_req->src_x, plane_req->src_y,
2532 				 plane_req->src_w, plane_req->src_h);
2533 }
2534 
2535 /**
2536  * drm_mode_set_config_internal - helper to call ->set_config
2537  * @set: modeset config to set
2538  *
2539  * This is a little helper to wrap internal calls to the ->set_config driver
2540  * interface. The only thing it adds is correct refcounting dance.
2541  *
2542  * Returns:
2543  * Zero on success, negative errno on failure.
2544  */
2545 int drm_mode_set_config_internal(struct drm_mode_set *set)
2546 {
2547 	struct drm_crtc *crtc = set->crtc;
2548 	struct drm_framebuffer *fb;
2549 	struct drm_crtc *tmp;
2550 	int ret;
2551 
2552 	/*
2553 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2554 	 * connectors from it), hence we need to refcount the fbs across all
2555 	 * crtcs. Atomic modeset will have saner semantics ...
2556 	 */
2557 	drm_for_each_crtc(tmp, crtc->dev)
2558 		tmp->primary->old_fb = tmp->primary->fb;
2559 
2560 	fb = set->fb;
2561 
2562 	ret = crtc->funcs->set_config(set);
2563 	if (ret == 0) {
2564 		crtc->primary->crtc = crtc;
2565 		crtc->primary->fb = fb;
2566 	}
2567 
2568 	drm_for_each_crtc(tmp, crtc->dev) {
2569 		if (tmp->primary->fb)
2570 			drm_framebuffer_reference(tmp->primary->fb);
2571 		if (tmp->primary->old_fb)
2572 			drm_framebuffer_unreference(tmp->primary->old_fb);
2573 		tmp->primary->old_fb = NULL;
2574 	}
2575 
2576 	return ret;
2577 }
2578 EXPORT_SYMBOL(drm_mode_set_config_internal);
2579 
2580 /**
2581  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2582  * @mode: mode to query
2583  * @hdisplay: hdisplay value to fill in
2584  * @vdisplay: vdisplay value to fill in
2585  *
2586  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2587  * the appropriate layout.
2588  */
2589 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2590 			    int *hdisplay, int *vdisplay)
2591 {
2592 	struct drm_display_mode adjusted;
2593 
2594 	drm_mode_copy(&adjusted, mode);
2595 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2596 	*hdisplay = adjusted.crtc_hdisplay;
2597 	*vdisplay = adjusted.crtc_vdisplay;
2598 }
2599 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2600 
2601 /**
2602  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2603  *     CRTC viewport
2604  * @crtc: CRTC that framebuffer will be displayed on
2605  * @x: x panning
2606  * @y: y panning
2607  * @mode: mode that framebuffer will be displayed under
2608  * @fb: framebuffer to check size of
2609  */
2610 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2611 			    int x, int y,
2612 			    const struct drm_display_mode *mode,
2613 			    const struct drm_framebuffer *fb)
2614 
2615 {
2616 	int hdisplay, vdisplay;
2617 
2618 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2619 
2620 	if (crtc->state &&
2621 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
2622 					      BIT(DRM_ROTATE_270)))
2623 		swap(hdisplay, vdisplay);
2624 
2625 	return check_src_coords(x << 16, y << 16,
2626 				hdisplay << 16, vdisplay << 16, fb);
2627 }
2628 EXPORT_SYMBOL(drm_crtc_check_viewport);
2629 
2630 /**
2631  * drm_mode_setcrtc - set CRTC configuration
2632  * @dev: drm device for the ioctl
2633  * @data: data pointer for the ioctl
2634  * @file_priv: drm file for the ioctl call
2635  *
2636  * Build a new CRTC configuration based on user request.
2637  *
2638  * Called by the user via ioctl.
2639  *
2640  * Returns:
2641  * Zero on success, negative errno on failure.
2642  */
2643 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2644 		     struct drm_file *file_priv)
2645 {
2646 	struct drm_mode_config *config = &dev->mode_config;
2647 	struct drm_mode_crtc *crtc_req = data;
2648 	struct drm_crtc *crtc;
2649 	struct drm_connector **connector_set = NULL, *connector;
2650 	struct drm_framebuffer *fb = NULL;
2651 	struct drm_display_mode *mode = NULL;
2652 	struct drm_mode_set set;
2653 	uint32_t __user *set_connectors_ptr;
2654 	int ret;
2655 	int i;
2656 
2657 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2658 		return -EINVAL;
2659 
2660 	/*
2661 	 * Universal plane src offsets are only 16.16, prevent havoc for
2662 	 * drivers using universal plane code internally.
2663 	 */
2664 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2665 		return -ERANGE;
2666 
2667 	drm_modeset_lock_all(dev);
2668 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2669 	if (!crtc) {
2670 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2671 		ret = -ENOENT;
2672 		goto out;
2673 	}
2674 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2675 
2676 	if (crtc_req->mode_valid) {
2677 		/* If we have a mode we need a framebuffer. */
2678 		/* If we pass -1, set the mode with the currently bound fb */
2679 		if (crtc_req->fb_id == -1) {
2680 			if (!crtc->primary->fb) {
2681 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2682 				ret = -EINVAL;
2683 				goto out;
2684 			}
2685 			fb = crtc->primary->fb;
2686 			/* Make refcounting symmetric with the lookup path. */
2687 			drm_framebuffer_reference(fb);
2688 		} else {
2689 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2690 			if (!fb) {
2691 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2692 						crtc_req->fb_id);
2693 				ret = -ENOENT;
2694 				goto out;
2695 			}
2696 		}
2697 
2698 		mode = drm_mode_create(dev);
2699 		if (!mode) {
2700 			ret = -ENOMEM;
2701 			goto out;
2702 		}
2703 
2704 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2705 		if (ret) {
2706 			DRM_DEBUG_KMS("Invalid mode\n");
2707 			goto out;
2708 		}
2709 
2710 		/*
2711 		 * Check whether the primary plane supports the fb pixel format.
2712 		 * Drivers not implementing the universal planes API use a
2713 		 * default formats list provided by the DRM core which doesn't
2714 		 * match real hardware capabilities. Skip the check in that
2715 		 * case.
2716 		 */
2717 		if (!crtc->primary->format_default) {
2718 			ret = drm_plane_check_pixel_format(crtc->primary,
2719 							   fb->pixel_format);
2720 			if (ret) {
2721 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2722 					drm_get_format_name(fb->pixel_format));
2723 				goto out;
2724 			}
2725 		}
2726 
2727 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2728 					      mode, fb);
2729 		if (ret)
2730 			goto out;
2731 
2732 	}
2733 
2734 	if (crtc_req->count_connectors == 0 && mode) {
2735 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2736 		ret = -EINVAL;
2737 		goto out;
2738 	}
2739 
2740 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2741 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2742 			  crtc_req->count_connectors);
2743 		ret = -EINVAL;
2744 		goto out;
2745 	}
2746 
2747 	if (crtc_req->count_connectors > 0) {
2748 		u32 out_id;
2749 
2750 		/* Avoid unbounded kernel memory allocation */
2751 		if (crtc_req->count_connectors > config->num_connector) {
2752 			ret = -EINVAL;
2753 			goto out;
2754 		}
2755 
2756 		connector_set = kmalloc_array(crtc_req->count_connectors,
2757 					      sizeof(struct drm_connector *),
2758 					      GFP_KERNEL);
2759 		if (!connector_set) {
2760 			ret = -ENOMEM;
2761 			goto out;
2762 		}
2763 
2764 		for (i = 0; i < crtc_req->count_connectors; i++) {
2765 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2766 			if (get_user(out_id, &set_connectors_ptr[i])) {
2767 				ret = -EFAULT;
2768 				goto out;
2769 			}
2770 
2771 			connector = drm_connector_find(dev, out_id);
2772 			if (!connector) {
2773 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2774 						out_id);
2775 				ret = -ENOENT;
2776 				goto out;
2777 			}
2778 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2779 					connector->base.id,
2780 					connector->name);
2781 
2782 			connector_set[i] = connector;
2783 		}
2784 	}
2785 
2786 	set.crtc = crtc;
2787 	set.x = crtc_req->x;
2788 	set.y = crtc_req->y;
2789 	set.mode = mode;
2790 	set.connectors = connector_set;
2791 	set.num_connectors = crtc_req->count_connectors;
2792 	set.fb = fb;
2793 	ret = drm_mode_set_config_internal(&set);
2794 
2795 out:
2796 	if (fb)
2797 		drm_framebuffer_unreference(fb);
2798 
2799 	kfree(connector_set);
2800 	drm_mode_destroy(dev, mode);
2801 	drm_modeset_unlock_all(dev);
2802 	return ret;
2803 }
2804 
2805 /**
2806  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2807  *     universal plane handler call
2808  * @crtc: crtc to update cursor for
2809  * @req: data pointer for the ioctl
2810  * @file_priv: drm file for the ioctl call
2811  *
2812  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2813  * translate legacy ioctl calls into universal plane handler calls, we need to
2814  * wrap the native buffer handle in a drm_framebuffer.
2815  *
2816  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2817  * buffer with a pitch of 4*width; the universal plane interface should be used
2818  * directly in cases where the hardware can support other buffer settings and
2819  * userspace wants to make use of these capabilities.
2820  *
2821  * Returns:
2822  * Zero on success, negative errno on failure.
2823  */
2824 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2825 				     struct drm_mode_cursor2 *req,
2826 				     struct drm_file *file_priv)
2827 {
2828 	struct drm_device *dev = crtc->dev;
2829 	struct drm_framebuffer *fb = NULL;
2830 	struct drm_mode_fb_cmd2 fbreq = {
2831 		.width = req->width,
2832 		.height = req->height,
2833 		.pixel_format = DRM_FORMAT_ARGB8888,
2834 		.pitches = { req->width * 4 },
2835 		.handles = { req->handle },
2836 	};
2837 	int32_t crtc_x, crtc_y;
2838 	uint32_t crtc_w = 0, crtc_h = 0;
2839 	uint32_t src_w = 0, src_h = 0;
2840 	int ret = 0;
2841 
2842 	BUG_ON(!crtc->cursor);
2843 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2844 
2845 	/*
2846 	 * Obtain fb we'll be using (either new or existing) and take an extra
2847 	 * reference to it if fb != null.  setplane will take care of dropping
2848 	 * the reference if the plane update fails.
2849 	 */
2850 	if (req->flags & DRM_MODE_CURSOR_BO) {
2851 		if (req->handle) {
2852 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2853 			if (IS_ERR(fb)) {
2854 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2855 				return PTR_ERR(fb);
2856 			}
2857 		} else {
2858 			fb = NULL;
2859 		}
2860 	} else {
2861 		fb = crtc->cursor->fb;
2862 		if (fb)
2863 			drm_framebuffer_reference(fb);
2864 	}
2865 
2866 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2867 		crtc_x = req->x;
2868 		crtc_y = req->y;
2869 	} else {
2870 		crtc_x = crtc->cursor_x;
2871 		crtc_y = crtc->cursor_y;
2872 	}
2873 
2874 	if (fb) {
2875 		crtc_w = fb->width;
2876 		crtc_h = fb->height;
2877 		src_w = fb->width << 16;
2878 		src_h = fb->height << 16;
2879 	}
2880 
2881 	/*
2882 	 * setplane_internal will take care of deref'ing either the old or new
2883 	 * framebuffer depending on success.
2884 	 */
2885 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2886 				crtc_x, crtc_y, crtc_w, crtc_h,
2887 				0, 0, src_w, src_h);
2888 
2889 	/* Update successful; save new cursor position, if necessary */
2890 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2891 		crtc->cursor_x = req->x;
2892 		crtc->cursor_y = req->y;
2893 	}
2894 
2895 	return ret;
2896 }
2897 
2898 static int drm_mode_cursor_common(struct drm_device *dev,
2899 				  struct drm_mode_cursor2 *req,
2900 				  struct drm_file *file_priv)
2901 {
2902 	struct drm_crtc *crtc;
2903 	int ret = 0;
2904 
2905 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2906 		return -EINVAL;
2907 
2908 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2909 		return -EINVAL;
2910 
2911 	crtc = drm_crtc_find(dev, req->crtc_id);
2912 	if (!crtc) {
2913 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2914 		return -ENOENT;
2915 	}
2916 
2917 	/*
2918 	 * If this crtc has a universal cursor plane, call that plane's update
2919 	 * handler rather than using legacy cursor handlers.
2920 	 */
2921 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2922 	if (crtc->cursor) {
2923 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2924 		goto out;
2925 	}
2926 
2927 	if (req->flags & DRM_MODE_CURSOR_BO) {
2928 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2929 			ret = -ENXIO;
2930 			goto out;
2931 		}
2932 		/* Turns off the cursor if handle is 0 */
2933 		if (crtc->funcs->cursor_set2)
2934 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2935 						      req->width, req->height, req->hot_x, req->hot_y);
2936 		else
2937 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2938 						      req->width, req->height);
2939 	}
2940 
2941 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2942 		if (crtc->funcs->cursor_move) {
2943 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2944 		} else {
2945 			ret = -EFAULT;
2946 			goto out;
2947 		}
2948 	}
2949 out:
2950 	drm_modeset_unlock_crtc(crtc);
2951 
2952 	return ret;
2953 
2954 }
2955 
2956 
2957 /**
2958  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2959  * @dev: drm device for the ioctl
2960  * @data: data pointer for the ioctl
2961  * @file_priv: drm file for the ioctl call
2962  *
2963  * Set the cursor configuration based on user request.
2964  *
2965  * Called by the user via ioctl.
2966  *
2967  * Returns:
2968  * Zero on success, negative errno on failure.
