xref: /linux/drivers/gpu/drm/drm_crtc.c (revision 56a0eccdc0dec223d4625c80de31514f04390159)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    const struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	struct ida ida;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 	int i;
196 
197 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
198 		ida_init(&drm_connector_enum_list[i].ida);
199 }
200 
201 void drm_connector_ida_destroy(void)
202 {
203 	int i;
204 
205 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
206 		ida_destroy(&drm_connector_enum_list[i].ida);
207 }
208 
209 /**
210  * drm_get_connector_status_name - return a string for connector status
211  * @status: connector status to compute name of
212  *
213  * In contrast to the other drm_get_*_name functions this one here returns a
214  * const pointer and hence is threadsafe.
215  */
216 const char *drm_get_connector_status_name(enum drm_connector_status status)
217 {
218 	if (status == connector_status_connected)
219 		return "connected";
220 	else if (status == connector_status_disconnected)
221 		return "disconnected";
222 	else
223 		return "unknown";
224 }
225 EXPORT_SYMBOL(drm_get_connector_status_name);
226 
227 /**
228  * drm_get_subpixel_order_name - return a string for a given subpixel enum
229  * @order: enum of subpixel_order
230  *
231  * Note you could abuse this and return something out of bounds, but that
232  * would be a caller error.  No unscrubbed user data should make it here.
233  */
234 const char *drm_get_subpixel_order_name(enum subpixel_order order)
235 {
236 	return drm_subpixel_enum_list[order].name;
237 }
238 EXPORT_SYMBOL(drm_get_subpixel_order_name);
239 
240 static char printable_char(int c)
241 {
242 	return isascii(c) && isprint(c) ? c : '?';
243 }
244 
245 /**
246  * drm_get_format_name - return a string for drm fourcc format
247  * @format: format to compute name of
248  *
249  * Note that the buffer used by this function is globally shared and owned by
250  * the function itself.
251  *
252  * FIXME: This isn't really multithreading safe.
253  */
254 const char *drm_get_format_name(uint32_t format)
255 {
256 	static char buf[32];
257 
258 	snprintf(buf, sizeof(buf),
259 		 "%c%c%c%c %s-endian (0x%08x)",
260 		 printable_char(format & 0xff),
261 		 printable_char((format >> 8) & 0xff),
262 		 printable_char((format >> 16) & 0xff),
263 		 printable_char((format >> 24) & 0x7f),
264 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
265 		 format);
266 
267 	return buf;
268 }
269 EXPORT_SYMBOL(drm_get_format_name);
270 
271 /*
272  * Internal function to assign a slot in the object idr and optionally
273  * register the object into the idr.
274  */
275 static int drm_mode_object_get_reg(struct drm_device *dev,
276 				   struct drm_mode_object *obj,
277 				   uint32_t obj_type,
278 				   bool register_obj)
279 {
280 	int ret;
281 
282 	mutex_lock(&dev->mode_config.idr_mutex);
283 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
284 	if (ret >= 0) {
285 		/*
286 		 * Set up the object linking under the protection of the idr
287 		 * lock so that other users can't see inconsistent state.
288 		 */
289 		obj->id = ret;
290 		obj->type = obj_type;
291 	}
292 	mutex_unlock(&dev->mode_config.idr_mutex);
293 
294 	return ret < 0 ? ret : 0;
295 }
296 
297 /**
298  * drm_mode_object_get - allocate a new modeset identifier
299  * @dev: DRM device
300  * @obj: object pointer, used to generate unique ID
301  * @obj_type: object type
302  *
303  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
304  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
305  * modeset identifiers are _not_ reference counted. Hence don't use this for
306  * reference counted modeset objects like framebuffers.
307  *
308  * Returns:
309  * Zero on success, error code on failure.
310  */
311 int drm_mode_object_get(struct drm_device *dev,
312 			struct drm_mode_object *obj, uint32_t obj_type)
313 {
314 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
315 }
316 
317 static void drm_mode_object_register(struct drm_device *dev,
318 				     struct drm_mode_object *obj)
319 {
320 	mutex_lock(&dev->mode_config.idr_mutex);
321 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
322 	mutex_unlock(&dev->mode_config.idr_mutex);
323 }
324 
325 /**
326  * drm_mode_object_put - free a modeset identifer
327  * @dev: DRM device
328  * @object: object to free
329  *
330  * Free @id from @dev's unique identifier pool. Note that despite the _get
331  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
332  * for reference counted modeset objects like framebuffers.
333  */
334 void drm_mode_object_put(struct drm_device *dev,
335 			 struct drm_mode_object *object)
336 {
337 	mutex_lock(&dev->mode_config.idr_mutex);
338 	idr_remove(&dev->mode_config.crtc_idr, object->id);
339 	mutex_unlock(&dev->mode_config.idr_mutex);
340 }
341 
342 static struct drm_mode_object *_object_find(struct drm_device *dev,
343 		uint32_t id, uint32_t type)
344 {
345 	struct drm_mode_object *obj = NULL;
346 
347 	mutex_lock(&dev->mode_config.idr_mutex);
348 	obj = idr_find(&dev->mode_config.crtc_idr, id);
349 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
350 		obj = NULL;
351 	if (obj && obj->id != id)
352 		obj = NULL;
353 	/* don't leak out unref'd fb's */
354 	if (obj &&
355 	    (obj->type == DRM_MODE_OBJECT_FB ||
356 	     obj->type == DRM_MODE_OBJECT_BLOB))
357 		obj = NULL;
358 	mutex_unlock(&dev->mode_config.idr_mutex);
359 
360 	return obj;
361 }
362 
363 /**
364  * drm_mode_object_find - look up a drm object with static lifetime
365  * @dev: drm device
366  * @id: id of the mode object
367  * @type: type of the mode object
368  *
369  * Note that framebuffers cannot be looked up with this functions - since those
370  * are reference counted, they need special treatment.  Even with
371  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
372  * rather than WARN_ON()).
373  */
374 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
375 		uint32_t id, uint32_t type)
376 {
377 	struct drm_mode_object *obj = NULL;
378 
379 	/* Framebuffers are reference counted and need their own lookup
380 	 * function.*/
381 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
382 	obj = _object_find(dev, id, type);
383 	return obj;
384 }
385 EXPORT_SYMBOL(drm_mode_object_find);
386 
387 /**
388  * drm_framebuffer_init - initialize a framebuffer
389  * @dev: DRM device
390  * @fb: framebuffer to be initialized
391  * @funcs: ... with these functions
392  *
393  * Allocates an ID for the framebuffer's parent mode object, sets its mode
394  * functions & device file and adds it to the master fd list.
395  *
396  * IMPORTANT:
397  * This functions publishes the fb and makes it available for concurrent access
398  * by other users. Which means by this point the fb _must_ be fully set up -
399  * since all the fb attributes are invariant over its lifetime, no further
400  * locking but only correct reference counting is required.
401  *
402  * Returns:
403  * Zero on success, error code on failure.
404  */
405 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
406 			 const struct drm_framebuffer_funcs *funcs)
407 {
408 	int ret;
409 
410 	mutex_lock(&dev->mode_config.fb_lock);
411 	kref_init(&fb->refcount);
412 	INIT_LIST_HEAD(&fb->filp_head);
413 	fb->dev = dev;
414 	fb->funcs = funcs;
415 
416 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
417 	if (ret)
418 		goto out;
419 
420 	dev->mode_config.num_fb++;
421 	list_add(&fb->head, &dev->mode_config.fb_list);
422 out:
423 	mutex_unlock(&dev->mode_config.fb_lock);
424 
425 	return ret;
426 }
427 EXPORT_SYMBOL(drm_framebuffer_init);
428 
429 /* dev->mode_config.fb_lock must be held! */
430 static void __drm_framebuffer_unregister(struct drm_device *dev,
431 					 struct drm_framebuffer *fb)
432 {
433 	drm_mode_object_put(dev, &fb->base);
434 
435 	fb->base.id = 0;
436 }
437 
438 static void drm_framebuffer_free(struct kref *kref)
439 {
440 	struct drm_framebuffer *fb =
441 			container_of(kref, struct drm_framebuffer, refcount);
442 	struct drm_device *dev = fb->dev;
443 
444 	/*
445 	 * The lookup idr holds a weak reference, which has not necessarily been
446 	 * removed at this point. Check for that.
447 	 */
448 	mutex_lock(&dev->mode_config.fb_lock);
449 	if (fb->base.id) {
450 		/* Mark fb as reaped and drop idr ref. */
451 		__drm_framebuffer_unregister(dev, fb);
452 	}
453 	mutex_unlock(&dev->mode_config.fb_lock);
454 
455 	fb->funcs->destroy(fb);
456 }
457 
458 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
459 							uint32_t id)
460 {
461 	struct drm_mode_object *obj = NULL;
462 	struct drm_framebuffer *fb;
463 
464 	mutex_lock(&dev->mode_config.idr_mutex);
465 	obj = idr_find(&dev->mode_config.crtc_idr, id);
466 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
467 		fb = NULL;
468 	else
469 		fb = obj_to_fb(obj);
470 	mutex_unlock(&dev->mode_config.idr_mutex);
471 
472 	return fb;
473 }
474 
475 /**
476  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
477  * @dev: drm device
478  * @id: id of the fb object
479  *
480  * If successful, this grabs an additional reference to the framebuffer -
481  * callers need to make sure to eventually unreference the returned framebuffer
482  * again, using @drm_framebuffer_unreference.
483  */
484 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
485 					       uint32_t id)
486 {
487 	struct drm_framebuffer *fb;
488 
489 	mutex_lock(&dev->mode_config.fb_lock);
490 	fb = __drm_framebuffer_lookup(dev, id);
491 	if (fb) {
492 		if (!kref_get_unless_zero(&fb->refcount))
493 			fb = NULL;
494 	}
495 	mutex_unlock(&dev->mode_config.fb_lock);
496 
497 	return fb;
498 }
499 EXPORT_SYMBOL(drm_framebuffer_lookup);
500 
501 /**
502  * drm_framebuffer_unreference - unref a framebuffer
503  * @fb: framebuffer to unref
504  *
505  * This functions decrements the fb's refcount and frees it if it drops to zero.
506  */
507 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
508 {
509 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
510 	kref_put(&fb->refcount, drm_framebuffer_free);
511 }
512 EXPORT_SYMBOL(drm_framebuffer_unreference);
513 
514 /**
515  * drm_framebuffer_reference - incr the fb refcnt
516  * @fb: framebuffer
517  *
518  * This functions increments the fb's refcount.
519  */
520 void drm_framebuffer_reference(struct drm_framebuffer *fb)
521 {
522 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
523 	kref_get(&fb->refcount);
524 }
525 EXPORT_SYMBOL(drm_framebuffer_reference);
526 
527 /**
528  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
529  * @fb: fb to unregister
530  *
531  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
532  * those used for fbdev. Note that the caller must hold a reference of it's own,
533  * i.e. the object may not be destroyed through this call (since it'll lead to a
534  * locking inversion).
535  */
536 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
537 {
538 	struct drm_device *dev;
539 
540 	if (!fb)
541 		return;
542 
543 	dev = fb->dev;
544 
545 	mutex_lock(&dev->mode_config.fb_lock);
546 	/* Mark fb as reaped and drop idr ref. */
547 	__drm_framebuffer_unregister(dev, fb);
548 	mutex_unlock(&dev->mode_config.fb_lock);
549 }
550 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
551 
552 /**
553  * drm_framebuffer_cleanup - remove a framebuffer object
554  * @fb: framebuffer to remove
555  *
556  * Cleanup framebuffer. This function is intended to be used from the drivers
557  * ->destroy callback. It can also be used to clean up driver private
558  *  framebuffers embedded into a larger structure.
559  *
560  * Note that this function does not remove the fb from active usuage - if it is
561  * still used anywhere, hilarity can ensue since userspace could call getfb on
562  * the id and get back -EINVAL. Obviously no concern at driver unload time.
563  *
564  * Also, the framebuffer will not be removed from the lookup idr - for
565  * user-created framebuffers this will happen in in the rmfb ioctl. For
566  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
567  * drm_framebuffer_unregister_private.
568  */
569 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
570 {
571 	struct drm_device *dev = fb->dev;
572 
573 	mutex_lock(&dev->mode_config.fb_lock);
574 	list_del(&fb->head);
575 	dev->mode_config.num_fb--;
576 	mutex_unlock(&dev->mode_config.fb_lock);
577 }
578 EXPORT_SYMBOL(drm_framebuffer_cleanup);
579 
580 /**
581  * drm_framebuffer_remove - remove and unreference a framebuffer object
582  * @fb: framebuffer to remove
583  *
584  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
585  * using @fb, removes it, setting it to NULL. Then drops the reference to the
586  * passed-in framebuffer. Might take the modeset locks.
587  *
588  * Note that this function optimizes the cleanup away if the caller holds the
589  * last reference to the framebuffer. It is also guaranteed to not take the
590  * modeset locks in this case.
591  */
592 void drm_framebuffer_remove(struct drm_framebuffer *fb)
593 {
594 	struct drm_device *dev;
595 	struct drm_crtc *crtc;
596 	struct drm_plane *plane;
597 	struct drm_mode_set set;
598 	int ret;
599 
600 	if (!fb)
601 		return;
602 
603 	dev = fb->dev;
604 
605 	WARN_ON(!list_empty(&fb->filp_head));
606 
607 	/*
608 	 * drm ABI mandates that we remove any deleted framebuffers from active
609 	 * useage. But since most sane clients only remove framebuffers they no
610 	 * longer need, try to optimize this away.
611 	 *
612 	 * Since we're holding a reference ourselves, observing a refcount of 1
613 	 * means that we're the last holder and can skip it. Also, the refcount
614 	 * can never increase from 1 again, so we don't need any barriers or
615 	 * locks.
616 	 *
617 	 * Note that userspace could try to race with use and instate a new
618 	 * usage _after_ we've cleared all current ones. End result will be an
619 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
620 	 * in this manner.
621 	 */
622 	if (atomic_read(&fb->refcount.refcount) > 1) {
623 		drm_modeset_lock_all(dev);
624 		/* remove from any CRTC */
625 		drm_for_each_crtc(crtc, dev) {
626 			if (crtc->primary->fb == fb) {
627 				/* should turn off the crtc */
628 				memset(&set, 0, sizeof(struct drm_mode_set));
629 				set.crtc = crtc;
630 				set.fb = NULL;
631 				ret = drm_mode_set_config_internal(&set);
632 				if (ret)
633 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
634 			}
635 		}
636 
637 		drm_for_each_plane(plane, dev) {
638 			if (plane->fb == fb)
639 				drm_plane_force_disable(plane);
640 		}
641 		drm_modeset_unlock_all(dev);
642 	}
643 
644 	drm_framebuffer_unreference(fb);
645 }
646 EXPORT_SYMBOL(drm_framebuffer_remove);
647 
648 DEFINE_WW_CLASS(crtc_ww_class);
649 
650 static unsigned int drm_num_crtcs(struct drm_device *dev)
651 {
652 	unsigned int num = 0;
653 	struct drm_crtc *tmp;
654 
655 	drm_for_each_crtc(tmp, dev) {
656 		num++;
657 	}
658 
659 	return num;
660 }
661 
662 /**
663  * drm_crtc_init_with_planes - Initialise a new CRTC object with
664  *    specified primary and cursor planes.
665  * @dev: DRM device
666  * @crtc: CRTC object to init
667  * @primary: Primary plane for CRTC
668  * @cursor: Cursor plane for CRTC
669  * @funcs: callbacks for the new CRTC
670  * @name: printf style format string for the CRTC name, or NULL for default name
671  *
672  * Inits a new object created as base part of a driver crtc object.
673  *
674  * Returns:
675  * Zero on success, error code on failure.
676  */
677 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
678 			      struct drm_plane *primary,
679 			      struct drm_plane *cursor,
680 			      const struct drm_crtc_funcs *funcs,
681 			      const char *name, ...)
682 {
683 	struct drm_mode_config *config = &dev->mode_config;
684 	int ret;
685 
686 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
687 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
688 
689 	crtc->dev = dev;
690 	crtc->funcs = funcs;
691 
692 	drm_modeset_lock_init(&crtc->mutex);
693 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
694 	if (ret)
695 		return ret;
696 
697 	if (name) {
698 		va_list ap;
699 
700 		va_start(ap, name);
701 		crtc->name = kvasprintf(GFP_KERNEL, name, ap);
702 		va_end(ap);
703 	} else {
704 		crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
705 				       drm_num_crtcs(dev));
706 	}
707 	if (!crtc->name) {
708 		drm_mode_object_put(dev, &crtc->base);
709 		return -ENOMEM;
710 	}
711 
712 	crtc->base.properties = &crtc->properties;
713 
714 	list_add_tail(&crtc->head, &config->crtc_list);
715 	config->num_crtc++;
716 
717 	crtc->primary = primary;
718 	crtc->cursor = cursor;
719 	if (primary)
720 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
721 	if (cursor)
722 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
723 
724 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
725 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
726 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
727 	}
728 
729 	return 0;
730 }
731 EXPORT_SYMBOL(drm_crtc_init_with_planes);
732 
733 /**
734  * drm_crtc_cleanup - Clean up the core crtc usage
735  * @crtc: CRTC to cleanup
736  *
737  * This function cleans up @crtc and removes it from the DRM mode setting
738  * core. Note that the function does *not* free the crtc structure itself,
739  * this is the responsibility of the caller.
740  */
741 void drm_crtc_cleanup(struct drm_crtc *crtc)
742 {
743 	struct drm_device *dev = crtc->dev;
744 
745 	kfree(crtc->gamma_store);
746 	crtc->gamma_store = NULL;
747 
748 	drm_modeset_lock_fini(&crtc->mutex);
749 
750 	drm_mode_object_put(dev, &crtc->base);
751 	list_del(&crtc->head);
752 	dev->mode_config.num_crtc--;
753 
754 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
755 	if (crtc->state && crtc->funcs->atomic_destroy_state)
756 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
757 
758 	kfree(crtc->name);
759 
760 	memset(crtc, 0, sizeof(*crtc));
761 }
762 EXPORT_SYMBOL(drm_crtc_cleanup);
763 
764 /**
765  * drm_crtc_index - find the index of a registered CRTC
766  * @crtc: CRTC to find index for
767  *
768  * Given a registered CRTC, return the index of that CRTC within a DRM
769  * device's list of CRTCs.
770  */
771 unsigned int drm_crtc_index(struct drm_crtc *crtc)
772 {
773 	unsigned int index = 0;
774 	struct drm_crtc *tmp;
775 
776 	drm_for_each_crtc(tmp, crtc->dev) {
777 		if (tmp == crtc)
778 			return index;
779 
780 		index++;
781 	}
782 
783 	BUG();
784 }
785 EXPORT_SYMBOL(drm_crtc_index);
786 
787 /*
788  * drm_mode_remove - remove and free a mode
789  * @connector: connector list to modify
790  * @mode: mode to remove
791  *
792  * Remove @mode from @connector's mode list, then free it.
793  */
794 static void drm_mode_remove(struct drm_connector *connector,
795 			    struct drm_display_mode *mode)
796 {
797 	list_del(&mode->head);
798 	drm_mode_destroy(connector->dev, mode);
799 }
800 
801 /**
802  * drm_display_info_set_bus_formats - set the supported bus formats
803  * @info: display info to store bus formats in
804  * @formats: array containing the supported bus formats
805  * @num_formats: the number of entries in the fmts array
806  *
807  * Store the supported bus formats in display info structure.
808  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
809  * a full list of available formats.
810  */
811 int drm_display_info_set_bus_formats(struct drm_display_info *info,
812 				     const u32 *formats,
813 				     unsigned int num_formats)
814 {
815 	u32 *fmts = NULL;
816 
817 	if (!formats && num_formats)
818 		return -EINVAL;
819 
820 	if (formats && num_formats) {
821 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
822 			       GFP_KERNEL);
823 		if (!fmts)
824 			return -ENOMEM;
825 	}
826 
827 	kfree(info->bus_formats);
828 	info->bus_formats = fmts;
829 	info->num_bus_formats = num_formats;
830 
831 	return 0;
832 }
833 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
834 
835 /**
836  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
837  * @connector: connector to quwery
838  *
839  * The kernel supports per-connector configration of its consoles through
840  * use of the video= parameter. This function parses that option and
841  * extracts the user's specified mode (or enable/disable status) for a
842  * particular connector. This is typically only used during the early fbdev
843  * setup.
844  */
845 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
846 {
847 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
848 	char *option = NULL;
849 
850 	if (fb_get_options(connector->name, &option))
851 		return;
852 
853 	if (!drm_mode_parse_command_line_for_connector(option,
854 						       connector,
855 						       mode))
856 		return;
857 
858 	if (mode->force) {
859 		const char *s;
860 
861 		switch (mode->force) {
862 		case DRM_FORCE_OFF:
863 			s = "OFF";
864 			break;
865 		case DRM_FORCE_ON_DIGITAL:
866 			s = "ON - dig";
867 			break;
868 		default:
869 		case DRM_FORCE_ON:
870 			s = "ON";
871 			break;
872 		}
873 
874 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
875 		connector->force = mode->force;
876 	}
877 
878 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
879 		      connector->name,
880 		      mode->xres, mode->yres,
881 		      mode->refresh_specified ? mode->refresh : 60,
882 		      mode->rb ? " reduced blanking" : "",
883 		      mode->margins ? " with margins" : "",
884 		      mode->interlace ?  " interlaced" : "");
885 }
886 
887 /**
888  * drm_connector_init - Init a preallocated connector
889  * @dev: DRM device
890  * @connector: the connector to init
891  * @funcs: callbacks for this connector
892  * @connector_type: user visible type of the connector
893  *
894  * Initialises a preallocated connector. Connectors should be
895  * subclassed as part of driver connector objects.
896  *
897  * Returns:
898  * Zero on success, error code on failure.
