xref: /linux/drivers/gpu/drm/drm_crtc.c (revision a6fcb6d4804b51ffcae7881c7f99483f4981ddf1)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	struct ida ida;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 	int i;
196 
197 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
198 		ida_init(&drm_connector_enum_list[i].ida);
199 }
200 
201 void drm_connector_ida_destroy(void)
202 {
203 	int i;
204 
205 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
206 		ida_destroy(&drm_connector_enum_list[i].ida);
207 }
208 
209 /**
210  * drm_get_connector_status_name - return a string for connector status
211  * @status: connector status to compute name of
212  *
213  * In contrast to the other drm_get_*_name functions this one here returns a
214  * const pointer and hence is threadsafe.
215  */
216 const char *drm_get_connector_status_name(enum drm_connector_status status)
217 {
218 	if (status == connector_status_connected)
219 		return "connected";
220 	else if (status == connector_status_disconnected)
221 		return "disconnected";
222 	else
223 		return "unknown";
224 }
225 EXPORT_SYMBOL(drm_get_connector_status_name);
226 
227 /**
228  * drm_get_subpixel_order_name - return a string for a given subpixel enum
229  * @order: enum of subpixel_order
230  *
231  * Note you could abuse this and return something out of bounds, but that
232  * would be a caller error.  No unscrubbed user data should make it here.
233  */
234 const char *drm_get_subpixel_order_name(enum subpixel_order order)
235 {
236 	return drm_subpixel_enum_list[order].name;
237 }
238 EXPORT_SYMBOL(drm_get_subpixel_order_name);
239 
240 static char printable_char(int c)
241 {
242 	return isascii(c) && isprint(c) ? c : '?';
243 }
244 
245 /**
246  * drm_get_format_name - return a string for drm fourcc format
247  * @format: format to compute name of
248  *
249  * Note that the buffer used by this function is globally shared and owned by
250  * the function itself.
251  *
252  * FIXME: This isn't really multithreading safe.
253  */
254 const char *drm_get_format_name(uint32_t format)
255 {
256 	static char buf[32];
257 
258 	snprintf(buf, sizeof(buf),
259 		 "%c%c%c%c %s-endian (0x%08x)",
260 		 printable_char(format & 0xff),
261 		 printable_char((format >> 8) & 0xff),
262 		 printable_char((format >> 16) & 0xff),
263 		 printable_char((format >> 24) & 0x7f),
264 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
265 		 format);
266 
267 	return buf;
268 }
269 EXPORT_SYMBOL(drm_get_format_name);
270 
271 /*
272  * Internal function to assign a slot in the object idr and optionally
273  * register the object into the idr.
274  */
275 static int drm_mode_object_get_reg(struct drm_device *dev,
276 				   struct drm_mode_object *obj,
277 				   uint32_t obj_type,
278 				   bool register_obj)
279 {
280 	int ret;
281 
282 	mutex_lock(&dev->mode_config.idr_mutex);
283 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
284 	if (ret >= 0) {
285 		/*
286 		 * Set up the object linking under the protection of the idr
287 		 * lock so that other users can't see inconsistent state.
288 		 */
289 		obj->id = ret;
290 		obj->type = obj_type;
291 	}
292 	mutex_unlock(&dev->mode_config.idr_mutex);
293 
294 	return ret < 0 ? ret : 0;
295 }
296 
297 /**
298  * drm_mode_object_get - allocate a new modeset identifier
299  * @dev: DRM device
300  * @obj: object pointer, used to generate unique ID
301  * @obj_type: object type
302  *
303  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
304  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
305  * modeset identifiers are _not_ reference counted. Hence don't use this for
306  * reference counted modeset objects like framebuffers.
307  *
308  * Returns:
309  * New unique (relative to other objects in @dev) integer identifier for the
310  * object.
311  */
312 int drm_mode_object_get(struct drm_device *dev,
313 			struct drm_mode_object *obj, uint32_t obj_type)
314 {
315 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
316 }
317 
318 static void drm_mode_object_register(struct drm_device *dev,
319 				     struct drm_mode_object *obj)
320 {
321 	mutex_lock(&dev->mode_config.idr_mutex);
322 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
323 	mutex_unlock(&dev->mode_config.idr_mutex);
324 }
325 
326 /**
327  * drm_mode_object_put - free a modeset identifer
328  * @dev: DRM device
329  * @object: object to free
330  *
331  * Free @id from @dev's unique identifier pool. Note that despite the _get
332  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
333  * for reference counted modeset objects like framebuffers.
334  */
335 void drm_mode_object_put(struct drm_device *dev,
336 			 struct drm_mode_object *object)
337 {
338 	mutex_lock(&dev->mode_config.idr_mutex);
339 	idr_remove(&dev->mode_config.crtc_idr, object->id);
340 	mutex_unlock(&dev->mode_config.idr_mutex);
341 }
342 
343 static struct drm_mode_object *_object_find(struct drm_device *dev,
344 		uint32_t id, uint32_t type)
345 {
346 	struct drm_mode_object *obj = NULL;
347 
348 	mutex_lock(&dev->mode_config.idr_mutex);
349 	obj = idr_find(&dev->mode_config.crtc_idr, id);
350 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
351 		obj = NULL;
352 	if (obj && obj->id != id)
353 		obj = NULL;
354 	/* don't leak out unref'd fb's */
355 	if (obj && (obj->type == DRM_MODE_OBJECT_FB))
356 		obj = NULL;
357 	mutex_unlock(&dev->mode_config.idr_mutex);
358 
359 	return obj;
360 }
361 
362 /**
363  * drm_mode_object_find - look up a drm object with static lifetime
364  * @dev: drm device
365  * @id: id of the mode object
366  * @type: type of the mode object
367  *
368  * Note that framebuffers cannot be looked up with this functions - since those
369  * are reference counted, they need special treatment.  Even with
370  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
371  * rather than WARN_ON()).
372  */
373 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
374 		uint32_t id, uint32_t type)
375 {
376 	struct drm_mode_object *obj = NULL;
377 
378 	/* Framebuffers are reference counted and need their own lookup
379 	 * function.*/
380 	WARN_ON(type == DRM_MODE_OBJECT_FB);
381 	obj = _object_find(dev, id, type);
382 	return obj;
383 }
384 EXPORT_SYMBOL(drm_mode_object_find);
385 
386 /**
387  * drm_framebuffer_init - initialize a framebuffer
388  * @dev: DRM device
389  * @fb: framebuffer to be initialized
390  * @funcs: ... with these functions
391  *
392  * Allocates an ID for the framebuffer's parent mode object, sets its mode
393  * functions & device file and adds it to the master fd list.
394  *
395  * IMPORTANT:
396  * This functions publishes the fb and makes it available for concurrent access
397  * by other users. Which means by this point the fb _must_ be fully set up -
398  * since all the fb attributes are invariant over its lifetime, no further
399  * locking but only correct reference counting is required.
400  *
401  * Returns:
402  * Zero on success, error code on failure.
403  */
404 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
405 			 const struct drm_framebuffer_funcs *funcs)
406 {
407 	int ret;
408 
409 	mutex_lock(&dev->mode_config.fb_lock);
410 	kref_init(&fb->refcount);
411 	INIT_LIST_HEAD(&fb->filp_head);
412 	fb->dev = dev;
413 	fb->funcs = funcs;
414 
415 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
416 	if (ret)
417 		goto out;
418 
419 	dev->mode_config.num_fb++;
420 	list_add(&fb->head, &dev->mode_config.fb_list);
421 out:
422 	mutex_unlock(&dev->mode_config.fb_lock);
423 
424 	return 0;
425 }
426 EXPORT_SYMBOL(drm_framebuffer_init);
427 
428 /* dev->mode_config.fb_lock must be held! */
429 static void __drm_framebuffer_unregister(struct drm_device *dev,
430 					 struct drm_framebuffer *fb)
431 {
432 	mutex_lock(&dev->mode_config.idr_mutex);
433 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
434 	mutex_unlock(&dev->mode_config.idr_mutex);
435 
436 	fb->base.id = 0;
437 }
438 
439 static void drm_framebuffer_free(struct kref *kref)
440 {
441 	struct drm_framebuffer *fb =
442 			container_of(kref, struct drm_framebuffer, refcount);
443 	struct drm_device *dev = fb->dev;
444 
445 	/*
446 	 * The lookup idr holds a weak reference, which has not necessarily been
447 	 * removed at this point. Check for that.
448 	 */
449 	mutex_lock(&dev->mode_config.fb_lock);
450 	if (fb->base.id) {
451 		/* Mark fb as reaped and drop idr ref. */
452 		__drm_framebuffer_unregister(dev, fb);
453 	}
454 	mutex_unlock(&dev->mode_config.fb_lock);
455 
456 	fb->funcs->destroy(fb);
457 }
458 
459 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
460 							uint32_t id)
461 {
462 	struct drm_mode_object *obj = NULL;
463 	struct drm_framebuffer *fb;
464 
465 	mutex_lock(&dev->mode_config.idr_mutex);
466 	obj = idr_find(&dev->mode_config.crtc_idr, id);
467 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
468 		fb = NULL;
469 	else
470 		fb = obj_to_fb(obj);
471 	mutex_unlock(&dev->mode_config.idr_mutex);
472 
473 	return fb;
474 }
475 
476 /**
477  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
478  * @dev: drm device
479  * @id: id of the fb object
480  *
481  * If successful, this grabs an additional reference to the framebuffer -
482  * callers need to make sure to eventually unreference the returned framebuffer
483  * again, using @drm_framebuffer_unreference.
484  */
485 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
486 					       uint32_t id)
487 {
488 	struct drm_framebuffer *fb;
489 
490 	mutex_lock(&dev->mode_config.fb_lock);
491 	fb = __drm_framebuffer_lookup(dev, id);
492 	if (fb) {
493 		if (!kref_get_unless_zero(&fb->refcount))
494 			fb = NULL;
495 	}
496 	mutex_unlock(&dev->mode_config.fb_lock);
497 
498 	return fb;
499 }
500 EXPORT_SYMBOL(drm_framebuffer_lookup);
501 
502 /**
503  * drm_framebuffer_unreference - unref a framebuffer
504  * @fb: framebuffer to unref
505  *
506  * This functions decrements the fb's refcount and frees it if it drops to zero.
507  */
508 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
509 {
510 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
511 	kref_put(&fb->refcount, drm_framebuffer_free);
512 }
513 EXPORT_SYMBOL(drm_framebuffer_unreference);
514 
515 /**
516  * drm_framebuffer_reference - incr the fb refcnt
517  * @fb: framebuffer
518  *
519  * This functions increments the fb's refcount.
520  */
521 void drm_framebuffer_reference(struct drm_framebuffer *fb)
522 {
523 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
524 	kref_get(&fb->refcount);
525 }
526 EXPORT_SYMBOL(drm_framebuffer_reference);
527 
528 /**
529  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
530  * @fb: fb to unregister
531  *
532  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
533  * those used for fbdev. Note that the caller must hold a reference of it's own,
534  * i.e. the object may not be destroyed through this call (since it'll lead to a
535  * locking inversion).
536  */
537 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
538 {
539 	struct drm_device *dev = fb->dev;
540 
541 	mutex_lock(&dev->mode_config.fb_lock);
542 	/* Mark fb as reaped and drop idr ref. */
543 	__drm_framebuffer_unregister(dev, fb);
544 	mutex_unlock(&dev->mode_config.fb_lock);
545 }
546 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
547 
548 /**
549  * drm_framebuffer_cleanup - remove a framebuffer object
550  * @fb: framebuffer to remove
551  *
552  * Cleanup framebuffer. This function is intended to be used from the drivers
553  * ->destroy callback. It can also be used to clean up driver private
554  *  framebuffers embedded into a larger structure.
555  *
556  * Note that this function does not remove the fb from active usuage - if it is
557  * still used anywhere, hilarity can ensue since userspace could call getfb on
558  * the id and get back -EINVAL. Obviously no concern at driver unload time.
559  *
560  * Also, the framebuffer will not be removed from the lookup idr - for
561  * user-created framebuffers this will happen in in the rmfb ioctl. For
562  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
563  * drm_framebuffer_unregister_private.
564  */
565 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
566 {
567 	struct drm_device *dev = fb->dev;
568 
569 	mutex_lock(&dev->mode_config.fb_lock);
570 	list_del(&fb->head);
571 	dev->mode_config.num_fb--;
572 	mutex_unlock(&dev->mode_config.fb_lock);
573 }
574 EXPORT_SYMBOL(drm_framebuffer_cleanup);
575 
576 /**
577  * drm_framebuffer_remove - remove and unreference a framebuffer object
578  * @fb: framebuffer to remove
579  *
580  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
581  * using @fb, removes it, setting it to NULL. Then drops the reference to the
582  * passed-in framebuffer. Might take the modeset locks.
583  *
584  * Note that this function optimizes the cleanup away if the caller holds the
585  * last reference to the framebuffer. It is also guaranteed to not take the
586  * modeset locks in this case.
587  */
588 void drm_framebuffer_remove(struct drm_framebuffer *fb)
589 {
590 	struct drm_device *dev = fb->dev;
591 	struct drm_crtc *crtc;
592 	struct drm_plane *plane;
593 	struct drm_mode_set set;
594 	int ret;
595 
596 	WARN_ON(!list_empty(&fb->filp_head));
597 
598 	/*
599 	 * drm ABI mandates that we remove any deleted framebuffers from active
600 	 * useage. But since most sane clients only remove framebuffers they no
601 	 * longer need, try to optimize this away.
602 	 *
603 	 * Since we're holding a reference ourselves, observing a refcount of 1
604 	 * means that we're the last holder and can skip it. Also, the refcount
605 	 * can never increase from 1 again, so we don't need any barriers or
606 	 * locks.
607 	 *
608 	 * Note that userspace could try to race with use and instate a new
609 	 * usage _after_ we've cleared all current ones. End result will be an
610 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
611 	 * in this manner.
612 	 */
613 	if (atomic_read(&fb->refcount.refcount) > 1) {
614 		drm_modeset_lock_all(dev);
615 		/* remove from any CRTC */
616 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
617 			if (crtc->primary->fb == fb) {
618 				/* should turn off the crtc */
619 				memset(&set, 0, sizeof(struct drm_mode_set));
620 				set.crtc = crtc;
621 				set.fb = NULL;
622 				ret = drm_mode_set_config_internal(&set);
623 				if (ret)
624 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
625 			}
626 		}
627 
628 		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
629 			if (plane->fb == fb)
630 				drm_plane_force_disable(plane);
631 		}
632 		drm_modeset_unlock_all(dev);
633 	}
634 
635 	drm_framebuffer_unreference(fb);
636 }
637 EXPORT_SYMBOL(drm_framebuffer_remove);
638 
639 DEFINE_WW_CLASS(crtc_ww_class);
640 
641 /**
642  * drm_crtc_init_with_planes - Initialise a new CRTC object with
643  *    specified primary and cursor planes.
644  * @dev: DRM device
645  * @crtc: CRTC object to init
646  * @primary: Primary plane for CRTC
647  * @cursor: Cursor plane for CRTC
648  * @funcs: callbacks for the new CRTC
649  *
650  * Inits a new object created as base part of a driver crtc object.
651  *
652  * Returns:
653  * Zero on success, error code on failure.
654  */
655 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
656 			      struct drm_plane *primary,
657 			      struct drm_plane *cursor,
658 			      const struct drm_crtc_funcs *funcs)
659 {
660 	struct drm_mode_config *config = &dev->mode_config;
661 	int ret;
662 
663 	crtc->dev = dev;
664 	crtc->funcs = funcs;
665 	crtc->invert_dimensions = false;
666 
667 	drm_modeset_lock_init(&crtc->mutex);
668 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
669 	if (ret)
670 		return ret;
671 
672 	crtc->base.properties = &crtc->properties;
673 
674 	list_add_tail(&crtc->head, &config->crtc_list);
675 	config->num_crtc++;
676 
677 	crtc->primary = primary;
678 	crtc->cursor = cursor;
679 	if (primary)
680 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
681 	if (cursor)
682 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
683 
684 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
685 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
686 	}
687 
688 	return 0;
689 }
690 EXPORT_SYMBOL(drm_crtc_init_with_planes);
691 
692 /**
693  * drm_crtc_cleanup - Clean up the core crtc usage
694  * @crtc: CRTC to cleanup
695  *
696  * This function cleans up @crtc and removes it from the DRM mode setting
697  * core. Note that the function does *not* free the crtc structure itself,
698  * this is the responsibility of the caller.
699  */
700 void drm_crtc_cleanup(struct drm_crtc *crtc)
701 {
702 	struct drm_device *dev = crtc->dev;
703 
704 	kfree(crtc->gamma_store);
705 	crtc->gamma_store = NULL;
706 
707 	drm_modeset_lock_fini(&crtc->mutex);
708 
709 	drm_mode_object_put(dev, &crtc->base);
710 	list_del(&crtc->head);
711 	dev->mode_config.num_crtc--;
712 
713 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
714 	if (crtc->state && crtc->funcs->atomic_destroy_state)
715 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
716 
717 	memset(crtc, 0, sizeof(*crtc));
718 }
719 EXPORT_SYMBOL(drm_crtc_cleanup);
720 
721 /**
722  * drm_crtc_index - find the index of a registered CRTC
723  * @crtc: CRTC to find index for
724  *
725  * Given a registered CRTC, return the index of that CRTC within a DRM
726  * device's list of CRTCs.
727  */
728 unsigned int drm_crtc_index(struct drm_crtc *crtc)
729 {
730 	unsigned int index = 0;
731 	struct drm_crtc *tmp;
732 
733 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
734 		if (tmp == crtc)
735 			return index;
736 
737 		index++;
738 	}
739 
740 	BUG();
741 }
742 EXPORT_SYMBOL(drm_crtc_index);
743 
744 /*
745  * drm_mode_remove - remove and free a mode
746  * @connector: connector list to modify
747  * @mode: mode to remove
748  *
749  * Remove @mode from @connector's mode list, then free it.
750  */
751 static void drm_mode_remove(struct drm_connector *connector,
752 			    struct drm_display_mode *mode)
753 {
754 	list_del(&mode->head);
755 	drm_mode_destroy(connector->dev, mode);
756 }
757 
758 /**
759  * drm_display_info_set_bus_formats - set the supported bus formats
760  * @info: display info to store bus formats in
761  * @formats: array containing the supported bus formats
762  * @num_formats: the number of entries in the fmts array
763  *
764  * Store the supported bus formats in display info structure.
765  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
766  * a full list of available formats.
767  */
768 int drm_display_info_set_bus_formats(struct drm_display_info *info,
769 				     const u32 *formats,
770 				     unsigned int num_formats)
771 {
772 	u32 *fmts = NULL;
773 
774 	if (!formats && num_formats)
775 		return -EINVAL;
776 
777 	if (formats && num_formats) {
778 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
779 			       GFP_KERNEL);
780 		if (!fmts)
781 			return -ENOMEM;
782 	}
783 
784 	kfree(info->bus_formats);
785 	info->bus_formats = fmts;
786 	info->num_bus_formats = num_formats;
787 
788 	return 0;
789 }
790 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
791 
792 /**
793  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
794  * @connector: connector to quwery
795  *
796  * The kernel supports per-connector configration of its consoles through
797  * use of the video= parameter. This function parses that option and
798  * extracts the user's specified mode (or enable/disable status) for a
799  * particular connector. This is typically only used during the early fbdev
800  * setup.
801  */
802 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
803 {
804 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
805 	char *option = NULL;
806 
807 	if (fb_get_options(connector->name, &option))
808 		return;
809 
810 	if (!drm_mode_parse_command_line_for_connector(option,
811 						       connector,
812 						       mode))
813 		return;
814 
815 	if (mode->force) {
816 		const char *s;
817 
818 		switch (mode->force) {
819 		case DRM_FORCE_OFF:
820 			s = "OFF";
821 			break;
822 		case DRM_FORCE_ON_DIGITAL:
823 			s = "ON - dig";
824 			break;
825 		default:
826 		case DRM_FORCE_ON:
827 			s = "ON";
828 			break;
829 		}
830 
831 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
832 		connector->force = mode->force;
833 	}
834 
835 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
836 		      connector->name,
837 		      mode->xres, mode->yres,
838 		      mode->refresh_specified ? mode->refresh : 60,
839 		      mode->rb ? " reduced blanking" : "",
840 		      mode->margins ? " with margins" : "",
841 		      mode->interlace ?  " interlaced" : "");
842 }
843 
844 /**
845  * drm_connector_init - Init a preallocated connector
846  * @dev: DRM device
847  * @connector: the connector to init
848  * @funcs: callbacks for this connector
849  * @connector_type: user visible type of the connector
850  *
851  * Initialises a preallocated connector. Connectors should be
852  * subclassed as part of driver connector objects.
853  *
854  * Returns:
855  * Zero on success, error code on failure.