2969  */
2970 int drm_mode_cursor_ioctl(struct drm_device *dev,
2971 			  void *data, struct drm_file *file_priv)
2972 {
2973 	struct drm_mode_cursor *req = data;
2974 	struct drm_mode_cursor2 new_req;
2975 
2976 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2977 	new_req.hot_x = new_req.hot_y = 0;
2978 
2979 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2980 }
2981 
2982 /**
2983  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2984  * @dev: drm device for the ioctl
2985  * @data: data pointer for the ioctl
2986  * @file_priv: drm file for the ioctl call
2987  *
2988  * Set the cursor configuration based on user request. This implements the 2nd
2989  * version of the cursor ioctl, which allows userspace to additionally specify
2990  * the hotspot of the pointer.
2991  *
2992  * Called by the user via ioctl.
2993  *
2994  * Returns:
2995  * Zero on success, negative errno on failure.
2996  */
2997 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2998 			   void *data, struct drm_file *file_priv)
2999 {
3000 	struct drm_mode_cursor2 *req = data;
3001 
3002 	return drm_mode_cursor_common(dev, req, file_priv);
3003 }
3004 
3005 /**
3006  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3007  * @bpp: bits per pixels
3008  * @depth: bit depth per pixel
3009  *
3010  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3011  * Useful in fbdev emulation code, since that deals in those values.
3012  */
3013 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3014 {
3015 	uint32_t fmt;
3016 
3017 	switch (bpp) {
3018 	case 8:
3019 		fmt = DRM_FORMAT_C8;
3020 		break;
3021 	case 16:
3022 		if (depth == 15)
3023 			fmt = DRM_FORMAT_XRGB1555;
3024 		else
3025 			fmt = DRM_FORMAT_RGB565;
3026 		break;
3027 	case 24:
3028 		fmt = DRM_FORMAT_RGB888;
3029 		break;
3030 	case 32:
3031 		if (depth == 24)
3032 			fmt = DRM_FORMAT_XRGB8888;
3033 		else if (depth == 30)
3034 			fmt = DRM_FORMAT_XRGB2101010;
3035 		else
3036 			fmt = DRM_FORMAT_ARGB8888;
3037 		break;
3038 	default:
3039 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3040 		fmt = DRM_FORMAT_XRGB8888;
3041 		break;
3042 	}
3043 
3044 	return fmt;
3045 }
3046 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3047 
3048 /**
3049  * drm_mode_addfb - add an FB to the graphics configuration
3050  * @dev: drm device for the ioctl
3051  * @data: data pointer for the ioctl
3052  * @file_priv: drm file for the ioctl call
3053  *
3054  * Add a new FB to the specified CRTC, given a user request. This is the
3055  * original addfb ioctl which only supported RGB formats.
3056  *
3057  * Called by the user via ioctl.
3058  *
3059  * Returns:
3060  * Zero on success, negative errno on failure.
3061  */
3062 int drm_mode_addfb(struct drm_device *dev,
3063 		   void *data, struct drm_file *file_priv)
3064 {
3065 	struct drm_mode_fb_cmd *or = data;
3066 	static const struct drm_mode_fb_cmd2 zero_fbcmd;
3067 	struct drm_mode_fb_cmd2 r = zero_fbcmd;
3068 	int ret;
3069 
3070 	/* convert to new format and call new ioctl */
3071 	r.fb_id = or->fb_id;
3072 	r.width = or->width;
3073 	r.height = or->height;
3074 	r.pitches[0] = or->pitch;
3075 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3076 	r.handles[0] = or->handle;
3077 
3078 	ret = drm_mode_addfb2(dev, &r, file_priv);
3079 	if (ret)
3080 		return ret;
3081 
3082 	or->fb_id = r.fb_id;
3083 
3084 	return 0;
3085 }
3086 
3087 static int format_check(const struct drm_mode_fb_cmd2 *r)
3088 {
3089 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3090 
3091 	switch (format) {
3092 	case DRM_FORMAT_C8:
3093 	case DRM_FORMAT_RGB332:
3094 	case DRM_FORMAT_BGR233:
3095 	case DRM_FORMAT_XRGB4444:
3096 	case DRM_FORMAT_XBGR4444:
3097 	case DRM_FORMAT_RGBX4444:
3098 	case DRM_FORMAT_BGRX4444:
3099 	case DRM_FORMAT_ARGB4444:
3100 	case DRM_FORMAT_ABGR4444:
3101 	case DRM_FORMAT_RGBA4444:
3102 	case DRM_FORMAT_BGRA4444:
3103 	case DRM_FORMAT_XRGB1555:
3104 	case DRM_FORMAT_XBGR1555:
3105 	case DRM_FORMAT_RGBX5551:
3106 	case DRM_FORMAT_BGRX5551:
3107 	case DRM_FORMAT_ARGB1555:
3108 	case DRM_FORMAT_ABGR1555:
3109 	case DRM_FORMAT_RGBA5551:
3110 	case DRM_FORMAT_BGRA5551:
3111 	case DRM_FORMAT_RGB565:
3112 	case DRM_FORMAT_BGR565:
3113 	case DRM_FORMAT_RGB888:
3114 	case DRM_FORMAT_BGR888:
3115 	case DRM_FORMAT_XRGB8888:
3116 	case DRM_FORMAT_XBGR8888:
3117 	case DRM_FORMAT_RGBX8888:
3118 	case DRM_FORMAT_BGRX8888:
3119 	case DRM_FORMAT_ARGB8888:
3120 	case DRM_FORMAT_ABGR8888:
3121 	case DRM_FORMAT_RGBA8888:
3122 	case DRM_FORMAT_BGRA8888:
3123 	case DRM_FORMAT_XRGB2101010:
3124 	case DRM_FORMAT_XBGR2101010:
3125 	case DRM_FORMAT_RGBX1010102:
3126 	case DRM_FORMAT_BGRX1010102:
3127 	case DRM_FORMAT_ARGB2101010:
3128 	case DRM_FORMAT_ABGR2101010:
3129 	case DRM_FORMAT_RGBA1010102:
3130 	case DRM_FORMAT_BGRA1010102:
3131 	case DRM_FORMAT_YUYV:
3132 	case DRM_FORMAT_YVYU:
3133 	case DRM_FORMAT_UYVY:
3134 	case DRM_FORMAT_VYUY:
3135 	case DRM_FORMAT_AYUV:
3136 	case DRM_FORMAT_NV12:
3137 	case DRM_FORMAT_NV21:
3138 	case DRM_FORMAT_NV16:
3139 	case DRM_FORMAT_NV61:
3140 	case DRM_FORMAT_NV24:
3141 	case DRM_FORMAT_NV42:
3142 	case DRM_FORMAT_YUV410:
3143 	case DRM_FORMAT_YVU410:
3144 	case DRM_FORMAT_YUV411:
3145 	case DRM_FORMAT_YVU411:
3146 	case DRM_FORMAT_YUV420:
3147 	case DRM_FORMAT_YVU420:
3148 	case DRM_FORMAT_YUV422:
3149 	case DRM_FORMAT_YVU422:
3150 	case DRM_FORMAT_YUV444:
3151 	case DRM_FORMAT_YVU444:
3152 		return 0;
3153 	default:
3154 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3155 			      drm_get_format_name(r->pixel_format));
3156 		return -EINVAL;
3157 	}
3158 }
3159 
3160 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3161 {
3162 	int ret, hsub, vsub, num_planes, i;
3163 
3164 	ret = format_check(r);
3165 	if (ret) {
3166 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3167 			      drm_get_format_name(r->pixel_format));
3168 		return ret;
3169 	}
3170 
3171 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3172 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3173 	num_planes = drm_format_num_planes(r->pixel_format);
3174 
3175 	if (r->width == 0 || r->width % hsub) {
3176 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3177 		return -EINVAL;
3178 	}
3179 
3180 	if (r->height == 0 || r->height % vsub) {
3181 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3182 		return -EINVAL;
3183 	}
3184 
3185 	for (i = 0; i < num_planes; i++) {
3186 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3187 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3188 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3189 
3190 		if (!r->handles[i]) {
3191 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3192 			return -EINVAL;
3193 		}
3194 
3195 		if ((uint64_t) width * cpp > UINT_MAX)
3196 			return -ERANGE;
3197 
3198 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3199 			return -ERANGE;
3200 
3201 		if (r->pitches[i] < width * cpp) {
3202 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3203 			return -EINVAL;
3204 		}
3205 
3206 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3207 			DRM_DEBUG_KMS("bad fb modifier %"PRIu64" for plane %d\n",
3208 				      r->modifier[i], i);
3209 			return -EINVAL;
3210 		}
3211 
3212 		/* modifier specific checks: */
3213 		switch (r->modifier[i]) {
3214 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3215 			/* NOTE: the pitch restriction may be lifted later if it turns
3216 			 * out that no hw has this restriction:
3217 			 */
3218 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3219 					width % 128 || height % 32 ||
3220 					r->pitches[i] % 128) {
3221 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3222 				return -EINVAL;
3223 			}
3224 			break;
3225 
3226 		default:
3227 			break;
3228 		}
3229 	}
3230 
3231 	for (i = num_planes; i < 4; i++) {
3232 		if (r->modifier[i]) {
3233 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3234 			return -EINVAL;
3235 		}
3236 
3237 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3238 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3239 			continue;
3240 
3241 		if (r->handles[i]) {
3242 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3243 			return -EINVAL;
3244 		}
3245 
3246 		if (r->pitches[i]) {
3247 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3248 			return -EINVAL;
3249 		}
3250 
3251 		if (r->offsets[i]) {
3252 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3253 			return -EINVAL;
3254 		}
3255 	}
3256 
3257 	return 0;
3258 }
3259 
3260 static struct drm_framebuffer *
3261 internal_framebuffer_create(struct drm_device *dev,
3262 			    struct drm_mode_fb_cmd2 *r,
3263 			    struct drm_file *file_priv)
3264 {
3265 	struct drm_mode_config *config = &dev->mode_config;
3266 	struct drm_framebuffer *fb;
3267 	int ret;
3268 
3269 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3270 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3271 		return ERR_PTR(-EINVAL);
3272 	}
3273 
3274 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3275 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3276 			  r->width, config->min_width, config->max_width);
3277 		return ERR_PTR(-EINVAL);
3278 	}
3279 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3280 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3281 			  r->height, config->min_height, config->max_height);
3282 		return ERR_PTR(-EINVAL);
3283 	}
3284 
3285 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3286 	    !dev->mode_config.allow_fb_modifiers) {
3287 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3288 		return ERR_PTR(-EINVAL);
3289 	}
3290 
3291 	ret = framebuffer_check(r);
3292 	if (ret)
3293 		return ERR_PTR(ret);
3294 
3295 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3296 	if (IS_ERR(fb)) {
3297 		DRM_DEBUG_KMS("could not create framebuffer\n");
3298 		return fb;
3299 	}
3300 
3301 	return fb;
3302 }
3303 
3304 /**
3305  * drm_mode_addfb2 - add an FB to the graphics configuration
3306  * @dev: drm device for the ioctl
3307  * @data: data pointer for the ioctl
3308  * @file_priv: drm file for the ioctl call
3309  *
3310  * Add a new FB to the specified CRTC, given a user request with format. This is
3311  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3312  * and uses fourcc codes as pixel format specifiers.
3313  *
3314  * Called by the user via ioctl.
3315  *
3316  * Returns:
3317  * Zero on success, negative errno on failure.
3318  */
3319 int drm_mode_addfb2(struct drm_device *dev,
3320 		    void *data, struct drm_file *file_priv)
3321 {
3322 	struct drm_mode_fb_cmd2 *r = data;
3323 	struct drm_framebuffer *fb;
3324 
3325 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3326 		return -EINVAL;
3327 
3328 	fb = internal_framebuffer_create(dev, r, file_priv);
3329 	if (IS_ERR(fb))
3330 		return PTR_ERR(fb);
3331 
3332 	/* Transfer ownership to the filp for reaping on close */
3333 
3334 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3335 	mutex_lock(&file_priv->fbs_lock);
3336 	r->fb_id = fb->base.id;
3337 	list_add(&fb->filp_head, &file_priv->fbs);
3338 	mutex_unlock(&file_priv->fbs_lock);
3339 
3340 	return 0;
3341 }
3342 
3343 struct drm_mode_rmfb_work {
3344 	struct work_struct work;
3345 	struct list_head fbs;
3346 };
3347 
3348 static void drm_mode_rmfb_work_fn(struct work_struct *w)
3349 {
3350 	struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work);
3351 
3352 	while (!list_empty(&arg->fbs)) {
3353 		struct drm_framebuffer *fb =
3354 			list_first_entry(&arg->fbs, typeof(*fb), filp_head);
3355 
3356 		list_del_init(&fb->filp_head);
3357 		drm_framebuffer_remove(fb);
3358 	}
3359 }
3360 
3361 /**
3362  * drm_mode_rmfb - remove an FB from the configuration
3363  * @dev: drm device for the ioctl
3364  * @data: data pointer for the ioctl
3365  * @file_priv: drm file for the ioctl call
3366  *
3367  * Remove the FB specified by the user.
3368  *
3369  * Called by the user via ioctl.
3370  *
3371  * Returns:
3372  * Zero on success, negative errno on failure.
3373  */
3374 int drm_mode_rmfb(struct drm_device *dev,
3375 		   void *data, struct drm_file *file_priv)
3376 {
3377 	struct drm_framebuffer *fb = NULL;
3378 	struct drm_framebuffer *fbl = NULL;
3379 	uint32_t *id = data;
3380 	int found = 0;
3381 
3382 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3383 		return -EINVAL;
3384 
3385 	mutex_lock(&file_priv->fbs_lock);
3386 	mutex_lock(&dev->mode_config.fb_lock);
3387 	fb = __drm_framebuffer_lookup(dev, *id);
3388 	if (!fb)
3389 		goto fail_lookup;
3390 
3391 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3392 		if (fb == fbl)
3393 			found = 1;
3394 	if (!found)
3395 		goto fail_lookup;
3396 
3397 	list_del_init(&fb->filp_head);
3398 	mutex_unlock(&dev->mode_config.fb_lock);
3399 	mutex_unlock(&file_priv->fbs_lock);
3400 
3401 	/*
3402 	 * we now own the reference that was stored in the fbs list
3403 	 *
3404 	 * drm_framebuffer_remove may fail with -EINTR on pending signals,
3405 	 * so run this in a separate stack as there's no way to correctly
3406 	 * handle this after the fb is already removed from the lookup table.