899  */
900 int drm_connector_init(struct drm_device *dev,
901 		       struct drm_connector *connector,
902 		       const struct drm_connector_funcs *funcs,
903 		       int connector_type)
904 {
905 	struct drm_mode_config *config = &dev->mode_config;
906 	int ret;
907 	struct ida *connector_ida =
908 		&drm_connector_enum_list[connector_type].ida;
909 
910 	drm_modeset_lock_all(dev);
911 
912 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
913 	if (ret)
914 		goto out_unlock;
915 
916 	connector->base.properties = &connector->properties;
917 	connector->dev = dev;
918 	connector->funcs = funcs;
919 
920 	connector->connector_id = ida_simple_get(&config->connector_ida, 0, 0, GFP_KERNEL);
921 	if (connector->connector_id < 0) {
922 		ret = connector->connector_id;
923 		goto out_put;
924 	}
925 
926 	connector->connector_type = connector_type;
927 	connector->connector_type_id =
928 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
929 	if (connector->connector_type_id < 0) {
930 		ret = connector->connector_type_id;
931 		goto out_put_id;
932 	}
933 	connector->name =
934 		kasprintf(GFP_KERNEL, "%s-%d",
935 			  drm_connector_enum_list[connector_type].name,
936 			  connector->connector_type_id);
937 	if (!connector->name) {
938 		ret = -ENOMEM;
939 		goto out_put_type_id;
940 	}
941 
942 	INIT_LIST_HEAD(&connector->probed_modes);
943 	INIT_LIST_HEAD(&connector->modes);
944 	connector->edid_blob_ptr = NULL;
945 	connector->status = connector_status_unknown;
946 
947 	drm_connector_get_cmdline_mode(connector);
948 
949 	/* We should add connectors at the end to avoid upsetting the connector
950 	 * index too much. */
951 	list_add_tail(&connector->head, &config->connector_list);
952 	config->num_connector++;
953 
954 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
955 		drm_object_attach_property(&connector->base,
956 					      config->edid_property,
957 					      0);
958 
959 	drm_object_attach_property(&connector->base,
960 				      config->dpms_property, 0);
961 
962 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
963 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
964 	}
965 
966 	connector->debugfs_entry = NULL;
967 out_put_type_id:
968 	if (ret)
969 		ida_remove(connector_ida, connector->connector_type_id);
970 out_put_id:
971 	if (ret)
972 		ida_remove(&config->connector_ida, connector->connector_id);
973 out_put:
974 	if (ret)
975 		drm_mode_object_put(dev, &connector->base);
976 
977 out_unlock:
978 	drm_modeset_unlock_all(dev);
979 
980 	return ret;
981 }
982 EXPORT_SYMBOL(drm_connector_init);
983 
984 /**
985  * drm_connector_cleanup - cleans up an initialised connector
986  * @connector: connector to cleanup
987  *
988  * Cleans up the connector but doesn't free the object.
989  */
990 void drm_connector_cleanup(struct drm_connector *connector)
991 {
992 	struct drm_device *dev = connector->dev;
993 	struct drm_display_mode *mode, *t;
994 
995 	if (connector->tile_group) {
996 		drm_mode_put_tile_group(dev, connector->tile_group);
997 		connector->tile_group = NULL;
998 	}
999 
1000 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
1001 		drm_mode_remove(connector, mode);
1002 
1003 	list_for_each_entry_safe(mode, t, &connector->modes, head)
1004 		drm_mode_remove(connector, mode);
1005 
1006 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
1007 		   connector->connector_type_id);
1008 
1009 	ida_remove(&dev->mode_config.connector_ida,
1010 		   connector->connector_id);
1011 
1012 	kfree(connector->display_info.bus_formats);
1013 	drm_mode_object_put(dev, &connector->base);
1014 	kfree(connector->name);
1015 	connector->name = NULL;
1016 	list_del(&connector->head);
1017 	dev->mode_config.num_connector--;
1018 
1019 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
1020 	if (connector->state && connector->funcs->atomic_destroy_state)
1021 		connector->funcs->atomic_destroy_state(connector,
1022 						       connector->state);
1023 
1024 	memset(connector, 0, sizeof(*connector));
1025 }
1026 EXPORT_SYMBOL(drm_connector_cleanup);
1027 
1028 /**
1029  * drm_connector_register - register a connector
1030  * @connector: the connector to register
1031  *
1032  * Register userspace interfaces for a connector
1033  *
1034  * Returns:
1035  * Zero on success, error code on failure.
1036  */
1037 int drm_connector_register(struct drm_connector *connector)
1038 {
1039 	int ret;
1040 
1041 	drm_mode_object_register(connector->dev, &connector->base);
1042 
1043 	ret = drm_sysfs_connector_add(connector);
1044 	if (ret)
1045 		return ret;
1046 
1047 	ret = drm_debugfs_connector_add(connector);
1048 	if (ret) {
1049 		drm_sysfs_connector_remove(connector);
1050 		return ret;
1051 	}
1052 
1053 	return 0;
1054 }
1055 EXPORT_SYMBOL(drm_connector_register);
1056 
1057 /**
1058  * drm_connector_unregister - unregister a connector
1059  * @connector: the connector to unregister
1060  *
1061  * Unregister userspace interfaces for a connector
1062  */
1063 void drm_connector_unregister(struct drm_connector *connector)
1064 {
1065 	drm_sysfs_connector_remove(connector);
1066 	drm_debugfs_connector_remove(connector);
1067 }
1068 EXPORT_SYMBOL(drm_connector_unregister);
1069 
1070 
1071 /**
1072  * drm_connector_unplug_all - unregister connector userspace interfaces
1073  * @dev: drm device
1074  *
1075  * This function unregisters all connector userspace interfaces in sysfs. Should
1076  * be call when the device is disconnected, e.g. from an usb driver's
1077  * ->disconnect callback.
1078  */
1079 void drm_connector_unplug_all(struct drm_device *dev)
1080 {
1081 	struct drm_connector *connector;
1082 
1083 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1084 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1085 		drm_connector_unregister(connector);
1086 
1087 }
1088 EXPORT_SYMBOL(drm_connector_unplug_all);
1089 
1090 /**
1091  * drm_encoder_init - Init a preallocated encoder
1092  * @dev: drm device
1093  * @encoder: the encoder to init
1094  * @funcs: callbacks for this encoder
1095  * @encoder_type: user visible type of the encoder
1096  * @name: printf style format string for the encoder name, or NULL for default name
1097  *
1098  * Initialises a preallocated encoder. Encoder should be
1099  * subclassed as part of driver encoder objects.
1100  *
1101  * Returns:
1102  * Zero on success, error code on failure.
1103  */
1104 int drm_encoder_init(struct drm_device *dev,
1105 		      struct drm_encoder *encoder,
1106 		      const struct drm_encoder_funcs *funcs,
1107 		      int encoder_type, const char *name, ...)
1108 {
1109 	int ret;
1110 
1111 	drm_modeset_lock_all(dev);
1112 
1113 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1114 	if (ret)
1115 		goto out_unlock;
1116 
1117 	encoder->dev = dev;
1118 	encoder->encoder_type = encoder_type;
1119 	encoder->funcs = funcs;
1120 	if (name) {
1121 		va_list ap;
1122 
1123 		va_start(ap, name);
1124 		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
1125 		va_end(ap);
1126 	} else {
1127 		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1128 					  drm_encoder_enum_list[encoder_type].name,
1129 					  encoder->base.id);
1130 	}
1131 	if (!encoder->name) {
1132 		ret = -ENOMEM;
1133 		goto out_put;
1134 	}
1135 
1136 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1137 	dev->mode_config.num_encoder++;
1138 
1139 out_put:
1140 	if (ret)
1141 		drm_mode_object_put(dev, &encoder->base);
1142 
1143 out_unlock:
1144 	drm_modeset_unlock_all(dev);
1145 
1146 	return ret;
1147 }
1148 EXPORT_SYMBOL(drm_encoder_init);
1149 
1150 /**
1151  * drm_encoder_index - find the index of a registered encoder
1152  * @encoder: encoder to find index for
1153  *
1154  * Given a registered encoder, return the index of that encoder within a DRM
1155  * device's list of encoders.
1156  */
1157 unsigned int drm_encoder_index(struct drm_encoder *encoder)
1158 {
1159 	unsigned int index = 0;
1160 	struct drm_encoder *tmp;
1161 
1162 	drm_for_each_encoder(tmp, encoder->dev) {
1163 		if (tmp == encoder)
1164 			return index;
1165 
1166 		index++;
1167 	}
1168 
1169 	BUG();
1170 }
1171 EXPORT_SYMBOL(drm_encoder_index);
1172 
1173 /**
1174  * drm_encoder_cleanup - cleans up an initialised encoder
1175  * @encoder: encoder to cleanup
1176  *
1177  * Cleans up the encoder but doesn't free the object.
1178  */
1179 void drm_encoder_cleanup(struct drm_encoder *encoder)
1180 {
1181 	struct drm_device *dev = encoder->dev;
1182 
1183 	drm_modeset_lock_all(dev);
1184 	drm_mode_object_put(dev, &encoder->base);
1185 	kfree(encoder->name);
1186 	list_del(&encoder->head);
1187 	dev->mode_config.num_encoder--;
1188 	drm_modeset_unlock_all(dev);
1189 
1190 	memset(encoder, 0, sizeof(*encoder));
1191 }
1192 EXPORT_SYMBOL(drm_encoder_cleanup);
1193 
1194 static unsigned int drm_num_planes(struct drm_device *dev)
1195 {
1196 	unsigned int num = 0;
1197 	struct drm_plane *tmp;
1198 
1199 	drm_for_each_plane(tmp, dev) {
1200 		num++;
1201 	}
1202 
1203 	return num;
1204 }
1205 
1206 /**
1207  * drm_universal_plane_init - Initialize a new universal plane object
1208  * @dev: DRM device
1209  * @plane: plane object to init
1210  * @possible_crtcs: bitmask of possible CRTCs
1211  * @funcs: callbacks for the new plane
1212  * @formats: array of supported formats (%DRM_FORMAT_*)
1213  * @format_count: number of elements in @formats
1214  * @type: type of plane (overlay, primary, cursor)
1215  * @name: printf style format string for the plane name, or NULL for default name
1216  *
1217  * Initializes a plane object of type @type.
1218  *
1219  * Returns:
1220  * Zero on success, error code on failure.
1221  */
1222 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1223 			     unsigned long possible_crtcs,
1224 			     const struct drm_plane_funcs *funcs,
1225 			     const uint32_t *formats, unsigned int format_count,
1226 			     enum drm_plane_type type,
1227 			     const char *name, ...)
1228 {
1229 	struct drm_mode_config *config = &dev->mode_config;
1230 	int ret;
1231 
1232 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1233 	if (ret)
1234 		return ret;
1235 
1236 	drm_modeset_lock_init(&plane->mutex);
1237 
1238 	plane->base.properties = &plane->properties;
1239 	plane->dev = dev;
1240 	plane->funcs = funcs;
1241 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1242 					    GFP_KERNEL);
1243 	if (!plane->format_types) {
1244 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1245 		drm_mode_object_put(dev, &plane->base);
1246 		return -ENOMEM;
1247 	}
1248 
1249 	if (name) {
1250 		va_list ap;
1251 
1252 		va_start(ap, name);
1253 		plane->name = kvasprintf(GFP_KERNEL, name, ap);
1254 		va_end(ap);
1255 	} else {
1256 		plane->name = kasprintf(GFP_KERNEL, "plane-%d",
1257 					drm_num_planes(dev));
1258 	}
1259 	if (!plane->name) {
1260 		kfree(plane->format_types);
1261 		drm_mode_object_put(dev, &plane->base);
1262 		return -ENOMEM;
1263 	}
1264 
1265 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1266 	plane->format_count = format_count;
1267 	plane->possible_crtcs = possible_crtcs;
1268 	plane->type = type;
1269 
1270 	list_add_tail(&plane->head, &config->plane_list);
1271 	config->num_total_plane++;
1272 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1273 		config->num_overlay_plane++;
1274 
1275 	drm_object_attach_property(&plane->base,
1276 				   config->plane_type_property,
1277 				   plane->type);
1278 
1279 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1280 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1281 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1282 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1283 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1284 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1285 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1286 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1287 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1288 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1289 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1290 	}
1291 
1292 	return 0;
1293 }
1294 EXPORT_SYMBOL(drm_universal_plane_init);
1295 
1296 /**
1297  * drm_plane_init - Initialize a legacy plane
1298  * @dev: DRM device
1299  * @plane: plane object to init
1300  * @possible_crtcs: bitmask of possible CRTCs
1301  * @funcs: callbacks for the new plane
1302  * @formats: array of supported formats (%DRM_FORMAT_*)
1303  * @format_count: number of elements in @formats
1304  * @is_primary: plane type (primary vs overlay)
1305  *
1306  * Legacy API to initialize a DRM plane.
1307  *
1308  * New drivers should call drm_universal_plane_init() instead.
1309  *
1310  * Returns:
1311  * Zero on success, error code on failure.
1312  */
1313 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1314 		   unsigned long possible_crtcs,
1315 		   const struct drm_plane_funcs *funcs,
1316 		   const uint32_t *formats, unsigned int format_count,
1317 		   bool is_primary)
1318 {
1319 	enum drm_plane_type type;
1320 
1321 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1322 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1323 					formats, format_count, type, NULL);
1324 }
1325 EXPORT_SYMBOL(drm_plane_init);
1326 
1327 /**
1328  * drm_plane_cleanup - Clean up the core plane usage
1329  * @plane: plane to cleanup
1330  *
1331  * This function cleans up @plane and removes it from the DRM mode setting
1332  * core. Note that the function does *not* free the plane structure itself,
1333  * this is the responsibility of the caller.
1334  */
1335 void drm_plane_cleanup(struct drm_plane *plane)
1336 {
1337 	struct drm_device *dev = plane->dev;
1338 
1339 	drm_modeset_lock_all(dev);
1340 	kfree(plane->format_types);
1341 	drm_mode_object_put(dev, &plane->base);
1342 
1343 	BUG_ON(list_empty(&plane->head));
1344 
1345 	list_del(&plane->head);
1346 	dev->mode_config.num_total_plane--;
1347 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1348 		dev->mode_config.num_overlay_plane--;
1349 	drm_modeset_unlock_all(dev);
1350 
1351 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1352 	if (plane->state && plane->funcs->atomic_destroy_state)
1353 		plane->funcs->atomic_destroy_state(plane, plane->state);
1354 
1355 	kfree(plane->name);
1356 
1357 	memset(plane, 0, sizeof(*plane));
1358 }
1359 EXPORT_SYMBOL(drm_plane_cleanup);
1360 
1361 /**
1362  * drm_plane_index - find the index of a registered plane
1363  * @plane: plane to find index for
1364  *
1365  * Given a registered plane, return the index of that CRTC within a DRM
1366  * device's list of planes.
1367  */
1368 unsigned int drm_plane_index(struct drm_plane *plane)
1369 {
1370 	unsigned int index = 0;
1371 	struct drm_plane *tmp;
1372 
1373 	drm_for_each_plane(tmp, plane->dev) {
1374 		if (tmp == plane)
1375 			return index;
1376 
1377 		index++;
1378 	}
1379 
1380 	BUG();
1381 }
1382 EXPORT_SYMBOL(drm_plane_index);
1383 
1384 /**
1385  * drm_plane_from_index - find the registered plane at an index
1386  * @dev: DRM device
1387  * @idx: index of registered plane to find for
1388  *
1389  * Given a plane index, return the registered plane from DRM device's
1390  * list of planes with matching index.
1391  */
1392 struct drm_plane *
1393 drm_plane_from_index(struct drm_device *dev, int idx)
1394 {
1395 	struct drm_plane *plane;
1396 	unsigned int i = 0;
1397 
1398 	drm_for_each_plane(plane, dev) {
1399 		if (i == idx)
1400 			return plane;
1401 		i++;
1402 	}
1403 	return NULL;
1404 }
1405 EXPORT_SYMBOL(drm_plane_from_index);
1406 
1407 /**
1408  * drm_plane_force_disable - Forcibly disable a plane
1409  * @plane: plane to disable
1410  *
1411  * Forces the plane to be disabled.
1412  *
1413  * Used when the plane's current framebuffer is destroyed,
1414  * and when restoring fbdev mode.
1415  */
1416 void drm_plane_force_disable(struct drm_plane *plane)
1417 {
1418 	int ret;
1419 
1420 	if (!plane->fb)
1421 		return;
1422 
1423 	plane->old_fb = plane->fb;
1424 	ret = plane->funcs->disable_plane(plane);
1425 	if (ret) {
1426 		DRM_ERROR("failed to disable plane with busy fb\n");
1427 		plane->old_fb = NULL;
1428 		return;
1429 	}
1430 	/* disconnect the plane from the fb and crtc: */
1431 	drm_framebuffer_unreference(plane->old_fb);
1432 	plane->old_fb = NULL;
1433 	plane->fb = NULL;
1434 	plane->crtc = NULL;
1435 }
1436 EXPORT_SYMBOL(drm_plane_force_disable);
1437 
1438 static int drm_mode_create_standard_properties(struct drm_device *dev)
1439 {
1440 	struct drm_property *prop;
1441 
1442 	/*
1443 	 * Standard properties (apply to all connectors)
1444 	 */
1445 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1446 				   DRM_MODE_PROP_IMMUTABLE,
1447 				   "EDID", 0);
1448 	if (!prop)
1449 		return -ENOMEM;
1450 	dev->mode_config.edid_property = prop;
1451 
1452 	prop = drm_property_create_enum(dev, 0,
1453 				   "DPMS", drm_dpms_enum_list,
1454 				   ARRAY_SIZE(drm_dpms_enum_list));
1455 	if (!prop)
1456 		return -ENOMEM;
1457 	dev->mode_config.dpms_property = prop;
1458 
1459 	prop = drm_property_create(dev,
1460 				   DRM_MODE_PROP_BLOB |
1461 				   DRM_MODE_PROP_IMMUTABLE,
1462 				   "PATH", 0);
1463 	if (!prop)
1464 		return -ENOMEM;
1465 	dev->mode_config.path_property = prop;
1466 
1467 	prop = drm_property_create(dev,
1468 				   DRM_MODE_PROP_BLOB |
1469 				   DRM_MODE_PROP_IMMUTABLE,
1470 				   "TILE", 0);
1471 	if (!prop)
1472 		return -ENOMEM;
1473 	dev->mode_config.tile_property = prop;
1474 
1475 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1476 					"type", drm_plane_type_enum_list,
1477 					ARRAY_SIZE(drm_plane_type_enum_list));
1478 	if (!prop)
1479 		return -ENOMEM;
1480 	dev->mode_config.plane_type_property = prop;
1481 
1482 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1483 			"SRC_X", 0, UINT_MAX);
1484 	if (!prop)
1485 		return -ENOMEM;
1486 	dev->mode_config.prop_src_x = prop;
1487 
1488 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1489 			"SRC_Y", 0, UINT_MAX);
1490 	if (!prop)
1491 		return -ENOMEM;
1492 	dev->mode_config.prop_src_y = prop;
1493 
1494 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1495 			"SRC_W", 0, UINT_MAX);
1496 	if (!prop)
1497 		return -ENOMEM;
1498 	dev->mode_config.prop_src_w = prop;
1499 
1500 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1501 			"SRC_H", 0, UINT_MAX);
1502 	if (!prop)
1503 		return -ENOMEM;
1504 	dev->mode_config.prop_src_h = prop;
1505 
1506 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1507 			"CRTC_X", INT_MIN, INT_MAX);
1508 	if (!prop)
1509 		return -ENOMEM;
1510 	dev->mode_config.prop_crtc_x = prop;
1511 
1512 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1513 			"CRTC_Y", INT_MIN, INT_MAX);
1514 	if (!prop)
1515 		return -ENOMEM;
1516 	dev->mode_config.prop_crtc_y = prop;
1517 
1518 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1519 			"CRTC_W", 0, INT_MAX);
1520 	if (!prop)
1521 		return -ENOMEM;
1522 	dev->mode_config.prop_crtc_w = prop;
1523 
1524 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1525 			"CRTC_H", 0, INT_MAX);
1526 	if (!prop)
1527 		return -ENOMEM;
1528 	dev->mode_config.prop_crtc_h = prop;
1529 
1530 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1531 			"FB_ID", DRM_MODE_OBJECT_FB);
1532 	if (!prop)
1533 		return -ENOMEM;
1534 	dev->mode_config.prop_fb_id = prop;
1535 
1536 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1537 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1538 	if (!prop)
1539 		return -ENOMEM;
1540 	dev->mode_config.prop_crtc_id = prop;
1541 
1542 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1543 			"ACTIVE");
1544 	if (!prop)
1545 		return -ENOMEM;
1546 	dev->mode_config.prop_active = prop;
1547 
1548 	prop = drm_property_create(dev,
1549 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1550 			"MODE_ID", 0);
1551 	if (!prop)
1552 		return -ENOMEM;
1553 	dev->mode_config.prop_mode_id = prop;
1554 
1555 	prop = drm_property_create(dev,
1556 			DRM_MODE_PROP_BLOB,
1557 			"DEGAMMA_LUT", 0);
1558 	if (!prop)
1559 		return -ENOMEM;
1560 	dev->mode_config.degamma_lut_property = prop;
1561 
1562 	prop = drm_property_create_range(dev,
1563 			DRM_MODE_PROP_IMMUTABLE,
1564 			"DEGAMMA_LUT_SIZE", 0, UINT_MAX);
1565 	if (!prop)
1566 		return -ENOMEM;
1567 	dev->mode_config.degamma_lut_size_property = prop;
1568 
1569 	prop = drm_property_create(dev,
1570 			DRM_MODE_PROP_BLOB,
1571 			"CTM", 0);
1572 	if (!prop)
1573 		return -ENOMEM;
1574 	dev->mode_config.ctm_property = prop;
1575 
1576 	prop = drm_property_create(dev,
1577 			DRM_MODE_PROP_BLOB,
1578 			"GAMMA_LUT", 0);
1579 	if (!prop)
1580 		return -ENOMEM;
1581 	dev->mode_config.gamma_lut_property = prop;
1582 
1583 	prop = drm_property_create_range(dev,
1584 			DRM_MODE_PROP_IMMUTABLE,
1585 			"GAMMA_LUT_SIZE", 0, UINT_MAX);
1586 	if (!prop)
1587 		return -ENOMEM;
1588 	dev->mode_config.gamma_lut_size_property = prop;
1589 
1590 	return 0;
1591 }
1592 
1593 /**
1594  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1595  * @dev: DRM device
1596  *
1597  * Called by a driver the first time a DVI-I connector is made.
1598  */
1599 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1600 {
1601 	struct drm_property *dvi_i_selector;
1602 	struct drm_property *dvi_i_subconnector;
1603 
1604 	if (dev->mode_config.dvi_i_select_subconnector_property)
1605 		return 0;
1606 
1607 	dvi_i_selector =
1608 		drm_property_create_enum(dev, 0,
1609 				    "select subconnector",
1610 				    drm_dvi_i_select_enum_list,
1611 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1612 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1613 
1614 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1615 				    "subconnector",
1616 				    drm_dvi_i_subconnector_enum_list,
1617 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1618 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1619 
1620 	return 0;
1621 }
1622 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1623 
1624 /**
1625  * drm_create_tv_properties - create TV specific connector properties
1626  * @dev: DRM device
1627  * @num_modes: number of different TV formats (modes) supported
1628  * @modes: array of pointers to strings containing name of each format
1629  *
1630  * Called by a driver's TV initialization routine, this function creates
1631  * the TV specific connector properties for a given device.  Caller is
1632  * responsible for allocating a list of format names and passing them to
1633  * this routine.
1634  */
1635 int drm_mode_create_tv_properties(struct drm_device *dev,
1636 				  unsigned int num_modes,
1637 				  const char * const modes[])
1638 {
1639 	struct drm_property *tv_selector;
1640 	struct drm_property *tv_subconnector;
1641 	unsigned int i;
1642 
1643 	if (dev->mode_config.tv_select_subconnector_property)
1644 		return 0;
1645 
1646 	/*
1647 	 * Basic connector properties
1648 	 */
1649 	tv_selector = drm_property_create_enum(dev, 0,
1650 					  "select subconnector",
1651 					  drm_tv_select_enum_list,
1652 					  ARRAY_SIZE(drm_tv_select_enum_list));
1653 	if (!tv_selector)
1654 		goto nomem;
1655 
1656 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1657 
1658 	tv_subconnector =
1659 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1660 				    "subconnector",
1661 				    drm_tv_subconnector_enum_list,
1662 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1663 	if (!tv_subconnector)
1664 		goto nomem;
1665 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1666 
1667 	/*
1668 	 * Other, TV specific properties: margins & TV modes.