856  */
857 int drm_connector_init(struct drm_device *dev,
858 		       struct drm_connector *connector,
859 		       const struct drm_connector_funcs *funcs,
860 		       int connector_type)
861 {
862 	struct drm_mode_config *config = &dev->mode_config;
863 	int ret;
864 	struct ida *connector_ida =
865 		&drm_connector_enum_list[connector_type].ida;
866 
867 	drm_modeset_lock_all(dev);
868 
869 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
870 	if (ret)
871 		goto out_unlock;
872 
873 	connector->base.properties = &connector->properties;
874 	connector->dev = dev;
875 	connector->funcs = funcs;
876 	connector->connector_type = connector_type;
877 	connector->connector_type_id =
878 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
879 	if (connector->connector_type_id < 0) {
880 		ret = connector->connector_type_id;
881 		goto out_put;
882 	}
883 	connector->name =
884 		kasprintf(GFP_KERNEL, "%s-%d",
885 			  drm_connector_enum_list[connector_type].name,
886 			  connector->connector_type_id);
887 	if (!connector->name) {
888 		ret = -ENOMEM;
889 		goto out_put;
890 	}
891 
892 	INIT_LIST_HEAD(&connector->probed_modes);
893 	INIT_LIST_HEAD(&connector->modes);
894 	connector->edid_blob_ptr = NULL;
895 	connector->status = connector_status_unknown;
896 
897 	drm_connector_get_cmdline_mode(connector);
898 
899 	/* We should add connectors at the end to avoid upsetting the connector
900 	 * index too much. */
901 	list_add_tail(&connector->head, &config->connector_list);
902 	config->num_connector++;
903 
904 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
905 		drm_object_attach_property(&connector->base,
906 					      config->edid_property,
907 					      0);
908 
909 	drm_object_attach_property(&connector->base,
910 				      config->dpms_property, 0);
911 
912 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
913 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
914 	}
915 
916 	connector->debugfs_entry = NULL;
917 
918 out_put:
919 	if (ret)
920 		drm_mode_object_put(dev, &connector->base);
921 
922 out_unlock:
923 	drm_modeset_unlock_all(dev);
924 
925 	return ret;
926 }
927 EXPORT_SYMBOL(drm_connector_init);
928 
929 /**
930  * drm_connector_cleanup - cleans up an initialised connector
931  * @connector: connector to cleanup
932  *
933  * Cleans up the connector but doesn't free the object.
934  */
935 void drm_connector_cleanup(struct drm_connector *connector)
936 {
937 	struct drm_device *dev = connector->dev;
938 	struct drm_display_mode *mode, *t;
939 
940 	if (connector->tile_group) {
941 		drm_mode_put_tile_group(dev, connector->tile_group);
942 		connector->tile_group = NULL;
943 	}
944 
945 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
946 		drm_mode_remove(connector, mode);
947 
948 	list_for_each_entry_safe(mode, t, &connector->modes, head)
949 		drm_mode_remove(connector, mode);
950 
951 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
952 		   connector->connector_type_id);
953 
954 	kfree(connector->display_info.bus_formats);
955 	drm_mode_object_put(dev, &connector->base);
956 	kfree(connector->name);
957 	connector->name = NULL;
958 	list_del(&connector->head);
959 	dev->mode_config.num_connector--;
960 
961 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
962 	if (connector->state && connector->funcs->atomic_destroy_state)
963 		connector->funcs->atomic_destroy_state(connector,
964 						       connector->state);
965 
966 	memset(connector, 0, sizeof(*connector));
967 }
968 EXPORT_SYMBOL(drm_connector_cleanup);
969 
970 /**
971  * drm_connector_index - find the index of a registered connector
972  * @connector: connector to find index for
973  *
974  * Given a registered connector, return the index of that connector within a DRM
975  * device's list of connectors.
976  */
977 unsigned int drm_connector_index(struct drm_connector *connector)
978 {
979 	unsigned int index = 0;
980 	struct drm_connector *tmp;
981 	struct drm_mode_config *config = &connector->dev->mode_config;
982 
983 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
984 
985 	list_for_each_entry(tmp, &connector->dev->mode_config.connector_list, head) {
986 		if (tmp == connector)
987 			return index;
988 
989 		index++;
990 	}
991 
992 	BUG();
993 }
994 EXPORT_SYMBOL(drm_connector_index);
995 
996 /**
997  * drm_connector_register - register a connector
998  * @connector: the connector to register
999  *
1000  * Register userspace interfaces for a connector
1001  *
1002  * Returns:
1003  * Zero on success, error code on failure.
1004  */
1005 int drm_connector_register(struct drm_connector *connector)
1006 {
1007 	int ret;
1008 
1009 	drm_mode_object_register(connector->dev, &connector->base);
1010 
1011 	ret = drm_sysfs_connector_add(connector);
1012 	if (ret)
1013 		return ret;
1014 
1015 	ret = drm_debugfs_connector_add(connector);
1016 	if (ret) {
1017 		drm_sysfs_connector_remove(connector);
1018 		return ret;
1019 	}
1020 
1021 	return 0;
1022 }
1023 EXPORT_SYMBOL(drm_connector_register);
1024 
1025 /**
1026  * drm_connector_unregister - unregister a connector
1027  * @connector: the connector to unregister
1028  *
1029  * Unregister userspace interfaces for a connector
1030  */
1031 void drm_connector_unregister(struct drm_connector *connector)
1032 {
1033 	drm_sysfs_connector_remove(connector);
1034 	drm_debugfs_connector_remove(connector);
1035 }
1036 EXPORT_SYMBOL(drm_connector_unregister);
1037 
1038 
1039 /**
1040  * drm_connector_unplug_all - unregister connector userspace interfaces
1041  * @dev: drm device
1042  *
1043  * This function unregisters all connector userspace interfaces in sysfs. Should
1044  * be call when the device is disconnected, e.g. from an usb driver's
1045  * ->disconnect callback.
1046  */
1047 void drm_connector_unplug_all(struct drm_device *dev)
1048 {
1049 	struct drm_connector *connector;
1050 
1051 	/* taking the mode config mutex ends up in a clash with sysfs */
1052 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1053 		drm_connector_unregister(connector);
1054 
1055 }
1056 EXPORT_SYMBOL(drm_connector_unplug_all);
1057 
1058 /**
1059  * drm_encoder_init - Init a preallocated encoder
1060  * @dev: drm device
1061  * @encoder: the encoder to init
1062  * @funcs: callbacks for this encoder
1063  * @encoder_type: user visible type of the encoder
1064  *
1065  * Initialises a preallocated encoder. Encoder should be
1066  * subclassed as part of driver encoder objects.
1067  *
1068  * Returns:
1069  * Zero on success, error code on failure.
1070  */
1071 int drm_encoder_init(struct drm_device *dev,
1072 		      struct drm_encoder *encoder,
1073 		      const struct drm_encoder_funcs *funcs,
1074 		      int encoder_type)
1075 {
1076 	int ret;
1077 
1078 	drm_modeset_lock_all(dev);
1079 
1080 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1081 	if (ret)
1082 		goto out_unlock;
1083 
1084 	encoder->dev = dev;
1085 	encoder->encoder_type = encoder_type;
1086 	encoder->funcs = funcs;
1087 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1088 				  drm_encoder_enum_list[encoder_type].name,
1089 				  encoder->base.id);
1090 	if (!encoder->name) {
1091 		ret = -ENOMEM;
1092 		goto out_put;
1093 	}
1094 
1095 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1096 	dev->mode_config.num_encoder++;
1097 
1098 out_put:
1099 	if (ret)
1100 		drm_mode_object_put(dev, &encoder->base);
1101 
1102 out_unlock:
1103 	drm_modeset_unlock_all(dev);
1104 
1105 	return ret;
1106 }
1107 EXPORT_SYMBOL(drm_encoder_init);
1108 
1109 /**
1110  * drm_encoder_cleanup - cleans up an initialised encoder
1111  * @encoder: encoder to cleanup
1112  *
1113  * Cleans up the encoder but doesn't free the object.
1114  */
1115 void drm_encoder_cleanup(struct drm_encoder *encoder)
1116 {
1117 	struct drm_device *dev = encoder->dev;
1118 
1119 	drm_modeset_lock_all(dev);
1120 	drm_mode_object_put(dev, &encoder->base);
1121 	kfree(encoder->name);
1122 	list_del(&encoder->head);
1123 	dev->mode_config.num_encoder--;
1124 	drm_modeset_unlock_all(dev);
1125 
1126 	memset(encoder, 0, sizeof(*encoder));
1127 }
1128 EXPORT_SYMBOL(drm_encoder_cleanup);
1129 
1130 /**
1131  * drm_universal_plane_init - Initialize a new universal plane object
1132  * @dev: DRM device
1133  * @plane: plane object to init
1134  * @possible_crtcs: bitmask of possible CRTCs
1135  * @funcs: callbacks for the new plane
1136  * @formats: array of supported formats (%DRM_FORMAT_*)
1137  * @format_count: number of elements in @formats
1138  * @type: type of plane (overlay, primary, cursor)
1139  *
1140  * Initializes a plane object of type @type.
1141  *
1142  * Returns:
1143  * Zero on success, error code on failure.
1144  */
1145 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1146 			     unsigned long possible_crtcs,
1147 			     const struct drm_plane_funcs *funcs,
1148 			     const uint32_t *formats, uint32_t format_count,
1149 			     enum drm_plane_type type)
1150 {
1151 	struct drm_mode_config *config = &dev->mode_config;
1152 	int ret;
1153 
1154 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1155 	if (ret)
1156 		return ret;
1157 
1158 	drm_modeset_lock_init(&plane->mutex);
1159 
1160 	plane->base.properties = &plane->properties;
1161 	plane->dev = dev;
1162 	plane->funcs = funcs;
1163 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1164 					    GFP_KERNEL);
1165 	if (!plane->format_types) {
1166 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1167 		drm_mode_object_put(dev, &plane->base);
1168 		return -ENOMEM;
1169 	}
1170 
1171 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1172 	plane->format_count = format_count;
1173 	plane->possible_crtcs = possible_crtcs;
1174 	plane->type = type;
1175 
1176 	list_add_tail(&plane->head, &config->plane_list);
1177 	config->num_total_plane++;
1178 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1179 		config->num_overlay_plane++;
1180 
1181 	drm_object_attach_property(&plane->base,
1182 				   config->plane_type_property,
1183 				   plane->type);
1184 
1185 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1186 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1187 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1188 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1189 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1190 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1191 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1192 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1193 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1194 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1195 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1196 	}
1197 
1198 	return 0;
1199 }
1200 EXPORT_SYMBOL(drm_universal_plane_init);
1201 
1202 /**
1203  * drm_plane_init - Initialize a legacy plane
1204  * @dev: DRM device
1205  * @plane: plane object to init
1206  * @possible_crtcs: bitmask of possible CRTCs
1207  * @funcs: callbacks for the new plane
1208  * @formats: array of supported formats (%DRM_FORMAT_*)
1209  * @format_count: number of elements in @formats
1210  * @is_primary: plane type (primary vs overlay)
1211  *
1212  * Legacy API to initialize a DRM plane.
1213  *
1214  * New drivers should call drm_universal_plane_init() instead.
1215  *
1216  * Returns:
1217  * Zero on success, error code on failure.
1218  */
1219 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1220 		   unsigned long possible_crtcs,
1221 		   const struct drm_plane_funcs *funcs,
1222 		   const uint32_t *formats, uint32_t format_count,
1223 		   bool is_primary)
1224 {
1225 	enum drm_plane_type type;
1226 
1227 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1228 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1229 					formats, format_count, type);
1230 }
1231 EXPORT_SYMBOL(drm_plane_init);
1232 
1233 /**
1234  * drm_plane_cleanup - Clean up the core plane usage
1235  * @plane: plane to cleanup
1236  *
1237  * This function cleans up @plane and removes it from the DRM mode setting
1238  * core. Note that the function does *not* free the plane structure itself,
1239  * this is the responsibility of the caller.
1240  */
1241 void drm_plane_cleanup(struct drm_plane *plane)
1242 {
1243 	struct drm_device *dev = plane->dev;
1244 
1245 	drm_modeset_lock_all(dev);
1246 	kfree(plane->format_types);
1247 	drm_mode_object_put(dev, &plane->base);
1248 
1249 	BUG_ON(list_empty(&plane->head));
1250 
1251 	list_del(&plane->head);
1252 	dev->mode_config.num_total_plane--;
1253 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1254 		dev->mode_config.num_overlay_plane--;
1255 	drm_modeset_unlock_all(dev);
1256 
1257 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1258 	if (plane->state && plane->funcs->atomic_destroy_state)
1259 		plane->funcs->atomic_destroy_state(plane, plane->state);
1260 
1261 	memset(plane, 0, sizeof(*plane));
1262 }
1263 EXPORT_SYMBOL(drm_plane_cleanup);
1264 
1265 /**
1266  * drm_plane_index - find the index of a registered plane
1267  * @plane: plane to find index for
1268  *
1269  * Given a registered plane, return the index of that CRTC within a DRM
1270  * device's list of planes.
1271  */
1272 unsigned int drm_plane_index(struct drm_plane *plane)
1273 {
1274 	unsigned int index = 0;
1275 	struct drm_plane *tmp;
1276 
1277 	list_for_each_entry(tmp, &plane->dev->mode_config.plane_list, head) {
1278 		if (tmp == plane)
1279 			return index;
1280 
1281 		index++;
1282 	}
1283 
1284 	BUG();
1285 }
1286 EXPORT_SYMBOL(drm_plane_index);
1287 
1288 /**
1289  * drm_plane_force_disable - Forcibly disable a plane
1290  * @plane: plane to disable
1291  *
1292  * Forces the plane to be disabled.
1293  *
1294  * Used when the plane's current framebuffer is destroyed,
1295  * and when restoring fbdev mode.
1296  */
1297 void drm_plane_force_disable(struct drm_plane *plane)
1298 {
1299 	int ret;
1300 
1301 	if (!plane->fb)
1302 		return;
1303 
1304 	plane->old_fb = plane->fb;
1305 	ret = plane->funcs->disable_plane(plane);
1306 	if (ret) {
1307 		DRM_ERROR("failed to disable plane with busy fb\n");
1308 		plane->old_fb = NULL;
1309 		return;
1310 	}
1311 	/* disconnect the plane from the fb and crtc: */
1312 	drm_framebuffer_unreference(plane->old_fb);
1313 	plane->old_fb = NULL;
1314 	plane->fb = NULL;
1315 	plane->crtc = NULL;
1316 }
1317 EXPORT_SYMBOL(drm_plane_force_disable);
1318 
1319 static int drm_mode_create_standard_properties(struct drm_device *dev)
1320 {
1321 	struct drm_property *prop;
1322 
1323 	/*
1324 	 * Standard properties (apply to all connectors)
1325 	 */
1326 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1327 				   DRM_MODE_PROP_IMMUTABLE,
1328 				   "EDID", 0);
1329 	if (!prop)
1330 		return -ENOMEM;
1331 	dev->mode_config.edid_property = prop;
1332 
1333 	prop = drm_property_create_enum(dev, 0,
1334 				   "DPMS", drm_dpms_enum_list,
1335 				   ARRAY_SIZE(drm_dpms_enum_list));
1336 	if (!prop)
1337 		return -ENOMEM;
1338 	dev->mode_config.dpms_property = prop;
1339 
1340 	prop = drm_property_create(dev,
1341 				   DRM_MODE_PROP_BLOB |
1342 				   DRM_MODE_PROP_IMMUTABLE,
1343 				   "PATH", 0);
1344 	if (!prop)
1345 		return -ENOMEM;
1346 	dev->mode_config.path_property = prop;
1347 
1348 	prop = drm_property_create(dev,
1349 				   DRM_MODE_PROP_BLOB |
1350 				   DRM_MODE_PROP_IMMUTABLE,
1351 				   "TILE", 0);
1352 	if (!prop)
1353 		return -ENOMEM;
1354 	dev->mode_config.tile_property = prop;
1355 
1356 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1357 					"type", drm_plane_type_enum_list,
1358 					ARRAY_SIZE(drm_plane_type_enum_list));
1359 	if (!prop)
1360 		return -ENOMEM;
1361 	dev->mode_config.plane_type_property = prop;
1362 
1363 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1364 			"SRC_X", 0, UINT_MAX);
1365 	if (!prop)
1366 		return -ENOMEM;
1367 	dev->mode_config.prop_src_x = prop;
1368 
1369 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1370 			"SRC_Y", 0, UINT_MAX);
1371 	if (!prop)
1372 		return -ENOMEM;
1373 	dev->mode_config.prop_src_y = prop;
1374 
1375 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1376 			"SRC_W", 0, UINT_MAX);
1377 	if (!prop)
1378 		return -ENOMEM;
1379 	dev->mode_config.prop_src_w = prop;
1380 
1381 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1382 			"SRC_H", 0, UINT_MAX);
1383 	if (!prop)
1384 		return -ENOMEM;
1385 	dev->mode_config.prop_src_h = prop;
1386 
1387 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1388 			"CRTC_X", INT_MIN, INT_MAX);
1389 	if (!prop)
1390 		return -ENOMEM;
1391 	dev->mode_config.prop_crtc_x = prop;
1392 
1393 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1394 			"CRTC_Y", INT_MIN, INT_MAX);
1395 	if (!prop)
1396 		return -ENOMEM;
1397 	dev->mode_config.prop_crtc_y = prop;
1398 
1399 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1400 			"CRTC_W", 0, INT_MAX);
1401 	if (!prop)
1402 		return -ENOMEM;
1403 	dev->mode_config.prop_crtc_w = prop;
1404 
1405 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1406 			"CRTC_H", 0, INT_MAX);
1407 	if (!prop)
1408 		return -ENOMEM;
1409 	dev->mode_config.prop_crtc_h = prop;
1410 
1411 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1412 			"FB_ID", DRM_MODE_OBJECT_FB);
1413 	if (!prop)
1414 		return -ENOMEM;
1415 	dev->mode_config.prop_fb_id = prop;
1416 
1417 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1418 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1419 	if (!prop)
1420 		return -ENOMEM;
1421 	dev->mode_config.prop_crtc_id = prop;
1422 
1423 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1424 			"ACTIVE");
1425 	if (!prop)
1426 		return -ENOMEM;
1427 	dev->mode_config.prop_active = prop;
1428 
1429 	return 0;
1430 }
1431 
1432 /**
1433  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1434  * @dev: DRM device
1435  *
1436  * Called by a driver the first time a DVI-I connector is made.
1437  */
1438 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1439 {
1440 	struct drm_property *dvi_i_selector;
1441 	struct drm_property *dvi_i_subconnector;
1442 
1443 	if (dev->mode_config.dvi_i_select_subconnector_property)
1444 		return 0;
1445 
1446 	dvi_i_selector =
1447 		drm_property_create_enum(dev, 0,
1448 				    "select subconnector",
1449 				    drm_dvi_i_select_enum_list,
1450 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1451 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1452 
1453 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1454 				    "subconnector",
1455 				    drm_dvi_i_subconnector_enum_list,
1456 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1457 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1458 
1459 	return 0;
1460 }
1461 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1462 
1463 /**
1464  * drm_create_tv_properties - create TV specific connector properties
1465  * @dev: DRM device
1466  * @num_modes: number of different TV formats (modes) supported
1467  * @modes: array of pointers to strings containing name of each format
1468  *
1469  * Called by a driver's TV initialization routine, this function creates
1470  * the TV specific connector properties for a given device.  Caller is
1471  * responsible for allocating a list of format names and passing them to
1472  * this routine.
1473  */
1474 int drm_mode_create_tv_properties(struct drm_device *dev,
1475 				  unsigned int num_modes,
1476 				  char *modes[])
1477 {
1478 	struct drm_property *tv_selector;
1479 	struct drm_property *tv_subconnector;
1480 	unsigned int i;
1481 
1482 	if (dev->mode_config.tv_select_subconnector_property)
1483 		return 0;
1484 
1485 	/*
1486 	 * Basic connector properties
1487 	 */
1488 	tv_selector = drm_property_create_enum(dev, 0,
1489 					  "select subconnector",
1490 					  drm_tv_select_enum_list,
1491 					  ARRAY_SIZE(drm_tv_select_enum_list));
1492 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1493 
1494 	tv_subconnector =
1495 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1496 				    "subconnector",
1497 				    drm_tv_subconnector_enum_list,
1498 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1499 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1500 
1501 	/*
1502 	 * Other, TV specific properties: margins & TV modes.
1503 	 */
1504 	dev->mode_config.tv_left_margin_property =
1505 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1506 
1507 	dev->mode_config.tv_right_margin_property =
1508 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1509 
1510 	dev->mode_config.tv_top_margin_property =
1511 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1512 
1513 	dev->mode_config.tv_bottom_margin_property =
1514 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1515 
1516 	dev->mode_config.tv_mode_property =
1517 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1518 				    "mode", num_modes);
1519 	for (i = 0; i < num_modes; i++)
1520 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1521 				      i, modes[i]);
1522 
1523 	dev->mode_config.tv_brightness_property =
1524 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1525 
1526 	dev->mode_config.tv_contrast_property =
1527 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1528 
1529 	dev->mode_config.tv_flicker_reduction_property =
1530 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1531 
1532 	dev->mode_config.tv_overscan_property =
1533 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1534 
1535 	dev->mode_config.tv_saturation_property =
1536 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1537 
1538 	dev->mode_config.tv_hue_property =
1539 		drm_property_create_range(dev, 0, "hue", 0, 100);
1540 
1541 	return 0;
1542 }
1543 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1544 
1545 /**
1546  * drm_mode_create_scaling_mode_property - create scaling mode property
1547  * @dev: DRM device
1548  *
1549  * Called by a driver the first time it's needed, must be attached to desired
1550  * connectors.