3407 	 */
3408 	if (!kref_exclusive_p(&fb->refcount)) {
3409 		struct drm_mode_rmfb_work arg;
3410 
3411 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
3412 		INIT_LIST_HEAD(&arg.fbs);
3413 		list_add_tail(&fb->filp_head, &arg.fbs);
3414 
3415 		schedule_work(&arg.work);
3416 		flush_work(&arg.work);
3417 		destroy_work_on_stack(&arg.work);
3418 	} else
3419 		drm_framebuffer_unreference(fb);
3420 
3421 	return 0;
3422 
3423 fail_lookup:
3424 	mutex_unlock(&dev->mode_config.fb_lock);
3425 	mutex_unlock(&file_priv->fbs_lock);
3426 
3427 	return -ENOENT;
3428 }
3429 
3430 /**
3431  * drm_mode_getfb - get FB info
3432  * @dev: drm device for the ioctl
3433  * @data: data pointer for the ioctl
3434  * @file_priv: drm file for the ioctl call
3435  *
3436  * Lookup the FB given its ID and return info about it.
3437  *
3438  * Called by the user via ioctl.
3439  *
3440  * Returns:
3441  * Zero on success, negative errno on failure.
3442  */
3443 int drm_mode_getfb(struct drm_device *dev,
3444 		   void *data, struct drm_file *file_priv)
3445 {
3446 	struct drm_mode_fb_cmd *r = data;
3447 	struct drm_framebuffer *fb;
3448 	int ret;
3449 
3450 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3451 		return -EINVAL;
3452 
3453 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3454 	if (!fb)
3455 		return -ENOENT;
3456 
3457 	r->height = fb->height;
3458 	r->width = fb->width;
3459 	r->depth = fb->depth;
3460 	r->bpp = fb->bits_per_pixel;
3461 	r->pitch = fb->pitches[0];
3462 	if (fb->funcs->create_handle) {
3463 		if (file_priv->is_master ||
3464 #ifdef __NetBSD__
3465 		    DRM_SUSER() ||
3466 #else
3467 		    capable(CAP_SYS_ADMIN) ||
3468 #endif
3469 		    drm_is_control_client(file_priv)) {
3470 			ret = fb->funcs->create_handle(fb, file_priv,
3471 						       &r->handle);
3472 		} else {
3473 			/* GET_FB() is an unprivileged ioctl so we must not
3474 			 * return a buffer-handle to non-master processes! For
3475 			 * backwards-compatibility reasons, we cannot make
3476 			 * GET_FB() privileged, so just return an invalid handle
3477 			 * for non-masters. */
3478 			r->handle = 0;
3479 			ret = 0;
3480 		}
3481 	} else {
3482 		ret = -ENODEV;
3483 	}
3484 
3485 	drm_framebuffer_unreference(fb);
3486 
3487 	return ret;
3488 }
3489 
3490 /**
3491  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3492  * @dev: drm device for the ioctl
3493  * @data: data pointer for the ioctl
3494  * @file_priv: drm file for the ioctl call
3495  *
3496  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3497  * rectangle list. Generic userspace which does frontbuffer rendering must call
3498  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3499  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3500  *
3501  * Modesetting drivers which always update the frontbuffer do not need to
3502  * implement the corresponding ->dirty framebuffer callback.
3503  *
3504  * Called by the user via ioctl.
3505  *
3506  * Returns:
3507  * Zero on success, negative errno on failure.
3508  */
3509 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3510 			   void *data, struct drm_file *file_priv)
3511 {
3512 	struct drm_clip_rect __user *clips_ptr;
3513 	struct drm_clip_rect *clips = NULL;
3514 	struct drm_mode_fb_dirty_cmd *r = data;
3515 	struct drm_framebuffer *fb;
3516 	unsigned flags;
3517 	int num_clips;
3518 	int ret;
3519 
3520 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3521 		return -EINVAL;
3522 
3523 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3524 	if (!fb)
3525 		return -ENOENT;
3526 
3527 	num_clips = r->num_clips;
3528 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3529 
3530 	if (!num_clips != !clips_ptr) {
3531 		ret = -EINVAL;
3532 		goto out_err1;
3533 	}
3534 
3535 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3536 
3537 	/* If userspace annotates copy, clips must come in pairs */
3538 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3539 		ret = -EINVAL;
3540 		goto out_err1;
3541 	}
3542 
3543 	if (num_clips && clips_ptr) {
3544 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3545 			ret = -EINVAL;
3546 			goto out_err1;
3547 		}
3548 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3549 		if (!clips) {
3550 			ret = -ENOMEM;
3551 			goto out_err1;
3552 		}
3553 
3554 		ret = copy_from_user(clips, clips_ptr,
3555 				     num_clips * sizeof(*clips));
3556 		if (ret) {
3557 			ret = -EFAULT;
3558 			goto out_err2;
3559 		}
3560 	}
3561 
3562 	if (fb->funcs->dirty) {
3563 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3564 				       clips, num_clips);
3565 	} else {
3566 		ret = -ENOSYS;
3567 	}
3568 
3569 out_err2:
3570 	kfree(clips);
3571 out_err1:
3572 	drm_framebuffer_unreference(fb);
3573 
3574 	return ret;
3575 }
3576 
3577 /**
3578  * drm_fb_release - remove and free the FBs on this file
3579  * @priv: drm file for the ioctl
3580  *
3581  * Destroy all the FBs associated with @filp.
3582  *
3583  * Called by the user via ioctl.
3584  *
3585  * Returns:
3586  * Zero on success, negative errno on failure.
3587  */
3588 void drm_fb_release(struct drm_file *priv)
3589 {
3590 	struct drm_framebuffer *fb, *tfb;
3591 	struct drm_mode_rmfb_work arg;
3592 
3593 	INIT_LIST_HEAD(&arg.fbs);
3594 
3595 	/*
3596 	 * When the file gets released that means no one else can access the fb
3597 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3598 	 * avoid upsetting lockdep since the universal cursor code adds a
3599 	 * framebuffer while holding mutex locks.
3600 	 *
3601 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3602 	 * locks is impossible here since no one else but this function can get
3603 	 * at it any more.
3604 	 */
3605 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3606 		if (!kref_exclusive_p(&fb->refcount)) {
3607 			list_move_tail(&fb->filp_head, &arg.fbs);
3608 		} else {
3609 			list_del_init(&fb->filp_head);
3610 
3611 			/* This drops the fpriv->fbs reference. */
3612 			drm_framebuffer_unreference(fb);
3613 		}
3614 	}
3615 
3616 	if (!list_empty(&arg.fbs)) {
3617 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
3618 
3619 		schedule_work(&arg.work);
3620 		flush_work(&arg.work);
3621 		destroy_work_on_stack(&arg.work);
3622 	}
3623 }
3624 
3625 /**
3626  * drm_property_create - create a new property type
3627  * @dev: drm device
3628  * @flags: flags specifying the property type
3629  * @name: name of the property
3630  * @num_values: number of pre-defined values
3631  *
3632  * This creates a new generic drm property which can then be attached to a drm
3633  * object with drm_object_attach_property. The returned property object must be
3634  * freed with drm_property_destroy.
3635  *
3636  * Note that the DRM core keeps a per-device list of properties and that, if
3637  * drm_mode_config_cleanup() is called, it will destroy all properties created
3638  * by the driver.
3639  *
3640  * Returns:
3641  * A pointer to the newly created property on success, NULL on failure.
3642  */
3643 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3644 					 const char *name, int num_values)
3645 {
3646 	struct drm_property *property = NULL;
3647 	int ret;
3648 
3649 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3650 	if (!property)
3651 		return NULL;
3652 
3653 	property->dev = dev;
3654 
3655 	if (num_values) {
3656 		property->values = kcalloc(num_values, sizeof(uint64_t),
3657 					   GFP_KERNEL);
3658 		if (!property->values)
3659 			goto fail;
3660 	}
3661 
3662 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3663 	if (ret)
3664 		goto fail;
3665 
3666 	property->flags = flags;
3667 	property->num_values = num_values;
3668 	INIT_LIST_HEAD(&property->enum_list);
3669 
3670 	if (name) {
3671 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3672 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3673 	}
3674 
3675 	list_add_tail(&property->head, &dev->mode_config.property_list);
3676 
3677 	WARN_ON(!drm_property_type_valid(property));
3678 
3679 	return property;
3680 fail:
3681 	kfree(property->values);
3682 	kfree(property);
3683 	return NULL;
3684 }
3685 EXPORT_SYMBOL(drm_property_create);
3686 
3687 /**
3688  * drm_property_create_enum - create a new enumeration property type
3689  * @dev: drm device
3690  * @flags: flags specifying the property type
3691  * @name: name of the property
3692  * @props: enumeration lists with property values
3693  * @num_values: number of pre-defined values
3694  *
3695  * This creates a new generic drm property which can then be attached to a drm
3696  * object with drm_object_attach_property. The returned property object must be
3697  * freed with drm_property_destroy.
3698  *
3699  * Userspace is only allowed to set one of the predefined values for enumeration
3700  * properties.
3701  *
3702  * Returns:
3703  * A pointer to the newly created property on success, NULL on failure.
3704  */
3705 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3706 					 const char *name,
3707 					 const struct drm_prop_enum_list *props,
3708 					 int num_values)
3709 {
3710 	struct drm_property *property;
3711 	int i, ret;
3712 
3713 	flags |= DRM_MODE_PROP_ENUM;
3714 
3715 	property = drm_property_create(dev, flags, name, num_values);
3716 	if (!property)
3717 		return NULL;
3718 
3719 	for (i = 0; i < num_values; i++) {
3720 		ret = drm_property_add_enum(property, i,
3721 				      props[i].type,
3722 				      props[i].name);
3723 		if (ret) {
3724 			drm_property_destroy(dev, property);
3725 			return NULL;
3726 		}
3727 	}
3728 
3729 	return property;
3730 }
3731 EXPORT_SYMBOL(drm_property_create_enum);
3732 
3733 /**
3734  * drm_property_create_bitmask - create a new bitmask property type
3735  * @dev: drm device
3736  * @flags: flags specifying the property type
3737  * @name: name of the property
3738  * @props: enumeration lists with property bitflags
3739  * @num_props: size of the @props array
3740  * @supported_bits: bitmask of all supported enumeration values
3741  *
3742  * This creates a new bitmask drm property which can then be attached to a drm
3743  * object with drm_object_attach_property. The returned property object must be
3744  * freed with drm_property_destroy.
3745  *
3746  * Compared to plain enumeration properties userspace is allowed to set any
3747  * or'ed together combination of the predefined property bitflag values
3748  *
3749  * Returns:
3750  * A pointer to the newly created property on success, NULL on failure.
3751  */
3752 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3753 					 int flags, const char *name,
3754 					 const struct drm_prop_enum_list *props,
3755 					 int num_props,
3756 					 uint64_t supported_bits)
3757 {
3758 	struct drm_property *property;
3759 	int i, ret, index = 0;
3760 	int num_values = hweight64(supported_bits);
3761 
3762 	flags |= DRM_MODE_PROP_BITMASK;
3763 
3764 	property = drm_property_create(dev, flags, name, num_values);
3765 	if (!property)
3766 		return NULL;
3767 	for (i = 0; i < num_props; i++) {
3768 		if (!(supported_bits & (1ULL << props[i].type)))
3769 			continue;
3770 
3771 		if (WARN_ON(index >= num_values)) {
3772 			drm_property_destroy(dev, property);
3773 			return NULL;
3774 		}
3775 
3776 		ret = drm_property_add_enum(property, index++,
3777 				      props[i].type,
3778 				      props[i].name);
3779 		if (ret) {
3780 			drm_property_destroy(dev, property);
3781 			return NULL;
3782 		}
3783 	}
3784 
3785 	return property;
3786 }
3787 EXPORT_SYMBOL(drm_property_create_bitmask);
3788 
3789 static struct drm_property *property_create_range(struct drm_device *dev,
3790 					 int flags, const char *name,
3791 					 uint64_t min, uint64_t max)
3792 {
3793 	struct drm_property *property;
3794 
3795 	property = drm_property_create(dev, flags, name, 2);
3796 	if (!property)
3797 		return NULL;
3798 
3799 	property->values[0] = min;
3800 	property->values[1] = max;
3801 
3802 	return property;
3803 }
3804 
3805 /**
3806  * drm_property_create_range - create a new unsigned ranged property type
3807  * @dev: drm device
3808  * @flags: flags specifying the property type
3809  * @name: name of the property
3810  * @min: minimum value of the property
3811  * @max: maximum value of the property
3812  *
3813  * This creates a new generic drm property which can then be attached to a drm
3814  * object with drm_object_attach_property. The returned property object must be
3815  * freed with drm_property_destroy.
3816  *
3817  * Userspace is allowed to set any unsigned integer value in the (min, max)
3818  * range inclusive.
3819  *
3820  * Returns:
3821  * A pointer to the newly created property on success, NULL on failure.
3822  */
3823 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3824 					 const char *name,
3825 					 uint64_t min, uint64_t max)
3826 {
3827 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3828 			name, min, max);
3829 }
3830 EXPORT_SYMBOL(drm_property_create_range);
3831 
3832 /**
3833  * drm_property_create_signed_range - create a new signed ranged property type
3834  * @dev: drm device
3835  * @flags: flags specifying the property type
3836  * @name: name of the property
3837  * @min: minimum value of the property
3838  * @max: maximum value of the property
3839  *
3840  * This creates a new generic drm property which can then be attached to a drm
3841  * object with drm_object_attach_property. The returned property object must be
3842  * freed with drm_property_destroy.
3843  *
3844  * Userspace is allowed to set any signed integer value in the (min, max)
3845  * range inclusive.