1669 	 */
1670 	dev->mode_config.tv_left_margin_property =
1671 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1672 	if (!dev->mode_config.tv_left_margin_property)
1673 		goto nomem;
1674 
1675 	dev->mode_config.tv_right_margin_property =
1676 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1677 	if (!dev->mode_config.tv_right_margin_property)
1678 		goto nomem;
1679 
1680 	dev->mode_config.tv_top_margin_property =
1681 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1682 	if (!dev->mode_config.tv_top_margin_property)
1683 		goto nomem;
1684 
1685 	dev->mode_config.tv_bottom_margin_property =
1686 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1687 	if (!dev->mode_config.tv_bottom_margin_property)
1688 		goto nomem;
1689 
1690 	dev->mode_config.tv_mode_property =
1691 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1692 				    "mode", num_modes);
1693 	if (!dev->mode_config.tv_mode_property)
1694 		goto nomem;
1695 
1696 	for (i = 0; i < num_modes; i++)
1697 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1698 				      i, modes[i]);
1699 
1700 	dev->mode_config.tv_brightness_property =
1701 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1702 	if (!dev->mode_config.tv_brightness_property)
1703 		goto nomem;
1704 
1705 	dev->mode_config.tv_contrast_property =
1706 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1707 	if (!dev->mode_config.tv_contrast_property)
1708 		goto nomem;
1709 
1710 	dev->mode_config.tv_flicker_reduction_property =
1711 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1712 	if (!dev->mode_config.tv_flicker_reduction_property)
1713 		goto nomem;
1714 
1715 	dev->mode_config.tv_overscan_property =
1716 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1717 	if (!dev->mode_config.tv_overscan_property)
1718 		goto nomem;
1719 
1720 	dev->mode_config.tv_saturation_property =
1721 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1722 	if (!dev->mode_config.tv_saturation_property)
1723 		goto nomem;
1724 
1725 	dev->mode_config.tv_hue_property =
1726 		drm_property_create_range(dev, 0, "hue", 0, 100);
1727 	if (!dev->mode_config.tv_hue_property)
1728 		goto nomem;
1729 
1730 	return 0;
1731 nomem:
1732 	return -ENOMEM;
1733 }
1734 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1735 
1736 /**
1737  * drm_mode_create_scaling_mode_property - create scaling mode property
1738  * @dev: DRM device
1739  *
1740  * Called by a driver the first time it's needed, must be attached to desired
1741  * connectors.
1742  */
1743 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1744 {
1745 	struct drm_property *scaling_mode;
1746 
1747 	if (dev->mode_config.scaling_mode_property)
1748 		return 0;
1749 
1750 	scaling_mode =
1751 		drm_property_create_enum(dev, 0, "scaling mode",
1752 				drm_scaling_mode_enum_list,
1753 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1754 
1755 	dev->mode_config.scaling_mode_property = scaling_mode;
1756 
1757 	return 0;
1758 }
1759 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1760 
1761 /**
1762  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1763  * @dev: DRM device
1764  *
1765  * Called by a driver the first time it's needed, must be attached to desired
1766  * connectors.
1767  *
1768  * Returns:
1769  * Zero on success, negative errno on failure.
1770  */
1771 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1772 {
1773 	if (dev->mode_config.aspect_ratio_property)
1774 		return 0;
1775 
1776 	dev->mode_config.aspect_ratio_property =
1777 		drm_property_create_enum(dev, 0, "aspect ratio",
1778 				drm_aspect_ratio_enum_list,
1779 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1780 
1781 	if (dev->mode_config.aspect_ratio_property == NULL)
1782 		return -ENOMEM;
1783 
1784 	return 0;
1785 }
1786 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1787 
1788 /**
1789  * drm_mode_create_dirty_property - create dirty property
1790  * @dev: DRM device
1791  *
1792  * Called by a driver the first time it's needed, must be attached to desired
1793  * connectors.
1794  */
1795 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1796 {
1797 	struct drm_property *dirty_info;
1798 
1799 	if (dev->mode_config.dirty_info_property)
1800 		return 0;
1801 
1802 	dirty_info =
1803 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1804 				    "dirty",
1805 				    drm_dirty_info_enum_list,
1806 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1807 	dev->mode_config.dirty_info_property = dirty_info;
1808 
1809 	return 0;
1810 }
1811 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1812 
1813 /**
1814  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1815  * @dev: DRM device
1816  *
1817  * Create the the suggested x/y offset property for connectors.
1818  */
1819 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1820 {
1821 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1822 		return 0;
1823 
1824 	dev->mode_config.suggested_x_property =
1825 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1826 
1827 	dev->mode_config.suggested_y_property =
1828 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1829 
1830 	if (dev->mode_config.suggested_x_property == NULL ||
1831 	    dev->mode_config.suggested_y_property == NULL)
1832 		return -ENOMEM;
1833 	return 0;
1834 }
1835 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1836 
1837 /**
1838  * drm_mode_getresources - get graphics configuration
1839  * @dev: drm device for the ioctl
1840  * @data: data pointer for the ioctl
1841  * @file_priv: drm file for the ioctl call
1842  *
1843  * Construct a set of configuration description structures and return
1844  * them to the user, including CRTC, connector and framebuffer configuration.
1845  *
1846  * Called by the user via ioctl.
1847  *
1848  * Returns:
1849  * Zero on success, negative errno on failure.
1850  */
1851 int drm_mode_getresources(struct drm_device *dev, void *data,
1852 			  struct drm_file *file_priv)
1853 {
1854 	struct drm_mode_card_res *card_res = data;
1855 	struct list_head *lh;
1856 	struct drm_framebuffer *fb;
1857 	struct drm_connector *connector;
1858 	struct drm_crtc *crtc;
1859 	struct drm_encoder *encoder;
1860 	int ret = 0;
1861 	int connector_count = 0;
1862 	int crtc_count = 0;
1863 	int fb_count = 0;
1864 	int encoder_count = 0;
1865 	int copied = 0;
1866 	uint32_t __user *fb_id;
1867 	uint32_t __user *crtc_id;
1868 	uint32_t __user *connector_id;
1869 	uint32_t __user *encoder_id;
1870 
1871 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1872 		return -EINVAL;
1873 
1874 
1875 	mutex_lock(&file_priv->fbs_lock);
1876 	/*
1877 	 * For the non-control nodes we need to limit the list of resources
1878 	 * by IDs in the group list for this node
1879 	 */
1880 	list_for_each(lh, &file_priv->fbs)
1881 		fb_count++;
1882 
1883 	/* handle this in 4 parts */
1884 	/* FBs */
1885 	if (card_res->count_fbs >= fb_count) {
1886 		copied = 0;
1887 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1888 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1889 			if (put_user(fb->base.id, fb_id + copied)) {
1890 				mutex_unlock(&file_priv->fbs_lock);
1891 				return -EFAULT;
1892 			}
1893 			copied++;
1894 		}
1895 	}
1896 	card_res->count_fbs = fb_count;
1897 	mutex_unlock(&file_priv->fbs_lock);
1898 
1899 	/* mode_config.mutex protects the connector list against e.g. DP MST
1900 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1901 	mutex_lock(&dev->mode_config.mutex);
1902 	drm_for_each_crtc(crtc, dev)
1903 		crtc_count++;
1904 
1905 	drm_for_each_connector(connector, dev)
1906 		connector_count++;
1907 
1908 	drm_for_each_encoder(encoder, dev)
1909 		encoder_count++;
1910 
1911 	card_res->max_height = dev->mode_config.max_height;
1912 	card_res->min_height = dev->mode_config.min_height;
1913 	card_res->max_width = dev->mode_config.max_width;
1914 	card_res->min_width = dev->mode_config.min_width;
1915 
1916 	/* CRTCs */
1917 	if (card_res->count_crtcs >= crtc_count) {
1918 		copied = 0;
1919 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1920 		drm_for_each_crtc(crtc, dev) {
1921 			DRM_DEBUG_KMS("[CRTC:%d:%s]\n",
1922 				      crtc->base.id, crtc->name);
1923 			if (put_user(crtc->base.id, crtc_id + copied)) {
1924 				ret = -EFAULT;
1925 				goto out;
1926 			}
1927 			copied++;
1928 		}
1929 	}
1930 	card_res->count_crtcs = crtc_count;
1931 
1932 	/* Encoders */
1933 	if (card_res->count_encoders >= encoder_count) {
1934 		copied = 0;
1935 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1936 		drm_for_each_encoder(encoder, dev) {
1937 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1938 					encoder->name);
1939 			if (put_user(encoder->base.id, encoder_id +
1940 				     copied)) {
1941 				ret = -EFAULT;
1942 				goto out;
1943 			}
1944 			copied++;
1945 		}
1946 	}
1947 	card_res->count_encoders = encoder_count;
1948 
1949 	/* Connectors */
1950 	if (card_res->count_connectors >= connector_count) {
1951 		copied = 0;
1952 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1953 		drm_for_each_connector(connector, dev) {
1954 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1955 				connector->base.id,
1956 				connector->name);
1957 			if (put_user(connector->base.id,
1958 				     connector_id + copied)) {
1959 				ret = -EFAULT;
1960 				goto out;
1961 			}
1962 			copied++;
1963 		}
1964 	}
1965 	card_res->count_connectors = connector_count;
1966 
1967 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1968 		  card_res->count_connectors, card_res->count_encoders);
1969 
1970 out:
1971 	mutex_unlock(&dev->mode_config.mutex);
1972 	return ret;
1973 }
1974 
1975 /**
1976  * drm_mode_getcrtc - get CRTC configuration
1977  * @dev: drm device for the ioctl
1978  * @data: data pointer for the ioctl
1979  * @file_priv: drm file for the ioctl call
1980  *
1981  * Construct a CRTC configuration structure to return to the user.
1982  *
1983  * Called by the user via ioctl.
1984  *
1985  * Returns:
1986  * Zero on success, negative errno on failure.
1987  */
1988 int drm_mode_getcrtc(struct drm_device *dev,
1989 		     void *data, struct drm_file *file_priv)
1990 {
1991 	struct drm_mode_crtc *crtc_resp = data;
1992 	struct drm_crtc *crtc;
1993 
1994 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1995 		return -EINVAL;
1996 
1997 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1998 	if (!crtc)
1999 		return -ENOENT;
2000 
2001 	drm_modeset_lock_crtc(crtc, crtc->primary);
2002 	crtc_resp->gamma_size = crtc->gamma_size;
2003 	if (crtc->primary->fb)
2004 		crtc_resp->fb_id = crtc->primary->fb->base.id;
2005 	else
2006 		crtc_resp->fb_id = 0;
2007 
2008 	if (crtc->state) {
2009 		crtc_resp->x = crtc->primary->state->src_x >> 16;
2010 		crtc_resp->y = crtc->primary->state->src_y >> 16;
2011 		if (crtc->state->enable) {
2012 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
2013 			crtc_resp->mode_valid = 1;
2014 
2015 		} else {
2016 			crtc_resp->mode_valid = 0;
2017 		}
2018 	} else {
2019 		crtc_resp->x = crtc->x;
2020 		crtc_resp->y = crtc->y;
2021 		if (crtc->enabled) {
2022 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
2023 			crtc_resp->mode_valid = 1;
2024 
2025 		} else {
2026 			crtc_resp->mode_valid = 0;
2027 		}
2028 	}
2029 	drm_modeset_unlock_crtc(crtc);
2030 
2031 	return 0;
2032 }
2033 
2034 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
2035 					 const struct drm_file *file_priv)
2036 {
2037 	/*
2038 	 * If user-space hasn't configured the driver to expose the stereo 3D
2039 	 * modes, don't expose them.
2040 	 */
2041 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
2042 		return false;
2043 
2044 	return true;
2045 }
2046 
2047 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
2048 {
2049 	/* For atomic drivers only state objects are synchronously updated and
2050 	 * protected by modeset locks, so check those first. */
2051 	if (connector->state)
2052 		return connector->state->best_encoder;
2053 	return connector->encoder;
2054 }
2055 
2056 /* helper for getconnector and getproperties ioctls */
2057 static int get_properties(struct drm_mode_object *obj, bool atomic,
2058 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
2059 		uint32_t *arg_count_props)
2060 {
2061 	int props_count;
2062 	int i, ret, copied;
2063 
2064 	props_count = obj->properties->count;
2065 	if (!atomic)
2066 		props_count -= obj->properties->atomic_count;
2067 
2068 	if ((*arg_count_props >= props_count) && props_count) {
2069 		for (i = 0, copied = 0; copied < props_count; i++) {
2070 			struct drm_property *prop = obj->properties->properties[i];
2071 			uint64_t val;
2072 
2073 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
2074 				continue;
2075 
2076 			ret = drm_object_property_get_value(obj, prop, &val);
2077 			if (ret)
2078 				return ret;
2079 
2080 			if (put_user(prop->base.id, prop_ptr + copied))
2081 				return -EFAULT;
2082 
2083 			if (put_user(val, prop_values + copied))
2084 				return -EFAULT;
2085 
2086 			copied++;
2087 		}
2088 	}
2089 	*arg_count_props = props_count;
2090 
2091 	return 0;
2092 }
2093 
2094 /**
2095  * drm_mode_getconnector - get connector configuration
2096  * @dev: drm device for the ioctl
2097  * @data: data pointer for the ioctl
2098  * @file_priv: drm file for the ioctl call
2099  *
2100  * Construct a connector configuration structure to return to the user.
2101  *
2102  * Called by the user via ioctl.
2103  *
2104  * Returns:
2105  * Zero on success, negative errno on failure.
2106  */
2107 int drm_mode_getconnector(struct drm_device *dev, void *data,
2108 			  struct drm_file *file_priv)
2109 {
2110 	struct drm_mode_get_connector *out_resp = data;
2111 	struct drm_connector *connector;
2112 	struct drm_encoder *encoder;
2113 	struct drm_display_mode *mode;
2114 	int mode_count = 0;
2115 	int encoders_count = 0;
2116 	int ret = 0;
2117 	int copied = 0;
2118 	int i;
2119 	struct drm_mode_modeinfo u_mode;
2120 	struct drm_mode_modeinfo __user *mode_ptr;
2121 	uint32_t __user *encoder_ptr;
2122 
2123 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2124 		return -EINVAL;
2125 
2126 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2127 
2128 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2129 
2130 	mutex_lock(&dev->mode_config.mutex);
2131 
2132 	connector = drm_connector_find(dev, out_resp->connector_id);
2133 	if (!connector) {
2134 		ret = -ENOENT;
2135 		goto out_unlock;
2136 	}
2137 
2138 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2139 		if (connector->encoder_ids[i] != 0)
2140 			encoders_count++;
2141 
2142 	if (out_resp->count_modes == 0) {
2143 		connector->funcs->fill_modes(connector,
2144 					     dev->mode_config.max_width,
2145 					     dev->mode_config.max_height);
2146 	}
2147 
2148 	/* delayed so we get modes regardless of pre-fill_modes state */
2149 	list_for_each_entry(mode, &connector->modes, head)
2150 		if (drm_mode_expose_to_userspace(mode, file_priv))
2151 			mode_count++;
2152 
2153 	out_resp->connector_id = connector->base.id;
2154 	out_resp->connector_type = connector->connector_type;
2155 	out_resp->connector_type_id = connector->connector_type_id;
2156 	out_resp->mm_width = connector->display_info.width_mm;
2157 	out_resp->mm_height = connector->display_info.height_mm;
2158 	out_resp->subpixel = connector->display_info.subpixel_order;
2159 	out_resp->connection = connector->status;
2160 
2161 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2162 	encoder = drm_connector_get_encoder(connector);
2163 	if (encoder)
2164 		out_resp->encoder_id = encoder->base.id;
2165 	else
2166 		out_resp->encoder_id = 0;
2167 
2168 	/*
2169 	 * This ioctl is called twice, once to determine how much space is
2170 	 * needed, and the 2nd time to fill it.
2171 	 */
2172 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2173 		copied = 0;
2174 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2175 		list_for_each_entry(mode, &connector->modes, head) {
2176 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2177 				continue;
2178 
2179 			drm_mode_convert_to_umode(&u_mode, mode);
2180 			if (copy_to_user(mode_ptr + copied,
2181 					 &u_mode, sizeof(u_mode))) {
2182 				ret = -EFAULT;
2183 				goto out;
2184 			}
2185 			copied++;
2186 		}
2187 	}
2188 	out_resp->count_modes = mode_count;
2189 
2190 	ret = get_properties(&connector->base, file_priv->atomic,
2191 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2192 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2193 			&out_resp->count_props);
2194 	if (ret)
2195 		goto out;
2196 
2197 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2198 		copied = 0;
2199 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2200 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2201 			if (connector->encoder_ids[i] != 0) {
2202 				if (put_user(connector->encoder_ids[i],
2203 					     encoder_ptr + copied)) {
2204 					ret = -EFAULT;
2205 					goto out;
2206 				}
2207 				copied++;
2208 			}
2209 		}
2210 	}
2211 	out_resp->count_encoders = encoders_count;
2212 
2213 out:
2214 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2215 
2216 out_unlock:
2217 	mutex_unlock(&dev->mode_config.mutex);
2218 
2219 	return ret;
2220 }
2221 
2222 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2223 {
2224 	struct drm_connector *connector;
2225 	struct drm_device *dev = encoder->dev;
2226 	bool uses_atomic = false;
2227 
2228 	/* For atomic drivers only state objects are synchronously updated and
2229 	 * protected by modeset locks, so check those first. */
2230 	drm_for_each_connector(connector, dev) {
2231 		if (!connector->state)
2232 			continue;
2233 
2234 		uses_atomic = true;
2235 
2236 		if (connector->state->best_encoder != encoder)
2237 			continue;
2238 
2239 		return connector->state->crtc;
2240 	}
2241 
2242 	/* Don't return stale data (e.g. pending async disable). */
2243 	if (uses_atomic)
2244 		return NULL;
2245 
2246 	return encoder->crtc;
2247 }
2248 
2249 /**
2250  * drm_mode_getencoder - get encoder configuration
2251  * @dev: drm device for the ioctl
2252  * @data: data pointer for the ioctl
2253  * @file_priv: drm file for the ioctl call
2254  *
2255  * Construct a encoder configuration structure to return to the user.
2256  *
2257  * Called by the user via ioctl.
2258  *
2259  * Returns:
2260  * Zero on success, negative errno on failure.
2261  */
2262 int drm_mode_getencoder(struct drm_device *dev, void *data,
2263 			struct drm_file *file_priv)
2264 {
2265 	struct drm_mode_get_encoder *enc_resp = data;
2266 	struct drm_encoder *encoder;
2267 	struct drm_crtc *crtc;
2268 
2269 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2270 		return -EINVAL;
2271 
2272 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2273 	if (!encoder)
2274 		return -ENOENT;
2275 
2276 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2277 	crtc = drm_encoder_get_crtc(encoder);
2278 	if (crtc)
2279 		enc_resp->crtc_id = crtc->base.id;
2280 	else
2281 		enc_resp->crtc_id = 0;
2282 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2283 
2284 	enc_resp->encoder_type = encoder->encoder_type;
2285 	enc_resp->encoder_id = encoder->base.id;
2286 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2287 	enc_resp->possible_clones = encoder->possible_clones;
2288 
2289 	return 0;
2290 }
2291 
2292 /**
2293  * drm_mode_getplane_res - enumerate all plane resources
2294  * @dev: DRM device
2295  * @data: ioctl data
2296  * @file_priv: DRM file info
2297  *
2298  * Construct a list of plane ids to return to the user.
2299  *
2300  * Called by the user via ioctl.
2301  *
2302  * Returns:
2303  * Zero on success, negative errno on failure.
2304  */
2305 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2306 			  struct drm_file *file_priv)
2307 {
2308 	struct drm_mode_get_plane_res *plane_resp = data;
2309 	struct drm_mode_config *config;
2310 	struct drm_plane *plane;
2311 	uint32_t __user *plane_ptr;
2312 	int copied = 0;
2313 	unsigned num_planes;
2314 
2315 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2316 		return -EINVAL;
2317 
2318 	config = &dev->mode_config;
2319 
2320 	if (file_priv->universal_planes)
2321 		num_planes = config->num_total_plane;
2322 	else
2323 		num_planes = config->num_overlay_plane;
2324 
2325 	/*
2326 	 * This ioctl is called twice, once to determine how much space is
2327 	 * needed, and the 2nd time to fill it.
2328 	 */
2329 	if (num_planes &&
2330 	    (plane_resp->count_planes >= num_planes)) {
2331 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2332 
2333 		/* Plane lists are invariant, no locking needed. */
2334 		drm_for_each_plane(plane, dev) {
2335 			/*
2336 			 * Unless userspace set the 'universal planes'
2337 			 * capability bit, only advertise overlays.
2338 			 */
2339 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2340 			    !file_priv->universal_planes)
2341 				continue;
2342 
2343 			if (put_user(plane->base.id, plane_ptr + copied))
2344 				return -EFAULT;
2345 			copied++;
2346 		}
2347 	}
2348 	plane_resp->count_planes = num_planes;
2349 
2350 	return 0;
2351 }
2352 
2353 /**
2354  * drm_mode_getplane - get plane configuration
2355  * @dev: DRM device
2356  * @data: ioctl data
2357  * @file_priv: DRM file info
2358  *
2359  * Construct a plane configuration structure to return to the user.
2360  *
2361  * Called by the user via ioctl.
2362  *
2363  * Returns:
2364  * Zero on success, negative errno on failure.
2365  */
2366 int drm_mode_getplane(struct drm_device *dev, void *data,
2367 		      struct drm_file *file_priv)
2368 {
2369 	struct drm_mode_get_plane *plane_resp = data;
2370 	struct drm_plane *plane;
2371 	uint32_t __user *format_ptr;
2372 
2373 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2374 		return -EINVAL;
2375 
2376 	plane = drm_plane_find(dev, plane_resp->plane_id);
2377 	if (!plane)
2378 		return -ENOENT;
2379 
2380 	drm_modeset_lock(&plane->mutex, NULL);
2381 	if (plane->crtc)
2382 		plane_resp->crtc_id = plane->crtc->base.id;
2383 	else
2384 		plane_resp->crtc_id = 0;
2385 
2386 	if (plane->fb)
2387 		plane_resp->fb_id = plane->fb->base.id;
2388 	else
2389 		plane_resp->fb_id = 0;
2390 	drm_modeset_unlock(&plane->mutex);
2391 
2392 	plane_resp->plane_id = plane->base.id;
2393 	plane_resp->possible_crtcs = plane->possible_crtcs;
2394 	plane_resp->gamma_size = 0;
2395 
2396 	/*
2397 	 * This ioctl is called twice, once to determine how much space is
2398 	 * needed, and the 2nd time to fill it.
