xref: /linux/drivers/gpu/drm/drm_crtc.c (revision a8fe58cec351c25e09c393bf46117c0c47b5a17c)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
35 #include <linux/export.h>
36 #include <drm/drmP.h>
37 #include <drm/drm_crtc.h>
38 #include <drm/drm_edid.h>
39 #include <drm/drm_fourcc.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    const struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	struct ida ida;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 	int i;
196 
197 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
198 		ida_init(&drm_connector_enum_list[i].ida);
199 }
200 
201 void drm_connector_ida_destroy(void)
202 {
203 	int i;
204 
205 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
206 		ida_destroy(&drm_connector_enum_list[i].ida);
207 }
208 
209 /**
210  * drm_get_connector_status_name - return a string for connector status
211  * @status: connector status to compute name of
212  *
213  * In contrast to the other drm_get_*_name functions this one here returns a
214  * const pointer and hence is threadsafe.
215  */
216 const char *drm_get_connector_status_name(enum drm_connector_status status)
217 {
218 	if (status == connector_status_connected)
219 		return "connected";
220 	else if (status == connector_status_disconnected)
221 		return "disconnected";
222 	else
223 		return "unknown";
224 }
225 EXPORT_SYMBOL(drm_get_connector_status_name);
226 
227 /**
228  * drm_get_subpixel_order_name - return a string for a given subpixel enum
229  * @order: enum of subpixel_order
230  *
231  * Note you could abuse this and return something out of bounds, but that
232  * would be a caller error.  No unscrubbed user data should make it here.
233  */
234 const char *drm_get_subpixel_order_name(enum subpixel_order order)
235 {
236 	return drm_subpixel_enum_list[order].name;
237 }
238 EXPORT_SYMBOL(drm_get_subpixel_order_name);
239 
240 static char printable_char(int c)
241 {
242 	return isascii(c) && isprint(c) ? c : '?';
243 }
244 
245 /**
246  * drm_get_format_name - return a string for drm fourcc format
247  * @format: format to compute name of
248  *
249  * Note that the buffer used by this function is globally shared and owned by
250  * the function itself.
251  *
252  * FIXME: This isn't really multithreading safe.
253  */
254 const char *drm_get_format_name(uint32_t format)
255 {
256 	static char buf[32];
257 
258 	snprintf(buf, sizeof(buf),
259 		 "%c%c%c%c %s-endian (0x%08x)",
260 		 printable_char(format & 0xff),
261 		 printable_char((format >> 8) & 0xff),
262 		 printable_char((format >> 16) & 0xff),
263 		 printable_char((format >> 24) & 0x7f),
264 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
265 		 format);
266 
267 	return buf;
268 }
269 EXPORT_SYMBOL(drm_get_format_name);
270 
271 /*
272  * Internal function to assign a slot in the object idr and optionally
273  * register the object into the idr.
274  */
275 static int drm_mode_object_get_reg(struct drm_device *dev,
276 				   struct drm_mode_object *obj,
277 				   uint32_t obj_type,
278 				   bool register_obj)
279 {
280 	int ret;
281 
282 	mutex_lock(&dev->mode_config.idr_mutex);
283 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
284 	if (ret >= 0) {
285 		/*
286 		 * Set up the object linking under the protection of the idr
287 		 * lock so that other users can't see inconsistent state.
288 		 */
289 		obj->id = ret;
290 		obj->type = obj_type;
291 	}
292 	mutex_unlock(&dev->mode_config.idr_mutex);
293 
294 	return ret < 0 ? ret : 0;
295 }
296 
297 /**
298  * drm_mode_object_get - allocate a new modeset identifier
299  * @dev: DRM device
300  * @obj: object pointer, used to generate unique ID
301  * @obj_type: object type
302  *
303  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
304  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
305  * modeset identifiers are _not_ reference counted. Hence don't use this for
306  * reference counted modeset objects like framebuffers.
307  *
308  * Returns:
309  * Zero on success, error code on failure.
310  */
311 int drm_mode_object_get(struct drm_device *dev,
312 			struct drm_mode_object *obj, uint32_t obj_type)
313 {
314 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
315 }
316 
317 static void drm_mode_object_register(struct drm_device *dev,
318 				     struct drm_mode_object *obj)
319 {
320 	mutex_lock(&dev->mode_config.idr_mutex);
321 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
322 	mutex_unlock(&dev->mode_config.idr_mutex);
323 }
324 
325 /**
326  * drm_mode_object_put - free a modeset identifer
327  * @dev: DRM device
328  * @object: object to free
329  *
330  * Free @id from @dev's unique identifier pool. Note that despite the _get
331  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
332  * for reference counted modeset objects like framebuffers.