3846  *
3847  * Returns:
3848  * A pointer to the newly created property on success, NULL on failure.
3849  */
3850 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3851 					 int flags, const char *name,
3852 					 int64_t min, int64_t max)
3853 {
3854 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3855 			name, I642U64(min), I642U64(max));
3856 }
3857 EXPORT_SYMBOL(drm_property_create_signed_range);
3858 
3859 /**
3860  * drm_property_create_object - create a new object property type
3861  * @dev: drm device
3862  * @flags: flags specifying the property type
3863  * @name: name of the property
3864  * @type: object type from DRM_MODE_OBJECT_* defines
3865  *
3866  * This creates a new generic drm property which can then be attached to a drm
3867  * object with drm_object_attach_property. The returned property object must be
3868  * freed with drm_property_destroy.
3869  *
3870  * Userspace is only allowed to set this to any property value of the given
3871  * @type. Only useful for atomic properties, which is enforced.
3872  *
3873  * Returns:
3874  * A pointer to the newly created property on success, NULL on failure.
3875  */
3876 struct drm_property *drm_property_create_object(struct drm_device *dev,
3877 					 int flags, const char *name, uint32_t type)
3878 {
3879 	struct drm_property *property;
3880 
3881 	flags |= DRM_MODE_PROP_OBJECT;
3882 
3883 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3884 		return NULL;
3885 
3886 	property = drm_property_create(dev, flags, name, 1);
3887 	if (!property)
3888 		return NULL;
3889 
3890 	property->values[0] = type;
3891 
3892 	return property;
3893 }
3894 EXPORT_SYMBOL(drm_property_create_object);
3895 
3896 /**
3897  * drm_property_create_bool - create a new boolean property type
3898  * @dev: drm device
3899  * @flags: flags specifying the property type
3900  * @name: name of the property
3901  *
3902  * This creates a new generic drm property which can then be attached to a drm
3903  * object with drm_object_attach_property. The returned property object must be
3904  * freed with drm_property_destroy.
3905  *
3906  * This is implemented as a ranged property with only {0, 1} as valid values.
3907  *
3908  * Returns:
3909  * A pointer to the newly created property on success, NULL on failure.
3910  */
3911 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3912 					 const char *name)
3913 {
3914 	return drm_property_create_range(dev, flags, name, 0, 1);
3915 }
3916 EXPORT_SYMBOL(drm_property_create_bool);
3917 
3918 /**
3919  * drm_property_add_enum - add a possible value to an enumeration property
3920  * @property: enumeration property to change
3921  * @index: index of the new enumeration
3922  * @value: value of the new enumeration
3923  * @name: symbolic name of the new enumeration
3924  *
3925  * This functions adds enumerations to a property.
3926  *
3927  * It's use is deprecated, drivers should use one of the more specific helpers
3928  * to directly create the property with all enumerations already attached.
3929  *
3930  * Returns:
3931  * Zero on success, error code on failure.
3932  */
3933 int drm_property_add_enum(struct drm_property *property, int index,
3934 			  uint64_t value, const char *name)
3935 {
3936 	struct drm_property_enum *prop_enum;
3937 
3938 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3939 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3940 		return -EINVAL;
3941 
3942 	/*
3943 	 * Bitmask enum properties have the additional constraint of values
3944 	 * from 0 to 63
3945 	 */
3946 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3947 			(value > 63))
3948 		return -EINVAL;
3949 
3950 	if (!list_empty(&property->enum_list)) {
3951 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3952 			if (prop_enum->value == value) {
3953 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3954 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3955 				return 0;
3956 			}
3957 		}
3958 	}
3959 
3960 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3961 	if (!prop_enum)
3962 		return -ENOMEM;
3963 
3964 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3965 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3966 	prop_enum->value = value;
3967 
3968 	property->values[index] = value;
3969 	list_add_tail(&prop_enum->head, &property->enum_list);
3970 	return 0;
3971 }
3972 EXPORT_SYMBOL(drm_property_add_enum);
3973 
3974 /**
3975  * drm_property_destroy - destroy a drm property
3976  * @dev: drm device
3977  * @property: property to destry
3978  *
3979  * This function frees a property including any attached resources like
3980  * enumeration values.
3981  */
3982 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3983 {
3984 	struct drm_property_enum *prop_enum, *pt;
3985 
3986 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3987 		list_del(&prop_enum->head);
3988 		kfree(prop_enum);
3989 	}
3990 
3991 	if (property->num_values)
3992 		kfree(property->values);
3993 	drm_mode_object_put(dev, &property->base);
3994 	list_del(&property->head);
3995 	kfree(property);
3996 }
3997 EXPORT_SYMBOL(drm_property_destroy);
3998 
3999 /**
4000  * drm_object_attach_property - attach a property to a modeset object
4001  * @obj: drm modeset object
4002  * @property: property to attach
4003  * @init_val: initial value of the property
4004  *
4005  * This attaches the given property to the modeset object with the given initial
4006  * value. Currently this function cannot fail since the properties are stored in
4007  * a statically sized array.
4008  */
4009 void drm_object_attach_property(struct drm_mode_object *obj,
4010 				struct drm_property *property,
4011 				uint64_t init_val)
4012 {
4013 	int count = obj->properties->count;
4014 
4015 	if (count == DRM_OBJECT_MAX_PROPERTY) {
4016 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
4017 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
4018 			"you see this message on the same object type.\n",
4019 			obj->type);
4020 		return;
4021 	}
4022 
4023 	obj->properties->properties[count] = property;
4024 	obj->properties->values[count] = init_val;
4025 	obj->properties->count++;
4026 	if (property->flags & DRM_MODE_PROP_ATOMIC)
4027 		obj->properties->atomic_count++;
4028 }
4029 EXPORT_SYMBOL(drm_object_attach_property);
4030 
4031 /**
4032  * drm_object_property_set_value - set the value of a property
4033  * @obj: drm mode object to set property value for
4034  * @property: property to set
4035  * @val: value the property should be set to
4036  *
4037  * This functions sets a given property on a given object. This function only
4038  * changes the software state of the property, it does not call into the
4039  * driver's ->set_property callback.
4040  *
4041  * Returns:
4042  * Zero on success, error code on failure.
4043  */
4044 int drm_object_property_set_value(struct drm_mode_object *obj,
4045 				  struct drm_property *property, uint64_t val)
4046 {
4047 	int i;
4048 
4049 	for (i = 0; i < obj->properties->count; i++) {
4050 		if (obj->properties->properties[i] == property) {
4051 			obj->properties->values[i] = val;
4052 			return 0;
4053 		}
4054 	}
4055 
4056 	return -EINVAL;
4057 }
4058 EXPORT_SYMBOL(drm_object_property_set_value);
4059 
4060 /**
4061  * drm_object_property_get_value - retrieve the value of a property
4062  * @obj: drm mode object to get property value from
4063  * @property: property to retrieve
4064  * @val: storage for the property value
4065  *
4066  * This function retrieves the softare state of the given property for the given
4067  * property. Since there is no driver callback to retrieve the current property
4068  * value this might be out of sync with the hardware, depending upon the driver
4069  * and property.
4070  *
4071  * Returns:
4072  * Zero on success, error code on failure.
4073  */
4074 int drm_object_property_get_value(struct drm_mode_object *obj,
4075 				  struct drm_property *property, uint64_t *val)
4076 {
4077 	int i;
4078 
4079 	/* read-only properties bypass atomic mechanism and still store
4080 	 * their value in obj->properties->values[].. mostly to avoid
4081 	 * having to deal w/ EDID and similar props in atomic paths:
4082 	 */
4083 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4084 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4085 		return drm_atomic_get_property(obj, property, val);
4086 
4087 	for (i = 0; i < obj->properties->count; i++) {
4088 		if (obj->properties->properties[i] == property) {
4089 			*val = obj->properties->values[i];
4090 			return 0;
4091 		}
4092 	}
4093 
4094 	return -EINVAL;
4095 }
4096 EXPORT_SYMBOL(drm_object_property_get_value);
4097 
4098 /**
4099  * drm_mode_getproperty_ioctl - get the property metadata
4100  * @dev: DRM device
4101  * @data: ioctl data
4102  * @file_priv: DRM file info
4103  *
4104  * This function retrieves the metadata for a given property, like the different
4105  * possible values for an enum property or the limits for a range property.
4106  *
4107  * Blob properties are special
4108  *
4109  * Called by the user via ioctl.
4110  *
4111  * Returns:
4112  * Zero on success, negative errno on failure.
4113  */
4114 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4115 			       void *data, struct drm_file *file_priv)
4116 {
4117 	struct drm_mode_get_property *out_resp = data;
4118 	struct drm_property *property;
4119 	int enum_count = 0;
4120 	int value_count = 0;
4121 	int ret = 0, i;
4122 	int copied;
4123 	struct drm_property_enum *prop_enum;
4124 	struct drm_mode_property_enum __user *enum_ptr;
4125 	uint64_t __user *values_ptr;
4126 
4127 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4128 		return -EINVAL;
4129 
4130 	drm_modeset_lock_all(dev);
4131 	property = drm_property_find(dev, out_resp->prop_id);
4132 	if (!property) {
4133 		ret = -ENOENT;
4134 		goto done;
4135 	}
4136 
4137 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4138 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4139 		list_for_each_entry(prop_enum, &property->enum_list, head)
4140 			enum_count++;
4141 	}
4142 
4143 	value_count = property->num_values;
4144 
4145 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4146 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4147 	out_resp->flags = property->flags;
4148 
4149 	if ((out_resp->count_values >= value_count) && value_count) {
4150 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4151 		for (i = 0; i < value_count; i++) {
4152 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4153 				ret = -EFAULT;
4154 				goto done;
4155 			}
4156 		}
4157 	}
4158 	out_resp->count_values = value_count;
4159 
4160 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4161 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4162 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4163 			copied = 0;
4164 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4165 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4166 
4167 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4168 					ret = -EFAULT;
4169 					goto done;
4170 				}
4171 
4172 				if (copy_to_user(&enum_ptr[copied].name,
4173 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4174 					ret = -EFAULT;
4175 					goto done;
4176 				}
4177 				copied++;
4178 			}
4179 		}
4180 		out_resp->count_enum_blobs = enum_count;
4181 	}
4182 
4183 	/*
4184 	 * NOTE: The idea seems to have been to use this to read all the blob
4185 	 * property values. But nothing ever added them to the corresponding
4186 	 * list, userspace always used the special-purpose get_blob ioctl to
4187 	 * read the value for a blob property. It also doesn't make a lot of
4188 	 * sense to return values here when everything else is just metadata for
4189 	 * the property itself.
4190 	 */
4191 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4192 		out_resp->count_enum_blobs = 0;
4193 done:
4194 	drm_modeset_unlock_all(dev);
4195 	return ret;
4196 }
4197 
4198 /**
4199  * drm_property_create_blob - Create new blob property
4200  *
4201  * Creates a new blob property for a specified DRM device, optionally
4202  * copying data.
4203  *
4204  * @dev: DRM device to create property for
4205  * @length: Length to allocate for blob data
4206  * @data: If specified, copies data into blob
4207  *
4208  * Returns:
4209  * New blob property with a single reference on success, or an ERR_PTR
4210  * value on failure.
4211  */
4212 struct drm_property_blob *
4213 drm_property_create_blob(struct drm_device *dev, size_t length,
4214 			 const void *data)
4215 {
4216 	struct drm_property_blob *blob;
4217 	int ret;
4218 
4219 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
4220 		return ERR_PTR(-EINVAL);
4221 
4222 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4223 	if (!blob)
4224 		return ERR_PTR(-ENOMEM);
4225 
4226 	/* This must be explicitly initialised, so we can safely call list_del
4227 	 * on it in the removal handler, even if it isn't in a file list. */
4228 	INIT_LIST_HEAD(&blob->head_file);
4229 	blob->length = length;
4230 	blob->dev = dev;
4231 
4232 	if (data)
4233 		memcpy(blob->data, data, length);
4234 
4235 	mutex_lock(&dev->mode_config.blob_lock);
4236 
4237 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4238 	if (ret) {
4239 		kfree(blob);
4240 		mutex_unlock(&dev->mode_config.blob_lock);
4241 		return ERR_PTR(-EINVAL);
4242 	}
4243 
4244 	kref_init(&blob->refcount);
4245 
4246 	list_add_tail(&blob->head_global,
4247 	              &dev->mode_config.property_blob_list);
4248 
4249 	mutex_unlock(&dev->mode_config.blob_lock);
4250 
4251 	return blob;
4252 }
4253 EXPORT_SYMBOL(drm_property_create_blob);
4254 
4255 /**
4256  * drm_property_free_blob - Blob property destructor
4257  *
4258  * Internal free function for blob properties; must not be used directly.
4259  *
4260  * @kref: Reference
4261  */
4262 static void drm_property_free_blob(struct kref *kref)
4263 {
4264 	struct drm_property_blob *blob =
4265 		container_of(kref, struct drm_property_blob, refcount);
4266 
4267 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
4268 
4269 	list_del(&blob->head_global);
4270 	list_del(&blob->head_file);
4271 	drm_mode_object_put(blob->dev, &blob->base);
4272 
4273 	kfree(blob);
4274 }
4275 
4276 /**
4277  * drm_property_unreference_blob - Unreference a blob property
4278  *
4279  * Drop a reference on a blob property. May free the object.
4280  *
4281  * @blob: Pointer to blob property
4282  */
4283 void drm_property_unreference_blob(struct drm_property_blob *blob)
4284 {
4285 	struct drm_device *dev;
4286 
4287 	if (!blob)
4288 		return;
4289 
4290 	dev = blob->dev;
4291 
4292 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
4293 
4294 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
4295 			   &dev->mode_config.blob_lock))
4296 		mutex_unlock(&dev->mode_config.blob_lock);
4297 	else
4298 		might_lock(&dev->mode_config.blob_lock);
4299 }
4300 EXPORT_SYMBOL(drm_property_unreference_blob);
4301 
4302 /**
4303  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
4304  *
4305  * Drop a reference on a blob property. May free the object. This must be
4306  * called with blob_lock held.