2399 	 */
2400 	if (plane->format_count &&
2401 	    (plane_resp->count_format_types >= plane->format_count)) {
2402 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2403 		if (copy_to_user(format_ptr,
2404 				 plane->format_types,
2405 				 sizeof(uint32_t) * plane->format_count)) {
2406 			return -EFAULT;
2407 		}
2408 	}
2409 	plane_resp->count_format_types = plane->format_count;
2410 
2411 	return 0;
2412 }
2413 
2414 /**
2415  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2416  * @plane: plane to check for format support
2417  * @format: the pixel format
2418  *
2419  * Returns:
2420  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2421  * otherwise.
2422  */
2423 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2424 {
2425 	unsigned int i;
2426 
2427 	for (i = 0; i < plane->format_count; i++) {
2428 		if (format == plane->format_types[i])
2429 			return 0;
2430 	}
2431 
2432 	return -EINVAL;
2433 }
2434 
2435 static int check_src_coords(uint32_t src_x, uint32_t src_y,
2436 			    uint32_t src_w, uint32_t src_h,
2437 			    const struct drm_framebuffer *fb)
2438 {
2439 	unsigned int fb_width, fb_height;
2440 
2441 	fb_width = fb->width << 16;
2442 	fb_height = fb->height << 16;
2443 
2444 	/* Make sure source coordinates are inside the fb. */
2445 	if (src_w > fb_width ||
2446 	    src_x > fb_width - src_w ||
2447 	    src_h > fb_height ||
2448 	    src_y > fb_height - src_h) {
2449 		DRM_DEBUG_KMS("Invalid source coordinates "
2450 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2451 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2452 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2453 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2454 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2455 		return -ENOSPC;
2456 	}
2457 
2458 	return 0;
2459 }
2460 
2461 /*
2462  * setplane_internal - setplane handler for internal callers
2463  *
2464  * Note that we assume an extra reference has already been taken on fb.  If the
2465  * update fails, this reference will be dropped before return; if it succeeds,
2466  * the previous framebuffer (if any) will be unreferenced instead.
2467  *
2468  * src_{x,y,w,h} are provided in 16.16 fixed point format
2469  */
2470 static int __setplane_internal(struct drm_plane *plane,
2471 			       struct drm_crtc *crtc,
2472 			       struct drm_framebuffer *fb,
2473 			       int32_t crtc_x, int32_t crtc_y,
2474 			       uint32_t crtc_w, uint32_t crtc_h,
2475 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2476 			       uint32_t src_x, uint32_t src_y,
2477 			       uint32_t src_w, uint32_t src_h)
2478 {
2479 	int ret = 0;
2480 
2481 	/* No fb means shut it down */
2482 	if (!fb) {
2483 		plane->old_fb = plane->fb;
2484 		ret = plane->funcs->disable_plane(plane);
2485 		if (!ret) {
2486 			plane->crtc = NULL;
2487 			plane->fb = NULL;
2488 		} else {
2489 			plane->old_fb = NULL;
2490 		}
2491 		goto out;
2492 	}
2493 
2494 	/* Check whether this plane is usable on this CRTC */
2495 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2496 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2497 		ret = -EINVAL;
2498 		goto out;
2499 	}
2500 
2501 	/* Check whether this plane supports the fb pixel format. */
2502 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2503 	if (ret) {
2504 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2505 			      drm_get_format_name(fb->pixel_format));
2506 		goto out;
2507 	}
2508 
2509 	/* Give drivers some help against integer overflows */
2510 	if (crtc_w > INT_MAX ||
2511 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2512 	    crtc_h > INT_MAX ||
2513 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2514 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2515 			      crtc_w, crtc_h, crtc_x, crtc_y);
2516 		ret = -ERANGE;
2517 		goto out;
2518 	}
2519 
2520 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
2521 	if (ret)
2522 		goto out;
2523 
2524 	plane->old_fb = plane->fb;
2525 	ret = plane->funcs->update_plane(plane, crtc, fb,
2526 					 crtc_x, crtc_y, crtc_w, crtc_h,
2527 					 src_x, src_y, src_w, src_h);
2528 	if (!ret) {
2529 		plane->crtc = crtc;
2530 		plane->fb = fb;
2531 		fb = NULL;
2532 	} else {
2533 		plane->old_fb = NULL;
2534 	}
2535 
2536 out:
2537 	if (fb)
2538 		drm_framebuffer_unreference(fb);
2539 	if (plane->old_fb)
2540 		drm_framebuffer_unreference(plane->old_fb);
2541 	plane->old_fb = NULL;
2542 
2543 	return ret;
2544 }
2545 
2546 static int setplane_internal(struct drm_plane *plane,
2547 			     struct drm_crtc *crtc,
2548 			     struct drm_framebuffer *fb,
2549 			     int32_t crtc_x, int32_t crtc_y,
2550 			     uint32_t crtc_w, uint32_t crtc_h,
2551 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2552 			     uint32_t src_x, uint32_t src_y,
2553 			     uint32_t src_w, uint32_t src_h)
2554 {
2555 	int ret;
2556 
2557 	drm_modeset_lock_all(plane->dev);
2558 	ret = __setplane_internal(plane, crtc, fb,
2559 				  crtc_x, crtc_y, crtc_w, crtc_h,
2560 				  src_x, src_y, src_w, src_h);
2561 	drm_modeset_unlock_all(plane->dev);
2562 
2563 	return ret;
2564 }
2565 
2566 /**
2567  * drm_mode_setplane - configure a plane's configuration
2568  * @dev: DRM device
2569  * @data: ioctl data*
2570  * @file_priv: DRM file info
2571  *
2572  * Set plane configuration, including placement, fb, scaling, and other factors.
2573  * Or pass a NULL fb to disable (planes may be disabled without providing a
2574  * valid crtc).
2575  *
2576  * Returns:
2577  * Zero on success, negative errno on failure.
2578  */
2579 int drm_mode_setplane(struct drm_device *dev, void *data,
2580 		      struct drm_file *file_priv)
2581 {
2582 	struct drm_mode_set_plane *plane_req = data;
2583 	struct drm_plane *plane;
2584 	struct drm_crtc *crtc = NULL;
2585 	struct drm_framebuffer *fb = NULL;
2586 
2587 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2588 		return -EINVAL;
2589 
2590 	/*
2591 	 * First, find the plane, crtc, and fb objects.  If not available,
2592 	 * we don't bother to call the driver.
2593 	 */
2594 	plane = drm_plane_find(dev, plane_req->plane_id);
2595 	if (!plane) {
2596 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2597 			      plane_req->plane_id);
2598 		return -ENOENT;
2599 	}
2600 
2601 	if (plane_req->fb_id) {
2602 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2603 		if (!fb) {
2604 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2605 				      plane_req->fb_id);
2606 			return -ENOENT;
2607 		}
2608 
2609 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2610 		if (!crtc) {
2611 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2612 				      plane_req->crtc_id);
2613 			return -ENOENT;
2614 		}
2615 	}
2616 
2617 	/*
2618 	 * setplane_internal will take care of deref'ing either the old or new
2619 	 * framebuffer depending on success.
2620 	 */
2621 	return setplane_internal(plane, crtc, fb,
2622 				 plane_req->crtc_x, plane_req->crtc_y,
2623 				 plane_req->crtc_w, plane_req->crtc_h,
2624 				 plane_req->src_x, plane_req->src_y,
2625 				 plane_req->src_w, plane_req->src_h);
2626 }
2627 
2628 /**
2629  * drm_mode_set_config_internal - helper to call ->set_config
2630  * @set: modeset config to set
2631  *
2632  * This is a little helper to wrap internal calls to the ->set_config driver
2633  * interface. The only thing it adds is correct refcounting dance.
2634  *
2635  * Returns:
2636  * Zero on success, negative errno on failure.
2637  */
2638 int drm_mode_set_config_internal(struct drm_mode_set *set)
2639 {
2640 	struct drm_crtc *crtc = set->crtc;
2641 	struct drm_framebuffer *fb;
2642 	struct drm_crtc *tmp;
2643 	int ret;
2644 
2645 	/*
2646 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2647 	 * connectors from it), hence we need to refcount the fbs across all
2648 	 * crtcs. Atomic modeset will have saner semantics ...
2649 	 */
2650 	drm_for_each_crtc(tmp, crtc->dev)
2651 		tmp->primary->old_fb = tmp->primary->fb;
2652 
2653 	fb = set->fb;
2654 
2655 	ret = crtc->funcs->set_config(set);
2656 	if (ret == 0) {
2657 		crtc->primary->crtc = crtc;
2658 		crtc->primary->fb = fb;
2659 	}
2660 
2661 	drm_for_each_crtc(tmp, crtc->dev) {
2662 		if (tmp->primary->fb)
2663 			drm_framebuffer_reference(tmp->primary->fb);
2664 		if (tmp->primary->old_fb)
2665 			drm_framebuffer_unreference(tmp->primary->old_fb);
2666 		tmp->primary->old_fb = NULL;
2667 	}
2668 
2669 	return ret;
2670 }
2671 EXPORT_SYMBOL(drm_mode_set_config_internal);
2672 
2673 /**
2674  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2675  * @mode: mode to query
2676  * @hdisplay: hdisplay value to fill in
2677  * @vdisplay: vdisplay value to fill in
2678  *
2679  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2680  * the appropriate layout.
2681  */
2682 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2683 			    int *hdisplay, int *vdisplay)
2684 {
2685 	struct drm_display_mode adjusted;
2686 
2687 	drm_mode_copy(&adjusted, mode);
2688 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2689 	*hdisplay = adjusted.crtc_hdisplay;
2690 	*vdisplay = adjusted.crtc_vdisplay;
2691 }
2692 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2693 
2694 /**
2695  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2696  *     CRTC viewport
2697  * @crtc: CRTC that framebuffer will be displayed on
2698  * @x: x panning
2699  * @y: y panning
2700  * @mode: mode that framebuffer will be displayed under
2701  * @fb: framebuffer to check size of
2702  */
2703 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2704 			    int x, int y,
2705 			    const struct drm_display_mode *mode,
2706 			    const struct drm_framebuffer *fb)
2707 
2708 {
2709 	int hdisplay, vdisplay;
2710 
2711 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2712 
2713 	if (crtc->state &&
2714 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
2715 					      BIT(DRM_ROTATE_270)))
2716 		swap(hdisplay, vdisplay);
2717 
2718 	return check_src_coords(x << 16, y << 16,
2719 				hdisplay << 16, vdisplay << 16, fb);
2720 }
2721 EXPORT_SYMBOL(drm_crtc_check_viewport);
2722 
2723 /**
2724  * drm_mode_setcrtc - set CRTC configuration
2725  * @dev: drm device for the ioctl
2726  * @data: data pointer for the ioctl
2727  * @file_priv: drm file for the ioctl call
2728  *
2729  * Build a new CRTC configuration based on user request.
2730  *
2731  * Called by the user via ioctl.
2732  *
2733  * Returns:
2734  * Zero on success, negative errno on failure.
2735  */
2736 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2737 		     struct drm_file *file_priv)
2738 {
2739 	struct drm_mode_config *config = &dev->mode_config;
2740 	struct drm_mode_crtc *crtc_req = data;
2741 	struct drm_crtc *crtc;
2742 	struct drm_connector **connector_set = NULL, *connector;
2743 	struct drm_framebuffer *fb = NULL;
2744 	struct drm_display_mode *mode = NULL;
2745 	struct drm_mode_set set;
2746 	uint32_t __user *set_connectors_ptr;
2747 	int ret;
2748 	int i;
2749 
2750 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2751 		return -EINVAL;
2752 
2753 	/*
2754 	 * Universal plane src offsets are only 16.16, prevent havoc for
2755 	 * drivers using universal plane code internally.
2756 	 */
2757 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2758 		return -ERANGE;
2759 
2760 	drm_modeset_lock_all(dev);
2761 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2762 	if (!crtc) {
2763 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2764 		ret = -ENOENT;
2765 		goto out;
2766 	}
2767 	DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
2768 
2769 	if (crtc_req->mode_valid) {
2770 		/* If we have a mode we need a framebuffer. */
2771 		/* If we pass -1, set the mode with the currently bound fb */
2772 		if (crtc_req->fb_id == -1) {
2773 			if (!crtc->primary->fb) {
2774 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2775 				ret = -EINVAL;
2776 				goto out;
2777 			}
2778 			fb = crtc->primary->fb;
2779 			/* Make refcounting symmetric with the lookup path. */
2780 			drm_framebuffer_reference(fb);
2781 		} else {
2782 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2783 			if (!fb) {
2784 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2785 						crtc_req->fb_id);
2786 				ret = -ENOENT;
2787 				goto out;
2788 			}
2789 		}
2790 
2791 		mode = drm_mode_create(dev);
2792 		if (!mode) {
2793 			ret = -ENOMEM;
2794 			goto out;
2795 		}
2796 
2797 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2798 		if (ret) {
2799 			DRM_DEBUG_KMS("Invalid mode\n");
2800 			goto out;
2801 		}
2802 
2803 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2804 
2805 		/*
2806 		 * Check whether the primary plane supports the fb pixel format.
2807 		 * Drivers not implementing the universal planes API use a
2808 		 * default formats list provided by the DRM core which doesn't
2809 		 * match real hardware capabilities. Skip the check in that
2810 		 * case.
2811 		 */
2812 		if (!crtc->primary->format_default) {
2813 			ret = drm_plane_check_pixel_format(crtc->primary,
2814 							   fb->pixel_format);
2815 			if (ret) {
2816 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2817 					drm_get_format_name(fb->pixel_format));
2818 				goto out;
2819 			}
2820 		}
2821 
2822 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2823 					      mode, fb);
2824 		if (ret)
2825 			goto out;
2826 
2827 	}
2828 
2829 	if (crtc_req->count_connectors == 0 && mode) {
2830 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2831 		ret = -EINVAL;
2832 		goto out;
2833 	}
2834 
2835 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2836 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2837 			  crtc_req->count_connectors);
2838 		ret = -EINVAL;
2839 		goto out;
2840 	}
2841 
2842 	if (crtc_req->count_connectors > 0) {
2843 		u32 out_id;
2844 
2845 		/* Avoid unbounded kernel memory allocation */
2846 		if (crtc_req->count_connectors > config->num_connector) {
2847 			ret = -EINVAL;
2848 			goto out;
2849 		}
2850 
2851 		connector_set = kmalloc_array(crtc_req->count_connectors,
2852 					      sizeof(struct drm_connector *),
2853 					      GFP_KERNEL);
2854 		if (!connector_set) {
2855 			ret = -ENOMEM;
2856 			goto out;
2857 		}
2858 
2859 		for (i = 0; i < crtc_req->count_connectors; i++) {
2860 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2861 			if (get_user(out_id, &set_connectors_ptr[i])) {
2862 				ret = -EFAULT;
2863 				goto out;
2864 			}
2865 
2866 			connector = drm_connector_find(dev, out_id);
2867 			if (!connector) {
2868 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2869 						out_id);
2870 				ret = -ENOENT;
2871 				goto out;
2872 			}
2873 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2874 					connector->base.id,
2875 					connector->name);
2876 
2877 			connector_set[i] = connector;
2878 		}
2879 	}
2880 
2881 	set.crtc = crtc;
2882 	set.x = crtc_req->x;
2883 	set.y = crtc_req->y;
2884 	set.mode = mode;
2885 	set.connectors = connector_set;
2886 	set.num_connectors = crtc_req->count_connectors;
2887 	set.fb = fb;
2888 	ret = drm_mode_set_config_internal(&set);
2889 
2890 out:
2891 	if (fb)
2892 		drm_framebuffer_unreference(fb);
2893 
2894 	kfree(connector_set);
2895 	drm_mode_destroy(dev, mode);
2896 	drm_modeset_unlock_all(dev);
2897 	return ret;
2898 }
2899 
2900 /**
2901  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2902  *     universal plane handler call
2903  * @crtc: crtc to update cursor for
2904  * @req: data pointer for the ioctl
2905  * @file_priv: drm file for the ioctl call
2906  *
2907  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2908  * translate legacy ioctl calls into universal plane handler calls, we need to
2909  * wrap the native buffer handle in a drm_framebuffer.
2910  *
2911  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2912  * buffer with a pitch of 4*width; the universal plane interface should be used
2913  * directly in cases where the hardware can support other buffer settings and
2914  * userspace wants to make use of these capabilities.
2915  *
2916  * Returns:
2917  * Zero on success, negative errno on failure.
2918  */
2919 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2920 				     struct drm_mode_cursor2 *req,
2921 				     struct drm_file *file_priv)
2922 {
2923 	struct drm_device *dev = crtc->dev;
2924 	struct drm_framebuffer *fb = NULL;
2925 	struct drm_mode_fb_cmd2 fbreq = {
2926 		.width = req->width,
2927 		.height = req->height,
2928 		.pixel_format = DRM_FORMAT_ARGB8888,
2929 		.pitches = { req->width * 4 },
2930 		.handles = { req->handle },
2931 	};
2932 	int32_t crtc_x, crtc_y;
2933 	uint32_t crtc_w = 0, crtc_h = 0;
2934 	uint32_t src_w = 0, src_h = 0;
2935 	int ret = 0;
2936 
2937 	BUG_ON(!crtc->cursor);
2938 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2939 
2940 	/*
2941 	 * Obtain fb we'll be using (either new or existing) and take an extra
2942 	 * reference to it if fb != null.  setplane will take care of dropping
2943 	 * the reference if the plane update fails.
2944 	 */
2945 	if (req->flags & DRM_MODE_CURSOR_BO) {
2946 		if (req->handle) {
2947 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2948 			if (IS_ERR(fb)) {
2949 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2950 				return PTR_ERR(fb);
2951 			}
2952 		} else {
2953 			fb = NULL;
2954 		}
2955 	} else {
2956 		fb = crtc->cursor->fb;
2957 		if (fb)
2958 			drm_framebuffer_reference(fb);
2959 	}
2960 
2961 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2962 		crtc_x = req->x;
2963 		crtc_y = req->y;
2964 	} else {
2965 		crtc_x = crtc->cursor_x;
2966 		crtc_y = crtc->cursor_y;
2967 	}
2968 
2969 	if (fb) {
2970 		crtc_w = fb->width;
2971 		crtc_h = fb->height;
2972 		src_w = fb->width << 16;
2973 		src_h = fb->height << 16;
2974 	}
2975 
2976 	/*
2977 	 * setplane_internal will take care of deref'ing either the old or new
2978 	 * framebuffer depending on success.
2979 	 */
2980 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2981 				crtc_x, crtc_y, crtc_w, crtc_h,
2982 				0, 0, src_w, src_h);
2983 
2984 	/* Update successful; save new cursor position, if necessary */
2985 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2986 		crtc->cursor_x = req->x;
2987 		crtc->cursor_y = req->y;
2988 	}
2989 
2990 	return ret;
2991 }
2992 
2993 static int drm_mode_cursor_common(struct drm_device *dev,
2994 				  struct drm_mode_cursor2 *req,
2995 				  struct drm_file *file_priv)
2996 {
2997 	struct drm_crtc *crtc;
2998 	int ret = 0;
2999 
3000 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3001 		return -EINVAL;
3002 
3003 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
3004 		return -EINVAL;
3005 
3006 	crtc = drm_crtc_find(dev, req->crtc_id);
3007 	if (!crtc) {
3008 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
3009 		return -ENOENT;
3010 	}
3011 
3012 	/*
3013 	 * If this crtc has a universal cursor plane, call that plane's update
3014 	 * handler rather than using legacy cursor handlers.
3015 	 */
3016 	drm_modeset_lock_crtc(crtc, crtc->cursor);
3017 	if (crtc->cursor) {
3018 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
3019 		goto out;
3020 	}
3021 
3022 	if (req->flags & DRM_MODE_CURSOR_BO) {
3023 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
3024 			ret = -ENXIO;
3025 			goto out;
3026 		}
3027 		/* Turns off the cursor if handle is 0 */
3028 		if (crtc->funcs->cursor_set2)
3029 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
3030 						      req->width, req->height, req->hot_x, req->hot_y);
3031 		else
3032 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
3033 						      req->width, req->height);
3034 	}
3035 
3036 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
3037 		if (crtc->funcs->cursor_move) {
3038 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
3039 		} else {
3040 			ret = -EFAULT;
3041 			goto out;
3042 		}
3043 	}
3044 out:
3045 	drm_modeset_unlock_crtc(crtc);
3046 
3047 	return ret;
3048 
3049 }
3050 
3051 
3052 /**
3053  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
3054  * @dev: drm device for the ioctl
3055  * @data: data pointer for the ioctl
3056  * @file_priv: drm file for the ioctl call
3057  *
3058  * Set the cursor configuration based on user request.
3059  *
3060  * Called by the user via ioctl.
3061  *
3062  * Returns:
3063  * Zero on success, negative errno on failure.
3064  */
3065 int drm_mode_cursor_ioctl(struct drm_device *dev,
3066 			  void *data, struct drm_file *file_priv)
3067 {
3068 	struct drm_mode_cursor *req = data;
3069 	struct drm_mode_cursor2 new_req;
3070 
3071 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
3072 	new_req.hot_x = new_req.hot_y = 0;
3073 
3074 	return drm_mode_cursor_common(dev, &new_req, file_priv);
3075 }
3076 
3077 /**
3078  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
3079  * @dev: drm device for the ioctl
3080  * @data: data pointer for the ioctl
3081  * @file_priv: drm file for the ioctl call
3082  *
3083  * Set the cursor configuration based on user request. This implements the 2nd
3084  * version of the cursor ioctl, which allows userspace to additionally specify
3085  * the hotspot of the pointer.
3086  *
3087  * Called by the user via ioctl.
3088  *
3089  * Returns:
3090  * Zero on success, negative errno on failure.
3091  */
3092 int drm_mode_cursor2_ioctl(struct drm_device *dev,
3093 			   void *data, struct drm_file *file_priv)
3094 {
3095 	struct drm_mode_cursor2 *req = data;
3096 
3097 	return drm_mode_cursor_common(dev, req, file_priv);
3098 }
3099 
3100 /**
3101  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3102  * @bpp: bits per pixels
3103  * @depth: bit depth per pixel
3104  *
3105  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3106  * Useful in fbdev emulation code, since that deals in those values.
3107  */
3108 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3109 {
3110 	uint32_t fmt;
3111 
3112 	switch (bpp) {
3113 	case 8:
3114 		fmt = DRM_FORMAT_C8;
3115 		break;
3116 	case 16:
3117 		if (depth == 15)
3118 			fmt = DRM_FORMAT_XRGB1555;
3119 		else
3120 			fmt = DRM_FORMAT_RGB565;
3121 		break;
3122 	case 24:
3123 		fmt = DRM_FORMAT_RGB888;
3124 		break;
3125 	case 32:
3126 		if (depth == 24)
3127 			fmt = DRM_FORMAT_XRGB8888;
3128 		else if (depth == 30)
3129 			fmt = DRM_FORMAT_XRGB2101010;
3130 		else
3131 			fmt = DRM_FORMAT_ARGB8888;
3132 		break;
3133 	default:
3134 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3135 		fmt = DRM_FORMAT_XRGB8888;
3136 		break;
3137 	}
3138 
3139 	return fmt;
3140 }
3141 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3142 
3143 /**
3144  * drm_mode_addfb - add an FB to the graphics configuration
3145  * @dev: drm device for the ioctl
3146  * @data: data pointer for the ioctl
3147  * @file_priv: drm file for the ioctl call
3148  *
3149  * Add a new FB to the specified CRTC, given a user request. This is the
3150  * original addfb ioctl which only supported RGB formats.