1551  */
1552 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1553 {
1554 	struct drm_property *scaling_mode;
1555 
1556 	if (dev->mode_config.scaling_mode_property)
1557 		return 0;
1558 
1559 	scaling_mode =
1560 		drm_property_create_enum(dev, 0, "scaling mode",
1561 				drm_scaling_mode_enum_list,
1562 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1563 
1564 	dev->mode_config.scaling_mode_property = scaling_mode;
1565 
1566 	return 0;
1567 }
1568 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1569 
1570 /**
1571  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1572  * @dev: DRM device
1573  *
1574  * Called by a driver the first time it's needed, must be attached to desired
1575  * connectors.
1576  *
1577  * Returns:
1578  * Zero on success, negative errno on failure.
1579  */
1580 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1581 {
1582 	if (dev->mode_config.aspect_ratio_property)
1583 		return 0;
1584 
1585 	dev->mode_config.aspect_ratio_property =
1586 		drm_property_create_enum(dev, 0, "aspect ratio",
1587 				drm_aspect_ratio_enum_list,
1588 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1589 
1590 	if (dev->mode_config.aspect_ratio_property == NULL)
1591 		return -ENOMEM;
1592 
1593 	return 0;
1594 }
1595 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1596 
1597 /**
1598  * drm_mode_create_dirty_property - create dirty property
1599  * @dev: DRM device
1600  *
1601  * Called by a driver the first time it's needed, must be attached to desired
1602  * connectors.
1603  */
1604 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1605 {
1606 	struct drm_property *dirty_info;
1607 
1608 	if (dev->mode_config.dirty_info_property)
1609 		return 0;
1610 
1611 	dirty_info =
1612 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1613 				    "dirty",
1614 				    drm_dirty_info_enum_list,
1615 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1616 	dev->mode_config.dirty_info_property = dirty_info;
1617 
1618 	return 0;
1619 }
1620 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1621 
1622 /**
1623  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1624  * @dev: DRM device
1625  *
1626  * Create the the suggested x/y offset property for connectors.
1627  */
1628 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1629 {
1630 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1631 		return 0;
1632 
1633 	dev->mode_config.suggested_x_property =
1634 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1635 
1636 	dev->mode_config.suggested_y_property =
1637 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1638 
1639 	if (dev->mode_config.suggested_x_property == NULL ||
1640 	    dev->mode_config.suggested_y_property == NULL)
1641 		return -ENOMEM;
1642 	return 0;
1643 }
1644 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1645 
1646 static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
1647 {
1648 	uint32_t total_objects = 0;
1649 
1650 	total_objects += dev->mode_config.num_crtc;
1651 	total_objects += dev->mode_config.num_connector;
1652 	total_objects += dev->mode_config.num_encoder;
1653 
1654 	group->id_list = kcalloc(total_objects, sizeof(uint32_t), GFP_KERNEL);
1655 	if (!group->id_list)
1656 		return -ENOMEM;
1657 
1658 	group->num_crtcs = 0;
1659 	group->num_connectors = 0;
1660 	group->num_encoders = 0;
1661 	return 0;
1662 }
1663 
1664 void drm_mode_group_destroy(struct drm_mode_group *group)
1665 {
1666 	kfree(group->id_list);
1667 	group->id_list = NULL;
1668 }
1669 
1670 /*
1671  * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
1672  * the drm core's responsibility to set up mode control groups.
1673  */
1674 int drm_mode_group_init_legacy_group(struct drm_device *dev,
1675 				     struct drm_mode_group *group)
1676 {
1677 	struct drm_crtc *crtc;
1678 	struct drm_encoder *encoder;
1679 	struct drm_connector *connector;
1680 	int ret;
1681 
1682 	ret = drm_mode_group_init(dev, group);
1683 	if (ret)
1684 		return ret;
1685 
1686 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
1687 		group->id_list[group->num_crtcs++] = crtc->base.id;
1688 
1689 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
1690 		group->id_list[group->num_crtcs + group->num_encoders++] =
1691 		encoder->base.id;
1692 
1693 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1694 		group->id_list[group->num_crtcs + group->num_encoders +
1695 			       group->num_connectors++] = connector->base.id;
1696 
1697 	return 0;
1698 }
1699 EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
1700 
1701 void drm_reinit_primary_mode_group(struct drm_device *dev)
1702 {
1703 	drm_modeset_lock_all(dev);
1704 	drm_mode_group_destroy(&dev->primary->mode_group);
1705 	drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
1706 	drm_modeset_unlock_all(dev);
1707 }
1708 EXPORT_SYMBOL(drm_reinit_primary_mode_group);
1709 
1710 /**
1711  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
1712  * @out: drm_mode_modeinfo struct to return to the user
1713  * @in: drm_display_mode to use
1714  *
1715  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
1716  * the user.
1717  */
1718 static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
1719 				      const struct drm_display_mode *in)
1720 {
1721 	WARN(in->hdisplay > USHRT_MAX || in->hsync_start > USHRT_MAX ||
1722 	     in->hsync_end > USHRT_MAX || in->htotal > USHRT_MAX ||
1723 	     in->hskew > USHRT_MAX || in->vdisplay > USHRT_MAX ||
1724 	     in->vsync_start > USHRT_MAX || in->vsync_end > USHRT_MAX ||
1725 	     in->vtotal > USHRT_MAX || in->vscan > USHRT_MAX,
1726 	     "timing values too large for mode info\n");
1727 
1728 	out->clock = in->clock;
1729 	out->hdisplay = in->hdisplay;
1730 	out->hsync_start = in->hsync_start;
1731 	out->hsync_end = in->hsync_end;
1732 	out->htotal = in->htotal;
1733 	out->hskew = in->hskew;
1734 	out->vdisplay = in->vdisplay;
1735 	out->vsync_start = in->vsync_start;
1736 	out->vsync_end = in->vsync_end;
1737 	out->vtotal = in->vtotal;
1738 	out->vscan = in->vscan;
1739 	out->vrefresh = in->vrefresh;
1740 	out->flags = in->flags;
1741 	out->type = in->type;
1742 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1743 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1744 }
1745 
1746 /**
1747  * drm_crtc_convert_umode - convert a modeinfo into a drm_display_mode
1748  * @out: drm_display_mode to return to the user
1749  * @in: drm_mode_modeinfo to use
1750  *
1751  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
1752  * the caller.
1753  *
1754  * Returns:
1755  * Zero on success, negative errno on failure.
1756  */
1757 static int drm_crtc_convert_umode(struct drm_display_mode *out,
1758 				  const struct drm_mode_modeinfo *in)
1759 {
1760 	if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
1761 		return -ERANGE;
1762 
1763 	if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
1764 		return -EINVAL;
1765 
1766 	out->clock = in->clock;
1767 	out->hdisplay = in->hdisplay;
1768 	out->hsync_start = in->hsync_start;
1769 	out->hsync_end = in->hsync_end;
1770 	out->htotal = in->htotal;
1771 	out->hskew = in->hskew;
1772 	out->vdisplay = in->vdisplay;
1773 	out->vsync_start = in->vsync_start;
1774 	out->vsync_end = in->vsync_end;
1775 	out->vtotal = in->vtotal;
1776 	out->vscan = in->vscan;
1777 	out->vrefresh = in->vrefresh;
1778 	out->flags = in->flags;
1779 	out->type = in->type;
1780 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1781 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1782 
1783 	return 0;
1784 }
1785 
1786 /**
1787  * drm_mode_getresources - get graphics configuration
1788  * @dev: drm device for the ioctl
1789  * @data: data pointer for the ioctl
1790  * @file_priv: drm file for the ioctl call
1791  *
1792  * Construct a set of configuration description structures and return
1793  * them to the user, including CRTC, connector and framebuffer configuration.
1794  *
1795  * Called by the user via ioctl.
1796  *
1797  * Returns:
1798  * Zero on success, negative errno on failure.
1799  */
1800 int drm_mode_getresources(struct drm_device *dev, void *data,
1801 			  struct drm_file *file_priv)
1802 {
1803 	struct drm_mode_card_res *card_res = data;
1804 	struct list_head *lh;
1805 	struct drm_framebuffer *fb;
1806 	struct drm_connector *connector;
1807 	struct drm_crtc *crtc;
1808 	struct drm_encoder *encoder;
1809 	int ret = 0;
1810 	int connector_count = 0;
1811 	int crtc_count = 0;
1812 	int fb_count = 0;
1813 	int encoder_count = 0;
1814 	int copied = 0, i;
1815 	uint32_t __user *fb_id;
1816 	uint32_t __user *crtc_id;
1817 	uint32_t __user *connector_id;
1818 	uint32_t __user *encoder_id;
1819 	struct drm_mode_group *mode_group;
1820 
1821 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1822 		return -EINVAL;
1823 
1824 
1825 	mutex_lock(&file_priv->fbs_lock);
1826 	/*
1827 	 * For the non-control nodes we need to limit the list of resources
1828 	 * by IDs in the group list for this node
1829 	 */
1830 	list_for_each(lh, &file_priv->fbs)
1831 		fb_count++;
1832 
1833 	/* handle this in 4 parts */
1834 	/* FBs */
1835 	if (card_res->count_fbs >= fb_count) {
1836 		copied = 0;
1837 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1838 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1839 			if (put_user(fb->base.id, fb_id + copied)) {
1840 				mutex_unlock(&file_priv->fbs_lock);
1841 				return -EFAULT;
1842 			}
1843 			copied++;
1844 		}
1845 	}
1846 	card_res->count_fbs = fb_count;
1847 	mutex_unlock(&file_priv->fbs_lock);
1848 
1849 	/* mode_config.mutex protects the connector list against e.g. DP MST
1850 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1851 	mutex_lock(&dev->mode_config.mutex);
1852 	if (!drm_is_primary_client(file_priv)) {
1853 
1854 		mode_group = NULL;
1855 		list_for_each(lh, &dev->mode_config.crtc_list)
1856 			crtc_count++;
1857 
1858 		list_for_each(lh, &dev->mode_config.connector_list)
1859 			connector_count++;
1860 
1861 		list_for_each(lh, &dev->mode_config.encoder_list)
1862 			encoder_count++;
1863 	} else {
1864 
1865 		mode_group = &file_priv->master->minor->mode_group;
1866 		crtc_count = mode_group->num_crtcs;
1867 		connector_count = mode_group->num_connectors;
1868 		encoder_count = mode_group->num_encoders;
1869 	}
1870 
1871 	card_res->max_height = dev->mode_config.max_height;
1872 	card_res->min_height = dev->mode_config.min_height;
1873 	card_res->max_width = dev->mode_config.max_width;
1874 	card_res->min_width = dev->mode_config.min_width;
1875 
1876 	/* CRTCs */
1877 	if (card_res->count_crtcs >= crtc_count) {
1878 		copied = 0;
1879 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1880 		if (!mode_group) {
1881 			list_for_each_entry(crtc, &dev->mode_config.crtc_list,
1882 					    head) {
1883 				DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1884 				if (put_user(crtc->base.id, crtc_id + copied)) {
1885 					ret = -EFAULT;
1886 					goto out;
1887 				}
1888 				copied++;
1889 			}
1890 		} else {
1891 			for (i = 0; i < mode_group->num_crtcs; i++) {
1892 				if (put_user(mode_group->id_list[i],
1893 					     crtc_id + copied)) {
1894 					ret = -EFAULT;
1895 					goto out;
1896 				}
1897 				copied++;
1898 			}
1899 		}
1900 	}
1901 	card_res->count_crtcs = crtc_count;
1902 
1903 	/* Encoders */
1904 	if (card_res->count_encoders >= encoder_count) {
1905 		copied = 0;
1906 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1907 		if (!mode_group) {
1908 			list_for_each_entry(encoder,
1909 					    &dev->mode_config.encoder_list,
1910 					    head) {
1911 				DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1912 						encoder->name);
1913 				if (put_user(encoder->base.id, encoder_id +
1914 					     copied)) {
1915 					ret = -EFAULT;
1916 					goto out;
1917 				}
1918 				copied++;
1919 			}
1920 		} else {
1921 			for (i = mode_group->num_crtcs; i < mode_group->num_crtcs + mode_group->num_encoders; i++) {
1922 				if (put_user(mode_group->id_list[i],
1923 					     encoder_id + copied)) {
1924 					ret = -EFAULT;
1925 					goto out;
1926 				}
1927 				copied++;
1928 			}
1929 
1930 		}
1931 	}
1932 	card_res->count_encoders = encoder_count;
1933 
1934 	/* Connectors */
1935 	if (card_res->count_connectors >= connector_count) {
1936 		copied = 0;
1937 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1938 		if (!mode_group) {
1939 			list_for_each_entry(connector,
1940 					    &dev->mode_config.connector_list,
1941 					    head) {
1942 				DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1943 					connector->base.id,
1944 					connector->name);
1945 				if (put_user(connector->base.id,
1946 					     connector_id + copied)) {
1947 					ret = -EFAULT;
1948 					goto out;
1949 				}
1950 				copied++;
1951 			}
1952 		} else {
1953 			int start = mode_group->num_crtcs +
1954 				mode_group->num_encoders;
1955 			for (i = start; i < start + mode_group->num_connectors; i++) {
1956 				if (put_user(mode_group->id_list[i],
1957 					     connector_id + copied)) {
1958 					ret = -EFAULT;
1959 					goto out;
1960 				}
1961 				copied++;
1962 			}
1963 		}
1964 	}
1965 	card_res->count_connectors = connector_count;
1966 
1967 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1968 		  card_res->count_connectors, card_res->count_encoders);
1969 
1970 out:
1971 	mutex_unlock(&dev->mode_config.mutex);
1972 	return ret;
1973 }
1974 
1975 /**
1976  * drm_mode_getcrtc - get CRTC configuration
1977  * @dev: drm device for the ioctl
1978  * @data: data pointer for the ioctl
1979  * @file_priv: drm file for the ioctl call
1980  *
1981  * Construct a CRTC configuration structure to return to the user.
1982  *
1983  * Called by the user via ioctl.
1984  *
1985  * Returns:
1986  * Zero on success, negative errno on failure.
1987  */
1988 int drm_mode_getcrtc(struct drm_device *dev,
1989 		     void *data, struct drm_file *file_priv)
1990 {
1991 	struct drm_mode_crtc *crtc_resp = data;
1992 	struct drm_crtc *crtc;
1993 
1994 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1995 		return -EINVAL;
1996 
1997 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1998 	if (!crtc)
1999 		return -ENOENT;
2000 
2001 	drm_modeset_lock_crtc(crtc, crtc->primary);
2002 	crtc_resp->x = crtc->x;
2003 	crtc_resp->y = crtc->y;
2004 	crtc_resp->gamma_size = crtc->gamma_size;
2005 	if (crtc->primary->fb)
2006 		crtc_resp->fb_id = crtc->primary->fb->base.id;
2007 	else
2008 		crtc_resp->fb_id = 0;
2009 
2010 	if (crtc->enabled) {
2011 
2012 		drm_crtc_convert_to_umode(&crtc_resp->mode, &crtc->mode);
2013 		crtc_resp->mode_valid = 1;
2014 
2015 	} else {
2016 		crtc_resp->mode_valid = 0;
2017 	}
2018 	drm_modeset_unlock_crtc(crtc);
2019 
2020 	return 0;
2021 }
2022 
2023 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
2024 					 const struct drm_file *file_priv)
2025 {
2026 	/*
2027 	 * If user-space hasn't configured the driver to expose the stereo 3D
2028 	 * modes, don't expose them.
2029 	 */
2030 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
2031 		return false;
2032 
2033 	return true;
2034 }
2035 
2036 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
2037 {
2038 	/* For atomic drivers only state objects are synchronously updated and
2039 	 * protected by modeset locks, so check those first. */
2040 	if (connector->state)
2041 		return connector->state->best_encoder;
2042 	return connector->encoder;
2043 }
2044 
2045 /* helper for getconnector and getproperties ioctls */
2046 static int get_properties(struct drm_mode_object *obj, bool atomic,
2047 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
2048 		uint32_t *arg_count_props)
2049 {
2050 	int props_count;
2051 	int i, ret, copied;
2052 
2053 	props_count = obj->properties->count;
2054 	if (!atomic)
2055 		props_count -= obj->properties->atomic_count;
2056 
2057 	if ((*arg_count_props >= props_count) && props_count) {
2058 		for (i = 0, copied = 0; copied < props_count; i++) {
2059 			struct drm_property *prop = obj->properties->properties[i];
2060 			uint64_t val;
2061 
2062 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
2063 				continue;
2064 
2065 			ret = drm_object_property_get_value(obj, prop, &val);
2066 			if (ret)
2067 				return ret;
2068 
2069 			if (put_user(prop->base.id, prop_ptr + copied))
2070 				return -EFAULT;
2071 
2072 			if (put_user(val, prop_values + copied))
2073 				return -EFAULT;
2074 
2075 			copied++;
2076 		}
2077 	}
2078 	*arg_count_props = props_count;
2079 
2080 	return 0;
2081 }
2082 
2083 /**
2084  * drm_mode_getconnector - get connector configuration
2085  * @dev: drm device for the ioctl
2086  * @data: data pointer for the ioctl
2087  * @file_priv: drm file for the ioctl call
2088  *
2089  * Construct a connector configuration structure to return to the user.
2090  *
2091  * Called by the user via ioctl.
2092  *
2093  * Returns:
2094  * Zero on success, negative errno on failure.
2095  */
2096 int drm_mode_getconnector(struct drm_device *dev, void *data,
2097 			  struct drm_file *file_priv)
2098 {
2099 	struct drm_mode_get_connector *out_resp = data;
2100 	struct drm_connector *connector;
2101 	struct drm_encoder *encoder;
2102 	struct drm_display_mode *mode;
2103 	int mode_count = 0;
2104 	int encoders_count = 0;
2105 	int ret = 0;
2106 	int copied = 0;
2107 	int i;
2108 	struct drm_mode_modeinfo u_mode;
2109 	struct drm_mode_modeinfo __user *mode_ptr;
2110 	uint32_t __user *encoder_ptr;
2111 
2112 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2113 		return -EINVAL;
2114 
2115 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2116 
2117 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2118 
2119 	mutex_lock(&dev->mode_config.mutex);
2120 
2121 	connector = drm_connector_find(dev, out_resp->connector_id);
2122 	if (!connector) {
2123 		ret = -ENOENT;
2124 		goto out;
2125 	}
2126 
2127 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2128 		if (connector->encoder_ids[i] != 0)
2129 			encoders_count++;
2130 
2131 	if (out_resp->count_modes == 0) {
2132 		connector->funcs->fill_modes(connector,
2133 					     dev->mode_config.max_width,
2134 					     dev->mode_config.max_height);
2135 	}
2136 
2137 	/* delayed so we get modes regardless of pre-fill_modes state */
2138 	list_for_each_entry(mode, &connector->modes, head)
2139 		if (drm_mode_expose_to_userspace(mode, file_priv))
2140 			mode_count++;
2141 
2142 	out_resp->connector_id = connector->base.id;
2143 	out_resp->connector_type = connector->connector_type;
2144 	out_resp->connector_type_id = connector->connector_type_id;
2145 	out_resp->mm_width = connector->display_info.width_mm;
2146 	out_resp->mm_height = connector->display_info.height_mm;
2147 	out_resp->subpixel = connector->display_info.subpixel_order;
2148 	out_resp->connection = connector->status;
2149 
2150 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2151 	encoder = drm_connector_get_encoder(connector);
2152 	if (encoder)
2153 		out_resp->encoder_id = encoder->base.id;
2154 	else
2155 		out_resp->encoder_id = 0;
2156 
2157 	/*
2158 	 * This ioctl is called twice, once to determine how much space is
2159 	 * needed, and the 2nd time to fill it.
2160 	 */
2161 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2162 		copied = 0;
2163 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2164 		list_for_each_entry(mode, &connector->modes, head) {
2165 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2166 				continue;
2167 
2168 			drm_crtc_convert_to_umode(&u_mode, mode);
2169 			if (copy_to_user(mode_ptr + copied,
2170 					 &u_mode, sizeof(u_mode))) {
2171 				ret = -EFAULT;
2172 				goto out;
2173 			}
2174 			copied++;
2175 		}
2176 	}
2177 	out_resp->count_modes = mode_count;
2178 
2179 	ret = get_properties(&connector->base, file_priv->atomic,
2180 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2181 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2182 			&out_resp->count_props);
2183 	if (ret)
2184 		goto out;
2185 
2186 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2187 		copied = 0;
2188 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2189 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2190 			if (connector->encoder_ids[i] != 0) {
2191 				if (put_user(connector->encoder_ids[i],
2192 					     encoder_ptr + copied)) {
2193 					ret = -EFAULT;
2194 					goto out;
2195 				}
2196 				copied++;
2197 			}
2198 		}
2199 	}
2200 	out_resp->count_encoders = encoders_count;
2201 
2202 out:
2203 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2204 	mutex_unlock(&dev->mode_config.mutex);
2205 
2206 	return ret;
2207 }
2208 
2209 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2210 {
2211 	struct drm_connector *connector;
2212 	struct drm_device *dev = encoder->dev;
2213 	bool uses_atomic = false;
2214 
2215 	/* For atomic drivers only state objects are synchronously updated and
2216 	 * protected by modeset locks, so check those first. */
2217 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
2218 		if (!connector->state)
2219 			continue;
2220 
2221 		uses_atomic = true;
2222 
2223 		if (connector->state->best_encoder != encoder)
2224 			continue;
2225 
2226 		return connector->state->crtc;
2227 	}
2228 
2229 	/* Don't return stale data (e.g. pending async disable). */
2230 	if (uses_atomic)
2231 		return NULL;
2232 
2233 	return encoder->crtc;
2234 }
2235 
2236 /**
2237  * drm_mode_getencoder - get encoder configuration
2238  * @dev: drm device for the ioctl
2239  * @data: data pointer for the ioctl
2240  * @file_priv: drm file for the ioctl call
2241  *
2242  * Construct a encoder configuration structure to return to the user.