333  */
334 void drm_mode_object_put(struct drm_device *dev,
335 			 struct drm_mode_object *object)
336 {
337 	mutex_lock(&dev->mode_config.idr_mutex);
338 	idr_remove(&dev->mode_config.crtc_idr, object->id);
339 	mutex_unlock(&dev->mode_config.idr_mutex);
340 }
341 
342 static struct drm_mode_object *_object_find(struct drm_device *dev,
343 		uint32_t id, uint32_t type)
344 {
345 	struct drm_mode_object *obj = NULL;
346 
347 	mutex_lock(&dev->mode_config.idr_mutex);
348 	obj = idr_find(&dev->mode_config.crtc_idr, id);
349 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
350 		obj = NULL;
351 	if (obj && obj->id != id)
352 		obj = NULL;
353 	/* don't leak out unref'd fb's */
354 	if (obj &&
355 	    (obj->type == DRM_MODE_OBJECT_FB ||
356 	     obj->type == DRM_MODE_OBJECT_BLOB))
357 		obj = NULL;
358 	mutex_unlock(&dev->mode_config.idr_mutex);
359 
360 	return obj;
361 }
362 
363 /**
364  * drm_mode_object_find - look up a drm object with static lifetime
365  * @dev: drm device
366  * @id: id of the mode object
367  * @type: type of the mode object
368  *
369  * Note that framebuffers cannot be looked up with this functions - since those
370  * are reference counted, they need special treatment.  Even with
371  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
372  * rather than WARN_ON()).
373  */
374 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
375 		uint32_t id, uint32_t type)
376 {
377 	struct drm_mode_object *obj = NULL;
378 
379 	/* Framebuffers are reference counted and need their own lookup
380 	 * function.*/
381 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
382 	obj = _object_find(dev, id, type);
383 	return obj;
384 }
385 EXPORT_SYMBOL(drm_mode_object_find);
386 
387 /**
388  * drm_framebuffer_init - initialize a framebuffer
389  * @dev: DRM device
390  * @fb: framebuffer to be initialized
391  * @funcs: ... with these functions
392  *
393  * Allocates an ID for the framebuffer's parent mode object, sets its mode
394  * functions & device file and adds it to the master fd list.
395  *
396  * IMPORTANT:
397  * This functions publishes the fb and makes it available for concurrent access
398  * by other users. Which means by this point the fb _must_ be fully set up -
399  * since all the fb attributes are invariant over its lifetime, no further
400  * locking but only correct reference counting is required.
401  *
402  * Returns:
403  * Zero on success, error code on failure.
404  */
405 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
406 			 const struct drm_framebuffer_funcs *funcs)
407 {
408 	int ret;
409 
410 	mutex_lock(&dev->mode_config.fb_lock);
411 	kref_init(&fb->refcount);
412 	INIT_LIST_HEAD(&fb->filp_head);
413 	fb->dev = dev;
414 	fb->funcs = funcs;
415 
416 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
417 	if (ret)
418 		goto out;
419 
420 	dev->mode_config.num_fb++;
421 	list_add(&fb->head, &dev->mode_config.fb_list);
422 out:
423 	mutex_unlock(&dev->mode_config.fb_lock);
424 
425 	return ret;
426 }
427 EXPORT_SYMBOL(drm_framebuffer_init);
428 
429 /* dev->mode_config.fb_lock must be held! */
430 static void __drm_framebuffer_unregister(struct drm_device *dev,
431 					 struct drm_framebuffer *fb)
432 {
433 	mutex_lock(&dev->mode_config.idr_mutex);
434 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
435 	mutex_unlock(&dev->mode_config.idr_mutex);
436 
437 	fb->base.id = 0;
438 }
439 
440 static void drm_framebuffer_free(struct kref *kref)
441 {
442 	struct drm_framebuffer *fb =
443 			container_of(kref, struct drm_framebuffer, refcount);
444 	struct drm_device *dev = fb->dev;
445 
446 	/*
447 	 * The lookup idr holds a weak reference, which has not necessarily been
448 	 * removed at this point. Check for that.
449 	 */
450 	mutex_lock(&dev->mode_config.fb_lock);
451 	if (fb->base.id) {
452 		/* Mark fb as reaped and drop idr ref. */
453 		__drm_framebuffer_unregister(dev, fb);
454 	}
455 	mutex_unlock(&dev->mode_config.fb_lock);
456 
457 	fb->funcs->destroy(fb);
458 }
459 
460 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
461 							uint32_t id)
462 {
463 	struct drm_mode_object *obj = NULL;
464 	struct drm_framebuffer *fb;
465 
466 	mutex_lock(&dev->mode_config.idr_mutex);
467 	obj = idr_find(&dev->mode_config.crtc_idr, id);
468 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
469 		fb = NULL;
470 	else
471 		fb = obj_to_fb(obj);
472 	mutex_unlock(&dev->mode_config.idr_mutex);
473 
474 	return fb;
475 }
476 
477 /**
478  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
479  * @dev: drm device
480  * @id: id of the fb object
481  *
482  * If successful, this grabs an additional reference to the framebuffer -
483  * callers need to make sure to eventually unreference the returned framebuffer
484  * again, using @drm_framebuffer_unreference.