4307  *
4308  * @blob: Pointer to blob property
4309  */
4310 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
4311 {
4312 	if (!blob)
4313 		return;
4314 
4315 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
4316 
4317 	kref_put(&blob->refcount, drm_property_free_blob);
4318 }
4319 
4320 /**
4321  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4322  * @dev:       DRM device
4323  * @file_priv: destroy all blobs owned by this file handle
4324  */
4325 void drm_property_destroy_user_blobs(struct drm_device *dev,
4326 				     struct drm_file *file_priv)
4327 {
4328 	struct drm_property_blob *blob, *bt;
4329 
4330 	mutex_lock(&dev->mode_config.blob_lock);
4331 
4332 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4333 		list_del_init(&blob->head_file);
4334 		drm_property_unreference_blob_locked(blob);
4335 	}
4336 
4337 	mutex_unlock(&dev->mode_config.blob_lock);
4338 }
4339 
4340 /**
4341  * drm_property_reference_blob - Take a reference on an existing property
4342  *
4343  * Take a new reference on an existing blob property.
4344  *
4345  * @blob: Pointer to blob property
4346  */
4347 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4348 {
4349 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
4350 	kref_get(&blob->refcount);
4351 	return blob;
4352 }
4353 EXPORT_SYMBOL(drm_property_reference_blob);
4354 
4355 /*
4356  * Like drm_property_lookup_blob, but does not return an additional reference.
4357  * Must be called with blob_lock held.
4358  */
4359 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
4360 							    uint32_t id)
4361 {
4362 	struct drm_mode_object *obj = NULL;
4363 	struct drm_property_blob *blob;
4364 
4365 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
4366 
4367 	mutex_lock(&dev->mode_config.idr_mutex);
4368 	obj = idr_find(&dev->mode_config.crtc_idr, id);
4369 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
4370 		blob = NULL;
4371 	else
4372 		blob = obj_to_blob(obj);
4373 	mutex_unlock(&dev->mode_config.idr_mutex);
4374 
4375 	return blob;
4376 }
4377 
4378 /**
4379  * drm_property_lookup_blob - look up a blob property and take a reference
4380  * @dev: drm device
4381  * @id: id of the blob property
4382  *
4383  * If successful, this takes an additional reference to the blob property.
4384  * callers need to make sure to eventually unreference the returned property
4385  * again, using @drm_property_unreference_blob.
4386  */
4387 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4388 					           uint32_t id)
4389 {
4390 	struct drm_property_blob *blob;
4391 
4392 	mutex_lock(&dev->mode_config.blob_lock);
4393 	blob = __drm_property_lookup_blob(dev, id);
4394 	if (blob) {
4395 		if (!kref_get_unless_zero(&blob->refcount))
4396 			blob = NULL;
4397 	}
4398 	mutex_unlock(&dev->mode_config.blob_lock);
4399 
4400 	return blob;
4401 }
4402 EXPORT_SYMBOL(drm_property_lookup_blob);
4403 
4404 /**
4405  * drm_property_replace_global_blob - atomically replace existing blob property
4406  * @dev: drm device
4407  * @replace: location of blob property pointer to be replaced
4408  * @length: length of data for new blob, or 0 for no data
4409  * @data: content for new blob, or NULL for no data
4410  * @obj_holds_id: optional object for property holding blob ID
4411  * @prop_holds_id: optional property holding blob ID
4412  * @return 0 on success or error on failure
4413  *
4414  * This function will atomically replace a global property in the blob list,
4415  * optionally updating a property which holds the ID of that property. It is
4416  * guaranteed to be atomic: no caller will be allowed to see intermediate
4417  * results, and either the entire operation will succeed and clean up the
4418  * previous property, or it will fail and the state will be unchanged.
4419  *
4420  * If length is 0 or data is NULL, no new blob will be created, and the holding
4421  * property, if specified, will be set to 0.
4422  *
4423  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4424  * by holding the relevant modesetting object lock for its parent.
4425  *
4426  * For example, a drm_connector has a 'PATH' property, which contains the ID
4427  * of a blob property with the value of the MST path information. Calling this
4428  * function with replace pointing to the connector's path_blob_ptr, length and
4429  * data set for the new path information, obj_holds_id set to the connector's
4430  * base object, and prop_holds_id set to the path property name, will perform
4431  * a completely atomic update. The access to path_blob_ptr is protected by the
4432  * caller holding a lock on the connector.
4433  */
4434 static int drm_property_replace_global_blob(struct drm_device *dev,
4435                                             struct drm_property_blob **replace,
4436                                             size_t length,
4437                                             const void *data,
4438                                             struct drm_mode_object *obj_holds_id,
4439                                             struct drm_property *prop_holds_id)
4440 {
4441 	struct drm_property_blob *new_blob = NULL;
4442 	struct drm_property_blob *old_blob = NULL;
4443 	int ret;
4444 
4445 	WARN_ON(replace == NULL);
4446 
4447 	old_blob = *replace;
4448 
4449 	if (length && data) {
4450 		new_blob = drm_property_create_blob(dev, length, data);
4451 		if (IS_ERR(new_blob))
4452 			return PTR_ERR(new_blob);
4453 	}
4454 
4455 	/* This does not need to be synchronised with blob_lock, as the
4456 	 * get_properties ioctl locks all modesetting objects, and
4457 	 * obj_holds_id must be locked before calling here, so we cannot
4458 	 * have its value out of sync with the list membership modified
4459 	 * below under blob_lock. */
4460 	if (obj_holds_id) {
4461 		ret = drm_object_property_set_value(obj_holds_id,
4462 						    prop_holds_id,
4463 						    new_blob ?
4464 						        new_blob->base.id : 0);
4465 		if (ret != 0)
4466 			goto err_created;
4467 	}
4468 
4469 	drm_property_unreference_blob(old_blob);
4470 	*replace = new_blob;
4471 
4472 	return 0;
4473 
4474 err_created:
4475 	drm_property_unreference_blob(new_blob);
4476 	return ret;
4477 }
4478 
4479 /**
4480  * drm_mode_getblob_ioctl - get the contents of a blob property value
4481  * @dev: DRM device
4482  * @data: ioctl data
4483  * @file_priv: DRM file info
4484  *
4485  * This function retrieves the contents of a blob property. The value stored in
4486  * an object's blob property is just a normal modeset object id.
4487  *
4488  * Called by the user via ioctl.
4489  *
4490  * Returns:
4491  * Zero on success, negative errno on failure.
4492  */
4493 int drm_mode_getblob_ioctl(struct drm_device *dev,
4494 			   void *data, struct drm_file *file_priv)
4495 {
4496 	struct drm_mode_get_blob *out_resp = data;
4497 	struct drm_property_blob *blob;
4498 	int ret = 0;
4499 	void __user *blob_ptr;
4500 
4501 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4502 		return -EINVAL;
4503 
4504 	drm_modeset_lock_all(dev);
4505 	mutex_lock(&dev->mode_config.blob_lock);
4506 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4507 	if (!blob) {
4508 		ret = -ENOENT;
4509 		goto done;
4510 	}
4511 
4512 	if (out_resp->length == blob->length) {
4513 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4514 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4515 			ret = -EFAULT;
4516 			goto done;
4517 		}
4518 	}
4519 	out_resp->length = blob->length;
4520 
4521 done:
4522 	mutex_unlock(&dev->mode_config.blob_lock);
4523 	drm_modeset_unlock_all(dev);
4524 	return ret;
4525 }
4526 
4527 /**
4528  * drm_mode_createblob_ioctl - create a new blob property
4529  * @dev: DRM device
4530  * @data: ioctl data
4531  * @file_priv: DRM file info
4532  *
4533  * This function creates a new blob property with user-defined values. In order
4534  * to give us sensible validation and checking when creating, rather than at
4535  * every potential use, we also require a type to be provided upfront.
4536  *
4537  * Called by the user via ioctl.
4538  *
4539  * Returns:
4540  * Zero on success, negative errno on failure.
4541  */
4542 int drm_mode_createblob_ioctl(struct drm_device *dev,
4543 			      void *data, struct drm_file *file_priv)
4544 {
4545 	struct drm_mode_create_blob *out_resp = data;
4546 	struct drm_property_blob *blob;
4547 	void __user *blob_ptr;
4548 	int ret = 0;
4549 
4550 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4551 		return -EINVAL;
4552 
4553 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4554 	if (IS_ERR(blob))
4555 		return PTR_ERR(blob);
4556 
4557 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4558 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4559 		ret = -EFAULT;
4560 		goto out_blob;
4561 	}
4562 
4563 	/* Dropping the lock between create_blob and our access here is safe
4564 	 * as only the same file_priv can remove the blob; at this point, it is
4565 	 * not associated with any file_priv. */
4566 	mutex_lock(&dev->mode_config.blob_lock);
4567 	out_resp->blob_id = blob->base.id;
4568 	list_add_tail(&blob->head_file, &file_priv->blobs);
4569 	mutex_unlock(&dev->mode_config.blob_lock);
4570 
4571 	return 0;
4572 
4573 out_blob:
4574 	drm_property_unreference_blob(blob);
4575 	return ret;
4576 }
4577 
4578 /**
4579  * drm_mode_destroyblob_ioctl - destroy a user blob property
4580  * @dev: DRM device
4581  * @data: ioctl data
4582  * @file_priv: DRM file info
4583  *
4584  * Destroy an existing user-defined blob property.
4585  *
4586  * Called by the user via ioctl.
4587  *
4588  * Returns:
4589  * Zero on success, negative errno on failure.
4590  */
4591 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4592 			       void *data, struct drm_file *file_priv)
4593 {
4594 	struct drm_mode_destroy_blob *out_resp = data;
4595 	struct drm_property_blob *blob = NULL, *bt;
4596 	bool found = false;
4597 	int ret = 0;
4598 
4599 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4600 		return -EINVAL;
4601 
4602 	mutex_lock(&dev->mode_config.blob_lock);
4603 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4604 	if (!blob) {
4605 		ret = -ENOENT;
4606 		goto err;
4607 	}
4608 
4609 	/* Ensure the property was actually created by this user. */
4610 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4611 		if (bt == blob) {
4612 			found = true;
4613 			break;
4614 		}
4615 	}
4616 
4617 	if (!found) {
4618 		ret = -EPERM;
4619 		goto err;
4620 	}
4621 
4622 	/* We must drop head_file here, because we may not be the last
4623 	 * reference on the blob. */
4624 	list_del_init(&blob->head_file);
4625 	drm_property_unreference_blob_locked(blob);
4626 	mutex_unlock(&dev->mode_config.blob_lock);
4627 
4628 	return 0;
4629 
4630 err:
4631 	mutex_unlock(&dev->mode_config.blob_lock);
4632 	return ret;
4633 }
4634 
4635 /**
4636  * drm_mode_connector_set_path_property - set tile property on connector
4637  * @connector: connector to set property on.
4638  * @path: path to use for property; must not be NULL.
4639  *
4640  * This creates a property to expose to userspace to specify a
4641  * connector path. This is mainly used for DisplayPort MST where
4642  * connectors have a topology and we want to allow userspace to give
4643  * them more meaningful names.
4644  *
4645  * Returns:
4646  * Zero on success, negative errno on failure.
4647  */
4648 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4649 					 const char *path)
4650 {
4651 	struct drm_device *dev = connector->dev;
4652 	int ret;
4653 
4654 	ret = drm_property_replace_global_blob(dev,
4655 	                                       &connector->path_blob_ptr,
4656 	                                       strlen(path) + 1,
4657 	                                       path,
4658 	                                       &connector->base,
4659 	                                       dev->mode_config.path_property);
4660 	return ret;
4661 }
4662 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4663 
4664 /**
4665  * drm_mode_connector_set_tile_property - set tile property on connector
4666  * @connector: connector to set property on.
4667  *
4668  * This looks up the tile information for a connector, and creates a
4669  * property for userspace to parse if it exists. The property is of
4670  * the form of 8 integers using ':' as a separator.
4671  *
4672  * Returns:
4673  * Zero on success, errno on failure.
4674  */
4675 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4676 {
4677 	struct drm_device *dev = connector->dev;
4678 	char tile[256];
4679 	int ret;
4680 
4681 	if (!connector->has_tile) {
4682 		ret  = drm_property_replace_global_blob(dev,
4683 		                                        &connector->tile_blob_ptr,
4684 		                                        0,
4685 		                                        NULL,
4686 		                                        &connector->base,
4687 		                                        dev->mode_config.tile_property);
4688 		return ret;
4689 	}
4690 
4691 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4692 		 connector->tile_group->id, connector->tile_is_single_monitor,
4693 		 connector->num_h_tile, connector->num_v_tile,
4694 		 connector->tile_h_loc, connector->tile_v_loc,
4695 		 connector->tile_h_size, connector->tile_v_size);
4696 
4697 	ret = drm_property_replace_global_blob(dev,
4698 	                                       &connector->tile_blob_ptr,
4699 	                                       strlen(tile) + 1,
4700 	                                       tile,
4701 	                                       &connector->base,
4702 	                                       dev->mode_config.tile_property);
4703 	return ret;
4704 }
4705 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4706 
4707 /**
4708  * drm_mode_connector_update_edid_property - update the edid property of a connector
4709  * @connector: drm connector
4710  * @edid: new value of the edid property
4711  *
4712  * This function creates a new blob modeset object and assigns its id to the
4713  * connector's edid property.
4714  *
4715  * Returns:
4716  * Zero on success, negative errno on failure.