2243  *
2244  * Called by the user via ioctl.
2245  *
2246  * Returns:
2247  * Zero on success, negative errno on failure.
2248  */
2249 int drm_mode_getencoder(struct drm_device *dev, void *data,
2250 			struct drm_file *file_priv)
2251 {
2252 	struct drm_mode_get_encoder *enc_resp = data;
2253 	struct drm_encoder *encoder;
2254 	struct drm_crtc *crtc;
2255 
2256 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2257 		return -EINVAL;
2258 
2259 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2260 	if (!encoder)
2261 		return -ENOENT;
2262 
2263 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2264 	crtc = drm_encoder_get_crtc(encoder);
2265 	if (crtc)
2266 		enc_resp->crtc_id = crtc->base.id;
2267 	else if (encoder->crtc)
2268 		enc_resp->crtc_id = encoder->crtc->base.id;
2269 	else
2270 		enc_resp->crtc_id = 0;
2271 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2272 
2273 	enc_resp->encoder_type = encoder->encoder_type;
2274 	enc_resp->encoder_id = encoder->base.id;
2275 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2276 	enc_resp->possible_clones = encoder->possible_clones;
2277 
2278 	return 0;
2279 }
2280 
2281 /**
2282  * drm_mode_getplane_res - enumerate all plane resources
2283  * @dev: DRM device
2284  * @data: ioctl data
2285  * @file_priv: DRM file info
2286  *
2287  * Construct a list of plane ids to return to the user.
2288  *
2289  * Called by the user via ioctl.
2290  *
2291  * Returns:
2292  * Zero on success, negative errno on failure.
2293  */
2294 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2295 			  struct drm_file *file_priv)
2296 {
2297 	struct drm_mode_get_plane_res *plane_resp = data;
2298 	struct drm_mode_config *config;
2299 	struct drm_plane *plane;
2300 	uint32_t __user *plane_ptr;
2301 	int copied = 0;
2302 	unsigned num_planes;
2303 
2304 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2305 		return -EINVAL;
2306 
2307 	config = &dev->mode_config;
2308 
2309 	if (file_priv->universal_planes)
2310 		num_planes = config->num_total_plane;
2311 	else
2312 		num_planes = config->num_overlay_plane;
2313 
2314 	/*
2315 	 * This ioctl is called twice, once to determine how much space is
2316 	 * needed, and the 2nd time to fill it.
2317 	 */
2318 	if (num_planes &&
2319 	    (plane_resp->count_planes >= num_planes)) {
2320 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2321 
2322 		/* Plane lists are invariant, no locking needed. */
2323 		list_for_each_entry(plane, &config->plane_list, head) {
2324 			/*
2325 			 * Unless userspace set the 'universal planes'
2326 			 * capability bit, only advertise overlays.
2327 			 */
2328 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2329 			    !file_priv->universal_planes)
2330 				continue;
2331 
2332 			if (put_user(plane->base.id, plane_ptr + copied))
2333 				return -EFAULT;
2334 			copied++;
2335 		}
2336 	}
2337 	plane_resp->count_planes = num_planes;
2338 
2339 	return 0;
2340 }
2341 
2342 /**
2343  * drm_mode_getplane - get plane configuration
2344  * @dev: DRM device
2345  * @data: ioctl data
2346  * @file_priv: DRM file info
2347  *
2348  * Construct a plane configuration structure to return to the user.
2349  *
2350  * Called by the user via ioctl.
2351  *
2352  * Returns:
2353  * Zero on success, negative errno on failure.
2354  */
2355 int drm_mode_getplane(struct drm_device *dev, void *data,
2356 		      struct drm_file *file_priv)
2357 {
2358 	struct drm_mode_get_plane *plane_resp = data;
2359 	struct drm_plane *plane;
2360 	uint32_t __user *format_ptr;
2361 
2362 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2363 		return -EINVAL;
2364 
2365 	plane = drm_plane_find(dev, plane_resp->plane_id);
2366 	if (!plane)
2367 		return -ENOENT;
2368 
2369 	drm_modeset_lock(&plane->mutex, NULL);
2370 	if (plane->crtc)
2371 		plane_resp->crtc_id = plane->crtc->base.id;
2372 	else
2373 		plane_resp->crtc_id = 0;
2374 
2375 	if (plane->fb)
2376 		plane_resp->fb_id = plane->fb->base.id;
2377 	else
2378 		plane_resp->fb_id = 0;
2379 	drm_modeset_unlock(&plane->mutex);
2380 
2381 	plane_resp->plane_id = plane->base.id;
2382 	plane_resp->possible_crtcs = plane->possible_crtcs;
2383 	plane_resp->gamma_size = 0;
2384 
2385 	/*
2386 	 * This ioctl is called twice, once to determine how much space is
2387 	 * needed, and the 2nd time to fill it.
2388 	 */
2389 	if (plane->format_count &&
2390 	    (plane_resp->count_format_types >= plane->format_count)) {
2391 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2392 		if (copy_to_user(format_ptr,
2393 				 plane->format_types,
2394 				 sizeof(uint32_t) * plane->format_count)) {
2395 			return -EFAULT;
2396 		}
2397 	}
2398 	plane_resp->count_format_types = plane->format_count;
2399 
2400 	return 0;
2401 }
2402 
2403 /*
2404  * setplane_internal - setplane handler for internal callers
2405  *
2406  * Note that we assume an extra reference has already been taken on fb.  If the
2407  * update fails, this reference will be dropped before return; if it succeeds,
2408  * the previous framebuffer (if any) will be unreferenced instead.
2409  *
2410  * src_{x,y,w,h} are provided in 16.16 fixed point format
2411  */
2412 static int __setplane_internal(struct drm_plane *plane,
2413 			       struct drm_crtc *crtc,
2414 			       struct drm_framebuffer *fb,
2415 			       int32_t crtc_x, int32_t crtc_y,
2416 			       uint32_t crtc_w, uint32_t crtc_h,
2417 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2418 			       uint32_t src_x, uint32_t src_y,
2419 			       uint32_t src_w, uint32_t src_h)
2420 {
2421 	int ret = 0;
2422 	unsigned int fb_width, fb_height;
2423 	unsigned int i;
2424 
2425 	/* No fb means shut it down */
2426 	if (!fb) {
2427 		plane->old_fb = plane->fb;
2428 		ret = plane->funcs->disable_plane(plane);
2429 		if (!ret) {
2430 			plane->crtc = NULL;
2431 			plane->fb = NULL;
2432 		} else {
2433 			plane->old_fb = NULL;
2434 		}
2435 		goto out;
2436 	}
2437 
2438 	/* Check whether this plane is usable on this CRTC */
2439 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2440 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2441 		ret = -EINVAL;
2442 		goto out;
2443 	}
2444 
2445 	/* Check whether this plane supports the fb pixel format. */
2446 	for (i = 0; i < plane->format_count; i++)
2447 		if (fb->pixel_format == plane->format_types[i])
2448 			break;
2449 	if (i == plane->format_count) {
2450 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2451 			      drm_get_format_name(fb->pixel_format));
2452 		ret = -EINVAL;
2453 		goto out;
2454 	}
2455 
2456 	fb_width = fb->width << 16;
2457 	fb_height = fb->height << 16;
2458 
2459 	/* Make sure source coordinates are inside the fb. */
2460 	if (src_w > fb_width ||
2461 	    src_x > fb_width - src_w ||
2462 	    src_h > fb_height ||
2463 	    src_y > fb_height - src_h) {
2464 		DRM_DEBUG_KMS("Invalid source coordinates "
2465 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2466 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2467 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2468 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2469 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2470 		ret = -ENOSPC;
2471 		goto out;
2472 	}
2473 
2474 	plane->old_fb = plane->fb;
2475 	ret = plane->funcs->update_plane(plane, crtc, fb,
2476 					 crtc_x, crtc_y, crtc_w, crtc_h,
2477 					 src_x, src_y, src_w, src_h);
2478 	if (!ret) {
2479 		plane->crtc = crtc;
2480 		plane->fb = fb;
2481 		fb = NULL;
2482 	} else {
2483 		plane->old_fb = NULL;
2484 	}
2485 
2486 out:
2487 	if (fb)
2488 		drm_framebuffer_unreference(fb);
2489 	if (plane->old_fb)
2490 		drm_framebuffer_unreference(plane->old_fb);
2491 	plane->old_fb = NULL;
2492 
2493 	return ret;
2494 }
2495 
2496 static int setplane_internal(struct drm_plane *plane,
2497 			     struct drm_crtc *crtc,
2498 			     struct drm_framebuffer *fb,
2499 			     int32_t crtc_x, int32_t crtc_y,
2500 			     uint32_t crtc_w, uint32_t crtc_h,
2501 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2502 			     uint32_t src_x, uint32_t src_y,
2503 			     uint32_t src_w, uint32_t src_h)
2504 {
2505 	int ret;
2506 
2507 	drm_modeset_lock_all(plane->dev);
2508 	ret = __setplane_internal(plane, crtc, fb,
2509 				  crtc_x, crtc_y, crtc_w, crtc_h,
2510 				  src_x, src_y, src_w, src_h);
2511 	drm_modeset_unlock_all(plane->dev);
2512 
2513 	return ret;
2514 }
2515 
2516 /**
2517  * drm_mode_setplane - configure a plane's configuration
2518  * @dev: DRM device
2519  * @data: ioctl data*
2520  * @file_priv: DRM file info
2521  *
2522  * Set plane configuration, including placement, fb, scaling, and other factors.
2523  * Or pass a NULL fb to disable (planes may be disabled without providing a
2524  * valid crtc).
2525  *
2526  * Returns:
2527  * Zero on success, negative errno on failure.
2528  */
2529 int drm_mode_setplane(struct drm_device *dev, void *data,
2530 		      struct drm_file *file_priv)
2531 {
2532 	struct drm_mode_set_plane *plane_req = data;
2533 	struct drm_plane *plane;
2534 	struct drm_crtc *crtc = NULL;
2535 	struct drm_framebuffer *fb = NULL;
2536 
2537 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2538 		return -EINVAL;
2539 
2540 	/* Give drivers some help against integer overflows */
2541 	if (plane_req->crtc_w > INT_MAX ||
2542 	    plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
2543 	    plane_req->crtc_h > INT_MAX ||
2544 	    plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
2545 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2546 			      plane_req->crtc_w, plane_req->crtc_h,
2547 			      plane_req->crtc_x, plane_req->crtc_y);
2548 		return -ERANGE;
2549 	}
2550 
2551 	/*
2552 	 * First, find the plane, crtc, and fb objects.  If not available,
2553 	 * we don't bother to call the driver.
2554 	 */
2555 	plane = drm_plane_find(dev, plane_req->plane_id);
2556 	if (!plane) {
2557 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2558 			      plane_req->plane_id);
2559 		return -ENOENT;
2560 	}
2561 
2562 	if (plane_req->fb_id) {
2563 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2564 		if (!fb) {
2565 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2566 				      plane_req->fb_id);
2567 			return -ENOENT;
2568 		}
2569 
2570 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2571 		if (!crtc) {
2572 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2573 				      plane_req->crtc_id);
2574 			return -ENOENT;
2575 		}
2576 	}
2577 
2578 	/*
2579 	 * setplane_internal will take care of deref'ing either the old or new
2580 	 * framebuffer depending on success.
2581 	 */
2582 	return setplane_internal(plane, crtc, fb,
2583 				 plane_req->crtc_x, plane_req->crtc_y,
2584 				 plane_req->crtc_w, plane_req->crtc_h,
2585 				 plane_req->src_x, plane_req->src_y,
2586 				 plane_req->src_w, plane_req->src_h);
2587 }
2588 
2589 /**
2590  * drm_mode_set_config_internal - helper to call ->set_config
2591  * @set: modeset config to set
2592  *
2593  * This is a little helper to wrap internal calls to the ->set_config driver
2594  * interface. The only thing it adds is correct refcounting dance.
2595  *
2596  * Returns:
2597  * Zero on success, negative errno on failure.
2598  */
2599 int drm_mode_set_config_internal(struct drm_mode_set *set)
2600 {
2601 	struct drm_crtc *crtc = set->crtc;
2602 	struct drm_framebuffer *fb;
2603 	struct drm_crtc *tmp;
2604 	int ret;
2605 
2606 	/*
2607 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2608 	 * connectors from it), hence we need to refcount the fbs across all
2609 	 * crtcs. Atomic modeset will have saner semantics ...
2610 	 */
2611 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head)
2612 		tmp->primary->old_fb = tmp->primary->fb;
2613 
2614 	fb = set->fb;
2615 
2616 	ret = crtc->funcs->set_config(set);
2617 	if (ret == 0) {
2618 		crtc->primary->crtc = crtc;
2619 		crtc->primary->fb = fb;
2620 	}
2621 
2622 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
2623 		if (tmp->primary->fb)
2624 			drm_framebuffer_reference(tmp->primary->fb);
2625 		if (tmp->primary->old_fb)
2626 			drm_framebuffer_unreference(tmp->primary->old_fb);
2627 		tmp->primary->old_fb = NULL;
2628 	}
2629 
2630 	return ret;
2631 }
2632 EXPORT_SYMBOL(drm_mode_set_config_internal);
2633 
2634 /**
2635  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2636  * @mode: mode to query
2637  * @hdisplay: hdisplay value to fill in
2638  * @vdisplay: vdisplay value to fill in
2639  *
2640  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2641  * the appropriate layout.
2642  */
2643 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2644 			    int *hdisplay, int *vdisplay)
2645 {
2646 	struct drm_display_mode adjusted;
2647 
2648 	drm_mode_copy(&adjusted, mode);
2649 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2650 	*hdisplay = adjusted.crtc_hdisplay;
2651 	*vdisplay = adjusted.crtc_vdisplay;
2652 }
2653 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2654 
2655 /**
2656  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2657  *     CRTC viewport
2658  * @crtc: CRTC that framebuffer will be displayed on
2659  * @x: x panning
2660  * @y: y panning
2661  * @mode: mode that framebuffer will be displayed under
2662  * @fb: framebuffer to check size of
2663  */
2664 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2665 			    int x, int y,
2666 			    const struct drm_display_mode *mode,
2667 			    const struct drm_framebuffer *fb)
2668 
2669 {
2670 	int hdisplay, vdisplay;
2671 
2672 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2673 
2674 	if (crtc->invert_dimensions)
2675 		swap(hdisplay, vdisplay);
2676 
2677 	if (hdisplay > fb->width ||
2678 	    vdisplay > fb->height ||
2679 	    x > fb->width - hdisplay ||
2680 	    y > fb->height - vdisplay) {
2681 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2682 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2683 			      crtc->invert_dimensions ? " (inverted)" : "");
2684 		return -ENOSPC;
2685 	}
2686 
2687 	return 0;
2688 }
2689 EXPORT_SYMBOL(drm_crtc_check_viewport);
2690 
2691 /**
2692  * drm_mode_setcrtc - set CRTC configuration
2693  * @dev: drm device for the ioctl
2694  * @data: data pointer for the ioctl
2695  * @file_priv: drm file for the ioctl call
2696  *
2697  * Build a new CRTC configuration based on user request.
2698  *
2699  * Called by the user via ioctl.
2700  *
2701  * Returns:
2702  * Zero on success, negative errno on failure.
2703  */
2704 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2705 		     struct drm_file *file_priv)
2706 {
2707 	struct drm_mode_config *config = &dev->mode_config;
2708 	struct drm_mode_crtc *crtc_req = data;
2709 	struct drm_crtc *crtc;
2710 	struct drm_connector **connector_set = NULL, *connector;
2711 	struct drm_framebuffer *fb = NULL;
2712 	struct drm_display_mode *mode = NULL;
2713 	struct drm_mode_set set;
2714 	uint32_t __user *set_connectors_ptr;
2715 	int ret;
2716 	int i;
2717 
2718 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2719 		return -EINVAL;
2720 
2721 	/* For some reason crtc x/y offsets are signed internally. */
2722 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
2723 		return -ERANGE;
2724 
2725 	drm_modeset_lock_all(dev);
2726 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2727 	if (!crtc) {
2728 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2729 		ret = -ENOENT;
2730 		goto out;
2731 	}
2732 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2733 
2734 	if (crtc_req->mode_valid) {
2735 		/* If we have a mode we need a framebuffer. */
2736 		/* If we pass -1, set the mode with the currently bound fb */
2737 		if (crtc_req->fb_id == -1) {
2738 			if (!crtc->primary->fb) {
2739 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2740 				ret = -EINVAL;
2741 				goto out;
2742 			}
2743 			fb = crtc->primary->fb;
2744 			/* Make refcounting symmetric with the lookup path. */
2745 			drm_framebuffer_reference(fb);
2746 		} else {
2747 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2748 			if (!fb) {
2749 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2750 						crtc_req->fb_id);
2751 				ret = -ENOENT;
2752 				goto out;
2753 			}
2754 		}
2755 
2756 		mode = drm_mode_create(dev);
2757 		if (!mode) {
2758 			ret = -ENOMEM;
2759 			goto out;
2760 		}
2761 
2762 		ret = drm_crtc_convert_umode(mode, &crtc_req->mode);
2763 		if (ret) {
2764 			DRM_DEBUG_KMS("Invalid mode\n");
2765 			goto out;
2766 		}
2767 
2768 		mode->status = drm_mode_validate_basic(mode);
2769 		if (mode->status != MODE_OK) {
2770 			ret = -EINVAL;
2771 			goto out;
2772 		}
2773 
2774 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2775 
2776 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2777 					      mode, fb);
2778 		if (ret)
2779 			goto out;
2780 
2781 	}
2782 
2783 	if (crtc_req->count_connectors == 0 && mode) {
2784 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2785 		ret = -EINVAL;
2786 		goto out;
2787 	}
2788 
2789 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2790 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2791 			  crtc_req->count_connectors);
2792 		ret = -EINVAL;
2793 		goto out;
2794 	}
2795 
2796 	if (crtc_req->count_connectors > 0) {
2797 		u32 out_id;
2798 
2799 		/* Avoid unbounded kernel memory allocation */
2800 		if (crtc_req->count_connectors > config->num_connector) {
2801 			ret = -EINVAL;
2802 			goto out;
2803 		}
2804 
2805 		connector_set = kmalloc_array(crtc_req->count_connectors,
2806 					      sizeof(struct drm_connector *),
2807 					      GFP_KERNEL);
2808 		if (!connector_set) {
2809 			ret = -ENOMEM;
2810 			goto out;
2811 		}
2812 
2813 		for (i = 0; i < crtc_req->count_connectors; i++) {
2814 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2815 			if (get_user(out_id, &set_connectors_ptr[i])) {
2816 				ret = -EFAULT;
2817 				goto out;
2818 			}
2819 
2820 			connector = drm_connector_find(dev, out_id);
2821 			if (!connector) {
2822 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2823 						out_id);
2824 				ret = -ENOENT;
2825 				goto out;
2826 			}
2827 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2828 					connector->base.id,
2829 					connector->name);
2830 
2831 			connector_set[i] = connector;
2832 		}
2833 	}
2834 
2835 	set.crtc = crtc;
2836 	set.x = crtc_req->x;
2837 	set.y = crtc_req->y;
2838 	set.mode = mode;
2839 	set.connectors = connector_set;
2840 	set.num_connectors = crtc_req->count_connectors;
2841 	set.fb = fb;
2842 	ret = drm_mode_set_config_internal(&set);
2843 
2844 out:
2845 	if (fb)
2846 		drm_framebuffer_unreference(fb);
2847 
2848 	kfree(connector_set);
2849 	drm_mode_destroy(dev, mode);
2850 	drm_modeset_unlock_all(dev);
2851 	return ret;
2852 }
2853 
2854 /**
2855  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2856  *     universal plane handler call
2857  * @crtc: crtc to update cursor for
2858  * @req: data pointer for the ioctl
2859  * @file_priv: drm file for the ioctl call
2860  *
2861  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2862  * translate legacy ioctl calls into universal plane handler calls, we need to
2863  * wrap the native buffer handle in a drm_framebuffer.
2864  *
2865  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2866  * buffer with a pitch of 4*width; the universal plane interface should be used
2867  * directly in cases where the hardware can support other buffer settings and
2868  * userspace wants to make use of these capabilities.
2869  *
2870  * Returns:
2871  * Zero on success, negative errno on failure.
2872  */
2873 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2874 				     struct drm_mode_cursor2 *req,
2875 				     struct drm_file *file_priv)
2876 {
2877 	struct drm_device *dev = crtc->dev;
2878 	struct drm_framebuffer *fb = NULL;
2879 	struct drm_mode_fb_cmd2 fbreq = {
2880 		.width = req->width,
2881 		.height = req->height,
2882 		.pixel_format = DRM_FORMAT_ARGB8888,
2883 		.pitches = { req->width * 4 },
2884 		.handles = { req->handle },
2885 	};
2886 	int32_t crtc_x, crtc_y;
2887 	uint32_t crtc_w = 0, crtc_h = 0;
2888 	uint32_t src_w = 0, src_h = 0;
2889 	int ret = 0;
2890 
2891 	BUG_ON(!crtc->cursor);
2892 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2893 
2894 	/*
2895 	 * Obtain fb we'll be using (either new or existing) and take an extra
2896 	 * reference to it if fb != null.  setplane will take care of dropping
2897 	 * the reference if the plane update fails.