485  */
486 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
487 					       uint32_t id)
488 {
489 	struct drm_framebuffer *fb;
490 
491 	mutex_lock(&dev->mode_config.fb_lock);
492 	fb = __drm_framebuffer_lookup(dev, id);
493 	if (fb) {
494 		if (!kref_get_unless_zero(&fb->refcount))
495 			fb = NULL;
496 	}
497 	mutex_unlock(&dev->mode_config.fb_lock);
498 
499 	return fb;
500 }
501 EXPORT_SYMBOL(drm_framebuffer_lookup);
502 
503 /**
504  * drm_framebuffer_unreference - unref a framebuffer
505  * @fb: framebuffer to unref
506  *
507  * This functions decrements the fb's refcount and frees it if it drops to zero.
508  */
509 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
510 {
511 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
512 	kref_put(&fb->refcount, drm_framebuffer_free);
513 }
514 EXPORT_SYMBOL(drm_framebuffer_unreference);
515 
516 /**
517  * drm_framebuffer_reference - incr the fb refcnt
518  * @fb: framebuffer
519  *
520  * This functions increments the fb's refcount.
521  */
522 void drm_framebuffer_reference(struct drm_framebuffer *fb)
523 {
524 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
525 	kref_get(&fb->refcount);
526 }
527 EXPORT_SYMBOL(drm_framebuffer_reference);
528 
529 /**
530  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
531  * @fb: fb to unregister
532  *
533  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
534  * those used for fbdev. Note that the caller must hold a reference of it's own,
535  * i.e. the object may not be destroyed through this call (since it'll lead to a
536  * locking inversion).
537  */
538 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
539 {
540 	struct drm_device *dev;
541 
542 	if (!fb)
543 		return;
544 
545 	dev = fb->dev;
546 
547 	mutex_lock(&dev->mode_config.fb_lock);
548 	/* Mark fb as reaped and drop idr ref. */
549 	__drm_framebuffer_unregister(dev, fb);
550 	mutex_unlock(&dev->mode_config.fb_lock);
551 }
552 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
553 
554 /**
555  * drm_framebuffer_cleanup - remove a framebuffer object
556  * @fb: framebuffer to remove
557  *
558  * Cleanup framebuffer. This function is intended to be used from the drivers
559  * ->destroy callback. It can also be used to clean up driver private
560  *  framebuffers embedded into a larger structure.
561  *
562  * Note that this function does not remove the fb from active usuage - if it is
563  * still used anywhere, hilarity can ensue since userspace could call getfb on
564  * the id and get back -EINVAL. Obviously no concern at driver unload time.
565  *
566  * Also, the framebuffer will not be removed from the lookup idr - for
567  * user-created framebuffers this will happen in in the rmfb ioctl. For
568  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
569  * drm_framebuffer_unregister_private.
570  */
571 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
572 {
573 	struct drm_device *dev = fb->dev;
574 
575 	mutex_lock(&dev->mode_config.fb_lock);
576 	list_del(&fb->head);
577 	dev->mode_config.num_fb--;
578 	mutex_unlock(&dev->mode_config.fb_lock);
579 }
580 EXPORT_SYMBOL(drm_framebuffer_cleanup);
581 
582 /**
583  * drm_framebuffer_remove - remove and unreference a framebuffer object
584  * @fb: framebuffer to remove
585  *
586  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
587  * using @fb, removes it, setting it to NULL. Then drops the reference to the
588  * passed-in framebuffer. Might take the modeset locks.
589  *
590  * Note that this function optimizes the cleanup away if the caller holds the
591  * last reference to the framebuffer. It is also guaranteed to not take the
592  * modeset locks in this case.
593  */
594 void drm_framebuffer_remove(struct drm_framebuffer *fb)
595 {
596 	struct drm_device *dev;
597 	struct drm_crtc *crtc;
598 	struct drm_plane *plane;
599 	struct drm_mode_set set;
600 	int ret;
601 
602 	if (!fb)
603 		return;
604 
605 	dev = fb->dev;
606 
607 	WARN_ON(!list_empty(&fb->filp_head));
608 
609 	/*
610 	 * drm ABI mandates that we remove any deleted framebuffers from active
611 	 * useage. But since most sane clients only remove framebuffers they no
612 	 * longer need, try to optimize this away.