4717  */
4718 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4719 					    const struct edid *edid)
4720 {
4721 	struct drm_device *dev = connector->dev;
4722 	size_t size = 0;
4723 	int ret;
4724 
4725 	/* ignore requests to set edid when overridden */
4726 	if (connector->override_edid)
4727 		return 0;
4728 
4729 	if (edid)
4730 		size = EDID_LENGTH * (1 + edid->extensions);
4731 
4732 	ret = drm_property_replace_global_blob(dev,
4733 					       &connector->edid_blob_ptr,
4734 	                                       size,
4735 	                                       edid,
4736 	                                       &connector->base,
4737 	                                       dev->mode_config.edid_property);
4738 	return ret;
4739 }
4740 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4741 
4742 /* Some properties could refer to dynamic refcnt'd objects, or things that
4743  * need special locking to handle lifetime issues (ie. to ensure the prop
4744  * value doesn't become invalid part way through the property update due to
4745  * race).  The value returned by reference via 'obj' should be passed back
4746  * to drm_property_change_valid_put() after the property is set (and the
4747  * object to which the property is attached has a chance to take it's own
4748  * reference).
4749  */
4750 bool drm_property_change_valid_get(struct drm_property *property,
4751 					 uint64_t value, struct drm_mode_object **ref)
4752 {
4753 	int i;
4754 
4755 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4756 		return false;
4757 
4758 	*ref = NULL;
4759 
4760 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4761 		if (value < property->values[0] || value > property->values[1])
4762 			return false;
4763 		return true;
4764 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4765 		int64_t svalue = U642I64(value);
4766 
4767 		if (svalue < U642I64(property->values[0]) ||
4768 				svalue > U642I64(property->values[1]))
4769 			return false;
4770 		return true;
4771 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4772 		uint64_t valid_mask = 0;
4773 
4774 		for (i = 0; i < property->num_values; i++)
4775 			valid_mask |= (1ULL << property->values[i]);
4776 		return !(value & ~valid_mask);
4777 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4778 		struct drm_property_blob *blob;
4779 
4780 		if (value == 0)
4781 			return true;
4782 
4783 		blob = drm_property_lookup_blob(property->dev, value);
4784 		if (blob) {
4785 			*ref = &blob->base;
4786 			return true;
4787 		} else {
4788 			return false;
4789 		}
4790 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4791 		/* a zero value for an object property translates to null: */
4792 		if (value == 0)
4793 			return true;
4794 
4795 		/* handle refcnt'd objects specially: */
4796 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4797 			struct drm_framebuffer *fb;
4798 			fb = drm_framebuffer_lookup(property->dev, value);
4799 			if (fb) {
4800 				*ref = &fb->base;
4801 				return true;
4802 			} else {
4803 				return false;
4804 			}
4805 		} else {
4806 			return _object_find(property->dev, value, property->values[0]) != NULL;
4807 		}
4808 	}
4809 
4810 	for (i = 0; i < property->num_values; i++)
4811 		if (property->values[i] == value)
4812 			return true;
4813 	return false;
4814 }
4815 
4816 void drm_property_change_valid_put(struct drm_property *property,
4817 		struct drm_mode_object *ref)
4818 {
4819 	if (!ref)
4820 		return;
4821 
4822 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4823 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4824 			drm_framebuffer_unreference(obj_to_fb(ref));
4825 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4826 		drm_property_unreference_blob(obj_to_blob(ref));
4827 }
4828 
4829 /**
4830  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4831  * @dev: DRM device
4832  * @data: ioctl data
4833  * @file_priv: DRM file info
4834  *
4835  * This function sets the current value for a connectors's property. It also
4836  * calls into a driver's ->set_property callback to update the hardware state
4837  *
4838  * Called by the user via ioctl.
4839  *
4840  * Returns:
4841  * Zero on success, negative errno on failure.
4842  */
4843 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4844 				       void *data, struct drm_file *file_priv)
4845 {
4846 	struct drm_mode_connector_set_property *conn_set_prop = data;
4847 	struct drm_mode_obj_set_property obj_set_prop = {
4848 		.value = conn_set_prop->value,
4849 		.prop_id = conn_set_prop->prop_id,
4850 		.obj_id = conn_set_prop->connector_id,
4851 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4852 	};
4853 
4854 	/* It does all the locking and checking we need */
4855 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4856 }
4857 
4858 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4859 					   struct drm_property *property,
4860 					   uint64_t value)
4861 {
4862 	int ret = -EINVAL;
4863 	struct drm_connector *connector = obj_to_connector(obj);
4864 
4865 	/* Do DPMS ourselves */
4866 	if (property == connector->dev->mode_config.dpms_property) {
4867 		ret = 0;
4868 		if (connector->funcs->dpms)
4869 			ret = (*connector->funcs->dpms)(connector, (int)value);
4870 	} else if (connector->funcs->set_property)
4871 		ret = connector->funcs->set_property(connector, property, value);
4872 
4873 	/* store the property value if successful */
4874 	if (!ret)
4875 		drm_object_property_set_value(&connector->base, property, value);
4876 	return ret;
4877 }
4878 
4879 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4880 				      struct drm_property *property,
4881 				      uint64_t value)
4882 {
4883 	int ret = -EINVAL;
4884 	struct drm_crtc *crtc = obj_to_crtc(obj);
4885 
4886 	if (crtc->funcs->set_property)
4887 		ret = crtc->funcs->set_property(crtc, property, value);
4888 	if (!ret)
4889 		drm_object_property_set_value(obj, property, value);
4890 
4891 	return ret;
4892 }
4893 
4894 /**
4895  * drm_mode_plane_set_obj_prop - set the value of a property
4896  * @plane: drm plane object to set property value for
4897  * @property: property to set
4898  * @value: value the property should be set to
4899  *
4900  * This functions sets a given property on a given plane object. This function
4901  * calls the driver's ->set_property callback and changes the software state of
4902  * the property if the callback succeeds.
4903  *
4904  * Returns:
4905  * Zero on success, error code on failure.
4906  */
4907 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4908 				struct drm_property *property,
4909 				uint64_t value)
4910 {
4911 	int ret = -EINVAL;
4912 	struct drm_mode_object *obj = &plane->base;
4913 
4914 	if (plane->funcs->set_property)
4915 		ret = plane->funcs->set_property(plane, property, value);
4916 	if (!ret)
4917 		drm_object_property_set_value(obj, property, value);
4918 
4919 	return ret;
4920 }
4921 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4922 
4923 /**
4924  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4925  * @dev: DRM device
4926  * @data: ioctl data
4927  * @file_priv: DRM file info
4928  *
4929  * This function retrieves the current value for an object's property. Compared
4930  * to the connector specific ioctl this one is extended to also work on crtc and
4931  * plane objects.
4932  *
4933  * Called by the user via ioctl.
4934  *
4935  * Returns:
4936  * Zero on success, negative errno on failure.
4937  */
4938 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4939 				      struct drm_file *file_priv)
4940 {
4941 	struct drm_mode_obj_get_properties *arg = data;
4942 	struct drm_mode_object *obj;
4943 	int ret = 0;
4944 
4945 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4946 		return -EINVAL;
4947 
4948 	drm_modeset_lock_all(dev);
4949 
4950 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4951 	if (!obj) {
4952 		ret = -ENOENT;
4953 		goto out;
4954 	}
4955 	if (!obj->properties) {
4956 		ret = -EINVAL;
4957 		goto out;
4958 	}
4959 
4960 	ret = get_properties(obj, file_priv->atomic,
4961 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4962 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4963 			&arg->count_props);
4964 
4965 out:
4966 	drm_modeset_unlock_all(dev);
4967 	return ret;
4968 }
4969 
4970 /**
4971  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4972  * @dev: DRM device
4973  * @data: ioctl data
4974  * @file_priv: DRM file info
4975  *
4976  * This function sets the current value for an object's property. It also calls
4977  * into a driver's ->set_property callback to update the hardware state.
4978  * Compared to the connector specific ioctl this one is extended to also work on
4979  * crtc and plane objects.
4980  *
4981  * Called by the user via ioctl.
4982  *
4983  * Returns:
4984  * Zero on success, negative errno on failure.
4985  */
4986 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4987 				    struct drm_file *file_priv)
4988 {
4989 	struct drm_mode_obj_set_property *arg = data;
4990 	struct drm_mode_object *arg_obj;
4991 	struct drm_mode_object *prop_obj;
4992 	struct drm_property *property;
4993 	int i, ret = -EINVAL;
4994 	struct drm_mode_object *ref;
4995 
4996 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4997 		return -EINVAL;
4998 
4999 	drm_modeset_lock_all(dev);
5000 
5001 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
5002 	if (!arg_obj) {
5003 		ret = -ENOENT;
5004 		goto out;
5005 	}
5006 	if (!arg_obj->properties)
5007 		goto out;
5008 
5009 	for (i = 0; i < arg_obj->properties->count; i++)
5010 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
5011 			break;
5012 
5013 	if (i == arg_obj->properties->count)
5014 		goto out;
5015 
5016 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
5017 					DRM_MODE_OBJECT_PROPERTY);
5018 	if (!prop_obj) {
5019 		ret = -ENOENT;
5020 		goto out;
5021 	}
5022 	property = obj_to_property(prop_obj);
5023 
5024 	if (!drm_property_change_valid_get(property, arg->value, &ref))
5025 		goto out;
5026 
5027 	switch (arg_obj->type) {
5028 	case DRM_MODE_OBJECT_CONNECTOR:
5029 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
5030 						      arg->value);
5031 		break;
5032 	case DRM_MODE_OBJECT_CRTC:
5033 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
5034 		break;
5035 	case DRM_MODE_OBJECT_PLANE:
5036 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
5037 						  property, arg->value);
5038 		break;
5039 	}
5040 
5041 	drm_property_change_valid_put(property, ref);
5042 
5043 out:
5044 	drm_modeset_unlock_all(dev);
5045 	return ret;
5046 }
5047 
5048 /**
5049  * drm_mode_connector_attach_encoder - attach a connector to an encoder
5050  * @connector: connector to attach
5051  * @encoder: encoder to attach @connector to
5052  *
5053  * This function links up a connector to an encoder. Note that the routing
5054  * restrictions between encoders and crtcs are exposed to userspace through the
5055  * possible_clones and possible_crtcs bitmasks.
5056  *
5057  * Returns:
5058  * Zero on success, negative errno on failure.
5059  */
5060 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
5061 				      struct drm_encoder *encoder)
5062 {
5063 	int i;
5064 
5065 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
5066 		if (connector->encoder_ids[i] == 0) {
5067 			connector->encoder_ids[i] = encoder->base.id;
5068 			return 0;
5069 		}
5070 	}
5071 	return -ENOMEM;
5072 }
5073 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
5074 
5075 /**
5076  * drm_mode_crtc_set_gamma_size - set the gamma table size
5077  * @crtc: CRTC to set the gamma table size for
5078  * @gamma_size: size of the gamma table
5079  *
5080  * Drivers which support gamma tables should set this to the supported gamma
5081  * table size when initializing the CRTC. Currently the drm core only supports a
5082  * fixed gamma table size.
5083  *
5084  * Returns:
5085  * Zero on success, negative errno on failure.
5086  */
5087 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
5088 				 int gamma_size)
5089 {
5090 	crtc->gamma_size = gamma_size;
5091 
5092 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
5093 				    GFP_KERNEL);
5094 	if (!crtc->gamma_store) {
5095 		crtc->gamma_size = 0;
5096 		return -ENOMEM;
5097 	}
5098 
5099 	return 0;
5100 }
5101 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
5102 
5103 /**
5104  * drm_mode_gamma_set_ioctl - set the gamma table
5105  * @dev: DRM device
5106  * @data: ioctl data
5107  * @file_priv: DRM file info
5108  *
5109  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
5110  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5111  *
5112  * Called by the user via ioctl.
5113  *
5114  * Returns:
5115  * Zero on success, negative errno on failure.
5116  */
5117 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5118 			     void *data, struct drm_file *file_priv)
5119 {
5120 	struct drm_mode_crtc_lut *crtc_lut = data;
5121 	struct drm_crtc *crtc;
5122 	void *r_base, *g_base, *b_base;
5123 	int size;
5124 	int ret = 0;
5125 
5126 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5127 		return -EINVAL;
5128 
5129 	drm_modeset_lock_all(dev);
5130 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5131 	if (!crtc) {
5132 		ret = -ENOENT;
5133 		goto out;
5134 	}
5135 
5136 	if (crtc->funcs->gamma_set == NULL) {
5137 		ret = -ENOSYS;
5138 		goto out;
5139 	}
5140 
5141 	/* memcpy into gamma store */
5142 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5143 		ret = -EINVAL;
5144 		goto out;
5145 	}
5146 
5147 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5148 	r_base = crtc->gamma_store;
5149 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5150 		ret = -EFAULT;
5151 		goto out;
5152 	}
5153 
5154 	g_base = (char *)r_base + size;
5155 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5156 		ret = -EFAULT;
5157 		goto out;
5158 	}
5159 
5160 	b_base = (char *)g_base + size;
5161 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5162 		ret = -EFAULT;
5163 		goto out;
5164 	}
5165 
5166 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
5167 
5168 out:
5169 	drm_modeset_unlock_all(dev);
5170 	return ret;
5171 
5172 }
5173 
5174 /**
5175  * drm_mode_gamma_get_ioctl - get the gamma table
5176  * @dev: DRM device
5177  * @data: ioctl data
5178  * @file_priv: DRM file info
5179  *
5180  * Copy the current gamma table into the storage provided. This also provides
5181  * the gamma table size the driver expects, which can be used to size the
5182  * allocated storage.
5183  *
5184  * Called by the user via ioctl.
5185  *
5186  * Returns:
5187  * Zero on success, negative errno on failure.