3151  *
3152  * Called by the user via ioctl.
3153  *
3154  * Returns:
3155  * Zero on success, negative errno on failure.
3156  */
3157 int drm_mode_addfb(struct drm_device *dev,
3158 		   void *data, struct drm_file *file_priv)
3159 {
3160 	struct drm_mode_fb_cmd *or = data;
3161 	struct drm_mode_fb_cmd2 r = {};
3162 	int ret;
3163 
3164 	/* convert to new format and call new ioctl */
3165 	r.fb_id = or->fb_id;
3166 	r.width = or->width;
3167 	r.height = or->height;
3168 	r.pitches[0] = or->pitch;
3169 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3170 	r.handles[0] = or->handle;
3171 
3172 	ret = drm_mode_addfb2(dev, &r, file_priv);
3173 	if (ret)
3174 		return ret;
3175 
3176 	or->fb_id = r.fb_id;
3177 
3178 	return 0;
3179 }
3180 
3181 static int format_check(const struct drm_mode_fb_cmd2 *r)
3182 {
3183 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3184 
3185 	switch (format) {
3186 	case DRM_FORMAT_C8:
3187 	case DRM_FORMAT_RGB332:
3188 	case DRM_FORMAT_BGR233:
3189 	case DRM_FORMAT_XRGB4444:
3190 	case DRM_FORMAT_XBGR4444:
3191 	case DRM_FORMAT_RGBX4444:
3192 	case DRM_FORMAT_BGRX4444:
3193 	case DRM_FORMAT_ARGB4444:
3194 	case DRM_FORMAT_ABGR4444:
3195 	case DRM_FORMAT_RGBA4444:
3196 	case DRM_FORMAT_BGRA4444:
3197 	case DRM_FORMAT_XRGB1555:
3198 	case DRM_FORMAT_XBGR1555:
3199 	case DRM_FORMAT_RGBX5551:
3200 	case DRM_FORMAT_BGRX5551:
3201 	case DRM_FORMAT_ARGB1555:
3202 	case DRM_FORMAT_ABGR1555:
3203 	case DRM_FORMAT_RGBA5551:
3204 	case DRM_FORMAT_BGRA5551:
3205 	case DRM_FORMAT_RGB565:
3206 	case DRM_FORMAT_BGR565:
3207 	case DRM_FORMAT_RGB888:
3208 	case DRM_FORMAT_BGR888:
3209 	case DRM_FORMAT_XRGB8888:
3210 	case DRM_FORMAT_XBGR8888:
3211 	case DRM_FORMAT_RGBX8888:
3212 	case DRM_FORMAT_BGRX8888:
3213 	case DRM_FORMAT_ARGB8888:
3214 	case DRM_FORMAT_ABGR8888:
3215 	case DRM_FORMAT_RGBA8888:
3216 	case DRM_FORMAT_BGRA8888:
3217 	case DRM_FORMAT_XRGB2101010:
3218 	case DRM_FORMAT_XBGR2101010:
3219 	case DRM_FORMAT_RGBX1010102:
3220 	case DRM_FORMAT_BGRX1010102:
3221 	case DRM_FORMAT_ARGB2101010:
3222 	case DRM_FORMAT_ABGR2101010:
3223 	case DRM_FORMAT_RGBA1010102:
3224 	case DRM_FORMAT_BGRA1010102:
3225 	case DRM_FORMAT_YUYV:
3226 	case DRM_FORMAT_YVYU:
3227 	case DRM_FORMAT_UYVY:
3228 	case DRM_FORMAT_VYUY:
3229 	case DRM_FORMAT_AYUV:
3230 	case DRM_FORMAT_NV12:
3231 	case DRM_FORMAT_NV21:
3232 	case DRM_FORMAT_NV16:
3233 	case DRM_FORMAT_NV61:
3234 	case DRM_FORMAT_NV24:
3235 	case DRM_FORMAT_NV42:
3236 	case DRM_FORMAT_YUV410:
3237 	case DRM_FORMAT_YVU410:
3238 	case DRM_FORMAT_YUV411:
3239 	case DRM_FORMAT_YVU411:
3240 	case DRM_FORMAT_YUV420:
3241 	case DRM_FORMAT_YVU420:
3242 	case DRM_FORMAT_YUV422:
3243 	case DRM_FORMAT_YVU422:
3244 	case DRM_FORMAT_YUV444:
3245 	case DRM_FORMAT_YVU444:
3246 		return 0;
3247 	default:
3248 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3249 			      drm_get_format_name(r->pixel_format));
3250 		return -EINVAL;
3251 	}
3252 }
3253 
3254 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3255 {
3256 	int ret, hsub, vsub, num_planes, i;
3257 
3258 	ret = format_check(r);
3259 	if (ret) {
3260 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3261 			      drm_get_format_name(r->pixel_format));
3262 		return ret;
3263 	}
3264 
3265 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3266 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3267 	num_planes = drm_format_num_planes(r->pixel_format);
3268 
3269 	if (r->width == 0 || r->width % hsub) {
3270 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3271 		return -EINVAL;
3272 	}
3273 
3274 	if (r->height == 0 || r->height % vsub) {
3275 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3276 		return -EINVAL;
3277 	}
3278 
3279 	for (i = 0; i < num_planes; i++) {
3280 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3281 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3282 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3283 
3284 		if (!r->handles[i]) {
3285 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3286 			return -EINVAL;
3287 		}
3288 
3289 		if ((uint64_t) width * cpp > UINT_MAX)
3290 			return -ERANGE;
3291 
3292 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3293 			return -ERANGE;
3294 
3295 		if (r->pitches[i] < width * cpp) {
3296 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3297 			return -EINVAL;
3298 		}
3299 
3300 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3301 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
3302 				      r->modifier[i], i);
3303 			return -EINVAL;
3304 		}
3305 
3306 		/* modifier specific checks: */
3307 		switch (r->modifier[i]) {
3308 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3309 			/* NOTE: the pitch restriction may be lifted later if it turns
3310 			 * out that no hw has this restriction:
3311 			 */
3312 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3313 					width % 128 || height % 32 ||
3314 					r->pitches[i] % 128) {
3315 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3316 				return -EINVAL;
3317 			}
3318 			break;
3319 
3320 		default:
3321 			break;
3322 		}
3323 	}
3324 
3325 	for (i = num_planes; i < 4; i++) {
3326 		if (r->modifier[i]) {
3327 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3328 			return -EINVAL;
3329 		}
3330 
3331 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3332 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3333 			continue;
3334 
3335 		if (r->handles[i]) {
3336 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3337 			return -EINVAL;
3338 		}
3339 
3340 		if (r->pitches[i]) {
3341 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3342 			return -EINVAL;
3343 		}
3344 
3345 		if (r->offsets[i]) {
3346 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3347 			return -EINVAL;
3348 		}
3349 	}
3350 
3351 	return 0;
3352 }
3353 
3354 static struct drm_framebuffer *
3355 internal_framebuffer_create(struct drm_device *dev,
3356 			    const struct drm_mode_fb_cmd2 *r,
3357 			    struct drm_file *file_priv)
3358 {
3359 	struct drm_mode_config *config = &dev->mode_config;
3360 	struct drm_framebuffer *fb;
3361 	int ret;
3362 
3363 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3364 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3365 		return ERR_PTR(-EINVAL);
3366 	}
3367 
3368 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3369 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3370 			  r->width, config->min_width, config->max_width);
3371 		return ERR_PTR(-EINVAL);
3372 	}
3373 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3374 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3375 			  r->height, config->min_height, config->max_height);
3376 		return ERR_PTR(-EINVAL);
3377 	}
3378 
3379 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3380 	    !dev->mode_config.allow_fb_modifiers) {
3381 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3382 		return ERR_PTR(-EINVAL);
3383 	}
3384 
3385 	ret = framebuffer_check(r);
3386 	if (ret)
3387 		return ERR_PTR(ret);
3388 
3389 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3390 	if (IS_ERR(fb)) {
3391 		DRM_DEBUG_KMS("could not create framebuffer\n");
3392 		return fb;
3393 	}
3394 
3395 	return fb;
3396 }
3397 
3398 /**
3399  * drm_mode_addfb2 - add an FB to the graphics configuration
3400  * @dev: drm device for the ioctl
3401  * @data: data pointer for the ioctl
3402  * @file_priv: drm file for the ioctl call
3403  *
3404  * Add a new FB to the specified CRTC, given a user request with format. This is
3405  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3406  * and uses fourcc codes as pixel format specifiers.
3407  *
3408  * Called by the user via ioctl.
3409  *
3410  * Returns:
3411  * Zero on success, negative errno on failure.
3412  */
3413 int drm_mode_addfb2(struct drm_device *dev,
3414 		    void *data, struct drm_file *file_priv)
3415 {
3416 	struct drm_mode_fb_cmd2 *r = data;
3417 	struct drm_framebuffer *fb;
3418 
3419 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3420 		return -EINVAL;
3421 
3422 	fb = internal_framebuffer_create(dev, r, file_priv);
3423 	if (IS_ERR(fb))
3424 		return PTR_ERR(fb);
3425 
3426 	/* Transfer ownership to the filp for reaping on close */
3427 
3428 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3429 	mutex_lock(&file_priv->fbs_lock);
3430 	r->fb_id = fb->base.id;
3431 	list_add(&fb->filp_head, &file_priv->fbs);
3432 	mutex_unlock(&file_priv->fbs_lock);
3433 
3434 	return 0;
3435 }
3436 
3437 /**
3438  * drm_mode_rmfb - remove an FB from the configuration
3439  * @dev: drm device for the ioctl
3440  * @data: data pointer for the ioctl
3441  * @file_priv: drm file for the ioctl call
3442  *
3443  * Remove the FB specified by the user.
3444  *
3445  * Called by the user via ioctl.
3446  *
3447  * Returns:
3448  * Zero on success, negative errno on failure.
3449  */
3450 int drm_mode_rmfb(struct drm_device *dev,
3451 		   void *data, struct drm_file *file_priv)
3452 {
3453 	struct drm_framebuffer *fb = NULL;
3454 	struct drm_framebuffer *fbl = NULL;
3455 	uint32_t *id = data;
3456 	int found = 0;
3457 
3458 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3459 		return -EINVAL;
3460 
3461 	mutex_lock(&file_priv->fbs_lock);
3462 	mutex_lock(&dev->mode_config.fb_lock);
3463 	fb = __drm_framebuffer_lookup(dev, *id);
3464 	if (!fb)
3465 		goto fail_lookup;
3466 
3467 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3468 		if (fb == fbl)
3469 			found = 1;
3470 	if (!found)
3471 		goto fail_lookup;
3472 
3473 	list_del_init(&fb->filp_head);
3474 	mutex_unlock(&dev->mode_config.fb_lock);
3475 	mutex_unlock(&file_priv->fbs_lock);
3476 
3477 	drm_framebuffer_unreference(fb);
3478 
3479 	return 0;
3480 
3481 fail_lookup:
3482 	mutex_unlock(&dev->mode_config.fb_lock);
3483 	mutex_unlock(&file_priv->fbs_lock);
3484 
3485 	return -ENOENT;
3486 }
3487 
3488 /**
3489  * drm_mode_getfb - get FB info
3490  * @dev: drm device for the ioctl
3491  * @data: data pointer for the ioctl
3492  * @file_priv: drm file for the ioctl call
3493  *
3494  * Lookup the FB given its ID and return info about it.
3495  *
3496  * Called by the user via ioctl.
3497  *
3498  * Returns:
3499  * Zero on success, negative errno on failure.
3500  */
3501 int drm_mode_getfb(struct drm_device *dev,
3502 		   void *data, struct drm_file *file_priv)
3503 {
3504 	struct drm_mode_fb_cmd *r = data;
3505 	struct drm_framebuffer *fb;
3506 	int ret;
3507 
3508 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3509 		return -EINVAL;
3510 
3511 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3512 	if (!fb)
3513 		return -ENOENT;
3514 
3515 	r->height = fb->height;
3516 	r->width = fb->width;
3517 	r->depth = fb->depth;
3518 	r->bpp = fb->bits_per_pixel;
3519 	r->pitch = fb->pitches[0];
3520 	if (fb->funcs->create_handle) {
3521 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3522 		    drm_is_control_client(file_priv)) {
3523 			ret = fb->funcs->create_handle(fb, file_priv,
3524 						       &r->handle);
3525 		} else {
3526 			/* GET_FB() is an unprivileged ioctl so we must not
3527 			 * return a buffer-handle to non-master processes! For
3528 			 * backwards-compatibility reasons, we cannot make
3529 			 * GET_FB() privileged, so just return an invalid handle
3530 			 * for non-masters. */
3531 			r->handle = 0;
3532 			ret = 0;
3533 		}
3534 	} else {
3535 		ret = -ENODEV;
3536 	}
3537 
3538 	drm_framebuffer_unreference(fb);
3539 
3540 	return ret;
3541 }
3542 
3543 /**
3544  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3545  * @dev: drm device for the ioctl
3546  * @data: data pointer for the ioctl
3547  * @file_priv: drm file for the ioctl call
3548  *
3549  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3550  * rectangle list. Generic userspace which does frontbuffer rendering must call
3551  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3552  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3553  *
3554  * Modesetting drivers which always update the frontbuffer do not need to
3555  * implement the corresponding ->dirty framebuffer callback.
3556  *
3557  * Called by the user via ioctl.
3558  *
3559  * Returns:
3560  * Zero on success, negative errno on failure.
3561  */
3562 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3563 			   void *data, struct drm_file *file_priv)
3564 {
3565 	struct drm_clip_rect __user *clips_ptr;
3566 	struct drm_clip_rect *clips = NULL;
3567 	struct drm_mode_fb_dirty_cmd *r = data;
3568 	struct drm_framebuffer *fb;
3569 	unsigned flags;
3570 	int num_clips;
3571 	int ret;
3572 
3573 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3574 		return -EINVAL;
3575 
3576 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3577 	if (!fb)
3578 		return -ENOENT;
3579 
3580 	num_clips = r->num_clips;
3581 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3582 
3583 	if (!num_clips != !clips_ptr) {
3584 		ret = -EINVAL;
3585 		goto out_err1;
3586 	}
3587 
3588 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3589 
3590 	/* If userspace annotates copy, clips must come in pairs */
3591 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3592 		ret = -EINVAL;
3593 		goto out_err1;
3594 	}
3595 
3596 	if (num_clips && clips_ptr) {
3597 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3598 			ret = -EINVAL;
3599 			goto out_err1;
3600 		}
3601 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3602 		if (!clips) {
3603 			ret = -ENOMEM;
3604 			goto out_err1;
3605 		}
3606 
3607 		ret = copy_from_user(clips, clips_ptr,
3608 				     num_clips * sizeof(*clips));
3609 		if (ret) {
3610 			ret = -EFAULT;
3611 			goto out_err2;
3612 		}
3613 	}
3614 
3615 	if (fb->funcs->dirty) {
3616 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3617 				       clips, num_clips);
3618 	} else {
3619 		ret = -ENOSYS;
3620 	}
3621 
3622 out_err2:
3623 	kfree(clips);
3624 out_err1:
3625 	drm_framebuffer_unreference(fb);
3626 
3627 	return ret;
3628 }
3629 
3630 
3631 /**
3632  * drm_fb_release - remove and free the FBs on this file
3633  * @priv: drm file for the ioctl
3634  *
3635  * Destroy all the FBs associated with @filp.
3636  *
3637  * Called by the user via ioctl.
3638  *
3639  * Returns:
3640  * Zero on success, negative errno on failure.
3641  */
3642 void drm_fb_release(struct drm_file *priv)
3643 {
3644 	struct drm_framebuffer *fb, *tfb;
3645 
3646 	/*
3647 	 * When the file gets released that means no one else can access the fb
3648 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3649 	 * avoid upsetting lockdep since the universal cursor code adds a
3650 	 * framebuffer while holding mutex locks.
3651 	 *
3652 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3653 	 * locks is impossible here since no one else but this function can get
3654 	 * at it any more.
3655 	 */
3656 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3657 		list_del_init(&fb->filp_head);
3658 
3659 		/* This drops the fpriv->fbs reference. */
3660 		drm_framebuffer_unreference(fb);
3661 	}
3662 }
3663 
3664 /**
3665  * drm_property_create - create a new property type
3666  * @dev: drm device
3667  * @flags: flags specifying the property type
3668  * @name: name of the property
3669  * @num_values: number of pre-defined values
3670  *
3671  * This creates a new generic drm property which can then be attached to a drm
3672  * object with drm_object_attach_property. The returned property object must be
3673  * freed with drm_property_destroy.
3674  *
3675  * Note that the DRM core keeps a per-device list of properties and that, if
3676  * drm_mode_config_cleanup() is called, it will destroy all properties created
3677  * by the driver.
3678  *
3679  * Returns:
3680  * A pointer to the newly created property on success, NULL on failure.
3681  */
3682 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3683 					 const char *name, int num_values)
3684 {
3685 	struct drm_property *property = NULL;
3686 	int ret;
3687 
3688 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3689 	if (!property)
3690 		return NULL;
3691 
3692 	property->dev = dev;
3693 
3694 	if (num_values) {
3695 		property->values = kcalloc(num_values, sizeof(uint64_t),
3696 					   GFP_KERNEL);
3697 		if (!property->values)
3698 			goto fail;
3699 	}
3700 
3701 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3702 	if (ret)
3703 		goto fail;
3704 
3705 	property->flags = flags;
3706 	property->num_values = num_values;
3707 	INIT_LIST_HEAD(&property->enum_list);
3708 
3709 	if (name) {
3710 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3711 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3712 	}
3713 
3714 	list_add_tail(&property->head, &dev->mode_config.property_list);
3715 
3716 	WARN_ON(!drm_property_type_valid(property));
3717 
3718 	return property;
3719 fail:
3720 	kfree(property->values);
3721 	kfree(property);
3722 	return NULL;
3723 }
3724 EXPORT_SYMBOL(drm_property_create);
3725 
3726 /**
3727  * drm_property_create_enum - create a new enumeration property type
3728  * @dev: drm device
3729  * @flags: flags specifying the property type
3730  * @name: name of the property
3731  * @props: enumeration lists with property values
3732  * @num_values: number of pre-defined values
3733  *
3734  * This creates a new generic drm property which can then be attached to a drm
3735  * object with drm_object_attach_property. The returned property object must be
3736  * freed with drm_property_destroy.
3737  *
3738  * Userspace is only allowed to set one of the predefined values for enumeration
3739  * properties.
3740  *
3741  * Returns:
3742  * A pointer to the newly created property on success, NULL on failure.
3743  */
3744 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3745 					 const char *name,
3746 					 const struct drm_prop_enum_list *props,
3747 					 int num_values)
3748 {
3749 	struct drm_property *property;
3750 	int i, ret;
3751 
3752 	flags |= DRM_MODE_PROP_ENUM;
3753 
3754 	property = drm_property_create(dev, flags, name, num_values);
3755 	if (!property)
3756 		return NULL;
3757 
3758 	for (i = 0; i < num_values; i++) {
3759 		ret = drm_property_add_enum(property, i,
3760 				      props[i].type,
3761 				      props[i].name);
3762 		if (ret) {
3763 			drm_property_destroy(dev, property);
3764 			return NULL;
3765 		}
3766 	}
3767 
3768 	return property;
3769 }
3770 EXPORT_SYMBOL(drm_property_create_enum);
3771 
3772 /**
3773  * drm_property_create_bitmask - create a new bitmask property type
3774  * @dev: drm device
3775  * @flags: flags specifying the property type
3776  * @name: name of the property
3777  * @props: enumeration lists with property bitflags
3778  * @num_props: size of the @props array
3779  * @supported_bits: bitmask of all supported enumeration values
3780  *
3781  * This creates a new bitmask drm property which can then be attached to a drm
3782  * object with drm_object_attach_property. The returned property object must be
3783  * freed with drm_property_destroy.
3784  *
3785  * Compared to plain enumeration properties userspace is allowed to set any
3786  * or'ed together combination of the predefined property bitflag values
3787  *
3788  * Returns:
3789  * A pointer to the newly created property on success, NULL on failure.
3790  */
3791 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3792 					 int flags, const char *name,
3793 					 const struct drm_prop_enum_list *props,
3794 					 int num_props,
3795 					 uint64_t supported_bits)
3796 {
3797 	struct drm_property *property;
3798 	int i, ret, index = 0;
3799 	int num_values = hweight64(supported_bits);
3800 
3801 	flags |= DRM_MODE_PROP_BITMASK;
3802 
3803 	property = drm_property_create(dev, flags, name, num_values);
3804 	if (!property)
3805 		return NULL;
3806 	for (i = 0; i < num_props; i++) {
3807 		if (!(supported_bits & (1ULL << props[i].type)))
3808 			continue;
3809 
3810 		if (WARN_ON(index >= num_values)) {
3811 			drm_property_destroy(dev, property);
3812 			return NULL;
3813 		}
3814 
3815 		ret = drm_property_add_enum(property, index++,
3816 				      props[i].type,
3817 				      props[i].name);
3818 		if (ret) {
3819 			drm_property_destroy(dev, property);
3820 			return NULL;
3821 		}
3822 	}
3823 
3824 	return property;
3825 }
3826 EXPORT_SYMBOL(drm_property_create_bitmask);
3827 
3828 static struct drm_property *property_create_range(struct drm_device *dev,
3829 					 int flags, const char *name,
3830 					 uint64_t min, uint64_t max)
3831 {
3832 	struct drm_property *property;
3833 
3834 	property = drm_property_create(dev, flags, name, 2);
3835 	if (!property)
3836 		return NULL;
3837 
3838 	property->values[0] = min;
3839 	property->values[1] = max;
3840 
3841 	return property;
3842 }
3843 
3844 /**
3845  * drm_property_create_range - create a new unsigned ranged property type
3846  * @dev: drm device
3847  * @flags: flags specifying the property type
3848  * @name: name of the property
3849  * @min: minimum value of the property
3850  * @max: maximum value of the property
3851  *
3852  * This creates a new generic drm property which can then be attached to a drm
3853  * object with drm_object_attach_property. The returned property object must be
3854  * freed with drm_property_destroy.
3855  *
3856  * Userspace is allowed to set any unsigned integer value in the (min, max)
3857  * range inclusive.
3858  *
3859  * Returns:
3860  * A pointer to the newly created property on success, NULL on failure.
3861  */
3862 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3863 					 const char *name,
3864 					 uint64_t min, uint64_t max)
3865 {
3866 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3867 			name, min, max);
3868 }
3869 EXPORT_SYMBOL(drm_property_create_range);
3870 
3871 /**
3872  * drm_property_create_signed_range - create a new signed ranged property type
3873  * @dev: drm device
3874  * @flags: flags specifying the property type
3875  * @name: name of the property
3876  * @min: minimum value of the property
3877  * @max: maximum value of the property
3878  *
3879  * This creates a new generic drm property which can then be attached to a drm
3880  * object with drm_object_attach_property. The returned property object must be
3881  * freed with drm_property_destroy.