2898 	 */
2899 	if (req->flags & DRM_MODE_CURSOR_BO) {
2900 		if (req->handle) {
2901 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2902 			if (IS_ERR(fb)) {
2903 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2904 				return PTR_ERR(fb);
2905 			}
2906 		} else {
2907 			fb = NULL;
2908 		}
2909 	} else {
2910 		fb = crtc->cursor->fb;
2911 		if (fb)
2912 			drm_framebuffer_reference(fb);
2913 	}
2914 
2915 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2916 		crtc_x = req->x;
2917 		crtc_y = req->y;
2918 	} else {
2919 		crtc_x = crtc->cursor_x;
2920 		crtc_y = crtc->cursor_y;
2921 	}
2922 
2923 	if (fb) {
2924 		crtc_w = fb->width;
2925 		crtc_h = fb->height;
2926 		src_w = fb->width << 16;
2927 		src_h = fb->height << 16;
2928 	}
2929 
2930 	/*
2931 	 * setplane_internal will take care of deref'ing either the old or new
2932 	 * framebuffer depending on success.
2933 	 */
2934 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2935 				crtc_x, crtc_y, crtc_w, crtc_h,
2936 				0, 0, src_w, src_h);
2937 
2938 	/* Update successful; save new cursor position, if necessary */
2939 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2940 		crtc->cursor_x = req->x;
2941 		crtc->cursor_y = req->y;
2942 	}
2943 
2944 	return ret;
2945 }
2946 
2947 static int drm_mode_cursor_common(struct drm_device *dev,
2948 				  struct drm_mode_cursor2 *req,
2949 				  struct drm_file *file_priv)
2950 {
2951 	struct drm_crtc *crtc;
2952 	int ret = 0;
2953 
2954 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2955 		return -EINVAL;
2956 
2957 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2958 		return -EINVAL;
2959 
2960 	crtc = drm_crtc_find(dev, req->crtc_id);
2961 	if (!crtc) {
2962 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2963 		return -ENOENT;
2964 	}
2965 
2966 	/*
2967 	 * If this crtc has a universal cursor plane, call that plane's update
2968 	 * handler rather than using legacy cursor handlers.
2969 	 */
2970 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2971 	if (crtc->cursor) {
2972 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2973 		goto out;
2974 	}
2975 
2976 	if (req->flags & DRM_MODE_CURSOR_BO) {
2977 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2978 			ret = -ENXIO;
2979 			goto out;
2980 		}
2981 		/* Turns off the cursor if handle is 0 */
2982 		if (crtc->funcs->cursor_set2)
2983 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2984 						      req->width, req->height, req->hot_x, req->hot_y);
2985 		else
2986 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2987 						      req->width, req->height);
2988 	}
2989 
2990 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2991 		if (crtc->funcs->cursor_move) {
2992 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2993 		} else {
2994 			ret = -EFAULT;
2995 			goto out;
2996 		}
2997 	}
2998 out:
2999 	drm_modeset_unlock_crtc(crtc);
3000 
3001 	return ret;
3002 
3003 }
3004 
3005 
3006 /**
3007  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
3008  * @dev: drm device for the ioctl
3009  * @data: data pointer for the ioctl
3010  * @file_priv: drm file for the ioctl call
3011  *
3012  * Set the cursor configuration based on user request.
3013  *
3014  * Called by the user via ioctl.
3015  *
3016  * Returns:
3017  * Zero on success, negative errno on failure.
3018  */
3019 int drm_mode_cursor_ioctl(struct drm_device *dev,
3020 			  void *data, struct drm_file *file_priv)
3021 {
3022 	struct drm_mode_cursor *req = data;
3023 	struct drm_mode_cursor2 new_req;
3024 
3025 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
3026 	new_req.hot_x = new_req.hot_y = 0;
3027 
3028 	return drm_mode_cursor_common(dev, &new_req, file_priv);
3029 }
3030 
3031 /**
3032  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
3033  * @dev: drm device for the ioctl
3034  * @data: data pointer for the ioctl
3035  * @file_priv: drm file for the ioctl call
3036  *
3037  * Set the cursor configuration based on user request. This implements the 2nd
3038  * version of the cursor ioctl, which allows userspace to additionally specify
3039  * the hotspot of the pointer.
3040  *
3041  * Called by the user via ioctl.
3042  *
3043  * Returns:
3044  * Zero on success, negative errno on failure.
3045  */
3046 int drm_mode_cursor2_ioctl(struct drm_device *dev,
3047 			   void *data, struct drm_file *file_priv)
3048 {
3049 	struct drm_mode_cursor2 *req = data;
3050 
3051 	return drm_mode_cursor_common(dev, req, file_priv);
3052 }
3053 
3054 /**
3055  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3056  * @bpp: bits per pixels
3057  * @depth: bit depth per pixel
3058  *
3059  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3060  * Useful in fbdev emulation code, since that deals in those values.
3061  */
3062 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3063 {
3064 	uint32_t fmt;
3065 
3066 	switch (bpp) {
3067 	case 8:
3068 		fmt = DRM_FORMAT_C8;
3069 		break;
3070 	case 16:
3071 		if (depth == 15)
3072 			fmt = DRM_FORMAT_XRGB1555;
3073 		else
3074 			fmt = DRM_FORMAT_RGB565;
3075 		break;
3076 	case 24:
3077 		fmt = DRM_FORMAT_RGB888;
3078 		break;
3079 	case 32:
3080 		if (depth == 24)
3081 			fmt = DRM_FORMAT_XRGB8888;
3082 		else if (depth == 30)
3083 			fmt = DRM_FORMAT_XRGB2101010;
3084 		else
3085 			fmt = DRM_FORMAT_ARGB8888;
3086 		break;
3087 	default:
3088 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3089 		fmt = DRM_FORMAT_XRGB8888;
3090 		break;
3091 	}
3092 
3093 	return fmt;
3094 }
3095 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3096 
3097 /**
3098  * drm_mode_addfb - add an FB to the graphics configuration
3099  * @dev: drm device for the ioctl
3100  * @data: data pointer for the ioctl
3101  * @file_priv: drm file for the ioctl call
3102  *
3103  * Add a new FB to the specified CRTC, given a user request. This is the
3104  * original addfb ioctl which only supported RGB formats.
3105  *
3106  * Called by the user via ioctl.
3107  *
3108  * Returns:
3109  * Zero on success, negative errno on failure.
3110  */
3111 int drm_mode_addfb(struct drm_device *dev,
3112 		   void *data, struct drm_file *file_priv)
3113 {
3114 	struct drm_mode_fb_cmd *or = data;
3115 	struct drm_mode_fb_cmd2 r = {};
3116 	int ret;
3117 
3118 	/* convert to new format and call new ioctl */
3119 	r.fb_id = or->fb_id;
3120 	r.width = or->width;
3121 	r.height = or->height;
3122 	r.pitches[0] = or->pitch;
3123 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3124 	r.handles[0] = or->handle;
3125 
3126 	ret = drm_mode_addfb2(dev, &r, file_priv);
3127 	if (ret)
3128 		return ret;
3129 
3130 	or->fb_id = r.fb_id;
3131 
3132 	return 0;
3133 }
3134 
3135 static int format_check(const struct drm_mode_fb_cmd2 *r)
3136 {
3137 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3138 
3139 	switch (format) {
3140 	case DRM_FORMAT_C8:
3141 	case DRM_FORMAT_RGB332:
3142 	case DRM_FORMAT_BGR233:
3143 	case DRM_FORMAT_XRGB4444:
3144 	case DRM_FORMAT_XBGR4444:
3145 	case DRM_FORMAT_RGBX4444:
3146 	case DRM_FORMAT_BGRX4444:
3147 	case DRM_FORMAT_ARGB4444:
3148 	case DRM_FORMAT_ABGR4444:
3149 	case DRM_FORMAT_RGBA4444:
3150 	case DRM_FORMAT_BGRA4444:
3151 	case DRM_FORMAT_XRGB1555:
3152 	case DRM_FORMAT_XBGR1555:
3153 	case DRM_FORMAT_RGBX5551:
3154 	case DRM_FORMAT_BGRX5551:
3155 	case DRM_FORMAT_ARGB1555:
3156 	case DRM_FORMAT_ABGR1555:
3157 	case DRM_FORMAT_RGBA5551:
3158 	case DRM_FORMAT_BGRA5551:
3159 	case DRM_FORMAT_RGB565:
3160 	case DRM_FORMAT_BGR565:
3161 	case DRM_FORMAT_RGB888:
3162 	case DRM_FORMAT_BGR888:
3163 	case DRM_FORMAT_XRGB8888:
3164 	case DRM_FORMAT_XBGR8888:
3165 	case DRM_FORMAT_RGBX8888:
3166 	case DRM_FORMAT_BGRX8888:
3167 	case DRM_FORMAT_ARGB8888:
3168 	case DRM_FORMAT_ABGR8888:
3169 	case DRM_FORMAT_RGBA8888:
3170 	case DRM_FORMAT_BGRA8888:
3171 	case DRM_FORMAT_XRGB2101010:
3172 	case DRM_FORMAT_XBGR2101010:
3173 	case DRM_FORMAT_RGBX1010102:
3174 	case DRM_FORMAT_BGRX1010102:
3175 	case DRM_FORMAT_ARGB2101010:
3176 	case DRM_FORMAT_ABGR2101010:
3177 	case DRM_FORMAT_RGBA1010102:
3178 	case DRM_FORMAT_BGRA1010102:
3179 	case DRM_FORMAT_YUYV:
3180 	case DRM_FORMAT_YVYU:
3181 	case DRM_FORMAT_UYVY:
3182 	case DRM_FORMAT_VYUY:
3183 	case DRM_FORMAT_AYUV:
3184 	case DRM_FORMAT_NV12:
3185 	case DRM_FORMAT_NV21:
3186 	case DRM_FORMAT_NV16:
3187 	case DRM_FORMAT_NV61:
3188 	case DRM_FORMAT_NV24:
3189 	case DRM_FORMAT_NV42:
3190 	case DRM_FORMAT_YUV410:
3191 	case DRM_FORMAT_YVU410:
3192 	case DRM_FORMAT_YUV411:
3193 	case DRM_FORMAT_YVU411:
3194 	case DRM_FORMAT_YUV420:
3195 	case DRM_FORMAT_YVU420:
3196 	case DRM_FORMAT_YUV422:
3197 	case DRM_FORMAT_YVU422:
3198 	case DRM_FORMAT_YUV444:
3199 	case DRM_FORMAT_YVU444:
3200 		return 0;
3201 	default:
3202 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3203 			      drm_get_format_name(r->pixel_format));
3204 		return -EINVAL;
3205 	}
3206 }
3207 
3208 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3209 {
3210 	int ret, hsub, vsub, num_planes, i;
3211 
3212 	ret = format_check(r);
3213 	if (ret) {
3214 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3215 			      drm_get_format_name(r->pixel_format));
3216 		return ret;
3217 	}
3218 
3219 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3220 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3221 	num_planes = drm_format_num_planes(r->pixel_format);
3222 
3223 	if (r->width == 0 || r->width % hsub) {
3224 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3225 		return -EINVAL;
3226 	}
3227 
3228 	if (r->height == 0 || r->height % vsub) {
3229 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3230 		return -EINVAL;
3231 	}
3232 
3233 	for (i = 0; i < num_planes; i++) {
3234 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3235 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3236 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3237 
3238 		if (!r->handles[i]) {
3239 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3240 			return -EINVAL;
3241 		}
3242 
3243 		if ((uint64_t) width * cpp > UINT_MAX)
3244 			return -ERANGE;
3245 
3246 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3247 			return -ERANGE;
3248 
3249 		if (r->pitches[i] < width * cpp) {
3250 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3251 			return -EINVAL;
3252 		}
3253 	}
3254 
3255 	return 0;
3256 }
3257 
3258 static struct drm_framebuffer *
3259 internal_framebuffer_create(struct drm_device *dev,
3260 			    struct drm_mode_fb_cmd2 *r,
3261 			    struct drm_file *file_priv)
3262 {
3263 	struct drm_mode_config *config = &dev->mode_config;
3264 	struct drm_framebuffer *fb;
3265 	int ret;
3266 
3267 	if (r->flags & ~DRM_MODE_FB_INTERLACED) {
3268 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3269 		return ERR_PTR(-EINVAL);
3270 	}
3271 
3272 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3273 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3274 			  r->width, config->min_width, config->max_width);
3275 		return ERR_PTR(-EINVAL);
3276 	}
3277 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3278 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3279 			  r->height, config->min_height, config->max_height);
3280 		return ERR_PTR(-EINVAL);
3281 	}
3282 
3283 	ret = framebuffer_check(r);
3284 	if (ret)
3285 		return ERR_PTR(ret);
3286 
3287 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3288 	if (IS_ERR(fb)) {
3289 		DRM_DEBUG_KMS("could not create framebuffer\n");
3290 		return fb;
3291 	}
3292 
3293 	return fb;
3294 }
3295 
3296 /**
3297  * drm_mode_addfb2 - add an FB to the graphics configuration
3298  * @dev: drm device for the ioctl
3299  * @data: data pointer for the ioctl
3300  * @file_priv: drm file for the ioctl call
3301  *
3302  * Add a new FB to the specified CRTC, given a user request with format. This is
3303  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3304  * and uses fourcc codes as pixel format specifiers.
3305  *
3306  * Called by the user via ioctl.
3307  *
3308  * Returns:
3309  * Zero on success, negative errno on failure.
3310  */
3311 int drm_mode_addfb2(struct drm_device *dev,
3312 		    void *data, struct drm_file *file_priv)
3313 {
3314 	struct drm_mode_fb_cmd2 *r = data;
3315 	struct drm_framebuffer *fb;
3316 
3317 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3318 		return -EINVAL;
3319 
3320 	fb = internal_framebuffer_create(dev, r, file_priv);
3321 	if (IS_ERR(fb))
3322 		return PTR_ERR(fb);
3323 
3324 	/* Transfer ownership to the filp for reaping on close */
3325 
3326 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3327 	mutex_lock(&file_priv->fbs_lock);
3328 	r->fb_id = fb->base.id;
3329 	list_add(&fb->filp_head, &file_priv->fbs);
3330 	mutex_unlock(&file_priv->fbs_lock);
3331 
3332 	return 0;
3333 }
3334 
3335 /**
3336  * drm_mode_rmfb - remove an FB from the configuration
3337  * @dev: drm device for the ioctl
3338  * @data: data pointer for the ioctl
3339  * @file_priv: drm file for the ioctl call
3340  *
3341  * Remove the FB specified by the user.
3342  *
3343  * Called by the user via ioctl.
3344  *
3345  * Returns:
3346  * Zero on success, negative errno on failure.
3347  */
3348 int drm_mode_rmfb(struct drm_device *dev,
3349 		   void *data, struct drm_file *file_priv)
3350 {
3351 	struct drm_framebuffer *fb = NULL;
3352 	struct drm_framebuffer *fbl = NULL;
3353 	uint32_t *id = data;
3354 	int found = 0;
3355 
3356 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3357 		return -EINVAL;
3358 
3359 	mutex_lock(&file_priv->fbs_lock);
3360 	mutex_lock(&dev->mode_config.fb_lock);
3361 	fb = __drm_framebuffer_lookup(dev, *id);
3362 	if (!fb)
3363 		goto fail_lookup;
3364 
3365 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3366 		if (fb == fbl)
3367 			found = 1;
3368 	if (!found)
3369 		goto fail_lookup;
3370 
3371 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3372 	__drm_framebuffer_unregister(dev, fb);
3373 
3374 	list_del_init(&fb->filp_head);
3375 	mutex_unlock(&dev->mode_config.fb_lock);
3376 	mutex_unlock(&file_priv->fbs_lock);
3377 
3378 	drm_framebuffer_remove(fb);
3379 
3380 	return 0;
3381 
3382 fail_lookup:
3383 	mutex_unlock(&dev->mode_config.fb_lock);
3384 	mutex_unlock(&file_priv->fbs_lock);
3385 
3386 	return -ENOENT;
3387 }
3388 
3389 /**
3390  * drm_mode_getfb - get FB info
3391  * @dev: drm device for the ioctl
3392  * @data: data pointer for the ioctl
3393  * @file_priv: drm file for the ioctl call
3394  *
3395  * Lookup the FB given its ID and return info about it.
3396  *
3397  * Called by the user via ioctl.
3398  *
3399  * Returns:
3400  * Zero on success, negative errno on failure.
3401  */
3402 int drm_mode_getfb(struct drm_device *dev,
3403 		   void *data, struct drm_file *file_priv)
3404 {
3405 	struct drm_mode_fb_cmd *r = data;
3406 	struct drm_framebuffer *fb;
3407 	int ret;
3408 
3409 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3410 		return -EINVAL;
3411 
3412 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3413 	if (!fb)
3414 		return -ENOENT;
3415 
3416 	r->height = fb->height;
3417 	r->width = fb->width;
3418 	r->depth = fb->depth;
3419 	r->bpp = fb->bits_per_pixel;
3420 	r->pitch = fb->pitches[0];
3421 	if (fb->funcs->create_handle) {
3422 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3423 		    drm_is_control_client(file_priv)) {
3424 			ret = fb->funcs->create_handle(fb, file_priv,
3425 						       &r->handle);
3426 		} else {
3427 			/* GET_FB() is an unprivileged ioctl so we must not
3428 			 * return a buffer-handle to non-master processes! For
3429 			 * backwards-compatibility reasons, we cannot make
3430 			 * GET_FB() privileged, so just return an invalid handle
3431 			 * for non-masters. */
3432 			r->handle = 0;
3433 			ret = 0;
3434 		}
3435 	} else {
3436 		ret = -ENODEV;
3437 	}
3438 
3439 	drm_framebuffer_unreference(fb);
3440 
3441 	return ret;
3442 }
3443 
3444 /**
3445  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3446  * @dev: drm device for the ioctl
3447  * @data: data pointer for the ioctl
3448  * @file_priv: drm file for the ioctl call
3449  *
3450  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3451  * rectangle list. Generic userspace which does frontbuffer rendering must call
3452  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3453  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3454  *
3455  * Modesetting drivers which always update the frontbuffer do not need to
3456  * implement the corresponding ->dirty framebuffer callback.
3457  *
3458  * Called by the user via ioctl.
3459  *
3460  * Returns:
3461  * Zero on success, negative errno on failure.
3462  */
3463 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3464 			   void *data, struct drm_file *file_priv)
3465 {
3466 	struct drm_clip_rect __user *clips_ptr;
3467 	struct drm_clip_rect *clips = NULL;
3468 	struct drm_mode_fb_dirty_cmd *r = data;
3469 	struct drm_framebuffer *fb;
3470 	unsigned flags;
3471 	int num_clips;
3472 	int ret;
3473 
3474 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3475 		return -EINVAL;
3476 
3477 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3478 	if (!fb)
3479 		return -ENOENT;
3480 
3481 	num_clips = r->num_clips;
3482 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3483 
3484 	if (!num_clips != !clips_ptr) {
3485 		ret = -EINVAL;
3486 		goto out_err1;
3487 	}
3488 
3489 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3490 
3491 	/* If userspace annotates copy, clips must come in pairs */
3492 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3493 		ret = -EINVAL;
3494 		goto out_err1;
3495 	}
3496 
3497 	if (num_clips && clips_ptr) {
3498 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3499 			ret = -EINVAL;
3500 			goto out_err1;
3501 		}
3502 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3503 		if (!clips) {
3504 			ret = -ENOMEM;
3505 			goto out_err1;
3506 		}
3507 
3508 		ret = copy_from_user(clips, clips_ptr,
3509 				     num_clips * sizeof(*clips));
3510 		if (ret) {
3511 			ret = -EFAULT;
3512 			goto out_err2;
3513 		}
3514 	}
3515 
3516 	if (fb->funcs->dirty) {
3517 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3518 				       clips, num_clips);
3519 	} else {
3520 		ret = -ENOSYS;
3521 	}
3522 
3523 out_err2:
3524 	kfree(clips);
3525 out_err1:
3526 	drm_framebuffer_unreference(fb);
3527 
3528 	return ret;
3529 }
3530 
3531 
3532 /**
3533  * drm_fb_release - remove and free the FBs on this file
3534  * @priv: drm file for the ioctl
3535  *
3536  * Destroy all the FBs associated with @filp.
3537  *
3538  * Called by the user via ioctl.
3539  *
3540  * Returns:
3541  * Zero on success, negative errno on failure.
3542  */
3543 void drm_fb_release(struct drm_file *priv)
3544 {
3545 	struct drm_device *dev = priv->minor->dev;
3546 	struct drm_framebuffer *fb, *tfb;
3547 
3548 	/*
3549 	 * When the file gets released that means no one else can access the fb
3550 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3551 	 * avoid upsetting lockdep since the universal cursor code adds a
3552 	 * framebuffer while holding mutex locks.
3553 	 *
3554 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3555 	 * locks is impossible here since no one else but this function can get
3556 	 * at it any more.