5188  */
5189 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5190 			     void *data, struct drm_file *file_priv)
5191 {
5192 	struct drm_mode_crtc_lut *crtc_lut = data;
5193 	struct drm_crtc *crtc;
5194 	void *r_base, *g_base, *b_base;
5195 	int size;
5196 	int ret = 0;
5197 
5198 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5199 		return -EINVAL;
5200 
5201 	drm_modeset_lock_all(dev);
5202 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5203 	if (!crtc) {
5204 		ret = -ENOENT;
5205 		goto out;
5206 	}
5207 
5208 	/* memcpy into gamma store */
5209 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5210 		ret = -EINVAL;
5211 		goto out;
5212 	}
5213 
5214 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5215 	r_base = crtc->gamma_store;
5216 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5217 		ret = -EFAULT;
5218 		goto out;
5219 	}
5220 
5221 	g_base = (char *)r_base + size;
5222 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5223 		ret = -EFAULT;
5224 		goto out;
5225 	}
5226 
5227 	b_base = (char *)g_base + size;
5228 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5229 		ret = -EFAULT;
5230 		goto out;
5231 	}
5232 out:
5233 	drm_modeset_unlock_all(dev);
5234 	return ret;
5235 }
5236 
5237 /**
5238  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5239  * @dev: DRM device
5240  * @data: ioctl data
5241  * @file_priv: DRM file info
5242  *
5243  * This schedules an asynchronous update on a given CRTC, called page flip.
5244  * Optionally a drm event is generated to signal the completion of the event.
5245  * Generic drivers cannot assume that a pageflip with changed framebuffer
5246  * properties (including driver specific metadata like tiling layout) will work,
5247  * but some drivers support e.g. pixel format changes through the pageflip
5248  * ioctl.
5249  *
5250  * Called by the user via ioctl.
5251  *
5252  * Returns:
5253  * Zero on success, negative errno on failure.
5254  */
5255 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5256 			     void *data, struct drm_file *file_priv)
5257 {
5258 	struct drm_mode_crtc_page_flip *page_flip = data;
5259 	struct drm_crtc *crtc;
5260 	struct drm_framebuffer *fb = NULL;
5261 	struct drm_pending_vblank_event *e = NULL;
5262 	unsigned long flags;
5263 	int ret = -EINVAL;
5264 
5265 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5266 		return -EINVAL;
5267 
5268 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5269 	    page_flip->reserved != 0)
5270 		return -EINVAL;
5271 
5272 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5273 		return -EINVAL;
5274 
5275 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5276 	if (!crtc)
5277 		return -ENOENT;
5278 
5279 	drm_modeset_lock_crtc(crtc, crtc->primary);
5280 	if (crtc->primary->fb == NULL) {
5281 		/* The framebuffer is currently unbound, presumably
5282 		 * due to a hotplug event, that userspace has not
5283 		 * yet discovered.
5284 		 */
5285 		ret = -EBUSY;
5286 		goto out;
5287 	}
5288 
5289 	if (crtc->funcs->page_flip == NULL)
5290 		goto out;
5291 
5292 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5293 	if (!fb) {
5294 		ret = -ENOENT;
5295 		goto out;
5296 	}
5297 
5298 	if (crtc->state) {
5299 		const struct drm_plane_state *state = crtc->primary->state;
5300 
5301 		ret = check_src_coords(state->src_x, state->src_y,
5302 				       state->src_w, state->src_h, fb);
5303 	} else {
5304 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5305 	}
5306 	if (ret)
5307 		goto out;
5308 
5309 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5310 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5311 		ret = -EINVAL;
5312 		goto out;
5313 	}
5314 
5315 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5316 		ret = -ENOMEM;
5317 		spin_lock_irqsave(&dev->event_lock, flags);
5318 		if (file_priv->event_space < sizeof(e->event)) {
5319 			spin_unlock_irqrestore(&dev->event_lock, flags);
5320 			goto out;
5321 		}
5322 		file_priv->event_space -= sizeof(e->event);
5323 		spin_unlock_irqrestore(&dev->event_lock, flags);
5324 
5325 		e = kzalloc(sizeof(*e), GFP_KERNEL);
5326 		if (e == NULL) {
5327 			spin_lock_irqsave(&dev->event_lock, flags);
5328 			file_priv->event_space += sizeof(e->event);
5329 			spin_unlock_irqrestore(&dev->event_lock, flags);
5330 			goto out;
5331 		}
5332 
5333 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5334 		e->event.base.length = sizeof(e->event);
5335 		e->event.user_data = page_flip->user_data;
5336 		e->base.event = &e->event.base;
5337 		e->base.file_priv = file_priv;
5338 		e->base.destroy =
5339 			(void (*) (struct drm_pending_event *)) kfree;
5340 	}
5341 
5342 	crtc->primary->old_fb = crtc->primary->fb;
5343 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5344 	if (ret) {
5345 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5346 			spin_lock_irqsave(&dev->event_lock, flags);
5347 			file_priv->event_space += sizeof(e->event);
5348 			spin_unlock_irqrestore(&dev->event_lock, flags);
5349 			kfree(e);
5350 		}
5351 		/* Keep the old fb, don't unref it. */
5352 		crtc->primary->old_fb = NULL;
5353 	} else {
5354 		crtc->primary->fb = fb;
5355 		/* Unref only the old framebuffer. */
5356 		fb = NULL;
5357 	}
5358 
5359 out:
5360 	if (fb)
5361 		drm_framebuffer_unreference(fb);
5362 	if (crtc->primary->old_fb)
5363 		drm_framebuffer_unreference(crtc->primary->old_fb);
5364 	crtc->primary->old_fb = NULL;
5365 	drm_modeset_unlock_crtc(crtc);
5366 
5367 	return ret;
5368 }
5369 
5370 /**
5371  * drm_mode_config_reset - call ->reset callbacks
5372  * @dev: drm device
5373  *
5374  * This functions calls all the crtc's, encoder's and connector's ->reset
5375  * callback. Drivers can use this in e.g. their driver load or resume code to
5376  * reset hardware and software state.
5377  */
5378 void drm_mode_config_reset(struct drm_device *dev)
5379 {
5380 	struct drm_crtc *crtc;
5381 	struct drm_plane *plane;
5382 	struct drm_encoder *encoder;
5383 	struct drm_connector *connector;
5384 
5385 	drm_for_each_plane(plane, dev)
5386 		if (plane->funcs->reset)
5387 			plane->funcs->reset(plane);
5388 
5389 	drm_for_each_crtc(crtc, dev)
5390 		if (crtc->funcs->reset)
5391 			crtc->funcs->reset(crtc);
5392 
5393 	drm_for_each_encoder(encoder, dev)
5394 		if (encoder->funcs->reset)
5395 			encoder->funcs->reset(encoder);
5396 
5397 	mutex_lock(&dev->mode_config.mutex);
5398 	drm_for_each_connector(connector, dev)
5399 		if (connector->funcs->reset)
5400 			connector->funcs->reset(connector);
5401 	mutex_unlock(&dev->mode_config.mutex);
5402 }
5403 EXPORT_SYMBOL(drm_mode_config_reset);
5404 
5405 /**
5406  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5407  * @dev: DRM device
5408  * @data: ioctl data
5409  * @file_priv: DRM file info
5410  *
5411  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5412  * TTM or something else entirely) and returns the resulting buffer handle. This
5413  * handle can then be wrapped up into a framebuffer modeset object.
5414  *
5415  * Note that userspace is not allowed to use such objects for render
5416  * acceleration - drivers must create their own private ioctls for such a use
5417  * case.
5418  *
5419  * Called by the user via ioctl.
5420  *
5421  * Returns:
5422  * Zero on success, negative errno on failure.
5423  */
5424 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5425 			       void *data, struct drm_file *file_priv)
5426 {
5427 	struct drm_mode_create_dumb *args = data;
5428 	u32 cpp, stride, size;
5429 
5430 	if (!dev->driver->dumb_create)
5431 		return -ENOSYS;
5432 	if (!args->width || !args->height || !args->bpp)
5433 		return -EINVAL;
5434 
5435 	/* overflow checks for 32bit size calculations */
5436 	/* NOTE: DIV_ROUND_UP() can overflow */
5437 	cpp = DIV_ROUND_UP(args->bpp, 8);
5438 	if (!cpp || cpp > 0xffffffffU / args->width)
5439 		return -EINVAL;
5440 	stride = cpp * args->width;
5441 	if (args->height > 0xffffffffU / stride)
5442 		return -EINVAL;
5443 
5444 	/* test for wrap-around */
5445 	size = args->height * stride;
5446 	if (PAGE_ALIGN(size) == 0)
5447 		return -EINVAL;
5448 
5449 	/*
5450 	 * handle, pitch and size are output parameters. Zero them out to
5451 	 * prevent drivers from accidentally using uninitialized data. Since
5452 	 * not all existing userspace is clearing these fields properly we
5453 	 * cannot reject IOCTL with garbage in them.
5454 	 */
5455 	args->handle = 0;
5456 	args->pitch = 0;
5457 	args->size = 0;
5458 
5459 	return dev->driver->dumb_create(file_priv, dev, args);
5460 }
5461 
5462 /**
5463  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5464  * @dev: DRM device
5465  * @data: ioctl data
5466  * @file_priv: DRM file info
5467  *
5468  * Allocate an offset in the drm device node's address space to be able to
5469  * memory map a dumb buffer.
5470  *
5471  * Called by the user via ioctl.
5472  *
5473  * Returns:
5474  * Zero on success, negative errno on failure.
5475  */
5476 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5477 			     void *data, struct drm_file *file_priv)
5478 {
5479 	struct drm_mode_map_dumb *args = data;
5480 
5481 	/* call driver ioctl to get mmap offset */
5482 	if (!dev->driver->dumb_map_offset)
5483 		return -ENOSYS;
5484 
5485 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5486 }
5487 
5488 /**
5489  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5490  * @dev: DRM device
5491  * @data: ioctl data
5492  * @file_priv: DRM file info
5493  *
5494  * This destroys the userspace handle for the given dumb backing storage buffer.
5495  * Since buffer objects must be reference counted in the kernel a buffer object
5496  * won't be immediately freed if a framebuffer modeset object still uses it.
5497  *
5498  * Called by the user via ioctl.
5499  *
5500  * Returns:
5501  * Zero on success, negative errno on failure.
5502  */
5503 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5504 				void *data, struct drm_file *file_priv)
5505 {
5506 	struct drm_mode_destroy_dumb *args = data;
5507 
5508 	if (!dev->driver->dumb_destroy)
5509 		return -ENOSYS;
5510 
5511 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5512 }
5513 
5514 /**
5515  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5516  * @format: pixel format (DRM_FORMAT_*)
5517  * @depth: storage for the depth value
5518  * @bpp: storage for the bpp value
5519  *
5520  * This only supports RGB formats here for compat with code that doesn't use
5521  * pixel formats directly yet.
5522  */
5523 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5524 			  int *bpp)
5525 {
5526 	switch (format) {
5527 	case DRM_FORMAT_C8:
5528 	case DRM_FORMAT_RGB332:
5529 	case DRM_FORMAT_BGR233:
5530 		*depth = 8;
5531 		*bpp = 8;
5532 		break;
5533 	case DRM_FORMAT_XRGB1555:
5534 	case DRM_FORMAT_XBGR1555:
5535 	case DRM_FORMAT_RGBX5551:
5536 	case DRM_FORMAT_BGRX5551:
5537 	case DRM_FORMAT_ARGB1555:
5538 	case DRM_FORMAT_ABGR1555:
5539 	case DRM_FORMAT_RGBA5551:
5540 	case DRM_FORMAT_BGRA5551:
5541 		*depth = 15;
5542 		*bpp = 16;
5543 		break;
5544 	case DRM_FORMAT_RGB565:
5545 	case DRM_FORMAT_BGR565:
5546 		*depth = 16;
5547 		*bpp = 16;
5548 		break;
5549 	case DRM_FORMAT_RGB888:
5550 	case DRM_FORMAT_BGR888:
5551 		*depth = 24;
5552 		*bpp = 24;
5553 		break;
5554 	case DRM_FORMAT_XRGB8888:
5555 	case DRM_FORMAT_XBGR8888:
5556 	case DRM_FORMAT_RGBX8888:
5557 	case DRM_FORMAT_BGRX8888:
5558 		*depth = 24;
5559 		*bpp = 32;
5560 		break;
5561 	case DRM_FORMAT_XRGB2101010:
5562 	case DRM_FORMAT_XBGR2101010:
5563 	case DRM_FORMAT_RGBX1010102:
5564 	case DRM_FORMAT_BGRX1010102:
5565 	case DRM_FORMAT_ARGB2101010:
5566 	case DRM_FORMAT_ABGR2101010:
5567 	case DRM_FORMAT_RGBA1010102:
5568 	case DRM_FORMAT_BGRA1010102:
5569 		*depth = 30;
5570 		*bpp = 32;
5571 		break;
5572 	case DRM_FORMAT_ARGB8888:
5573 	case DRM_FORMAT_ABGR8888:
5574 	case DRM_FORMAT_RGBA8888:
5575 	case DRM_FORMAT_BGRA8888:
5576 		*depth = 32;
5577 		*bpp = 32;
5578 		break;
5579 	default:
5580 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5581 			      drm_get_format_name(format));
5582 		*depth = 0;
5583 		*bpp = 0;
5584 		break;
5585 	}
5586 }
5587 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5588 
5589 /**
5590  * drm_format_num_planes - get the number of planes for format
5591  * @format: pixel format (DRM_FORMAT_*)
5592  *
5593  * Returns:
5594  * The number of planes used by the specified pixel format.
5595  */
5596 int drm_format_num_planes(uint32_t format)
5597 {
5598 	switch (format) {
5599 	case DRM_FORMAT_YUV410:
5600 	case DRM_FORMAT_YVU410:
5601 	case DRM_FORMAT_YUV411:
5602 	case DRM_FORMAT_YVU411:
5603 	case DRM_FORMAT_YUV420:
5604 	case DRM_FORMAT_YVU420:
5605 	case DRM_FORMAT_YUV422:
5606 	case DRM_FORMAT_YVU422:
5607 	case DRM_FORMAT_YUV444:
5608 	case DRM_FORMAT_YVU444:
5609 		return 3;
5610 	case DRM_FORMAT_NV12:
5611 	case DRM_FORMAT_NV21:
5612 	case DRM_FORMAT_NV16:
5613 	case DRM_FORMAT_NV61:
5614 	case DRM_FORMAT_NV24:
5615 	case DRM_FORMAT_NV42:
5616 		return 2;
5617 	default:
5618 		return 1;
5619 	}
5620 }
5621 EXPORT_SYMBOL(drm_format_num_planes);
5622 
5623 /**
5624  * drm_format_plane_cpp - determine the bytes per pixel value
5625  * @format: pixel format (DRM_FORMAT_*)
5626  * @plane: plane index
5627  *
5628  * Returns:
5629  * The bytes per pixel value for the specified plane.