3882  *
3883  * Userspace is allowed to set any signed integer value in the (min, max)
3884  * range inclusive.
3885  *
3886  * Returns:
3887  * A pointer to the newly created property on success, NULL on failure.
3888  */
3889 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3890 					 int flags, const char *name,
3891 					 int64_t min, int64_t max)
3892 {
3893 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3894 			name, I642U64(min), I642U64(max));
3895 }
3896 EXPORT_SYMBOL(drm_property_create_signed_range);
3897 
3898 /**
3899  * drm_property_create_object - create a new object property type
3900  * @dev: drm device
3901  * @flags: flags specifying the property type
3902  * @name: name of the property
3903  * @type: object type from DRM_MODE_OBJECT_* defines
3904  *
3905  * This creates a new generic drm property which can then be attached to a drm
3906  * object with drm_object_attach_property. The returned property object must be
3907  * freed with drm_property_destroy.
3908  *
3909  * Userspace is only allowed to set this to any property value of the given
3910  * @type. Only useful for atomic properties, which is enforced.
3911  *
3912  * Returns:
3913  * A pointer to the newly created property on success, NULL on failure.
3914  */
3915 struct drm_property *drm_property_create_object(struct drm_device *dev,
3916 					 int flags, const char *name, uint32_t type)
3917 {
3918 	struct drm_property *property;
3919 
3920 	flags |= DRM_MODE_PROP_OBJECT;
3921 
3922 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3923 		return NULL;
3924 
3925 	property = drm_property_create(dev, flags, name, 1);
3926 	if (!property)
3927 		return NULL;
3928 
3929 	property->values[0] = type;
3930 
3931 	return property;
3932 }
3933 EXPORT_SYMBOL(drm_property_create_object);
3934 
3935 /**
3936  * drm_property_create_bool - create a new boolean property type
3937  * @dev: drm device
3938  * @flags: flags specifying the property type
3939  * @name: name of the property
3940  *
3941  * This creates a new generic drm property which can then be attached to a drm
3942  * object with drm_object_attach_property. The returned property object must be
3943  * freed with drm_property_destroy.
3944  *
3945  * This is implemented as a ranged property with only {0, 1} as valid values.
3946  *
3947  * Returns:
3948  * A pointer to the newly created property on success, NULL on failure.
3949  */
3950 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3951 					 const char *name)
3952 {
3953 	return drm_property_create_range(dev, flags, name, 0, 1);
3954 }
3955 EXPORT_SYMBOL(drm_property_create_bool);
3956 
3957 /**
3958  * drm_property_add_enum - add a possible value to an enumeration property
3959  * @property: enumeration property to change
3960  * @index: index of the new enumeration
3961  * @value: value of the new enumeration
3962  * @name: symbolic name of the new enumeration
3963  *
3964  * This functions adds enumerations to a property.
3965  *
3966  * It's use is deprecated, drivers should use one of the more specific helpers
3967  * to directly create the property with all enumerations already attached.
3968  *
3969  * Returns:
3970  * Zero on success, error code on failure.
3971  */
3972 int drm_property_add_enum(struct drm_property *property, int index,
3973 			  uint64_t value, const char *name)
3974 {
3975 	struct drm_property_enum *prop_enum;
3976 
3977 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3978 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3979 		return -EINVAL;
3980 
3981 	/*
3982 	 * Bitmask enum properties have the additional constraint of values
3983 	 * from 0 to 63
3984 	 */
3985 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3986 			(value > 63))
3987 		return -EINVAL;
3988 
3989 	if (!list_empty(&property->enum_list)) {
3990 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3991 			if (prop_enum->value == value) {
3992 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3993 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3994 				return 0;
3995 			}
3996 		}
3997 	}
3998 
3999 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
4000 	if (!prop_enum)
4001 		return -ENOMEM;
4002 
4003 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
4004 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
4005 	prop_enum->value = value;
4006 
4007 	property->values[index] = value;
4008 	list_add_tail(&prop_enum->head, &property->enum_list);
4009 	return 0;
4010 }
4011 EXPORT_SYMBOL(drm_property_add_enum);
4012 
4013 /**
4014  * drm_property_destroy - destroy a drm property
4015  * @dev: drm device
4016  * @property: property to destry
4017  *
4018  * This function frees a property including any attached resources like
4019  * enumeration values.
4020  */
4021 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
4022 {
4023 	struct drm_property_enum *prop_enum, *pt;
4024 
4025 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
4026 		list_del(&prop_enum->head);
4027 		kfree(prop_enum);
4028 	}
4029 
4030 	if (property->num_values)
4031 		kfree(property->values);
4032 	drm_mode_object_put(dev, &property->base);
4033 	list_del(&property->head);
4034 	kfree(property);
4035 }
4036 EXPORT_SYMBOL(drm_property_destroy);
4037 
4038 /**
4039  * drm_object_attach_property - attach a property to a modeset object
4040  * @obj: drm modeset object
4041  * @property: property to attach
4042  * @init_val: initial value of the property
4043  *
4044  * This attaches the given property to the modeset object with the given initial
4045  * value. Currently this function cannot fail since the properties are stored in
4046  * a statically sized array.
4047  */
4048 void drm_object_attach_property(struct drm_mode_object *obj,
4049 				struct drm_property *property,
4050 				uint64_t init_val)
4051 {
4052 	int count = obj->properties->count;
4053 
4054 	if (count == DRM_OBJECT_MAX_PROPERTY) {
4055 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
4056 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
4057 			"you see this message on the same object type.\n",
4058 			obj->type);
4059 		return;
4060 	}
4061 
4062 	obj->properties->properties[count] = property;
4063 	obj->properties->values[count] = init_val;
4064 	obj->properties->count++;
4065 	if (property->flags & DRM_MODE_PROP_ATOMIC)
4066 		obj->properties->atomic_count++;
4067 }
4068 EXPORT_SYMBOL(drm_object_attach_property);
4069 
4070 /**
4071  * drm_object_property_set_value - set the value of a property
4072  * @obj: drm mode object to set property value for
4073  * @property: property to set
4074  * @val: value the property should be set to
4075  *
4076  * This functions sets a given property on a given object. This function only
4077  * changes the software state of the property, it does not call into the
4078  * driver's ->set_property callback.
4079  *
4080  * Returns:
4081  * Zero on success, error code on failure.
4082  */
4083 int drm_object_property_set_value(struct drm_mode_object *obj,
4084 				  struct drm_property *property, uint64_t val)
4085 {
4086 	int i;
4087 
4088 	for (i = 0; i < obj->properties->count; i++) {
4089 		if (obj->properties->properties[i] == property) {
4090 			obj->properties->values[i] = val;
4091 			return 0;
4092 		}
4093 	}
4094 
4095 	return -EINVAL;
4096 }
4097 EXPORT_SYMBOL(drm_object_property_set_value);
4098 
4099 /**
4100  * drm_object_property_get_value - retrieve the value of a property
4101  * @obj: drm mode object to get property value from
4102  * @property: property to retrieve
4103  * @val: storage for the property value
4104  *
4105  * This function retrieves the softare state of the given property for the given
4106  * property. Since there is no driver callback to retrieve the current property
4107  * value this might be out of sync with the hardware, depending upon the driver
4108  * and property.
4109  *
4110  * Returns:
4111  * Zero on success, error code on failure.
4112  */
4113 int drm_object_property_get_value(struct drm_mode_object *obj,
4114 				  struct drm_property *property, uint64_t *val)
4115 {
4116 	int i;
4117 
4118 	/* read-only properties bypass atomic mechanism and still store
4119 	 * their value in obj->properties->values[].. mostly to avoid
4120 	 * having to deal w/ EDID and similar props in atomic paths:
4121 	 */
4122 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4123 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4124 		return drm_atomic_get_property(obj, property, val);
4125 
4126 	for (i = 0; i < obj->properties->count; i++) {
4127 		if (obj->properties->properties[i] == property) {
4128 			*val = obj->properties->values[i];
4129 			return 0;
4130 		}
4131 	}
4132 
4133 	return -EINVAL;
4134 }
4135 EXPORT_SYMBOL(drm_object_property_get_value);
4136 
4137 /**
4138  * drm_mode_getproperty_ioctl - get the property metadata
4139  * @dev: DRM device
4140  * @data: ioctl data
4141  * @file_priv: DRM file info
4142  *
4143  * This function retrieves the metadata for a given property, like the different
4144  * possible values for an enum property or the limits for a range property.
4145  *
4146  * Blob properties are special
4147  *
4148  * Called by the user via ioctl.
4149  *
4150  * Returns:
4151  * Zero on success, negative errno on failure.
4152  */
4153 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4154 			       void *data, struct drm_file *file_priv)
4155 {
4156 	struct drm_mode_get_property *out_resp = data;
4157 	struct drm_property *property;
4158 	int enum_count = 0;
4159 	int value_count = 0;
4160 	int ret = 0, i;
4161 	int copied;
4162 	struct drm_property_enum *prop_enum;
4163 	struct drm_mode_property_enum __user *enum_ptr;
4164 	uint64_t __user *values_ptr;
4165 
4166 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4167 		return -EINVAL;
4168 
4169 	drm_modeset_lock_all(dev);
4170 	property = drm_property_find(dev, out_resp->prop_id);
4171 	if (!property) {
4172 		ret = -ENOENT;
4173 		goto done;
4174 	}
4175 
4176 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4177 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4178 		list_for_each_entry(prop_enum, &property->enum_list, head)
4179 			enum_count++;
4180 	}
4181 
4182 	value_count = property->num_values;
4183 
4184 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4185 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4186 	out_resp->flags = property->flags;
4187 
4188 	if ((out_resp->count_values >= value_count) && value_count) {
4189 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4190 		for (i = 0; i < value_count; i++) {
4191 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4192 				ret = -EFAULT;
4193 				goto done;
4194 			}
4195 		}
4196 	}
4197 	out_resp->count_values = value_count;
4198 
4199 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4200 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4201 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4202 			copied = 0;
4203 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4204 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4205 
4206 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4207 					ret = -EFAULT;
4208 					goto done;
4209 				}
4210 
4211 				if (copy_to_user(&enum_ptr[copied].name,
4212 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4213 					ret = -EFAULT;
4214 					goto done;
4215 				}
4216 				copied++;
4217 			}
4218 		}
4219 		out_resp->count_enum_blobs = enum_count;
4220 	}
4221 
4222 	/*
4223 	 * NOTE: The idea seems to have been to use this to read all the blob
4224 	 * property values. But nothing ever added them to the corresponding
4225 	 * list, userspace always used the special-purpose get_blob ioctl to
4226 	 * read the value for a blob property. It also doesn't make a lot of
4227 	 * sense to return values here when everything else is just metadata for
4228 	 * the property itself.
4229 	 */
4230 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4231 		out_resp->count_enum_blobs = 0;
4232 done:
4233 	drm_modeset_unlock_all(dev);
4234 	return ret;
4235 }
4236 
4237 /**
4238  * drm_property_create_blob - Create new blob property
4239  *
4240  * Creates a new blob property for a specified DRM device, optionally
4241  * copying data.
4242  *
4243  * @dev: DRM device to create property for
4244  * @length: Length to allocate for blob data
4245  * @data: If specified, copies data into blob
4246  *
4247  * Returns:
4248  * New blob property with a single reference on success, or an ERR_PTR
4249  * value on failure.
4250  */
4251 struct drm_property_blob *
4252 drm_property_create_blob(struct drm_device *dev, size_t length,
4253 			 const void *data)
4254 {
4255 	struct drm_property_blob *blob;
4256 	int ret;
4257 
4258 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
4259 		return ERR_PTR(-EINVAL);
4260 
4261 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4262 	if (!blob)
4263 		return ERR_PTR(-ENOMEM);
4264 
4265 	/* This must be explicitly initialised, so we can safely call list_del
4266 	 * on it in the removal handler, even if it isn't in a file list. */
4267 	INIT_LIST_HEAD(&blob->head_file);
4268 	blob->length = length;
4269 	blob->dev = dev;
4270 
4271 	if (data)
4272 		memcpy(blob->data, data, length);
4273 
4274 	mutex_lock(&dev->mode_config.blob_lock);
4275 
4276 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4277 	if (ret) {
4278 		kfree(blob);
4279 		mutex_unlock(&dev->mode_config.blob_lock);
4280 		return ERR_PTR(-EINVAL);
4281 	}
4282 
4283 	kref_init(&blob->refcount);
4284 
4285 	list_add_tail(&blob->head_global,
4286 	              &dev->mode_config.property_blob_list);
4287 
4288 	mutex_unlock(&dev->mode_config.blob_lock);
4289 
4290 	return blob;
4291 }
4292 EXPORT_SYMBOL(drm_property_create_blob);
4293 
4294 /**
4295  * drm_property_free_blob - Blob property destructor
4296  *
4297  * Internal free function for blob properties; must not be used directly.
4298  *
4299  * @kref: Reference
4300  */
4301 static void drm_property_free_blob(struct kref *kref)
4302 {
4303 	struct drm_property_blob *blob =
4304 		container_of(kref, struct drm_property_blob, refcount);
4305 
4306 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
4307 
4308 	list_del(&blob->head_global);
4309 	list_del(&blob->head_file);
4310 	drm_mode_object_put(blob->dev, &blob->base);
4311 
4312 	kfree(blob);
4313 }
4314 
4315 /**
4316  * drm_property_unreference_blob - Unreference a blob property
4317  *
4318  * Drop a reference on a blob property. May free the object.
4319  *
4320  * @blob: Pointer to blob property
4321  */
4322 void drm_property_unreference_blob(struct drm_property_blob *blob)
4323 {
4324 	struct drm_device *dev;
4325 
4326 	if (!blob)
4327 		return;
4328 
4329 	dev = blob->dev;
4330 
4331 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4332 
4333 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
4334 			   &dev->mode_config.blob_lock))
4335 		mutex_unlock(&dev->mode_config.blob_lock);
4336 	else
4337 		might_lock(&dev->mode_config.blob_lock);
4338 }
4339 EXPORT_SYMBOL(drm_property_unreference_blob);
4340 
4341 /**
4342  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
4343  *
4344  * Drop a reference on a blob property. May free the object. This must be
4345  * called with blob_lock held.
4346  *
4347  * @blob: Pointer to blob property
4348  */
4349 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
4350 {
4351 	if (!blob)
4352 		return;
4353 
4354 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4355 
4356 	kref_put(&blob->refcount, drm_property_free_blob);
4357 }
4358 
4359 /**
4360  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4361  * @dev:       DRM device
4362  * @file_priv: destroy all blobs owned by this file handle
4363  */
4364 void drm_property_destroy_user_blobs(struct drm_device *dev,
4365 				     struct drm_file *file_priv)
4366 {
4367 	struct drm_property_blob *blob, *bt;
4368 
4369 	mutex_lock(&dev->mode_config.blob_lock);
4370 
4371 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4372 		list_del_init(&blob->head_file);
4373 		drm_property_unreference_blob_locked(blob);
4374 	}
4375 
4376 	mutex_unlock(&dev->mode_config.blob_lock);
4377 }
4378 
4379 /**
4380  * drm_property_reference_blob - Take a reference on an existing property
4381  *
4382  * Take a new reference on an existing blob property.
4383  *
4384  * @blob: Pointer to blob property
4385  */
4386 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4387 {
4388 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4389 	kref_get(&blob->refcount);
4390 	return blob;
4391 }
4392 EXPORT_SYMBOL(drm_property_reference_blob);
4393 
4394 /*
4395  * Like drm_property_lookup_blob, but does not return an additional reference.
4396  * Must be called with blob_lock held.
4397  */
4398 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
4399 							    uint32_t id)
4400 {
4401 	struct drm_mode_object *obj = NULL;
4402 	struct drm_property_blob *blob;
4403 
4404 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
4405 
4406 	mutex_lock(&dev->mode_config.idr_mutex);
4407 	obj = idr_find(&dev->mode_config.crtc_idr, id);
4408 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
4409 		blob = NULL;
4410 	else
4411 		blob = obj_to_blob(obj);
4412 	mutex_unlock(&dev->mode_config.idr_mutex);
4413 
4414 	return blob;
4415 }
4416 
4417 /**
4418  * drm_property_lookup_blob - look up a blob property and take a reference
4419  * @dev: drm device
4420  * @id: id of the blob property
4421  *
4422  * If successful, this takes an additional reference to the blob property.
4423  * callers need to make sure to eventually unreference the returned property
4424  * again, using @drm_property_unreference_blob.
4425  */
4426 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4427 					           uint32_t id)
4428 {
4429 	struct drm_property_blob *blob;
4430 
4431 	mutex_lock(&dev->mode_config.blob_lock);
4432 	blob = __drm_property_lookup_blob(dev, id);
4433 	if (blob) {
4434 		if (!kref_get_unless_zero(&blob->refcount))
4435 			blob = NULL;
4436 	}
4437 	mutex_unlock(&dev->mode_config.blob_lock);
4438 
4439 	return blob;
4440 }
4441 EXPORT_SYMBOL(drm_property_lookup_blob);
4442 
4443 /**
4444  * drm_property_replace_global_blob - atomically replace existing blob property
4445  * @dev: drm device
4446  * @replace: location of blob property pointer to be replaced
4447  * @length: length of data for new blob, or 0 for no data
4448  * @data: content for new blob, or NULL for no data
4449  * @obj_holds_id: optional object for property holding blob ID
4450  * @prop_holds_id: optional property holding blob ID
4451  * @return 0 on success or error on failure
4452  *
4453  * This function will atomically replace a global property in the blob list,
4454  * optionally updating a property which holds the ID of that property. It is
4455  * guaranteed to be atomic: no caller will be allowed to see intermediate
4456  * results, and either the entire operation will succeed and clean up the
4457  * previous property, or it will fail and the state will be unchanged.
4458  *
4459  * If length is 0 or data is NULL, no new blob will be created, and the holding
4460  * property, if specified, will be set to 0.
4461  *
4462  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4463  * by holding the relevant modesetting object lock for its parent.
4464  *
4465  * For example, a drm_connector has a 'PATH' property, which contains the ID
4466  * of a blob property with the value of the MST path information. Calling this
4467  * function with replace pointing to the connector's path_blob_ptr, length and
4468  * data set for the new path information, obj_holds_id set to the connector's
4469  * base object, and prop_holds_id set to the path property name, will perform
4470  * a completely atomic update. The access to path_blob_ptr is protected by the
4471  * caller holding a lock on the connector.
4472  */
4473 static int drm_property_replace_global_blob(struct drm_device *dev,
4474                                             struct drm_property_blob **replace,
4475                                             size_t length,
4476                                             const void *data,
4477                                             struct drm_mode_object *obj_holds_id,
4478                                             struct drm_property *prop_holds_id)
4479 {
4480 	struct drm_property_blob *new_blob = NULL;
4481 	struct drm_property_blob *old_blob = NULL;
4482 	int ret;
4483 
4484 	WARN_ON(replace == NULL);
4485 
4486 	old_blob = *replace;
4487 
4488 	if (length && data) {
4489 		new_blob = drm_property_create_blob(dev, length, data);
4490 		if (IS_ERR(new_blob))
4491 			return PTR_ERR(new_blob);
4492 	}
4493 
4494 	/* This does not need to be synchronised with blob_lock, as the
4495 	 * get_properties ioctl locks all modesetting objects, and
4496 	 * obj_holds_id must be locked before calling here, so we cannot
4497 	 * have its value out of sync with the list membership modified
4498 	 * below under blob_lock. */
4499 	if (obj_holds_id) {
4500 		ret = drm_object_property_set_value(obj_holds_id,
4501 						    prop_holds_id,
4502 						    new_blob ?
4503 						        new_blob->base.id : 0);
4504 		if (ret != 0)
4505 			goto err_created;
4506 	}
4507 
4508 	drm_property_unreference_blob(old_blob);
4509 	*replace = new_blob;
4510 
4511 	return 0;
4512 
4513 err_created:
4514 	drm_property_unreference_blob(new_blob);
4515 	return ret;
4516 }
4517 
4518 /**
4519  * drm_mode_getblob_ioctl - get the contents of a blob property value
4520  * @dev: DRM device
4521  * @data: ioctl data
4522  * @file_priv: DRM file info
4523  *
4524  * This function retrieves the contents of a blob property. The value stored in
4525  * an object's blob property is just a normal modeset object id.
4526  *
4527  * Called by the user via ioctl.
4528  *
4529  * Returns:
4530  * Zero on success, negative errno on failure.
4531  */
4532 int drm_mode_getblob_ioctl(struct drm_device *dev,
4533 			   void *data, struct drm_file *file_priv)
4534 {
4535 	struct drm_mode_get_blob *out_resp = data;
4536 	struct drm_property_blob *blob;
4537 	int ret = 0;
4538 	void __user *blob_ptr;
4539 
4540 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4541 		return -EINVAL;
4542 
4543 	drm_modeset_lock_all(dev);
4544 	mutex_lock(&dev->mode_config.blob_lock);
4545 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4546 	if (!blob) {
4547 		ret = -ENOENT;
4548 		goto done;
4549 	}
4550 
4551 	if (out_resp->length == blob->length) {
4552 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4553 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4554 			ret = -EFAULT;
4555 			goto done;
4556 		}
4557 	}
4558 	out_resp->length = blob->length;
4559 
4560 done:
4561 	mutex_unlock(&dev->mode_config.blob_lock);
4562 	drm_modeset_unlock_all(dev);
4563 	return ret;
4564 }
4565 
4566 /**
4567  * drm_mode_createblob_ioctl - create a new blob property
4568  * @dev: DRM device
4569  * @data: ioctl data
4570  * @file_priv: DRM file info
4571  *
4572  * This function creates a new blob property with user-defined values. In order
4573  * to give us sensible validation and checking when creating, rather than at
4574  * every potential use, we also require a type to be provided upfront.
4575  *
4576  * Called by the user via ioctl.
4577  *
4578  * Returns:
4579  * Zero on success, negative errno on failure.
4580  */
4581 int drm_mode_createblob_ioctl(struct drm_device *dev,
4582 			      void *data, struct drm_file *file_priv)
4583 {
4584 	struct drm_mode_create_blob *out_resp = data;
4585 	struct drm_property_blob *blob;
4586 	void __user *blob_ptr;
4587 	int ret = 0;
4588 
4589 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4590 		return -EINVAL;
4591 
4592 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4593 	if (IS_ERR(blob))
4594 		return PTR_ERR(blob);
4595 
4596 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4597 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4598 		ret = -EFAULT;
4599 		goto out_blob;
4600 	}
4601 
4602 	/* Dropping the lock between create_blob and our access here is safe
4603 	 * as only the same file_priv can remove the blob; at this point, it is
4604 	 * not associated with any file_priv. */
4605 	mutex_lock(&dev->mode_config.blob_lock);
4606 	out_resp->blob_id = blob->base.id;
4607 	list_add_tail(&blob->head_file, &file_priv->blobs);
4608 	mutex_unlock(&dev->mode_config.blob_lock);
4609 
4610 	return 0;
4611 
4612 out_blob:
4613 	drm_property_unreference_blob(blob);
4614 	return ret;
4615 }
4616 
4617 /**
4618  * drm_mode_destroyblob_ioctl - destroy a user blob property
4619  * @dev: DRM device
4620  * @data: ioctl data
4621  * @file_priv: DRM file info
4622  *
4623  * Destroy an existing user-defined blob property.