3557 	 */
3558 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3559 
3560 		mutex_lock(&dev->mode_config.fb_lock);
3561 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3562 		__drm_framebuffer_unregister(dev, fb);
3563 		mutex_unlock(&dev->mode_config.fb_lock);
3564 
3565 		list_del_init(&fb->filp_head);
3566 
3567 		/* This will also drop the fpriv->fbs reference. */
3568 		drm_framebuffer_remove(fb);
3569 	}
3570 }
3571 
3572 /**
3573  * drm_property_create - create a new property type
3574  * @dev: drm device
3575  * @flags: flags specifying the property type
3576  * @name: name of the property
3577  * @num_values: number of pre-defined values
3578  *
3579  * This creates a new generic drm property which can then be attached to a drm
3580  * object with drm_object_attach_property. The returned property object must be
3581  * freed with drm_property_destroy.
3582  *
3583  * Note that the DRM core keeps a per-device list of properties and that, if
3584  * drm_mode_config_cleanup() is called, it will destroy all properties created
3585  * by the driver.
3586  *
3587  * Returns:
3588  * A pointer to the newly created property on success, NULL on failure.
3589  */
3590 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3591 					 const char *name, int num_values)
3592 {
3593 	struct drm_property *property = NULL;
3594 	int ret;
3595 
3596 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3597 	if (!property)
3598 		return NULL;
3599 
3600 	property->dev = dev;
3601 
3602 	if (num_values) {
3603 		property->values = kcalloc(num_values, sizeof(uint64_t),
3604 					   GFP_KERNEL);
3605 		if (!property->values)
3606 			goto fail;
3607 	}
3608 
3609 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3610 	if (ret)
3611 		goto fail;
3612 
3613 	property->flags = flags;
3614 	property->num_values = num_values;
3615 	INIT_LIST_HEAD(&property->enum_list);
3616 
3617 	if (name) {
3618 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3619 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3620 	}
3621 
3622 	list_add_tail(&property->head, &dev->mode_config.property_list);
3623 
3624 	WARN_ON(!drm_property_type_valid(property));
3625 
3626 	return property;
3627 fail:
3628 	kfree(property->values);
3629 	kfree(property);
3630 	return NULL;
3631 }
3632 EXPORT_SYMBOL(drm_property_create);
3633 
3634 /**
3635  * drm_property_create_enum - create a new enumeration property type
3636  * @dev: drm device
3637  * @flags: flags specifying the property type
3638  * @name: name of the property
3639  * @props: enumeration lists with property values
3640  * @num_values: number of pre-defined values
3641  *
3642  * This creates a new generic drm property which can then be attached to a drm
3643  * object with drm_object_attach_property. The returned property object must be
3644  * freed with drm_property_destroy.
3645  *
3646  * Userspace is only allowed to set one of the predefined values for enumeration
3647  * properties.
3648  *
3649  * Returns:
3650  * A pointer to the newly created property on success, NULL on failure.
3651  */
3652 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3653 					 const char *name,
3654 					 const struct drm_prop_enum_list *props,
3655 					 int num_values)
3656 {
3657 	struct drm_property *property;
3658 	int i, ret;
3659 
3660 	flags |= DRM_MODE_PROP_ENUM;
3661 
3662 	property = drm_property_create(dev, flags, name, num_values);
3663 	if (!property)
3664 		return NULL;
3665 
3666 	for (i = 0; i < num_values; i++) {
3667 		ret = drm_property_add_enum(property, i,
3668 				      props[i].type,
3669 				      props[i].name);
3670 		if (ret) {
3671 			drm_property_destroy(dev, property);
3672 			return NULL;
3673 		}
3674 	}
3675 
3676 	return property;
3677 }
3678 EXPORT_SYMBOL(drm_property_create_enum);
3679 
3680 /**
3681  * drm_property_create_bitmask - create a new bitmask property type
3682  * @dev: drm device
3683  * @flags: flags specifying the property type
3684  * @name: name of the property
3685  * @props: enumeration lists with property bitflags
3686  * @num_props: size of the @props array
3687  * @supported_bits: bitmask of all supported enumeration values
3688  *
3689  * This creates a new bitmask drm property which can then be attached to a drm
3690  * object with drm_object_attach_property. The returned property object must be
3691  * freed with drm_property_destroy.
3692  *
3693  * Compared to plain enumeration properties userspace is allowed to set any
3694  * or'ed together combination of the predefined property bitflag values
3695  *
3696  * Returns:
3697  * A pointer to the newly created property on success, NULL on failure.
3698  */
3699 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3700 					 int flags, const char *name,
3701 					 const struct drm_prop_enum_list *props,
3702 					 int num_props,
3703 					 uint64_t supported_bits)
3704 {
3705 	struct drm_property *property;
3706 	int i, ret, index = 0;
3707 	int num_values = hweight64(supported_bits);
3708 
3709 	flags |= DRM_MODE_PROP_BITMASK;
3710 
3711 	property = drm_property_create(dev, flags, name, num_values);
3712 	if (!property)
3713 		return NULL;
3714 	for (i = 0; i < num_props; i++) {
3715 		if (!(supported_bits & (1ULL << props[i].type)))
3716 			continue;
3717 
3718 		if (WARN_ON(index >= num_values)) {
3719 			drm_property_destroy(dev, property);
3720 			return NULL;
3721 		}
3722 
3723 		ret = drm_property_add_enum(property, index++,
3724 				      props[i].type,
3725 				      props[i].name);
3726 		if (ret) {
3727 			drm_property_destroy(dev, property);
3728 			return NULL;
3729 		}
3730 	}
3731 
3732 	return property;
3733 }
3734 EXPORT_SYMBOL(drm_property_create_bitmask);
3735 
3736 static struct drm_property *property_create_range(struct drm_device *dev,
3737 					 int flags, const char *name,
3738 					 uint64_t min, uint64_t max)
3739 {
3740 	struct drm_property *property;
3741 
3742 	property = drm_property_create(dev, flags, name, 2);
3743 	if (!property)
3744 		return NULL;
3745 
3746 	property->values[0] = min;
3747 	property->values[1] = max;
3748 
3749 	return property;
3750 }
3751 
3752 /**
3753  * drm_property_create_range - create a new unsigned ranged property type
3754  * @dev: drm device
3755  * @flags: flags specifying the property type
3756  * @name: name of the property
3757  * @min: minimum value of the property
3758  * @max: maximum value of the property
3759  *
3760  * This creates a new generic drm property which can then be attached to a drm
3761  * object with drm_object_attach_property. The returned property object must be
3762  * freed with drm_property_destroy.
3763  *
3764  * Userspace is allowed to set any unsigned integer value in the (min, max)
3765  * range inclusive.
3766  *
3767  * Returns:
3768  * A pointer to the newly created property on success, NULL on failure.
3769  */
3770 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3771 					 const char *name,
3772 					 uint64_t min, uint64_t max)
3773 {
3774 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3775 			name, min, max);
3776 }
3777 EXPORT_SYMBOL(drm_property_create_range);
3778 
3779 /**
3780  * drm_property_create_signed_range - create a new signed ranged property type
3781  * @dev: drm device
3782  * @flags: flags specifying the property type
3783  * @name: name of the property
3784  * @min: minimum value of the property
3785  * @max: maximum value of the property
3786  *
3787  * This creates a new generic drm property which can then be attached to a drm
3788  * object with drm_object_attach_property. The returned property object must be
3789  * freed with drm_property_destroy.
3790  *
3791  * Userspace is allowed to set any signed integer value in the (min, max)
3792  * range inclusive.
3793  *
3794  * Returns:
3795  * A pointer to the newly created property on success, NULL on failure.
3796  */
3797 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3798 					 int flags, const char *name,
3799 					 int64_t min, int64_t max)
3800 {
3801 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3802 			name, I642U64(min), I642U64(max));
3803 }
3804 EXPORT_SYMBOL(drm_property_create_signed_range);
3805 
3806 /**
3807  * drm_property_create_object - create a new object property type
3808  * @dev: drm device
3809  * @flags: flags specifying the property type
3810  * @name: name of the property
3811  * @type: object type from DRM_MODE_OBJECT_* defines
3812  *
3813  * This creates a new generic drm property which can then be attached to a drm
3814  * object with drm_object_attach_property. The returned property object must be
3815  * freed with drm_property_destroy.
3816  *
3817  * Userspace is only allowed to set this to any property value of the given
3818  * @type. Only useful for atomic properties, which is enforced.
3819  *
3820  * Returns:
3821  * A pointer to the newly created property on success, NULL on failure.
3822  */
3823 struct drm_property *drm_property_create_object(struct drm_device *dev,
3824 					 int flags, const char *name, uint32_t type)
3825 {
3826 	struct drm_property *property;
3827 
3828 	flags |= DRM_MODE_PROP_OBJECT;
3829 
3830 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3831 		return NULL;
3832 
3833 	property = drm_property_create(dev, flags, name, 1);
3834 	if (!property)
3835 		return NULL;
3836 
3837 	property->values[0] = type;
3838 
3839 	return property;
3840 }
3841 EXPORT_SYMBOL(drm_property_create_object);
3842 
3843 /**
3844  * drm_property_create_bool - create a new boolean property type
3845  * @dev: drm device
3846  * @flags: flags specifying the property type
3847  * @name: name of the property
3848  *
3849  * This creates a new generic drm property which can then be attached to a drm
3850  * object with drm_object_attach_property. The returned property object must be
3851  * freed with drm_property_destroy.
3852  *
3853  * This is implemented as a ranged property with only {0, 1} as valid values.
3854  *
3855  * Returns:
3856  * A pointer to the newly created property on success, NULL on failure.
3857  */
3858 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3859 					 const char *name)
3860 {
3861 	return drm_property_create_range(dev, flags, name, 0, 1);
3862 }
3863 EXPORT_SYMBOL(drm_property_create_bool);
3864 
3865 /**
3866  * drm_property_add_enum - add a possible value to an enumeration property
3867  * @property: enumeration property to change
3868  * @index: index of the new enumeration
3869  * @value: value of the new enumeration
3870  * @name: symbolic name of the new enumeration
3871  *
3872  * This functions adds enumerations to a property.
3873  *
3874  * It's use is deprecated, drivers should use one of the more specific helpers
3875  * to directly create the property with all enumerations already attached.
3876  *
3877  * Returns:
3878  * Zero on success, error code on failure.
3879  */
3880 int drm_property_add_enum(struct drm_property *property, int index,
3881 			  uint64_t value, const char *name)
3882 {
3883 	struct drm_property_enum *prop_enum;
3884 
3885 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3886 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3887 		return -EINVAL;
3888 
3889 	/*
3890 	 * Bitmask enum properties have the additional constraint of values
3891 	 * from 0 to 63
3892 	 */
3893 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3894 			(value > 63))
3895 		return -EINVAL;
3896 
3897 	if (!list_empty(&property->enum_list)) {
3898 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3899 			if (prop_enum->value == value) {
3900 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3901 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3902 				return 0;
3903 			}
3904 		}
3905 	}
3906 
3907 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3908 	if (!prop_enum)
3909 		return -ENOMEM;
3910 
3911 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3912 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3913 	prop_enum->value = value;
3914 
3915 	property->values[index] = value;
3916 	list_add_tail(&prop_enum->head, &property->enum_list);
3917 	return 0;
3918 }
3919 EXPORT_SYMBOL(drm_property_add_enum);
3920 
3921 /**
3922  * drm_property_destroy - destroy a drm property
3923  * @dev: drm device
3924  * @property: property to destry
3925  *
3926  * This function frees a property including any attached resources like
3927  * enumeration values.
3928  */
3929 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3930 {
3931 	struct drm_property_enum *prop_enum, *pt;
3932 
3933 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3934 		list_del(&prop_enum->head);
3935 		kfree(prop_enum);
3936 	}
3937 
3938 	if (property->num_values)
3939 		kfree(property->values);
3940 	drm_mode_object_put(dev, &property->base);
3941 	list_del(&property->head);
3942 	kfree(property);
3943 }
3944 EXPORT_SYMBOL(drm_property_destroy);
3945 
3946 /**
3947  * drm_object_attach_property - attach a property to a modeset object
3948  * @obj: drm modeset object
3949  * @property: property to attach
3950  * @init_val: initial value of the property
3951  *
3952  * This attaches the given property to the modeset object with the given initial
3953  * value. Currently this function cannot fail since the properties are stored in
3954  * a statically sized array.
3955  */
3956 void drm_object_attach_property(struct drm_mode_object *obj,
3957 				struct drm_property *property,
3958 				uint64_t init_val)
3959 {
3960 	int count = obj->properties->count;
3961 
3962 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3963 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3964 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3965 			"you see this message on the same object type.\n",
3966 			obj->type);
3967 		return;
3968 	}
3969 
3970 	obj->properties->properties[count] = property;
3971 	obj->properties->values[count] = init_val;
3972 	obj->properties->count++;
3973 	if (property->flags & DRM_MODE_PROP_ATOMIC)
3974 		obj->properties->atomic_count++;
3975 }
3976 EXPORT_SYMBOL(drm_object_attach_property);
3977 
3978 /**
3979  * drm_object_property_set_value - set the value of a property
3980  * @obj: drm mode object to set property value for
3981  * @property: property to set
3982  * @val: value the property should be set to
3983  *
3984  * This functions sets a given property on a given object. This function only
3985  * changes the software state of the property, it does not call into the
3986  * driver's ->set_property callback.
3987  *
3988  * Returns:
3989  * Zero on success, error code on failure.
3990  */
3991 int drm_object_property_set_value(struct drm_mode_object *obj,
3992 				  struct drm_property *property, uint64_t val)
3993 {
3994 	int i;
3995 
3996 	for (i = 0; i < obj->properties->count; i++) {
3997 		if (obj->properties->properties[i] == property) {
3998 			obj->properties->values[i] = val;
3999 			return 0;
4000 		}
4001 	}
4002 
4003 	return -EINVAL;
4004 }
4005 EXPORT_SYMBOL(drm_object_property_set_value);
4006 
4007 /**
4008  * drm_object_property_get_value - retrieve the value of a property
4009  * @obj: drm mode object to get property value from
4010  * @property: property to retrieve
4011  * @val: storage for the property value
4012  *
4013  * This function retrieves the softare state of the given property for the given
4014  * property. Since there is no driver callback to retrieve the current property
4015  * value this might be out of sync with the hardware, depending upon the driver
4016  * and property.
4017  *
4018  * Returns:
4019  * Zero on success, error code on failure.
4020  */
4021 int drm_object_property_get_value(struct drm_mode_object *obj,
4022 				  struct drm_property *property, uint64_t *val)
4023 {
4024 	int i;
4025 
4026 	/* read-only properties bypass atomic mechanism and still store
4027 	 * their value in obj->properties->values[].. mostly to avoid
4028 	 * having to deal w/ EDID and similar props in atomic paths:
4029 	 */
4030 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4031 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4032 		return drm_atomic_get_property(obj, property, val);
4033 
4034 	for (i = 0; i < obj->properties->count; i++) {
4035 		if (obj->properties->properties[i] == property) {
4036 			*val = obj->properties->values[i];
4037 			return 0;
4038 		}
4039 	}
4040 
4041 	return -EINVAL;
4042 }
4043 EXPORT_SYMBOL(drm_object_property_get_value);
4044 
4045 /**
4046  * drm_mode_getproperty_ioctl - get the property metadata
4047  * @dev: DRM device
4048  * @data: ioctl data
4049  * @file_priv: DRM file info
4050  *
4051  * This function retrieves the metadata for a given property, like the different
4052  * possible values for an enum property or the limits for a range property.
4053  *
4054  * Blob properties are special
4055  *
4056  * Called by the user via ioctl.
4057  *
4058  * Returns:
4059  * Zero on success, negative errno on failure.
4060  */
4061 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4062 			       void *data, struct drm_file *file_priv)
4063 {
4064 	struct drm_mode_get_property *out_resp = data;
4065 	struct drm_property *property;
4066 	int enum_count = 0;
4067 	int value_count = 0;
4068 	int ret = 0, i;
4069 	int copied;
4070 	struct drm_property_enum *prop_enum;
4071 	struct drm_mode_property_enum __user *enum_ptr;
4072 	uint64_t __user *values_ptr;
4073 
4074 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4075 		return -EINVAL;
4076 
4077 	drm_modeset_lock_all(dev);
4078 	property = drm_property_find(dev, out_resp->prop_id);
4079 	if (!property) {
4080 		ret = -ENOENT;
4081 		goto done;
4082 	}
4083 
4084 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4085 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4086 		list_for_each_entry(prop_enum, &property->enum_list, head)
4087 			enum_count++;
4088 	}
4089 
4090 	value_count = property->num_values;
4091 
4092 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4093 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4094 	out_resp->flags = property->flags;
4095 
4096 	if ((out_resp->count_values >= value_count) && value_count) {
4097 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4098 		for (i = 0; i < value_count; i++) {
4099 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4100 				ret = -EFAULT;
4101 				goto done;
4102 			}
4103 		}
4104 	}
4105 	out_resp->count_values = value_count;
4106 
4107 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4108 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4109 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4110 			copied = 0;
4111 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4112 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4113 
4114 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4115 					ret = -EFAULT;
4116 					goto done;
4117 				}
4118 
4119 				if (copy_to_user(&enum_ptr[copied].name,
4120 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4121 					ret = -EFAULT;
4122 					goto done;
4123 				}
4124 				copied++;
4125 			}
4126 		}
4127 		out_resp->count_enum_blobs = enum_count;
4128 	}
4129 
4130 	/*
4131 	 * NOTE: The idea seems to have been to use this to read all the blob
4132 	 * property values. But nothing ever added them to the corresponding
4133 	 * list, userspace always used the special-purpose get_blob ioctl to
4134 	 * read the value for a blob property. It also doesn't make a lot of
4135 	 * sense to return values here when everything else is just metadata for
4136 	 * the property itself.
4137 	 */
4138 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4139 		out_resp->count_enum_blobs = 0;
4140 done:
4141 	drm_modeset_unlock_all(dev);
4142 	return ret;
4143 }
4144 
4145 static struct drm_property_blob *
4146 drm_property_create_blob(struct drm_device *dev, size_t length,
4147 			 const void *data)
4148 {
4149 	struct drm_property_blob *blob;
4150 	int ret;
4151 
4152 	if (!length || !data)
4153 		return NULL;
4154 
4155 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4156 	if (!blob)
4157 		return NULL;
4158 
4159 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4160 	if (ret) {
4161 		kfree(blob);
4162 		return NULL;
4163 	}
4164 
4165 	blob->length = length;
4166 
4167 	memcpy(blob->data, data, length);
4168 
4169 	list_add_tail(&blob->head, &dev->mode_config.property_blob_list);
4170 	return blob;
4171 }
4172 
4173 static void drm_property_destroy_blob(struct drm_device *dev,
4174 			       struct drm_property_blob *blob)
4175 {
4176 	drm_mode_object_put(dev, &blob->base);
4177 	list_del(&blob->head);
4178 	kfree(blob);
4179 }
4180 
4181 /**
4182  * drm_mode_getblob_ioctl - get the contents of a blob property value
4183  * @dev: DRM device
4184  * @data: ioctl data
4185  * @file_priv: DRM file info
4186  *
4187  * This function retrieves the contents of a blob property. The value stored in
4188  * an object's blob property is just a normal modeset object id.
4189  *
4190  * Called by the user via ioctl.
4191  *
4192  * Returns:
4193  * Zero on success, negative errno on failure.
4194  */
4195 int drm_mode_getblob_ioctl(struct drm_device *dev,
4196 			   void *data, struct drm_file *file_priv)
4197 {
4198 	struct drm_mode_get_blob *out_resp = data;
4199 	struct drm_property_blob *blob;
4200 	int ret = 0;
4201 	void __user *blob_ptr;
4202 
4203 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4204 		return -EINVAL;
4205 
4206 	drm_modeset_lock_all(dev);
4207 	blob = drm_property_blob_find(dev, out_resp->blob_id);
4208 	if (!blob) {
4209 		ret = -ENOENT;
4210 		goto done;
4211 	}
4212 
4213 	if (out_resp->length == blob->length) {
4214 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4215 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4216 			ret = -EFAULT;
4217 			goto done;
4218 		}
4219 	}
4220 	out_resp->length = blob->length;
4221 
4222 done:
4223 	drm_modeset_unlock_all(dev);
4224 	return ret;
4225 }
4226 
4227 /**
4228  * drm_mode_connector_set_path_property - set tile property on connector
4229  * @connector: connector to set property on.
4230  * @path: path to use for property.
4231  *
4232  * This creates a property to expose to userspace to specify a
4233  * connector path. This is mainly used for DisplayPort MST where
4234  * connectors have a topology and we want to allow userspace to give
4235  * them more meaningful names.
4236  *
4237  * Returns:
4238  * Zero on success, negative errno on failure.
4239  */
4240 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4241 					 const char *path)
4242 {
4243 	struct drm_device *dev = connector->dev;
4244 	size_t size = strlen(path) + 1;
4245 	int ret;
4246 
4247 	connector->path_blob_ptr = drm_property_create_blob(connector->dev,
4248 							    size, path);
4249 	if (!connector->path_blob_ptr)
4250 		return -EINVAL;
4251 
4252 	ret = drm_object_property_set_value(&connector->base,
4253 					    dev->mode_config.path_property,
4254 					    connector->path_blob_ptr->base.id);
4255 	return ret;
4256 }
4257 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4258 
4259 /**
4260  * drm_mode_connector_set_tile_property - set tile property on connector
4261  * @connector: connector to set property on.