5630  */
5631 int drm_format_plane_cpp(uint32_t format, int plane)
5632 {
5633 	unsigned int depth;
5634 	int bpp;
5635 
5636 	if (plane >= drm_format_num_planes(format))
5637 		return 0;
5638 
5639 	switch (format) {
5640 	case DRM_FORMAT_YUYV:
5641 	case DRM_FORMAT_YVYU:
5642 	case DRM_FORMAT_UYVY:
5643 	case DRM_FORMAT_VYUY:
5644 		return 2;
5645 	case DRM_FORMAT_NV12:
5646 	case DRM_FORMAT_NV21:
5647 	case DRM_FORMAT_NV16:
5648 	case DRM_FORMAT_NV61:
5649 	case DRM_FORMAT_NV24:
5650 	case DRM_FORMAT_NV42:
5651 		return plane ? 2 : 1;
5652 	case DRM_FORMAT_YUV410:
5653 	case DRM_FORMAT_YVU410:
5654 	case DRM_FORMAT_YUV411:
5655 	case DRM_FORMAT_YVU411:
5656 	case DRM_FORMAT_YUV420:
5657 	case DRM_FORMAT_YVU420:
5658 	case DRM_FORMAT_YUV422:
5659 	case DRM_FORMAT_YVU422:
5660 	case DRM_FORMAT_YUV444:
5661 	case DRM_FORMAT_YVU444:
5662 		return 1;
5663 	default:
5664 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5665 		return bpp >> 3;
5666 	}
5667 }
5668 EXPORT_SYMBOL(drm_format_plane_cpp);
5669 
5670 /**
5671  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5672  * @format: pixel format (DRM_FORMAT_*)
5673  *
5674  * Returns:
5675  * The horizontal chroma subsampling factor for the
5676  * specified pixel format.
5677  */
5678 int drm_format_horz_chroma_subsampling(uint32_t format)
5679 {
5680 	switch (format) {
5681 	case DRM_FORMAT_YUV411:
5682 	case DRM_FORMAT_YVU411:
5683 	case DRM_FORMAT_YUV410:
5684 	case DRM_FORMAT_YVU410:
5685 		return 4;
5686 	case DRM_FORMAT_YUYV:
5687 	case DRM_FORMAT_YVYU:
5688 	case DRM_FORMAT_UYVY:
5689 	case DRM_FORMAT_VYUY:
5690 	case DRM_FORMAT_NV12:
5691 	case DRM_FORMAT_NV21:
5692 	case DRM_FORMAT_NV16:
5693 	case DRM_FORMAT_NV61:
5694 	case DRM_FORMAT_YUV422:
5695 	case DRM_FORMAT_YVU422:
5696 	case DRM_FORMAT_YUV420:
5697 	case DRM_FORMAT_YVU420:
5698 		return 2;
5699 	default:
5700 		return 1;
5701 	}
5702 }
5703 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5704 
5705 /**
5706  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5707  * @format: pixel format (DRM_FORMAT_*)
5708  *
5709  * Returns:
5710  * The vertical chroma subsampling factor for the
5711  * specified pixel format.
5712  */
5713 int drm_format_vert_chroma_subsampling(uint32_t format)
5714 {
5715 	switch (format) {
5716 	case DRM_FORMAT_YUV410:
5717 	case DRM_FORMAT_YVU410:
5718 		return 4;
5719 	case DRM_FORMAT_YUV420:
5720 	case DRM_FORMAT_YVU420:
5721 	case DRM_FORMAT_NV12:
5722 	case DRM_FORMAT_NV21:
5723 		return 2;
5724 	default:
5725 		return 1;
5726 	}
5727 }
5728 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5729 
5730 /**
5731  * drm_rotation_simplify() - Try to simplify the rotation
5732  * @rotation: Rotation to be simplified
5733  * @supported_rotations: Supported rotations
5734  *
5735  * Attempt to simplify the rotation to a form that is supported.
5736  * Eg. if the hardware supports everything except DRM_REFLECT_X
5737  * one could call this function like this:
5738  *
5739  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5740  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5741  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5742  *
5743  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5744  * transforms the hardware supports, this function may not
5745  * be able to produce a supported transform, so the caller should
5746  * check the result afterwards.
5747  */
5748 unsigned int drm_rotation_simplify(unsigned int rotation,
5749 				   unsigned int supported_rotations)
5750 {
5751 	if (rotation & ~supported_rotations) {
5752 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5753 		rotation = (rotation & DRM_REFLECT_MASK) |
5754 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
5755 	}
5756 
5757 	return rotation;
5758 }
5759 EXPORT_SYMBOL(drm_rotation_simplify);
5760 
5761 /**
5762  * drm_mode_config_init - initialize DRM mode_configuration structure
5763  * @dev: DRM device
5764  *
5765  * Initialize @dev's mode_config structure, used for tracking the graphics
5766  * configuration of @dev.
5767  *
5768  * Since this initializes the modeset locks, no locking is possible. Which is no
5769  * problem, since this should happen single threaded at init time. It is the
5770  * driver's problem to ensure this guarantee.
5771  *
5772  */
5773 void drm_mode_config_init(struct drm_device *dev)
5774 {
5775 #ifdef __NetBSD__
5776 	linux_mutex_init(&dev->mode_config.mutex);
5777 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5778 	linux_mutex_init(&dev->mode_config.idr_mutex);
5779 	linux_mutex_init(&dev->mode_config.fb_lock);
5780 	linux_mutex_init(&dev->mode_config.blob_lock);
5781 #else
5782 	mutex_init(&dev->mode_config.mutex);
5783 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5784 	mutex_init(&dev->mode_config.idr_mutex);
5785 	mutex_init(&dev->mode_config.fb_lock);
5786 	mutex_init(&dev->mode_config.blob_lock);
5787 #endif
5788 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5789 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5790 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5791 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5792 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5793 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5794 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5795 	idr_init(&dev->mode_config.crtc_idr);
5796 	idr_init(&dev->mode_config.tile_idr);
5797 
5798 	drm_modeset_lock_all(dev);
5799 	drm_mode_create_standard_properties(dev);
5800 	drm_modeset_unlock_all(dev);
5801 
5802 	/* Just to be sure */
5803 	dev->mode_config.num_fb = 0;
5804 	dev->mode_config.num_connector = 0;
5805 	dev->mode_config.num_crtc = 0;
5806 	dev->mode_config.num_encoder = 0;
5807 	dev->mode_config.num_overlay_plane = 0;
5808 	dev->mode_config.num_total_plane = 0;
5809 }
5810 EXPORT_SYMBOL(drm_mode_config_init);
5811 
5812 /**
5813  * drm_mode_config_cleanup - free up DRM mode_config info
5814  * @dev: DRM device
5815  *
5816  * Free up all the connectors and CRTCs associated with this DRM device, then
5817  * free up the framebuffers and associated buffer objects.
5818  *
5819  * Note that since this /should/ happen single-threaded at driver/device
5820  * teardown time, no locking is required. It's the driver's job to ensure that
5821  * this guarantee actually holds true.
5822  *
5823  * FIXME: cleanup any dangling user buffer objects too
5824  */
5825 void drm_mode_config_cleanup(struct drm_device *dev)
5826 {
5827 	struct drm_connector *connector, *ot;
5828 	struct drm_crtc *crtc, *ct;
5829 	struct drm_encoder *encoder, *enct;
5830 	struct drm_framebuffer *fb, *fbt;
5831 	struct drm_property *property, *pt;
5832 	struct drm_property_blob *blob, *bt;
5833 	struct drm_plane *plane, *plt;
5834 
5835 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5836 				 head) {
5837 		encoder->funcs->destroy(encoder);
5838 	}
5839 
5840 	list_for_each_entry_safe(connector, ot,
5841 				 &dev->mode_config.connector_list, head) {
5842 		connector->funcs->destroy(connector);
5843 	}
5844 
5845 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5846 				 head) {
5847 		drm_property_destroy(dev, property);
5848 	}
5849 
5850 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5851 				 head_global) {
5852 		drm_property_unreference_blob(blob);
5853 	}
5854 
5855 	/*
5856 	 * Single-threaded teardown context, so it's not required to grab the
5857 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5858 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5859 	 *
5860 	 * Also, if there are any framebuffers left, that's a driver leak now,
5861 	 * so politely WARN about this.
5862 	 */
5863 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5864 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5865 		drm_framebuffer_free(&fb->refcount);
5866 	}
5867 
5868 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5869 				 head) {
5870 		plane->funcs->destroy(plane);
5871 	}
5872 
5873 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5874 		crtc->funcs->destroy(crtc);
5875 	}
5876 
5877 	idr_destroy(&dev->mode_config.tile_idr);
5878 	idr_destroy(&dev->mode_config.crtc_idr);
5879 #ifdef __NetBSD__
5880 	linux_mutex_destroy(&dev->mode_config.blob_lock);
5881 	linux_mutex_destroy(&dev->mode_config.fb_lock);
5882 	linux_mutex_destroy(&dev->mode_config.idr_mutex);
5883 	linux_mutex_destroy(&dev->mode_config.mutex);
5884 #endif
5885 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5886 }
5887 EXPORT_SYMBOL(drm_mode_config_cleanup);
5888 
5889 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5890 						       unsigned int supported_rotations)
5891 {
5892 	static const struct drm_prop_enum_list props[] = {
5893 		{ DRM_ROTATE_0,   "rotate-0" },
5894 		{ DRM_ROTATE_90,  "rotate-90" },
5895 		{ DRM_ROTATE_180, "rotate-180" },
5896 		{ DRM_ROTATE_270, "rotate-270" },
5897 		{ DRM_REFLECT_X,  "reflect-x" },
5898 		{ DRM_REFLECT_Y,  "reflect-y" },
5899 	};
5900 
5901 	return drm_property_create_bitmask(dev, 0, "rotation",
5902 					   props, ARRAY_SIZE(props),
5903 					   supported_rotations);
5904 }
5905 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5906 
5907 /**
5908  * DOC: Tile group
5909  *
5910  * Tile groups are used to represent tiled monitors with a unique
5911  * integer identifier. Tiled monitors using DisplayID v1.3 have
5912  * a unique 8-byte handle, we store this in a tile group, so we
5913  * have a common identifier for all tiles in a monitor group.
5914  */
5915 static void drm_tile_group_free(struct kref *kref)
5916 {
5917 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5918 	struct drm_device *dev = tg->dev;
5919 	mutex_lock(&dev->mode_config.idr_mutex);
5920 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5921 	mutex_unlock(&dev->mode_config.idr_mutex);
5922 	kfree(tg);
5923 }
5924 
5925 /**
5926  * drm_mode_put_tile_group - drop a reference to a tile group.
5927  * @dev: DRM device
5928  * @tg: tile group to drop reference to.
5929  *
5930  * drop reference to tile group and free if 0.
5931  */
5932 void drm_mode_put_tile_group(struct drm_device *dev,
5933 			     struct drm_tile_group *tg)
5934 {
5935 	kref_put(&tg->refcount, drm_tile_group_free);
5936 }
5937 
5938 /**
5939  * drm_mode_get_tile_group - get a reference to an existing tile group
5940  * @dev: DRM device
5941  * @topology: 8-bytes unique per monitor.
5942  *
5943  * Use the unique bytes to get a reference to an existing tile group.
5944  *
5945  * RETURNS:
5946  * tile group or NULL if not found.
5947  */
5948 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5949 					       char topology[8])
5950 {
5951 	struct drm_tile_group *tg;
5952 	int id;
5953 	mutex_lock(&dev->mode_config.idr_mutex);
5954 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5955 		if (!memcmp(tg->group_data, topology, 8)) {
5956 			if (!kref_get_unless_zero(&tg->refcount))
5957 				tg = NULL;
5958 			mutex_unlock(&dev->mode_config.idr_mutex);
5959 			return tg;
5960 		}
5961 	}
5962 	mutex_unlock(&dev->mode_config.idr_mutex);
5963 	return NULL;
5964 }
5965 EXPORT_SYMBOL(drm_mode_get_tile_group);
5966 
5967 /**
5968  * drm_mode_create_tile_group - create a tile group from a displayid description
5969  * @dev: DRM device
5970  * @topology: 8-bytes unique per monitor.
5971  *
5972  * Create a tile group for the unique monitor, and get a unique
5973  * identifier for the tile group.
5974  *
5975  * RETURNS:
5976  * new tile group or error.
5977  */
5978 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5979 						  char topology[8])
5980 {
5981 	struct drm_tile_group *tg;
5982 	int ret;
5983 
5984 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5985 	if (!tg)
5986 		return ERR_PTR(-ENOMEM);
5987 
5988 	kref_init(&tg->refcount);
5989 	memcpy(tg->group_data, topology, 8);
5990 	tg->dev = dev;
5991 
5992 	idr_preload(GFP_KERNEL);
5993 	mutex_lock(&dev->mode_config.idr_mutex);
5994 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5995 	if (ret >= 0) {
5996 		tg->id = ret;
5997 	} else {
5998 		kfree(tg);
5999 		tg = ERR_PTR(ret);
6000 	}
6001 
6002 	mutex_unlock(&dev->mode_config.idr_mutex);
6003 	idr_preload_end();
6004 	return tg;
6005 }
6006 EXPORT_SYMBOL(drm_mode_create_tile_group);
6007