4624  *
4625  * Called by the user via ioctl.
4626  *
4627  * Returns:
4628  * Zero on success, negative errno on failure.
4629  */
4630 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4631 			       void *data, struct drm_file *file_priv)
4632 {
4633 	struct drm_mode_destroy_blob *out_resp = data;
4634 	struct drm_property_blob *blob = NULL, *bt;
4635 	bool found = false;
4636 	int ret = 0;
4637 
4638 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4639 		return -EINVAL;
4640 
4641 	mutex_lock(&dev->mode_config.blob_lock);
4642 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4643 	if (!blob) {
4644 		ret = -ENOENT;
4645 		goto err;
4646 	}
4647 
4648 	/* Ensure the property was actually created by this user. */
4649 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4650 		if (bt == blob) {
4651 			found = true;
4652 			break;
4653 		}
4654 	}
4655 
4656 	if (!found) {
4657 		ret = -EPERM;
4658 		goto err;
4659 	}
4660 
4661 	/* We must drop head_file here, because we may not be the last
4662 	 * reference on the blob. */
4663 	list_del_init(&blob->head_file);
4664 	drm_property_unreference_blob_locked(blob);
4665 	mutex_unlock(&dev->mode_config.blob_lock);
4666 
4667 	return 0;
4668 
4669 err:
4670 	mutex_unlock(&dev->mode_config.blob_lock);
4671 	return ret;
4672 }
4673 
4674 /**
4675  * drm_mode_connector_set_path_property - set tile property on connector
4676  * @connector: connector to set property on.
4677  * @path: path to use for property; must not be NULL.
4678  *
4679  * This creates a property to expose to userspace to specify a
4680  * connector path. This is mainly used for DisplayPort MST where
4681  * connectors have a topology and we want to allow userspace to give
4682  * them more meaningful names.
4683  *
4684  * Returns:
4685  * Zero on success, negative errno on failure.
4686  */
4687 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4688 					 const char *path)
4689 {
4690 	struct drm_device *dev = connector->dev;
4691 	int ret;
4692 
4693 	ret = drm_property_replace_global_blob(dev,
4694 	                                       &connector->path_blob_ptr,
4695 	                                       strlen(path) + 1,
4696 	                                       path,
4697 	                                       &connector->base,
4698 	                                       dev->mode_config.path_property);
4699 	return ret;
4700 }
4701 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4702 
4703 /**
4704  * drm_mode_connector_set_tile_property - set tile property on connector
4705  * @connector: connector to set property on.
4706  *
4707  * This looks up the tile information for a connector, and creates a
4708  * property for userspace to parse if it exists. The property is of
4709  * the form of 8 integers using ':' as a separator.
4710  *
4711  * Returns:
4712  * Zero on success, errno on failure.
4713  */
4714 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4715 {
4716 	struct drm_device *dev = connector->dev;
4717 	char tile[256];
4718 	int ret;
4719 
4720 	if (!connector->has_tile) {
4721 		ret  = drm_property_replace_global_blob(dev,
4722 		                                        &connector->tile_blob_ptr,
4723 		                                        0,
4724 		                                        NULL,
4725 		                                        &connector->base,
4726 		                                        dev->mode_config.tile_property);
4727 		return ret;
4728 	}
4729 
4730 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4731 		 connector->tile_group->id, connector->tile_is_single_monitor,
4732 		 connector->num_h_tile, connector->num_v_tile,
4733 		 connector->tile_h_loc, connector->tile_v_loc,
4734 		 connector->tile_h_size, connector->tile_v_size);
4735 
4736 	ret = drm_property_replace_global_blob(dev,
4737 	                                       &connector->tile_blob_ptr,
4738 	                                       strlen(tile) + 1,
4739 	                                       tile,
4740 	                                       &connector->base,
4741 	                                       dev->mode_config.tile_property);
4742 	return ret;
4743 }
4744 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4745 
4746 /**
4747  * drm_mode_connector_update_edid_property - update the edid property of a connector
4748  * @connector: drm connector
4749  * @edid: new value of the edid property
4750  *
4751  * This function creates a new blob modeset object and assigns its id to the
4752  * connector's edid property.
4753  *
4754  * Returns:
4755  * Zero on success, negative errno on failure.
4756  */
4757 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4758 					    const struct edid *edid)
4759 {
4760 	struct drm_device *dev = connector->dev;
4761 	size_t size = 0;
4762 	int ret;
4763 
4764 	/* ignore requests to set edid when overridden */
4765 	if (connector->override_edid)
4766 		return 0;
4767 
4768 	if (edid)
4769 		size = EDID_LENGTH * (1 + edid->extensions);
4770 
4771 	ret = drm_property_replace_global_blob(dev,
4772 					       &connector->edid_blob_ptr,
4773 	                                       size,
4774 	                                       edid,
4775 	                                       &connector->base,
4776 	                                       dev->mode_config.edid_property);
4777 	return ret;
4778 }
4779 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4780 
4781 /* Some properties could refer to dynamic refcnt'd objects, or things that
4782  * need special locking to handle lifetime issues (ie. to ensure the prop
4783  * value doesn't become invalid part way through the property update due to
4784  * race).  The value returned by reference via 'obj' should be passed back
4785  * to drm_property_change_valid_put() after the property is set (and the
4786  * object to which the property is attached has a chance to take it's own
4787  * reference).
4788  */
4789 bool drm_property_change_valid_get(struct drm_property *property,
4790 					 uint64_t value, struct drm_mode_object **ref)
4791 {
4792 	int i;
4793 
4794 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4795 		return false;
4796 
4797 	*ref = NULL;
4798 
4799 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4800 		if (value < property->values[0] || value > property->values[1])
4801 			return false;
4802 		return true;
4803 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4804 		int64_t svalue = U642I64(value);
4805 
4806 		if (svalue < U642I64(property->values[0]) ||
4807 				svalue > U642I64(property->values[1]))
4808 			return false;
4809 		return true;
4810 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4811 		uint64_t valid_mask = 0;
4812 
4813 		for (i = 0; i < property->num_values; i++)
4814 			valid_mask |= (1ULL << property->values[i]);
4815 		return !(value & ~valid_mask);
4816 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4817 		struct drm_property_blob *blob;
4818 
4819 		if (value == 0)
4820 			return true;
4821 
4822 		blob = drm_property_lookup_blob(property->dev, value);
4823 		if (blob) {
4824 			*ref = &blob->base;
4825 			return true;
4826 		} else {
4827 			return false;
4828 		}
4829 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4830 		/* a zero value for an object property translates to null: */
4831 		if (value == 0)
4832 			return true;
4833 
4834 		/* handle refcnt'd objects specially: */
4835 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4836 			struct drm_framebuffer *fb;
4837 			fb = drm_framebuffer_lookup(property->dev, value);
4838 			if (fb) {
4839 				*ref = &fb->base;
4840 				return true;
4841 			} else {
4842 				return false;
4843 			}
4844 		} else {
4845 			return _object_find(property->dev, value, property->values[0]) != NULL;
4846 		}
4847 	}
4848 
4849 	for (i = 0; i < property->num_values; i++)
4850 		if (property->values[i] == value)
4851 			return true;
4852 	return false;
4853 }
4854 
4855 void drm_property_change_valid_put(struct drm_property *property,
4856 		struct drm_mode_object *ref)
4857 {
4858 	if (!ref)
4859 		return;
4860 
4861 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4862 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4863 			drm_framebuffer_unreference(obj_to_fb(ref));
4864 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4865 		drm_property_unreference_blob(obj_to_blob(ref));
4866 }
4867 
4868 /**
4869  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4870  * @dev: DRM device
4871  * @data: ioctl data
4872  * @file_priv: DRM file info
4873  *
4874  * This function sets the current value for a connectors's property. It also
4875  * calls into a driver's ->set_property callback to update the hardware state
4876  *
4877  * Called by the user via ioctl.
4878  *
4879  * Returns:
4880  * Zero on success, negative errno on failure.
4881  */
4882 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4883 				       void *data, struct drm_file *file_priv)
4884 {
4885 	struct drm_mode_connector_set_property *conn_set_prop = data;
4886 	struct drm_mode_obj_set_property obj_set_prop = {
4887 		.value = conn_set_prop->value,
4888 		.prop_id = conn_set_prop->prop_id,
4889 		.obj_id = conn_set_prop->connector_id,
4890 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4891 	};
4892 
4893 	/* It does all the locking and checking we need */
4894 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4895 }
4896 
4897 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4898 					   struct drm_property *property,
4899 					   uint64_t value)
4900 {
4901 	int ret = -EINVAL;
4902 	struct drm_connector *connector = obj_to_connector(obj);
4903 
4904 	/* Do DPMS ourselves */
4905 	if (property == connector->dev->mode_config.dpms_property) {
4906 		ret = (*connector->funcs->dpms)(connector, (int)value);
4907 	} else if (connector->funcs->set_property)
4908 		ret = connector->funcs->set_property(connector, property, value);
4909 
4910 	/* store the property value if successful */
4911 	if (!ret)
4912 		drm_object_property_set_value(&connector->base, property, value);
4913 	return ret;
4914 }
4915 
4916 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4917 				      struct drm_property *property,
4918 				      uint64_t value)
4919 {
4920 	int ret = -EINVAL;
4921 	struct drm_crtc *crtc = obj_to_crtc(obj);
4922 
4923 	if (crtc->funcs->set_property)
4924 		ret = crtc->funcs->set_property(crtc, property, value);
4925 	if (!ret)
4926 		drm_object_property_set_value(obj, property, value);
4927 
4928 	return ret;
4929 }
4930 
4931 /**
4932  * drm_mode_plane_set_obj_prop - set the value of a property
4933  * @plane: drm plane object to set property value for
4934  * @property: property to set
4935  * @value: value the property should be set to
4936  *
4937  * This functions sets a given property on a given plane object. This function
4938  * calls the driver's ->set_property callback and changes the software state of
4939  * the property if the callback succeeds.
4940  *
4941  * Returns:
4942  * Zero on success, error code on failure.
4943  */
4944 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4945 				struct drm_property *property,
4946 				uint64_t value)
4947 {
4948 	int ret = -EINVAL;
4949 	struct drm_mode_object *obj = &plane->base;
4950 
4951 	if (plane->funcs->set_property)
4952 		ret = plane->funcs->set_property(plane, property, value);
4953 	if (!ret)
4954 		drm_object_property_set_value(obj, property, value);
4955 
4956 	return ret;
4957 }
4958 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4959 
4960 /**
4961  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4962  * @dev: DRM device
4963  * @data: ioctl data
4964  * @file_priv: DRM file info
4965  *
4966  * This function retrieves the current value for an object's property. Compared
4967  * to the connector specific ioctl this one is extended to also work on crtc and
4968  * plane objects.
4969  *
4970  * Called by the user via ioctl.
4971  *
4972  * Returns:
4973  * Zero on success, negative errno on failure.
4974  */
4975 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4976 				      struct drm_file *file_priv)
4977 {
4978 	struct drm_mode_obj_get_properties *arg = data;
4979 	struct drm_mode_object *obj;
4980 	int ret = 0;
4981 
4982 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4983 		return -EINVAL;
4984 
4985 	drm_modeset_lock_all(dev);
4986 
4987 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4988 	if (!obj) {
4989 		ret = -ENOENT;
4990 		goto out;
4991 	}
4992 	if (!obj->properties) {
4993 		ret = -EINVAL;
4994 		goto out;
4995 	}
4996 
4997 	ret = get_properties(obj, file_priv->atomic,
4998 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4999 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
5000 			&arg->count_props);
5001 
5002 out:
5003 	drm_modeset_unlock_all(dev);
5004 	return ret;
5005 }
5006 
5007 /**
5008  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
5009  * @dev: DRM device
5010  * @data: ioctl data
5011  * @file_priv: DRM file info
5012  *
5013  * This function sets the current value for an object's property. It also calls
5014  * into a driver's ->set_property callback to update the hardware state.
5015  * Compared to the connector specific ioctl this one is extended to also work on
5016  * crtc and plane objects.
5017  *
5018  * Called by the user via ioctl.
5019  *
5020  * Returns:
5021  * Zero on success, negative errno on failure.
5022  */
5023 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
5024 				    struct drm_file *file_priv)
5025 {
5026 	struct drm_mode_obj_set_property *arg = data;
5027 	struct drm_mode_object *arg_obj;
5028 	struct drm_mode_object *prop_obj;
5029 	struct drm_property *property;
5030 	int i, ret = -EINVAL;
5031 	struct drm_mode_object *ref;
5032 
5033 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5034 		return -EINVAL;
5035 
5036 	drm_modeset_lock_all(dev);
5037 
5038 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
5039 	if (!arg_obj) {
5040 		ret = -ENOENT;
5041 		goto out;
5042 	}
5043 	if (!arg_obj->properties)
5044 		goto out;
5045 
5046 	for (i = 0; i < arg_obj->properties->count; i++)
5047 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
5048 			break;
5049 
5050 	if (i == arg_obj->properties->count)
5051 		goto out;
5052 
5053 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
5054 					DRM_MODE_OBJECT_PROPERTY);
5055 	if (!prop_obj) {
5056 		ret = -ENOENT;
5057 		goto out;
5058 	}
5059 	property = obj_to_property(prop_obj);
5060 
5061 	if (!drm_property_change_valid_get(property, arg->value, &ref))
5062 		goto out;
5063 
5064 	switch (arg_obj->type) {
5065 	case DRM_MODE_OBJECT_CONNECTOR:
5066 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
5067 						      arg->value);
5068 		break;
5069 	case DRM_MODE_OBJECT_CRTC:
5070 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
5071 		break;
5072 	case DRM_MODE_OBJECT_PLANE:
5073 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
5074 						  property, arg->value);
5075 		break;
5076 	}
5077 
5078 	drm_property_change_valid_put(property, ref);
5079 
5080 out:
5081 	drm_modeset_unlock_all(dev);
5082 	return ret;
5083 }
5084 
5085 /**
5086  * drm_mode_connector_attach_encoder - attach a connector to an encoder
5087  * @connector: connector to attach
5088  * @encoder: encoder to attach @connector to
5089  *
5090  * This function links up a connector to an encoder. Note that the routing
5091  * restrictions between encoders and crtcs are exposed to userspace through the
5092  * possible_clones and possible_crtcs bitmasks.
5093  *
5094  * Returns:
5095  * Zero on success, negative errno on failure.
5096  */
5097 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
5098 				      struct drm_encoder *encoder)
5099 {
5100 	int i;
5101 
5102 	/*
5103 	 * In the past, drivers have attempted to model the static association
5104 	 * of connector to encoder in simple connector/encoder devices using a
5105 	 * direct assignment of connector->encoder = encoder. This connection
5106 	 * is a logical one and the responsibility of the core, so drivers are
5107 	 * expected not to mess with this.
5108 	 *
5109 	 * Note that the error return should've been enough here, but a large
5110 	 * majority of drivers ignores the return value, so add in a big WARN
5111 	 * to get people's attention.
5112 	 */
5113 	if (WARN_ON(connector->encoder))
5114 		return -EINVAL;
5115 
5116 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
5117 		if (connector->encoder_ids[i] == 0) {
5118 			connector->encoder_ids[i] = encoder->base.id;
5119 			return 0;
5120 		}
5121 	}
5122 	return -ENOMEM;
5123 }
5124 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
5125 
5126 /**
5127  * drm_mode_crtc_set_gamma_size - set the gamma table size
5128  * @crtc: CRTC to set the gamma table size for
5129  * @gamma_size: size of the gamma table
5130  *
5131  * Drivers which support gamma tables should set this to the supported gamma
5132  * table size when initializing the CRTC. Currently the drm core only supports a
5133  * fixed gamma table size.
5134  *
5135  * Returns:
5136  * Zero on success, negative errno on failure.
5137  */
5138 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
5139 				 int gamma_size)
5140 {
5141 	crtc->gamma_size = gamma_size;
5142 
5143 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
5144 				    GFP_KERNEL);
5145 	if (!crtc->gamma_store) {
5146 		crtc->gamma_size = 0;
5147 		return -ENOMEM;
5148 	}
5149 
5150 	return 0;
5151 }
5152 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
5153 
5154 /**
5155  * drm_mode_gamma_set_ioctl - set the gamma table
5156  * @dev: DRM device
5157  * @data: ioctl data
5158  * @file_priv: DRM file info
5159  *
5160  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
5161  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5162  *
5163  * Called by the user via ioctl.
5164  *
5165  * Returns:
5166  * Zero on success, negative errno on failure.
5167  */
5168 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5169 			     void *data, struct drm_file *file_priv)
5170 {
5171 	struct drm_mode_crtc_lut *crtc_lut = data;
5172 	struct drm_crtc *crtc;
5173 	void *r_base, *g_base, *b_base;
5174 	int size;
5175 	int ret = 0;
5176 
5177 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5178 		return -EINVAL;
5179 
5180 	drm_modeset_lock_all(dev);
5181 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5182 	if (!crtc) {
5183 		ret = -ENOENT;
5184 		goto out;
5185 	}
5186 
5187 	if (crtc->funcs->gamma_set == NULL) {
5188 		ret = -ENOSYS;
5189 		goto out;
5190 	}
5191 
5192 	/* memcpy into gamma store */
5193 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5194 		ret = -EINVAL;
5195 		goto out;
5196 	}
5197 
5198 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5199 	r_base = crtc->gamma_store;
5200 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5201 		ret = -EFAULT;
5202 		goto out;
5203 	}
5204 
5205 	g_base = r_base + size;
5206 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5207 		ret = -EFAULT;
5208 		goto out;
5209 	}
5210 
5211 	b_base = g_base + size;
5212 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5213 		ret = -EFAULT;
5214 		goto out;
5215 	}
5216 
5217 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
5218 
5219 out:
5220 	drm_modeset_unlock_all(dev);
5221 	return ret;
5222 
5223 }
5224 
5225 /**
5226  * drm_mode_gamma_get_ioctl - get the gamma table
5227  * @dev: DRM device
5228  * @data: ioctl data
5229  * @file_priv: DRM file info
5230  *
5231  * Copy the current gamma table into the storage provided. This also provides
5232  * the gamma table size the driver expects, which can be used to size the
5233  * allocated storage.
5234  *
5235  * Called by the user via ioctl.
5236  *
5237  * Returns:
5238  * Zero on success, negative errno on failure.
5239  */
5240 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5241 			     void *data, struct drm_file *file_priv)
5242 {
5243 	struct drm_mode_crtc_lut *crtc_lut = data;
5244 	struct drm_crtc *crtc;
5245 	void *r_base, *g_base, *b_base;
5246 	int size;
5247 	int ret = 0;
5248 
5249 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5250 		return -EINVAL;
5251 
5252 	drm_modeset_lock_all(dev);
5253 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5254 	if (!crtc) {
5255 		ret = -ENOENT;
5256 		goto out;
5257 	}
5258 
5259 	/* memcpy into gamma store */
5260 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5261 		ret = -EINVAL;
5262 		goto out;
5263 	}
5264 
5265 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5266 	r_base = crtc->gamma_store;
5267 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5268 		ret = -EFAULT;
5269 		goto out;
5270 	}
5271 
5272 	g_base = r_base + size;
5273 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5274 		ret = -EFAULT;
5275 		goto out;
5276 	}
5277 
5278 	b_base = g_base + size;
5279 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5280 		ret = -EFAULT;
5281 		goto out;
5282 	}
5283 out:
5284 	drm_modeset_unlock_all(dev);
5285 	return ret;
5286 }
5287 
5288 /**
5289  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5290  * @dev: DRM device
5291  * @data: ioctl data
5292  * @file_priv: DRM file info
5293  *
5294  * This schedules an asynchronous update on a given CRTC, called page flip.
5295  * Optionally a drm event is generated to signal the completion of the event.
5296  * Generic drivers cannot assume that a pageflip with changed framebuffer
5297  * properties (including driver specific metadata like tiling layout) will work,
5298  * but some drivers support e.g. pixel format changes through the pageflip
5299  * ioctl.
5300  *
5301  * Called by the user via ioctl.
5302  *
5303  * Returns:
5304  * Zero on success, negative errno on failure.
5305  */
5306 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5307 			     void *data, struct drm_file *file_priv)
5308 {
5309 	struct drm_mode_crtc_page_flip *page_flip = data;
5310 	struct drm_crtc *crtc;
5311 	struct drm_framebuffer *fb = NULL;
5312 	struct drm_pending_vblank_event *e = NULL;
5313 	int ret = -EINVAL;
5314 
5315 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5316 	    page_flip->reserved != 0)
5317 		return -EINVAL;
5318 
5319 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5320 		return -EINVAL;
5321 
5322 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5323 	if (!crtc)
5324 		return -ENOENT;
5325 
5326 	drm_modeset_lock_crtc(crtc, crtc->primary);
5327 	if (crtc->primary->fb == NULL) {
5328 		/* The framebuffer is currently unbound, presumably
5329 		 * due to a hotplug event, that userspace has not
5330 		 * yet discovered.
5331 		 */
5332 		ret = -EBUSY;
5333 		goto out;
5334 	}
5335 
5336 	if (crtc->funcs->page_flip == NULL)
5337 		goto out;
5338 
5339 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5340 	if (!fb) {
5341 		ret = -ENOENT;
5342 		goto out;
5343 	}
5344 
5345 	if (crtc->state) {
5346 		const struct drm_plane_state *state = crtc->primary->state;
5347 
5348 		ret = check_src_coords(state->src_x, state->src_y,
5349 				       state->src_w, state->src_h, fb);
5350 	} else {
5351 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5352 	}
5353 	if (ret)
5354 		goto out;
5355 
5356 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5357 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5358 		ret = -EINVAL;
5359 		goto out;
5360 	}
5361 
5362 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5363 		e = kzalloc(sizeof *e, GFP_KERNEL);
5364 		if (!e) {
5365 			ret = -ENOMEM;
5366 			goto out;
5367 		}
5368 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5369 		e->event.base.length = sizeof(e->event);
5370 		e->event.user_data = page_flip->user_data;
5371 		ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
5372 		if (ret) {
5373 			kfree(e);
5374 			goto out;
5375 		}
5376 	}
5377 
5378 	crtc->primary->old_fb = crtc->primary->fb;
5379 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5380 	if (ret) {
5381 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
5382 			drm_event_cancel_free(dev, &e->base);
5383 		/* Keep the old fb, don't unref it. */
5384 		crtc->primary->old_fb = NULL;
5385 	} else {
5386 		crtc->primary->fb = fb;
5387 		/* Unref only the old framebuffer. */
5388 		fb = NULL;
5389 	}
5390 
5391 out:
5392 	if (fb)
5393 		drm_framebuffer_unreference(fb);
5394 	if (crtc->primary->old_fb)
5395 		drm_framebuffer_unreference(crtc->primary->old_fb);
5396 	crtc->primary->old_fb = NULL;
5397 	drm_modeset_unlock_crtc(crtc);
5398 
5399 	return ret;
5400 }
5401 
5402 /**
5403  * drm_mode_config_reset - call ->reset callbacks
5404  * @dev: drm device
5405  *
5406  * This functions calls all the crtc's, encoder's and connector's ->reset
5407  * callback. Drivers can use this in e.g. their driver load or resume code to
5408  * reset hardware and software state.