4262  *
4263  * This looks up the tile information for a connector, and creates a
4264  * property for userspace to parse if it exists. The property is of
4265  * the form of 8 integers using ':' as a separator.
4266  *
4267  * Returns:
4268  * Zero on success, errno on failure.
4269  */
4270 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4271 {
4272 	struct drm_device *dev = connector->dev;
4273 	int ret, size;
4274 	char tile[256];
4275 
4276 	if (connector->tile_blob_ptr)
4277 		drm_property_destroy_blob(dev, connector->tile_blob_ptr);
4278 
4279 	if (!connector->has_tile) {
4280 		connector->tile_blob_ptr = NULL;
4281 		ret = drm_object_property_set_value(&connector->base,
4282 						    dev->mode_config.tile_property, 0);
4283 		return ret;
4284 	}
4285 
4286 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4287 		 connector->tile_group->id, connector->tile_is_single_monitor,
4288 		 connector->num_h_tile, connector->num_v_tile,
4289 		 connector->tile_h_loc, connector->tile_v_loc,
4290 		 connector->tile_h_size, connector->tile_v_size);
4291 	size = strlen(tile) + 1;
4292 
4293 	connector->tile_blob_ptr = drm_property_create_blob(connector->dev,
4294 							    size, tile);
4295 	if (!connector->tile_blob_ptr)
4296 		return -EINVAL;
4297 
4298 	ret = drm_object_property_set_value(&connector->base,
4299 					    dev->mode_config.tile_property,
4300 					    connector->tile_blob_ptr->base.id);
4301 	return ret;
4302 }
4303 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4304 
4305 /**
4306  * drm_mode_connector_update_edid_property - update the edid property of a connector
4307  * @connector: drm connector
4308  * @edid: new value of the edid property
4309  *
4310  * This function creates a new blob modeset object and assigns its id to the
4311  * connector's edid property.
4312  *
4313  * Returns:
4314  * Zero on success, negative errno on failure.
4315  */
4316 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4317 					    const struct edid *edid)
4318 {
4319 	struct drm_device *dev = connector->dev;
4320 	size_t size;
4321 	int ret;
4322 
4323 	/* ignore requests to set edid when overridden */
4324 	if (connector->override_edid)
4325 		return 0;
4326 
4327 	if (connector->edid_blob_ptr)
4328 		drm_property_destroy_blob(dev, connector->edid_blob_ptr);
4329 
4330 	/* Delete edid, when there is none. */
4331 	if (!edid) {
4332 		connector->edid_blob_ptr = NULL;
4333 		ret = drm_object_property_set_value(&connector->base, dev->mode_config.edid_property, 0);
4334 		return ret;
4335 	}
4336 
4337 	size = EDID_LENGTH * (1 + edid->extensions);
4338 	connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
4339 							    size, edid);
4340 	if (!connector->edid_blob_ptr)
4341 		return -EINVAL;
4342 
4343 	ret = drm_object_property_set_value(&connector->base,
4344 					       dev->mode_config.edid_property,
4345 					       connector->edid_blob_ptr->base.id);
4346 
4347 	return ret;
4348 }
4349 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4350 
4351 /* Some properties could refer to dynamic refcnt'd objects, or things that
4352  * need special locking to handle lifetime issues (ie. to ensure the prop
4353  * value doesn't become invalid part way through the property update due to
4354  * race).  The value returned by reference via 'obj' should be passed back
4355  * to drm_property_change_valid_put() after the property is set (and the
4356  * object to which the property is attached has a chance to take it's own
4357  * reference).
4358  */
4359 bool drm_property_change_valid_get(struct drm_property *property,
4360 					 uint64_t value, struct drm_mode_object **ref)
4361 {
4362 	int i;
4363 
4364 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4365 		return false;
4366 
4367 	*ref = NULL;
4368 
4369 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4370 		if (value < property->values[0] || value > property->values[1])
4371 			return false;
4372 		return true;
4373 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4374 		int64_t svalue = U642I64(value);
4375 
4376 		if (svalue < U642I64(property->values[0]) ||
4377 				svalue > U642I64(property->values[1]))
4378 			return false;
4379 		return true;
4380 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4381 		uint64_t valid_mask = 0;
4382 
4383 		for (i = 0; i < property->num_values; i++)
4384 			valid_mask |= (1ULL << property->values[i]);
4385 		return !(value & ~valid_mask);
4386 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4387 		/* Only the driver knows */
4388 		return true;
4389 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4390 		/* a zero value for an object property translates to null: */
4391 		if (value == 0)
4392 			return true;
4393 
4394 		/* handle refcnt'd objects specially: */
4395 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4396 			struct drm_framebuffer *fb;
4397 			fb = drm_framebuffer_lookup(property->dev, value);
4398 			if (fb) {
4399 				*ref = &fb->base;
4400 				return true;
4401 			} else {
4402 				return false;
4403 			}
4404 		} else {
4405 			return _object_find(property->dev, value, property->values[0]) != NULL;
4406 		}
4407 	}
4408 
4409 	for (i = 0; i < property->num_values; i++)
4410 		if (property->values[i] == value)
4411 			return true;
4412 	return false;
4413 }
4414 
4415 void drm_property_change_valid_put(struct drm_property *property,
4416 		struct drm_mode_object *ref)
4417 {
4418 	if (!ref)
4419 		return;
4420 
4421 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4422 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4423 			drm_framebuffer_unreference(obj_to_fb(ref));
4424 	}
4425 }
4426 
4427 /**
4428  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4429  * @dev: DRM device
4430  * @data: ioctl data
4431  * @file_priv: DRM file info
4432  *
4433  * This function sets the current value for a connectors's property. It also
4434  * calls into a driver's ->set_property callback to update the hardware state
4435  *
4436  * Called by the user via ioctl.
4437  *
4438  * Returns:
4439  * Zero on success, negative errno on failure.
4440  */
4441 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4442 				       void *data, struct drm_file *file_priv)
4443 {
4444 	struct drm_mode_connector_set_property *conn_set_prop = data;
4445 	struct drm_mode_obj_set_property obj_set_prop = {
4446 		.value = conn_set_prop->value,
4447 		.prop_id = conn_set_prop->prop_id,
4448 		.obj_id = conn_set_prop->connector_id,
4449 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4450 	};
4451 
4452 	/* It does all the locking and checking we need */
4453 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4454 }
4455 
4456 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4457 					   struct drm_property *property,
4458 					   uint64_t value)
4459 {
4460 	int ret = -EINVAL;
4461 	struct drm_connector *connector = obj_to_connector(obj);
4462 
4463 	/* Do DPMS ourselves */
4464 	if (property == connector->dev->mode_config.dpms_property) {
4465 		if (connector->funcs->dpms)
4466 			(*connector->funcs->dpms)(connector, (int)value);
4467 		ret = 0;
4468 	} else if (connector->funcs->set_property)
4469 		ret = connector->funcs->set_property(connector, property, value);
4470 
4471 	/* store the property value if successful */
4472 	if (!ret)
4473 		drm_object_property_set_value(&connector->base, property, value);
4474 	return ret;
4475 }
4476 
4477 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4478 				      struct drm_property *property,
4479 				      uint64_t value)
4480 {
4481 	int ret = -EINVAL;
4482 	struct drm_crtc *crtc = obj_to_crtc(obj);
4483 
4484 	if (crtc->funcs->set_property)
4485 		ret = crtc->funcs->set_property(crtc, property, value);
4486 	if (!ret)
4487 		drm_object_property_set_value(obj, property, value);
4488 
4489 	return ret;
4490 }
4491 
4492 /**
4493  * drm_mode_plane_set_obj_prop - set the value of a property
4494  * @plane: drm plane object to set property value for
4495  * @property: property to set
4496  * @value: value the property should be set to
4497  *
4498  * This functions sets a given property on a given plane object. This function
4499  * calls the driver's ->set_property callback and changes the software state of
4500  * the property if the callback succeeds.
4501  *
4502  * Returns:
4503  * Zero on success, error code on failure.
4504  */
4505 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4506 				struct drm_property *property,
4507 				uint64_t value)
4508 {
4509 	int ret = -EINVAL;
4510 	struct drm_mode_object *obj = &plane->base;
4511 
4512 	if (plane->funcs->set_property)
4513 		ret = plane->funcs->set_property(plane, property, value);
4514 	if (!ret)
4515 		drm_object_property_set_value(obj, property, value);
4516 
4517 	return ret;
4518 }
4519 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4520 
4521 /**
4522  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4523  * @dev: DRM device
4524  * @data: ioctl data
4525  * @file_priv: DRM file info
4526  *
4527  * This function retrieves the current value for an object's property. Compared
4528  * to the connector specific ioctl this one is extended to also work on crtc and
4529  * plane objects.
4530  *
4531  * Called by the user via ioctl.
4532  *
4533  * Returns:
4534  * Zero on success, negative errno on failure.
4535  */
4536 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4537 				      struct drm_file *file_priv)
4538 {
4539 	struct drm_mode_obj_get_properties *arg = data;
4540 	struct drm_mode_object *obj;
4541 	int ret = 0;
4542 
4543 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4544 		return -EINVAL;
4545 
4546 	drm_modeset_lock_all(dev);
4547 
4548 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4549 	if (!obj) {
4550 		ret = -ENOENT;
4551 		goto out;
4552 	}
4553 	if (!obj->properties) {
4554 		ret = -EINVAL;
4555 		goto out;
4556 	}
4557 
4558 	ret = get_properties(obj, file_priv->atomic,
4559 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4560 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4561 			&arg->count_props);
4562 
4563 out:
4564 	drm_modeset_unlock_all(dev);
4565 	return ret;
4566 }
4567 
4568 /**
4569  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4570  * @dev: DRM device
4571  * @data: ioctl data
4572  * @file_priv: DRM file info
4573  *
4574  * This function sets the current value for an object's property. It also calls
4575  * into a driver's ->set_property callback to update the hardware state.
4576  * Compared to the connector specific ioctl this one is extended to also work on
4577  * crtc and plane objects.
4578  *
4579  * Called by the user via ioctl.
4580  *
4581  * Returns:
4582  * Zero on success, negative errno on failure.
4583  */
4584 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4585 				    struct drm_file *file_priv)
4586 {
4587 	struct drm_mode_obj_set_property *arg = data;
4588 	struct drm_mode_object *arg_obj;
4589 	struct drm_mode_object *prop_obj;
4590 	struct drm_property *property;
4591 	int i, ret = -EINVAL;
4592 	struct drm_mode_object *ref;
4593 
4594 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4595 		return -EINVAL;
4596 
4597 	drm_modeset_lock_all(dev);
4598 
4599 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4600 	if (!arg_obj) {
4601 		ret = -ENOENT;
4602 		goto out;
4603 	}
4604 	if (!arg_obj->properties)
4605 		goto out;
4606 
4607 	for (i = 0; i < arg_obj->properties->count; i++)
4608 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
4609 			break;
4610 
4611 	if (i == arg_obj->properties->count)
4612 		goto out;
4613 
4614 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4615 					DRM_MODE_OBJECT_PROPERTY);
4616 	if (!prop_obj) {
4617 		ret = -ENOENT;
4618 		goto out;
4619 	}
4620 	property = obj_to_property(prop_obj);
4621 
4622 	if (!drm_property_change_valid_get(property, arg->value, &ref))
4623 		goto out;
4624 
4625 	switch (arg_obj->type) {
4626 	case DRM_MODE_OBJECT_CONNECTOR:
4627 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4628 						      arg->value);
4629 		break;
4630 	case DRM_MODE_OBJECT_CRTC:
4631 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4632 		break;
4633 	case DRM_MODE_OBJECT_PLANE:
4634 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4635 						  property, arg->value);
4636 		break;
4637 	}
4638 
4639 	drm_property_change_valid_put(property, ref);
4640 
4641 out:
4642 	drm_modeset_unlock_all(dev);
4643 	return ret;
4644 }
4645 
4646 /**
4647  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4648  * @connector: connector to attach
4649  * @encoder: encoder to attach @connector to
4650  *
4651  * This function links up a connector to an encoder. Note that the routing
4652  * restrictions between encoders and crtcs are exposed to userspace through the
4653  * possible_clones and possible_crtcs bitmasks.
4654  *
4655  * Returns:
4656  * Zero on success, negative errno on failure.
4657  */
4658 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4659 				      struct drm_encoder *encoder)
4660 {
4661 	int i;
4662 
4663 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4664 		if (connector->encoder_ids[i] == 0) {
4665 			connector->encoder_ids[i] = encoder->base.id;
4666 			return 0;
4667 		}
4668 	}
4669 	return -ENOMEM;
4670 }
4671 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4672 
4673 /**
4674  * drm_mode_crtc_set_gamma_size - set the gamma table size
4675  * @crtc: CRTC to set the gamma table size for
4676  * @gamma_size: size of the gamma table
4677  *
4678  * Drivers which support gamma tables should set this to the supported gamma
4679  * table size when initializing the CRTC. Currently the drm core only supports a
4680  * fixed gamma table size.
4681  *
4682  * Returns:
4683  * Zero on success, negative errno on failure.
4684  */
4685 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4686 				 int gamma_size)
4687 {
4688 	crtc->gamma_size = gamma_size;
4689 
4690 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
4691 				    GFP_KERNEL);
4692 	if (!crtc->gamma_store) {
4693 		crtc->gamma_size = 0;
4694 		return -ENOMEM;
4695 	}
4696 
4697 	return 0;
4698 }
4699 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4700 
4701 /**
4702  * drm_mode_gamma_set_ioctl - set the gamma table
4703  * @dev: DRM device
4704  * @data: ioctl data
4705  * @file_priv: DRM file info
4706  *
4707  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4708  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
4709  *
4710  * Called by the user via ioctl.
4711  *
4712  * Returns:
4713  * Zero on success, negative errno on failure.
4714  */
4715 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
4716 			     void *data, struct drm_file *file_priv)
4717 {
4718 	struct drm_mode_crtc_lut *crtc_lut = data;
4719 	struct drm_crtc *crtc;
4720 	void *r_base, *g_base, *b_base;
4721 	int size;
4722 	int ret = 0;
4723 
4724 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4725 		return -EINVAL;
4726 
4727 	drm_modeset_lock_all(dev);
4728 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4729 	if (!crtc) {
4730 		ret = -ENOENT;
4731 		goto out;
4732 	}
4733 
4734 	if (crtc->funcs->gamma_set == NULL) {
4735 		ret = -ENOSYS;
4736 		goto out;
4737 	}
4738 
4739 	/* memcpy into gamma store */
4740 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4741 		ret = -EINVAL;
4742 		goto out;
4743 	}
4744 
4745 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4746 	r_base = crtc->gamma_store;
4747 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
4748 		ret = -EFAULT;
4749 		goto out;
4750 	}
4751 
4752 	g_base = r_base + size;
4753 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
4754 		ret = -EFAULT;
4755 		goto out;
4756 	}
4757 
4758 	b_base = g_base + size;
4759 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
4760 		ret = -EFAULT;
4761 		goto out;
4762 	}
4763 
4764 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
4765 
4766 out:
4767 	drm_modeset_unlock_all(dev);
4768 	return ret;
4769 
4770 }
4771 
4772 /**
4773  * drm_mode_gamma_get_ioctl - get the gamma table
4774  * @dev: DRM device
4775  * @data: ioctl data
4776  * @file_priv: DRM file info
4777  *
4778  * Copy the current gamma table into the storage provided. This also provides
4779  * the gamma table size the driver expects, which can be used to size the
4780  * allocated storage.
4781  *
4782  * Called by the user via ioctl.
4783  *
4784  * Returns:
4785  * Zero on success, negative errno on failure.
4786  */
4787 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
4788 			     void *data, struct drm_file *file_priv)
4789 {
4790 	struct drm_mode_crtc_lut *crtc_lut = data;
4791 	struct drm_crtc *crtc;
4792 	void *r_base, *g_base, *b_base;
4793 	int size;
4794 	int ret = 0;
4795 
4796 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4797 		return -EINVAL;
4798 
4799 	drm_modeset_lock_all(dev);
4800 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4801 	if (!crtc) {
4802 		ret = -ENOENT;
4803 		goto out;
4804 	}
4805 
4806 	/* memcpy into gamma store */
4807 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4808 		ret = -EINVAL;
4809 		goto out;
4810 	}
4811 
4812 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4813 	r_base = crtc->gamma_store;
4814 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
4815 		ret = -EFAULT;
4816 		goto out;
4817 	}
4818 
4819 	g_base = r_base + size;
4820 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
4821 		ret = -EFAULT;
4822 		goto out;
4823 	}
4824 
4825 	b_base = g_base + size;
4826 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
4827 		ret = -EFAULT;
4828 		goto out;
4829 	}
4830 out:
4831 	drm_modeset_unlock_all(dev);
4832 	return ret;
4833 }
4834 
4835 /**
4836  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
4837  * @dev: DRM device
4838  * @data: ioctl data
4839  * @file_priv: DRM file info
4840  *
4841  * This schedules an asynchronous update on a given CRTC, called page flip.
4842  * Optionally a drm event is generated to signal the completion of the event.
4843  * Generic drivers cannot assume that a pageflip with changed framebuffer
4844  * properties (including driver specific metadata like tiling layout) will work,
4845  * but some drivers support e.g. pixel format changes through the pageflip
4846  * ioctl.
4847  *
4848  * Called by the user via ioctl.
4849  *
4850  * Returns:
4851  * Zero on success, negative errno on failure.
4852  */
4853 int drm_mode_page_flip_ioctl(struct drm_device *dev,
4854 			     void *data, struct drm_file *file_priv)
4855 {
4856 	struct drm_mode_crtc_page_flip *page_flip = data;
4857 	struct drm_crtc *crtc;
4858 	struct drm_framebuffer *fb = NULL;
4859 	struct drm_pending_vblank_event *e = NULL;
4860 	unsigned long flags;
4861 	int ret = -EINVAL;
4862 
4863 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
4864 	    page_flip->reserved != 0)
4865 		return -EINVAL;
4866 
4867 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
4868 		return -EINVAL;
4869 
4870 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
4871 	if (!crtc)
4872 		return -ENOENT;
4873 
4874 	drm_modeset_lock_crtc(crtc, crtc->primary);
4875 	if (crtc->primary->fb == NULL) {
4876 		/* The framebuffer is currently unbound, presumably
4877 		 * due to a hotplug event, that userspace has not
4878 		 * yet discovered.
4879 		 */
4880 		ret = -EBUSY;
4881 		goto out;
4882 	}
4883 
4884 	if (crtc->funcs->page_flip == NULL)
4885 		goto out;
4886 
4887 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
4888 	if (!fb) {
4889 		ret = -ENOENT;
4890 		goto out;
4891 	}
4892 
4893 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
4894 	if (ret)
4895 		goto out;
4896 
4897 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
4898 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
4899 		ret = -EINVAL;
4900 		goto out;
4901 	}
4902 
4903 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4904 		ret = -ENOMEM;
4905 		spin_lock_irqsave(&dev->event_lock, flags);
4906 		if (file_priv->event_space < sizeof(e->event)) {
4907 			spin_unlock_irqrestore(&dev->event_lock, flags);
4908 			goto out;
4909 		}
4910 		file_priv->event_space -= sizeof(e->event);
4911 		spin_unlock_irqrestore(&dev->event_lock, flags);
4912 
4913 		e = kzalloc(sizeof(*e), GFP_KERNEL);
4914 		if (e == NULL) {
4915 			spin_lock_irqsave(&dev->event_lock, flags);
4916 			file_priv->event_space += sizeof(e->event);
4917 			spin_unlock_irqrestore(&dev->event_lock, flags);
4918 			goto out;
4919 		}
4920 
4921 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
4922 		e->event.base.length = sizeof(e->event);
4923 		e->event.user_data = page_flip->user_data;
4924 		e->base.event = &e->event.base;
4925 		e->base.file_priv = file_priv;
4926 		e->base.destroy =
4927 			(void (*) (struct drm_pending_event *)) kfree;
4928 	}
4929 
4930 	crtc->primary->old_fb = crtc->primary->fb;
4931 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
4932 	if (ret) {
4933 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4934 			spin_lock_irqsave(&dev->event_lock, flags);
4935 			file_priv->event_space += sizeof(e->event);
4936 			spin_unlock_irqrestore(&dev->event_lock, flags);
4937 			kfree(e);
4938 		}
4939 		/* Keep the old fb, don't unref it. */
4940 		crtc->primary->old_fb = NULL;
4941 	} else {
4942 		/*
4943 		 * Warn if the driver hasn't properly updated the crtc->fb
4944 		 * field to reflect that the new framebuffer is now used.
4945 		 * Failing to do so will screw with the reference counting
4946 		 * on framebuffers.
4947 		 */
4948 		WARN_ON(crtc->primary->fb != fb);
4949 		/* Unref only the old framebuffer. */
4950 		fb = NULL;
4951 	}
4952 
4953 out:
4954 	if (fb)
4955 		drm_framebuffer_unreference(fb);
4956 	if (crtc->primary->old_fb)
4957 		drm_framebuffer_unreference(crtc->primary->old_fb);
4958 	crtc->primary->old_fb = NULL;
4959 	drm_modeset_unlock_crtc(crtc);
4960 
4961 	return ret;
4962 }
4963 
4964 /**
4965  * drm_mode_config_reset - call ->reset callbacks
4966  * @dev: drm device
4967  *
4968  * This functions calls all the crtc's, encoder's and connector's ->reset
4969  * callback. Drivers can use this in e.g. their driver load or resume code to
4970  * reset hardware and software state.
4971  */
4972 void drm_mode_config_reset(struct drm_device *dev)
4973 {
4974 	struct drm_crtc *crtc;
4975 	struct drm_plane *plane;
4976 	struct drm_encoder *encoder;
4977 	struct drm_connector *connector;
4978 
4979 	list_for_each_entry(plane, &dev->mode_config.plane_list, head)
4980 		if (plane->funcs->reset)
4981 			plane->funcs->reset(plane);
4982 
4983 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
4984 		if (crtc->funcs->reset)
4985 			crtc->funcs->reset(crtc);
4986 
4987 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
4988 		if (encoder->funcs->reset)
4989 			encoder->funcs->reset(encoder);
4990 
4991 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
4992 		connector->status = connector_status_unknown;
4993 
4994 		if (connector->funcs->reset)
4995 			connector->funcs->reset(connector);
4996 	}
4997 }
4998 EXPORT_SYMBOL(drm_mode_config_reset);
4999 
5000 /**
5001  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5002  * @dev: DRM device
5003  * @data: ioctl data
5004  * @file_priv: DRM file info
5005  *
5006  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5007  * TTM or something else entirely) and returns the resulting buffer handle. This
5008  * handle can then be wrapped up into a framebuffer modeset object.
5009  *
5010  * Note that userspace is not allowed to use such objects for render
5011  * acceleration - drivers must create their own private ioctls for such a use
5012  * case.
5013  *
5014  * Called by the user via ioctl.
5015  *
5016  * Returns:
5017  * Zero on success, negative errno on failure.
5018  */
5019 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5020 			       void *data, struct drm_file *file_priv)
5021 {
5022 	struct drm_mode_create_dumb *args = data;
5023 	u32 cpp, stride, size;
5024 
5025 	if (!dev->driver->dumb_create)
5026 		return -ENOSYS;
5027 	if (!args->width || !args->height || !args->bpp)
5028 		return -EINVAL;
5029 
5030 	/* overflow checks for 32bit size calculations */
5031 	/* NOTE: DIV_ROUND_UP() can overflow */
5032 	cpp = DIV_ROUND_UP(args->bpp, 8);
5033 	if (!cpp || cpp > 0xffffffffU / args->width)
5034 		return -EINVAL;
5035 	stride = cpp * args->width;
5036 	if (args->height > 0xffffffffU / stride)
5037 		return -EINVAL;
5038 
5039 	/* test for wrap-around */
5040 	size = args->height * stride;
5041 	if (PAGE_ALIGN(size) == 0)
5042 		return -EINVAL;
5043 
5044 	/*
5045 	 * handle, pitch and size are output parameters. Zero them out to
5046 	 * prevent drivers from accidentally using uninitialized data. Since
5047 	 * not all existing userspace is clearing these fields properly we
5048 	 * cannot reject IOCTL with garbage in them.
5049 	 */
5050 	args->handle = 0;
5051 	args->pitch = 0;
5052 	args->size = 0;
5053 
5054 	return dev->driver->dumb_create(file_priv, dev, args);
5055 }
5056 
5057 /**
5058  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5059  * @dev: DRM device
5060  * @data: ioctl data
5061  * @file_priv: DRM file info
5062  *
5063  * Allocate an offset in the drm device node's address space to be able to
5064  * memory map a dumb buffer.
5065  *
5066  * Called by the user via ioctl.
5067  *
5068  * Returns:
5069  * Zero on success, negative errno on failure.
5070  */
5071 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5072 			     void *data, struct drm_file *file_priv)
5073 {
5074 	struct drm_mode_map_dumb *args = data;
5075 
5076 	/* call driver ioctl to get mmap offset */
5077 	if (!dev->driver->dumb_map_offset)
5078 		return -ENOSYS;
5079 
5080 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5081 }
5082 
5083 /**
5084  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5085  * @dev: DRM device
5086  * @data: ioctl data
5087  * @file_priv: DRM file info
5088  *
5089  * This destroys the userspace handle for the given dumb backing storage buffer.
5090  * Since buffer objects must be reference counted in the kernel a buffer object
5091  * won't be immediately freed if a framebuffer modeset object still uses it.
5092  *
5093  * Called by the user via ioctl.
5094  *
5095  * Returns:
5096  * Zero on success, negative errno on failure.
5097  */
5098 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5099 				void *data, struct drm_file *file_priv)
5100 {
5101 	struct drm_mode_destroy_dumb *args = data;
5102 
5103 	if (!dev->driver->dumb_destroy)
5104 		return -ENOSYS;
5105 
5106 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5107 }
5108 
5109 /**
5110  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5111  * @format: pixel format (DRM_FORMAT_*)
5112  * @depth: storage for the depth value
5113  * @bpp: storage for the bpp value
5114  *
5115  * This only supports RGB formats here for compat with code that doesn't use
5116  * pixel formats directly yet.
5117  */
5118 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5119 			  int *bpp)
5120 {
5121 	switch (format) {
5122 	case DRM_FORMAT_C8:
5123 	case DRM_FORMAT_RGB332:
5124 	case DRM_FORMAT_BGR233:
5125 		*depth = 8;
5126 		*bpp = 8;
5127 		break;
5128 	case DRM_FORMAT_XRGB1555:
5129 	case DRM_FORMAT_XBGR1555:
5130 	case DRM_FORMAT_RGBX5551:
5131 	case DRM_FORMAT_BGRX5551:
5132 	case DRM_FORMAT_ARGB1555:
5133 	case DRM_FORMAT_ABGR1555:
5134 	case DRM_FORMAT_RGBA5551:
5135 	case DRM_FORMAT_BGRA5551:
5136 		*depth = 15;
5137 		*bpp = 16;
5138 		break;
5139 	case DRM_FORMAT_RGB565:
5140 	case DRM_FORMAT_BGR565:
5141 		*depth = 16;
5142 		*bpp = 16;
5143 		break;
5144 	case DRM_FORMAT_RGB888:
5145 	case DRM_FORMAT_BGR888:
5146 		*depth = 24;
5147 		*bpp = 24;
5148 		break;
5149 	case DRM_FORMAT_XRGB8888:
5150 	case DRM_FORMAT_XBGR8888:
5151 	case DRM_FORMAT_RGBX8888:
5152 	case DRM_FORMAT_BGRX8888:
5153 		*depth = 24;
5154 		*bpp = 32;
5155 		break;
5156 	case DRM_FORMAT_XRGB2101010:
5157 	case DRM_FORMAT_XBGR2101010:
5158 	case DRM_FORMAT_RGBX1010102:
5159 	case DRM_FORMAT_BGRX1010102:
5160 	case DRM_FORMAT_ARGB2101010:
5161 	case DRM_FORMAT_ABGR2101010:
5162 	case DRM_FORMAT_RGBA1010102:
5163 	case DRM_FORMAT_BGRA1010102:
5164 		*depth = 30;
5165 		*bpp = 32;
5166 		break;
5167 	case DRM_FORMAT_ARGB8888:
5168 	case DRM_FORMAT_ABGR8888:
5169 	case DRM_FORMAT_RGBA8888:
5170 	case DRM_FORMAT_BGRA8888:
5171 		*depth = 32;
5172 		*bpp = 32;
5173 		break;
5174 	default:
5175 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5176 			      drm_get_format_name(format));
5177 		*depth = 0;
5178 		*bpp = 0;
5179 		break;
5180 	}
5181 }
5182 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5183 
5184 /**
5185  * drm_format_num_planes - get the number of planes for format
5186  * @format: pixel format (DRM_FORMAT_*)
5187  *
5188  * Returns:
5189  * The number of planes used by the specified pixel format.
5190  */
5191 int drm_format_num_planes(uint32_t format)
5192 {
5193 	switch (format) {
5194 	case DRM_FORMAT_YUV410:
5195 	case DRM_FORMAT_YVU410:
5196 	case DRM_FORMAT_YUV411:
5197 	case DRM_FORMAT_YVU411:
5198 	case DRM_FORMAT_YUV420:
5199 	case DRM_FORMAT_YVU420:
5200 	case DRM_FORMAT_YUV422:
5201 	case DRM_FORMAT_YVU422:
5202 	case DRM_FORMAT_YUV444:
5203 	case DRM_FORMAT_YVU444:
5204 		return 3;
5205 	case DRM_FORMAT_NV12:
5206 	case DRM_FORMAT_NV21:
5207 	case DRM_FORMAT_NV16:
5208 	case DRM_FORMAT_NV61:
5209 	case DRM_FORMAT_NV24:
5210 	case DRM_FORMAT_NV42:
5211 		return 2;
5212 	default:
5213 		return 1;
5214 	}
5215 }
5216 EXPORT_SYMBOL(drm_format_num_planes);
5217 
5218 /**
5219  * drm_format_plane_cpp - determine the bytes per pixel value
5220  * @format: pixel format (DRM_FORMAT_*)
5221  * @plane: plane index
5222  *
5223  * Returns:
5224  * The bytes per pixel value for the specified plane.
5225  */
5226 int drm_format_plane_cpp(uint32_t format, int plane)
5227 {
5228 	unsigned int depth;
5229 	int bpp;
5230 
5231 	if (plane >= drm_format_num_planes(format))
5232 		return 0;
5233 
5234 	switch (format) {
5235 	case DRM_FORMAT_YUYV:
5236 	case DRM_FORMAT_YVYU:
5237 	case DRM_FORMAT_UYVY:
5238 	case DRM_FORMAT_VYUY:
5239 		return 2;
5240 	case DRM_FORMAT_NV12:
5241 	case DRM_FORMAT_NV21:
5242 	case DRM_FORMAT_NV16:
5243 	case DRM_FORMAT_NV61:
5244 	case DRM_FORMAT_NV24:
5245 	case DRM_FORMAT_NV42:
5246 		return plane ? 2 : 1;
5247 	case DRM_FORMAT_YUV410:
5248 	case DRM_FORMAT_YVU410:
5249 	case DRM_FORMAT_YUV411:
5250 	case DRM_FORMAT_YVU411:
5251 	case DRM_FORMAT_YUV420:
5252 	case DRM_FORMAT_YVU420:
5253 	case DRM_FORMAT_YUV422:
5254 	case DRM_FORMAT_YVU422:
5255 	case DRM_FORMAT_YUV444:
5256 	case DRM_FORMAT_YVU444:
5257 		return 1;
5258 	default:
5259 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5260 		return bpp >> 3;
5261 	}
5262 }
5263 EXPORT_SYMBOL(drm_format_plane_cpp);
5264 
5265 /**
5266  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5267  * @format: pixel format (DRM_FORMAT_*)
5268  *
5269  * Returns:
5270  * The horizontal chroma subsampling factor for the
5271  * specified pixel format.
5272  */
5273 int drm_format_horz_chroma_subsampling(uint32_t format)
5274 {
5275 	switch (format) {
5276 	case DRM_FORMAT_YUV411:
5277 	case DRM_FORMAT_YVU411:
5278 	case DRM_FORMAT_YUV410:
5279 	case DRM_FORMAT_YVU410:
5280 		return 4;
5281 	case DRM_FORMAT_YUYV:
5282 	case DRM_FORMAT_YVYU:
5283 	case DRM_FORMAT_UYVY:
5284 	case DRM_FORMAT_VYUY:
5285 	case DRM_FORMAT_NV12:
5286 	case DRM_FORMAT_NV21:
5287 	case DRM_FORMAT_NV16:
5288 	case DRM_FORMAT_NV61:
5289 	case DRM_FORMAT_YUV422:
5290 	case DRM_FORMAT_YVU422:
5291 	case DRM_FORMAT_YUV420:
5292 	case DRM_FORMAT_YVU420:
5293 		return 2;
5294 	default:
5295 		return 1;
5296 	}
5297 }
5298 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5299 
5300 /**
5301  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5302  * @format: pixel format (DRM_FORMAT_*)
5303  *
5304  * Returns:
5305  * The vertical chroma subsampling factor for the
5306  * specified pixel format.
5307  */
5308 int drm_format_vert_chroma_subsampling(uint32_t format)
5309 {
5310 	switch (format) {
5311 	case DRM_FORMAT_YUV410:
5312 	case DRM_FORMAT_YVU410:
5313 		return 4;
5314 	case DRM_FORMAT_YUV420:
5315 	case DRM_FORMAT_YVU420:
5316 	case DRM_FORMAT_NV12:
5317 	case DRM_FORMAT_NV21:
5318 		return 2;
5319 	default:
5320 		return 1;
5321 	}
5322 }
5323 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5324 
5325 /**
5326  * drm_rotation_simplify() - Try to simplify the rotation
5327  * @rotation: Rotation to be simplified
5328  * @supported_rotations: Supported rotations
5329  *
5330  * Attempt to simplify the rotation to a form that is supported.
5331  * Eg. if the hardware supports everything except DRM_REFLECT_X
5332  * one could call this function like this:
5333  *
5334  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5335  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5336  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5337  *
5338  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5339  * transforms the hardware supports, this function may not
5340  * be able to produce a supported transform, so the caller should
5341  * check the result afterwards.
5342  */
5343 unsigned int drm_rotation_simplify(unsigned int rotation,
5344 				   unsigned int supported_rotations)
5345 {
5346 	if (rotation & ~supported_rotations) {
5347 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5348 		rotation = (rotation & ~0xf) | BIT((ffs(rotation & 0xf) + 1) % 4);
5349 	}
5350 
5351 	return rotation;
5352 }
5353 EXPORT_SYMBOL(drm_rotation_simplify);
5354 
5355 /**
5356  * drm_mode_config_init - initialize DRM mode_configuration structure
5357  * @dev: DRM device
5358  *
5359  * Initialize @dev's mode_config structure, used for tracking the graphics
5360  * configuration of @dev.
5361  *
5362  * Since this initializes the modeset locks, no locking is possible. Which is no
5363  * problem, since this should happen single threaded at init time. It is the
5364  * driver's problem to ensure this guarantee.
5365  *
5366  */
5367 void drm_mode_config_init(struct drm_device *dev)
5368 {
5369 	mutex_init(&dev->mode_config.mutex);
5370 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5371 	mutex_init(&dev->mode_config.idr_mutex);
5372 	mutex_init(&dev->mode_config.fb_lock);
5373 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5374 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5375 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5376 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5377 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5378 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5379 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5380 	idr_init(&dev->mode_config.crtc_idr);
5381 	idr_init(&dev->mode_config.tile_idr);
5382 
5383 	drm_modeset_lock_all(dev);
5384 	drm_mode_create_standard_properties(dev);
5385 	drm_modeset_unlock_all(dev);
5386 
5387 	/* Just to be sure */
5388 	dev->mode_config.num_fb = 0;
5389 	dev->mode_config.num_connector = 0;
5390 	dev->mode_config.num_crtc = 0;
5391 	dev->mode_config.num_encoder = 0;
5392 	dev->mode_config.num_overlay_plane = 0;
5393 	dev->mode_config.num_total_plane = 0;
5394 }
5395 EXPORT_SYMBOL(drm_mode_config_init);
5396 
5397 /**
5398  * drm_mode_config_cleanup - free up DRM mode_config info
5399  * @dev: DRM device
5400  *
5401  * Free up all the connectors and CRTCs associated with this DRM device, then
5402  * free up the framebuffers and associated buffer objects.
5403  *
5404  * Note that since this /should/ happen single-threaded at driver/device
5405  * teardown time, no locking is required. It's the driver's job to ensure that
5406  * this guarantee actually holds true.
5407  *
5408  * FIXME: cleanup any dangling user buffer objects too
5409  */
5410 void drm_mode_config_cleanup(struct drm_device *dev)
5411 {
5412 	struct drm_connector *connector, *ot;
5413 	struct drm_crtc *crtc, *ct;
5414 	struct drm_encoder *encoder, *enct;
5415 	struct drm_framebuffer *fb, *fbt;
5416 	struct drm_property *property, *pt;
5417 	struct drm_property_blob *blob, *bt;
5418 	struct drm_plane *plane, *plt;
5419 
5420 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5421 				 head) {
5422 		encoder->funcs->destroy(encoder);
5423 	}
5424 
5425 	list_for_each_entry_safe(connector, ot,
5426 				 &dev->mode_config.connector_list, head) {
5427 		connector->funcs->destroy(connector);
5428 	}
5429 
5430 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5431 				 head) {
5432 		drm_property_destroy(dev, property);
5433 	}
5434 
5435 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5436 				 head) {
5437 		drm_property_destroy_blob(dev, blob);
5438 	}
5439 
5440 	/*
5441 	 * Single-threaded teardown context, so it's not required to grab the
5442 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5443 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5444 	 *
5445 	 * Also, if there are any framebuffers left, that's a driver leak now,
5446 	 * so politely WARN about this.
5447 	 */
5448 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5449 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5450 		drm_framebuffer_remove(fb);
5451 	}
5452 
5453 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5454 				 head) {
5455 		plane->funcs->destroy(plane);
5456 	}
5457 
5458 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5459 		crtc->funcs->destroy(crtc);
5460 	}
5461 
5462 	idr_destroy(&dev->mode_config.tile_idr);
5463 	idr_destroy(&dev->mode_config.crtc_idr);
5464 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5465 }
5466 EXPORT_SYMBOL(drm_mode_config_cleanup);
5467 
5468 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5469 						       unsigned int supported_rotations)
5470 {
5471 	static const struct drm_prop_enum_list props[] = {
5472 		{ DRM_ROTATE_0,   "rotate-0" },
5473 		{ DRM_ROTATE_90,  "rotate-90" },
5474 		{ DRM_ROTATE_180, "rotate-180" },
5475 		{ DRM_ROTATE_270, "rotate-270" },
5476 		{ DRM_REFLECT_X,  "reflect-x" },
5477 		{ DRM_REFLECT_Y,  "reflect-y" },
5478 	};
5479 
5480 	return drm_property_create_bitmask(dev, 0, "rotation",
5481 					   props, ARRAY_SIZE(props),
5482 					   supported_rotations);
5483 }
5484 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5485 
5486 /**
5487  * DOC: Tile group
5488  *
5489  * Tile groups are used to represent tiled monitors with a unique
5490  * integer identifier. Tiled monitors using DisplayID v1.3 have
5491  * a unique 8-byte handle, we store this in a tile group, so we
5492  * have a common identifier for all tiles in a monitor group.
5493  */
5494 static void drm_tile_group_free(struct kref *kref)
5495 {
5496 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5497 	struct drm_device *dev = tg->dev;
5498 	mutex_lock(&dev->mode_config.idr_mutex);
5499 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5500 	mutex_unlock(&dev->mode_config.idr_mutex);
5501 	kfree(tg);
5502 }
5503 
5504 /**
5505  * drm_mode_put_tile_group - drop a reference to a tile group.
5506  * @dev: DRM device
5507  * @tg: tile group to drop reference to.
5508  *
5509  * drop reference to tile group and free if 0.
5510  */
5511 void drm_mode_put_tile_group(struct drm_device *dev,
5512 			     struct drm_tile_group *tg)
5513 {
5514 	kref_put(&tg->refcount, drm_tile_group_free);
5515 }
5516 
5517 /**
5518  * drm_mode_get_tile_group - get a reference to an existing tile group
5519  * @dev: DRM device
5520  * @topology: 8-bytes unique per monitor.
5521  *
5522  * Use the unique bytes to get a reference to an existing tile group.
5523  *
5524  * RETURNS:
5525  * tile group or NULL if not found.
5526  */
5527 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5528 					       char topology[8])
5529 {
5530 	struct drm_tile_group *tg;
5531 	int id;
5532 	mutex_lock(&dev->mode_config.idr_mutex);
5533 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5534 		if (!memcmp(tg->group_data, topology, 8)) {
5535 			if (!kref_get_unless_zero(&tg->refcount))
5536 				tg = NULL;
5537 			mutex_unlock(&dev->mode_config.idr_mutex);
5538 			return tg;
5539 		}
5540 	}
5541 	mutex_unlock(&dev->mode_config.idr_mutex);
5542 	return NULL;
5543 }
5544 
5545 /**
5546  * drm_mode_create_tile_group - create a tile group from a displayid description
5547  * @dev: DRM device
5548  * @topology: 8-bytes unique per monitor.
5549  *
5550  * Create a tile group for the unique monitor, and get a unique
5551  * identifier for the tile group.
5552  *
5553  * RETURNS:
5554  * new tile group or error.
5555  */
5556 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5557 						  char topology[8])
5558 {
5559 	struct drm_tile_group *tg;
5560 	int ret;
5561 
5562 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5563 	if (!tg)
5564 		return ERR_PTR(-ENOMEM);
5565 
5566 	kref_init(&tg->refcount);
5567 	memcpy(tg->group_data, topology, 8);
5568 	tg->dev = dev;
5569 
5570 	mutex_lock(&dev->mode_config.idr_mutex);
5571 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5572 	if (ret >= 0) {
5573 		tg->id = ret;
5574 	} else {
5575 		kfree(tg);
5576 		tg = ERR_PTR(ret);
5577 	}
5578 
5579 	mutex_unlock(&dev->mode_config.idr_mutex);
5580 	return tg;
5581 }
5582