5409  */
5410 void drm_mode_config_reset(struct drm_device *dev)
5411 {
5412 	struct drm_crtc *crtc;
5413 	struct drm_plane *plane;
5414 	struct drm_encoder *encoder;
5415 	struct drm_connector *connector;
5416 
5417 	drm_for_each_plane(plane, dev)
5418 		if (plane->funcs->reset)
5419 			plane->funcs->reset(plane);
5420 
5421 	drm_for_each_crtc(crtc, dev)
5422 		if (crtc->funcs->reset)
5423 			crtc->funcs->reset(crtc);
5424 
5425 	drm_for_each_encoder(encoder, dev)
5426 		if (encoder->funcs->reset)
5427 			encoder->funcs->reset(encoder);
5428 
5429 	mutex_lock(&dev->mode_config.mutex);
5430 	drm_for_each_connector(connector, dev)
5431 		if (connector->funcs->reset)
5432 			connector->funcs->reset(connector);
5433 	mutex_unlock(&dev->mode_config.mutex);
5434 }
5435 EXPORT_SYMBOL(drm_mode_config_reset);
5436 
5437 /**
5438  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5439  * @dev: DRM device
5440  * @data: ioctl data
5441  * @file_priv: DRM file info
5442  *
5443  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5444  * TTM or something else entirely) and returns the resulting buffer handle. This
5445  * handle can then be wrapped up into a framebuffer modeset object.
5446  *
5447  * Note that userspace is not allowed to use such objects for render
5448  * acceleration - drivers must create their own private ioctls for such a use
5449  * case.
5450  *
5451  * Called by the user via ioctl.
5452  *
5453  * Returns:
5454  * Zero on success, negative errno on failure.
5455  */
5456 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5457 			       void *data, struct drm_file *file_priv)
5458 {
5459 	struct drm_mode_create_dumb *args = data;
5460 	u32 cpp, stride, size;
5461 
5462 	if (!dev->driver->dumb_create)
5463 		return -ENOSYS;
5464 	if (!args->width || !args->height || !args->bpp)
5465 		return -EINVAL;
5466 
5467 	/* overflow checks for 32bit size calculations */
5468 	/* NOTE: DIV_ROUND_UP() can overflow */
5469 	cpp = DIV_ROUND_UP(args->bpp, 8);
5470 	if (!cpp || cpp > 0xffffffffU / args->width)
5471 		return -EINVAL;
5472 	stride = cpp * args->width;
5473 	if (args->height > 0xffffffffU / stride)
5474 		return -EINVAL;
5475 
5476 	/* test for wrap-around */
5477 	size = args->height * stride;
5478 	if (PAGE_ALIGN(size) == 0)
5479 		return -EINVAL;
5480 
5481 	/*
5482 	 * handle, pitch and size are output parameters. Zero them out to
5483 	 * prevent drivers from accidentally using uninitialized data. Since
5484 	 * not all existing userspace is clearing these fields properly we
5485 	 * cannot reject IOCTL with garbage in them.
5486 	 */
5487 	args->handle = 0;
5488 	args->pitch = 0;
5489 	args->size = 0;
5490 
5491 	return dev->driver->dumb_create(file_priv, dev, args);
5492 }
5493 
5494 /**
5495  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5496  * @dev: DRM device
5497  * @data: ioctl data
5498  * @file_priv: DRM file info
5499  *
5500  * Allocate an offset in the drm device node's address space to be able to
5501  * memory map a dumb buffer.
5502  *
5503  * Called by the user via ioctl.
5504  *
5505  * Returns:
5506  * Zero on success, negative errno on failure.
5507  */
5508 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5509 			     void *data, struct drm_file *file_priv)
5510 {
5511 	struct drm_mode_map_dumb *args = data;
5512 
5513 	/* call driver ioctl to get mmap offset */
5514 	if (!dev->driver->dumb_map_offset)
5515 		return -ENOSYS;
5516 
5517 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5518 }
5519 
5520 /**
5521  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5522  * @dev: DRM device
5523  * @data: ioctl data
5524  * @file_priv: DRM file info
5525  *
5526  * This destroys the userspace handle for the given dumb backing storage buffer.
5527  * Since buffer objects must be reference counted in the kernel a buffer object
5528  * won't be immediately freed if a framebuffer modeset object still uses it.
5529  *
5530  * Called by the user via ioctl.
5531  *
5532  * Returns:
5533  * Zero on success, negative errno on failure.
5534  */
5535 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5536 				void *data, struct drm_file *file_priv)
5537 {
5538 	struct drm_mode_destroy_dumb *args = data;
5539 
5540 	if (!dev->driver->dumb_destroy)
5541 		return -ENOSYS;
5542 
5543 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5544 }
5545 
5546 /**
5547  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5548  * @format: pixel format (DRM_FORMAT_*)
5549  * @depth: storage for the depth value
5550  * @bpp: storage for the bpp value
5551  *
5552  * This only supports RGB formats here for compat with code that doesn't use
5553  * pixel formats directly yet.
5554  */
5555 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5556 			  int *bpp)
5557 {
5558 	switch (format) {
5559 	case DRM_FORMAT_C8:
5560 	case DRM_FORMAT_RGB332:
5561 	case DRM_FORMAT_BGR233:
5562 		*depth = 8;
5563 		*bpp = 8;
5564 		break;
5565 	case DRM_FORMAT_XRGB1555:
5566 	case DRM_FORMAT_XBGR1555:
5567 	case DRM_FORMAT_RGBX5551:
5568 	case DRM_FORMAT_BGRX5551:
5569 	case DRM_FORMAT_ARGB1555:
5570 	case DRM_FORMAT_ABGR1555:
5571 	case DRM_FORMAT_RGBA5551:
5572 	case DRM_FORMAT_BGRA5551:
5573 		*depth = 15;
5574 		*bpp = 16;
5575 		break;
5576 	case DRM_FORMAT_RGB565:
5577 	case DRM_FORMAT_BGR565:
5578 		*depth = 16;
5579 		*bpp = 16;
5580 		break;
5581 	case DRM_FORMAT_RGB888:
5582 	case DRM_FORMAT_BGR888:
5583 		*depth = 24;
5584 		*bpp = 24;
5585 		break;
5586 	case DRM_FORMAT_XRGB8888:
5587 	case DRM_FORMAT_XBGR8888:
5588 	case DRM_FORMAT_RGBX8888:
5589 	case DRM_FORMAT_BGRX8888:
5590 		*depth = 24;
5591 		*bpp = 32;
5592 		break;
5593 	case DRM_FORMAT_XRGB2101010:
5594 	case DRM_FORMAT_XBGR2101010:
5595 	case DRM_FORMAT_RGBX1010102:
5596 	case DRM_FORMAT_BGRX1010102:
5597 	case DRM_FORMAT_ARGB2101010:
5598 	case DRM_FORMAT_ABGR2101010:
5599 	case DRM_FORMAT_RGBA1010102:
5600 	case DRM_FORMAT_BGRA1010102:
5601 		*depth = 30;
5602 		*bpp = 32;
5603 		break;
5604 	case DRM_FORMAT_ARGB8888:
5605 	case DRM_FORMAT_ABGR8888:
5606 	case DRM_FORMAT_RGBA8888:
5607 	case DRM_FORMAT_BGRA8888:
5608 		*depth = 32;
5609 		*bpp = 32;
5610 		break;
5611 	default:
5612 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5613 			      drm_get_format_name(format));
5614 		*depth = 0;
5615 		*bpp = 0;
5616 		break;
5617 	}
5618 }
5619 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5620 
5621 /**
5622  * drm_format_num_planes - get the number of planes for format
5623  * @format: pixel format (DRM_FORMAT_*)
5624  *
5625  * Returns:
5626  * The number of planes used by the specified pixel format.
5627  */
5628 int drm_format_num_planes(uint32_t format)
5629 {
5630 	switch (format) {
5631 	case DRM_FORMAT_YUV410:
5632 	case DRM_FORMAT_YVU410:
5633 	case DRM_FORMAT_YUV411:
5634 	case DRM_FORMAT_YVU411:
5635 	case DRM_FORMAT_YUV420:
5636 	case DRM_FORMAT_YVU420:
5637 	case DRM_FORMAT_YUV422:
5638 	case DRM_FORMAT_YVU422:
5639 	case DRM_FORMAT_YUV444:
5640 	case DRM_FORMAT_YVU444:
5641 		return 3;
5642 	case DRM_FORMAT_NV12:
5643 	case DRM_FORMAT_NV21:
5644 	case DRM_FORMAT_NV16:
5645 	case DRM_FORMAT_NV61:
5646 	case DRM_FORMAT_NV24:
5647 	case DRM_FORMAT_NV42:
5648 		return 2;
5649 	default:
5650 		return 1;
5651 	}
5652 }
5653 EXPORT_SYMBOL(drm_format_num_planes);
5654 
5655 /**
5656  * drm_format_plane_cpp - determine the bytes per pixel value
5657  * @format: pixel format (DRM_FORMAT_*)
5658  * @plane: plane index
5659  *
5660  * Returns:
5661  * The bytes per pixel value for the specified plane.
5662  */
5663 int drm_format_plane_cpp(uint32_t format, int plane)
5664 {
5665 	unsigned int depth;
5666 	int bpp;
5667 
5668 	if (plane >= drm_format_num_planes(format))
5669 		return 0;
5670 
5671 	switch (format) {
5672 	case DRM_FORMAT_YUYV:
5673 	case DRM_FORMAT_YVYU:
5674 	case DRM_FORMAT_UYVY:
5675 	case DRM_FORMAT_VYUY:
5676 		return 2;
5677 	case DRM_FORMAT_NV12:
5678 	case DRM_FORMAT_NV21:
5679 	case DRM_FORMAT_NV16:
5680 	case DRM_FORMAT_NV61:
5681 	case DRM_FORMAT_NV24:
5682 	case DRM_FORMAT_NV42:
5683 		return plane ? 2 : 1;
5684 	case DRM_FORMAT_YUV410:
5685 	case DRM_FORMAT_YVU410:
5686 	case DRM_FORMAT_YUV411:
5687 	case DRM_FORMAT_YVU411:
5688 	case DRM_FORMAT_YUV420:
5689 	case DRM_FORMAT_YVU420:
5690 	case DRM_FORMAT_YUV422:
5691 	case DRM_FORMAT_YVU422:
5692 	case DRM_FORMAT_YUV444:
5693 	case DRM_FORMAT_YVU444:
5694 		return 1;
5695 	default:
5696 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5697 		return bpp >> 3;
5698 	}
5699 }
5700 EXPORT_SYMBOL(drm_format_plane_cpp);
5701 
5702 /**
5703  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5704  * @format: pixel format (DRM_FORMAT_*)
5705  *
5706  * Returns:
5707  * The horizontal chroma subsampling factor for the
5708  * specified pixel format.
5709  */
5710 int drm_format_horz_chroma_subsampling(uint32_t format)
5711 {
5712 	switch (format) {
5713 	case DRM_FORMAT_YUV411:
5714 	case DRM_FORMAT_YVU411:
5715 	case DRM_FORMAT_YUV410:
5716 	case DRM_FORMAT_YVU410:
5717 		return 4;
5718 	case DRM_FORMAT_YUYV:
5719 	case DRM_FORMAT_YVYU:
5720 	case DRM_FORMAT_UYVY:
5721 	case DRM_FORMAT_VYUY:
5722 	case DRM_FORMAT_NV12:
5723 	case DRM_FORMAT_NV21:
5724 	case DRM_FORMAT_NV16:
5725 	case DRM_FORMAT_NV61:
5726 	case DRM_FORMAT_YUV422:
5727 	case DRM_FORMAT_YVU422:
5728 	case DRM_FORMAT_YUV420:
5729 	case DRM_FORMAT_YVU420:
5730 		return 2;
5731 	default:
5732 		return 1;
5733 	}
5734 }
5735 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5736 
5737 /**
5738  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5739  * @format: pixel format (DRM_FORMAT_*)
5740  *
5741  * Returns:
5742  * The vertical chroma subsampling factor for the
5743  * specified pixel format.
5744  */
5745 int drm_format_vert_chroma_subsampling(uint32_t format)
5746 {
5747 	switch (format) {
5748 	case DRM_FORMAT_YUV410:
5749 	case DRM_FORMAT_YVU410:
5750 		return 4;
5751 	case DRM_FORMAT_YUV420:
5752 	case DRM_FORMAT_YVU420:
5753 	case DRM_FORMAT_NV12:
5754 	case DRM_FORMAT_NV21:
5755 		return 2;
5756 	default:
5757 		return 1;
5758 	}
5759 }
5760 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5761 
5762 /**
5763  * drm_format_plane_width - width of the plane given the first plane
5764  * @width: width of the first plane
5765  * @format: pixel format
5766  * @plane: plane index
5767  *
5768  * Returns:
5769  * The width of @plane, given that the width of the first plane is @width.
5770  */
5771 int drm_format_plane_width(int width, uint32_t format, int plane)
5772 {
5773 	if (plane >= drm_format_num_planes(format))
5774 		return 0;
5775 
5776 	if (plane == 0)
5777 		return width;
5778 
5779 	return width / drm_format_horz_chroma_subsampling(format);
5780 }
5781 EXPORT_SYMBOL(drm_format_plane_width);
5782 
5783 /**
5784  * drm_format_plane_height - height of the plane given the first plane
5785  * @height: height of the first plane
5786  * @format: pixel format
5787  * @plane: plane index
5788  *
5789  * Returns:
5790  * The height of @plane, given that the height of the first plane is @height.
5791  */
5792 int drm_format_plane_height(int height, uint32_t format, int plane)
5793 {
5794 	if (plane >= drm_format_num_planes(format))
5795 		return 0;
5796 
5797 	if (plane == 0)
5798 		return height;
5799 
5800 	return height / drm_format_vert_chroma_subsampling(format);
5801 }
5802 EXPORT_SYMBOL(drm_format_plane_height);
5803 
5804 /**
5805  * drm_rotation_simplify() - Try to simplify the rotation
5806  * @rotation: Rotation to be simplified
5807  * @supported_rotations: Supported rotations
5808  *
5809  * Attempt to simplify the rotation to a form that is supported.
5810  * Eg. if the hardware supports everything except DRM_REFLECT_X
5811  * one could call this function like this:
5812  *
5813  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5814  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5815  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5816  *
5817  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5818  * transforms the hardware supports, this function may not
5819  * be able to produce a supported transform, so the caller should
5820  * check the result afterwards.
5821  */
5822 unsigned int drm_rotation_simplify(unsigned int rotation,
5823 				   unsigned int supported_rotations)
5824 {
5825 	if (rotation & ~supported_rotations) {
5826 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5827 		rotation = (rotation & DRM_REFLECT_MASK) |
5828 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
5829 	}
5830 
5831 	return rotation;
5832 }
5833 EXPORT_SYMBOL(drm_rotation_simplify);
5834 
5835 /**
5836  * drm_mode_config_init - initialize DRM mode_configuration structure
5837  * @dev: DRM device
5838  *
5839  * Initialize @dev's mode_config structure, used for tracking the graphics
5840  * configuration of @dev.
5841  *
5842  * Since this initializes the modeset locks, no locking is possible. Which is no
5843  * problem, since this should happen single threaded at init time. It is the
5844  * driver's problem to ensure this guarantee.
5845  *
5846  */
5847 void drm_mode_config_init(struct drm_device *dev)
5848 {
5849 	mutex_init(&dev->mode_config.mutex);
5850 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5851 	mutex_init(&dev->mode_config.idr_mutex);
5852 	mutex_init(&dev->mode_config.fb_lock);
5853 	mutex_init(&dev->mode_config.blob_lock);
5854 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5855 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5856 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5857 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5858 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5859 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5860 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5861 	idr_init(&dev->mode_config.crtc_idr);
5862 	idr_init(&dev->mode_config.tile_idr);
5863 	ida_init(&dev->mode_config.connector_ida);
5864 
5865 	drm_modeset_lock_all(dev);
5866 	drm_mode_create_standard_properties(dev);
5867 	drm_modeset_unlock_all(dev);
5868 
5869 	/* Just to be sure */
5870 	dev->mode_config.num_fb = 0;
5871 	dev->mode_config.num_connector = 0;
5872 	dev->mode_config.num_crtc = 0;
5873 	dev->mode_config.num_encoder = 0;
5874 	dev->mode_config.num_overlay_plane = 0;
5875 	dev->mode_config.num_total_plane = 0;
5876 }
5877 EXPORT_SYMBOL(drm_mode_config_init);
5878 
5879 /**
5880  * drm_mode_config_cleanup - free up DRM mode_config info
5881  * @dev: DRM device
5882  *
5883  * Free up all the connectors and CRTCs associated with this DRM device, then
5884  * free up the framebuffers and associated buffer objects.
5885  *
5886  * Note that since this /should/ happen single-threaded at driver/device
5887  * teardown time, no locking is required. It's the driver's job to ensure that
5888  * this guarantee actually holds true.
5889  *
5890  * FIXME: cleanup any dangling user buffer objects too
5891  */
5892 void drm_mode_config_cleanup(struct drm_device *dev)
5893 {
5894 	struct drm_connector *connector, *ot;
5895 	struct drm_crtc *crtc, *ct;
5896 	struct drm_encoder *encoder, *enct;
5897 	struct drm_framebuffer *fb, *fbt;
5898 	struct drm_property *property, *pt;
5899 	struct drm_property_blob *blob, *bt;
5900 	struct drm_plane *plane, *plt;
5901 
5902 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5903 				 head) {
5904 		encoder->funcs->destroy(encoder);
5905 	}
5906 
5907 	list_for_each_entry_safe(connector, ot,
5908 				 &dev->mode_config.connector_list, head) {
5909 		connector->funcs->destroy(connector);
5910 	}
5911 
5912 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5913 				 head) {
5914 		drm_property_destroy(dev, property);
5915 	}
5916 
5917 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5918 				 head_global) {
5919 		drm_property_unreference_blob(blob);
5920 	}
5921 
5922 	/*
5923 	 * Single-threaded teardown context, so it's not required to grab the
5924 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5925 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5926 	 *
5927 	 * Also, if there are any framebuffers left, that's a driver leak now,
5928 	 * so politely WARN about this.
5929 	 */
5930 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5931 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5932 		drm_framebuffer_free(&fb->refcount);
5933 	}
5934 
5935 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5936 				 head) {
5937 		plane->funcs->destroy(plane);
5938 	}
5939 
5940 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5941 		crtc->funcs->destroy(crtc);
5942 	}
5943 
5944 	ida_destroy(&dev->mode_config.connector_ida);
5945 	idr_destroy(&dev->mode_config.tile_idr);
5946 	idr_destroy(&dev->mode_config.crtc_idr);
5947 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5948 }
5949 EXPORT_SYMBOL(drm_mode_config_cleanup);
5950 
5951 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5952 						       unsigned int supported_rotations)
5953 {
5954 	static const struct drm_prop_enum_list props[] = {
5955 		{ DRM_ROTATE_0,   "rotate-0" },
5956 		{ DRM_ROTATE_90,  "rotate-90" },
5957 		{ DRM_ROTATE_180, "rotate-180" },
5958 		{ DRM_ROTATE_270, "rotate-270" },
5959 		{ DRM_REFLECT_X,  "reflect-x" },
5960 		{ DRM_REFLECT_Y,  "reflect-y" },
5961 	};
5962 
5963 	return drm_property_create_bitmask(dev, 0, "rotation",
5964 					   props, ARRAY_SIZE(props),
5965 					   supported_rotations);
5966 }
5967 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5968 
5969 /**
5970  * DOC: Tile group
5971  *
5972  * Tile groups are used to represent tiled monitors with a unique
5973  * integer identifier. Tiled monitors using DisplayID v1.3 have
5974  * a unique 8-byte handle, we store this in a tile group, so we
5975  * have a common identifier for all tiles in a monitor group.
5976  */
5977 static void drm_tile_group_free(struct kref *kref)
5978 {
5979 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5980 	struct drm_device *dev = tg->dev;
5981 	mutex_lock(&dev->mode_config.idr_mutex);
5982 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5983 	mutex_unlock(&dev->mode_config.idr_mutex);
5984 	kfree(tg);
5985 }
5986 
5987 /**
5988  * drm_mode_put_tile_group - drop a reference to a tile group.
5989  * @dev: DRM device
5990  * @tg: tile group to drop reference to.
5991  *
5992  * drop reference to tile group and free if 0.
5993  */
5994 void drm_mode_put_tile_group(struct drm_device *dev,
5995 			     struct drm_tile_group *tg)
5996 {
5997 	kref_put(&tg->refcount, drm_tile_group_free);
5998 }
5999 
6000 /**
6001  * drm_mode_get_tile_group - get a reference to an existing tile group
6002  * @dev: DRM device
6003  * @topology: 8-bytes unique per monitor.
6004  *
6005  * Use the unique bytes to get a reference to an existing tile group.
6006  *
6007  * RETURNS:
6008  * tile group or NULL if not found.
6009  */
6010 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
6011 					       char topology[8])
6012 {
6013 	struct drm_tile_group *tg;
6014 	int id;
6015 	mutex_lock(&dev->mode_config.idr_mutex);
6016 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
6017 		if (!memcmp(tg->group_data, topology, 8)) {
6018 			if (!kref_get_unless_zero(&tg->refcount))
6019 				tg = NULL;
6020 			mutex_unlock(&dev->mode_config.idr_mutex);
6021 			return tg;
6022 		}
6023 	}
6024 	mutex_unlock(&dev->mode_config.idr_mutex);
6025 	return NULL;
6026 }
6027 EXPORT_SYMBOL(drm_mode_get_tile_group);
6028 
6029 /**
6030  * drm_mode_create_tile_group - create a tile group from a displayid description
6031  * @dev: DRM device
6032  * @topology: 8-bytes unique per monitor.
6033  *
6034  * Create a tile group for the unique monitor, and get a unique
6035  * identifier for the tile group.
6036  *
6037  * RETURNS:
6038  * new tile group or error.
6039  */
6040 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
6041 						  char topology[8])
6042 {
6043 	struct drm_tile_group *tg;
6044 	int ret;
6045 
6046 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
6047 	if (!tg)
6048 		return ERR_PTR(-ENOMEM);
6049 
6050 	kref_init(&tg->refcount);
6051 	memcpy(tg->group_data, topology, 8);
6052 	tg->dev = dev;
6053 
6054 	mutex_lock(&dev->mode_config.idr_mutex);
6055 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
6056 	if (ret >= 0) {
6057 		tg->id = ret;
6058 	} else {
6059 		kfree(tg);
6060 		tg = ERR_PTR(ret);
6061 	}
6062 
6063 	mutex_unlock(&dev->mode_config.idr_mutex);
6064 	return tg;
6065 }
6066 EXPORT_SYMBOL(drm_mode_create_tile_group);
6067