613 	 *
614 	 * Since we're holding a reference ourselves, observing a refcount of 1
615 	 * means that we're the last holder and can skip it. Also, the refcount
616 	 * can never increase from 1 again, so we don't need any barriers or
617 	 * locks.
618 	 *
619 	 * Note that userspace could try to race with use and instate a new
620 	 * usage _after_ we've cleared all current ones. End result will be an
621 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
622 	 * in this manner.
623 	 */
624 	if (atomic_read(&fb->refcount.refcount) > 1) {
625 		drm_modeset_lock_all(dev);
626 		/* remove from any CRTC */
627 		drm_for_each_crtc(crtc, dev) {
628 			if (crtc->primary->fb == fb) {
629 				/* should turn off the crtc */
630 				memset(&set, 0, sizeof(struct drm_mode_set));
631 				set.crtc = crtc;
632 				set.fb = NULL;
633 				ret = drm_mode_set_config_internal(&set);
634 				if (ret)
635 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
636 			}
637 		}
638 
639 		drm_for_each_plane(plane, dev) {
640 			if (plane->fb == fb)
641 				drm_plane_force_disable(plane);
642 		}
643 		drm_modeset_unlock_all(dev);
644 	}
645 
646 	drm_framebuffer_unreference(fb);
647 }
648 EXPORT_SYMBOL(drm_framebuffer_remove);
649 
650 DEFINE_WW_CLASS(crtc_ww_class);
651 
652 static unsigned int drm_num_crtcs(struct drm_device *dev)
653 {
654 	unsigned int num = 0;
655 	struct drm_crtc *tmp;
656 
657 	drm_for_each_crtc(tmp, dev) {
658 		num++;
659 	}
660 
661 	return num;
662 }
663 
664 /**
665  * drm_crtc_init_with_planes - Initialise a new CRTC object with
666  *    specified primary and cursor planes.
667  * @dev: DRM device
668  * @crtc: CRTC object to init
669  * @primary: Primary plane for CRTC
670  * @cursor: Cursor plane for CRTC
671  * @funcs: callbacks for the new CRTC
672  * @name: printf style format string for the CRTC name, or NULL for default name
673  *
674  * Inits a new object created as base part of a driver crtc object.
675  *
676  * Returns:
677  * Zero on success, error code on failure.
678  */
679 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
680 			      struct drm_plane *primary,
681 			      struct drm_plane *cursor,
682 			      const struct drm_crtc_funcs *funcs,
683 			      const char *name, ...)
684 {
685 	struct drm_mode_config *config = &dev->mode_config;
686 	int ret;
687 
688 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
689 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
690 
691 	crtc->dev = dev;
692 	crtc->funcs = funcs;
693 
694 	drm_modeset_lock_init(&crtc->mutex);
695 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
696 	if (ret)
697 		return ret;
698 
699 	if (name) {
700 		va_list ap;
701 
702 		va_start(ap, name);
703 		crtc->name = kvasprintf(GFP_KERNEL, name, ap);
704 		va_end(ap);
705 	} else {
706 		crtc->name = kasprintf(GFP_KERNEL, "crtc-%d",
707 				       drm_num_crtcs(dev));
708 	}
709 	if (!crtc->name) {
710 		drm_mode_object_put(dev, &crtc->base);
711 		return -ENOMEM;
712 	}
713 
714 	crtc->base.properties = &crtc->properties;
715 
716 	list_add_tail(&crtc->head, &config->crtc_list);
717 	config->num_crtc++;
718 
719 	crtc->primary = primary;
720 	crtc->cursor = cursor;
721 	if (primary)
722 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
723 	if (cursor)
724 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
725 
726 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
727 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
728 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
729 	}
730 
731 	return 0;
732 }
733 EXPORT_SYMBOL(drm_crtc_init_with_planes);
734 
735 /**
736  * drm_crtc_cleanup - Clean up the core crtc usage
737  * @crtc: CRTC to cleanup
738  *
739  * This function cleans up @crtc and removes it from the DRM mode setting
740  * core. Note that the function does *not* free the crtc structure itself,
741  * this is the responsibility of the caller.
742  */
743 void drm_crtc_cleanup(struct drm_crtc *crtc)
744 {
745 	struct drm_device *dev = crtc->dev;
746 
747 	kfree(crtc->gamma_store);
748 	crtc->gamma_store = NULL;
749 
750 	drm_modeset_lock_fini(&crtc->mutex);
751 
752 	drm_mode_object_put(dev, &crtc->base);
753 	list_del(&crtc->head);
754 	dev->mode_config.num_crtc--;
755 
756 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
757 	if (crtc->state && crtc->funcs->atomic_destroy_state)
758 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
759 
760 	kfree(crtc->name);
761 
762 	memset(crtc, 0, sizeof(*crtc));
763 }
764 EXPORT_SYMBOL(drm_crtc_cleanup);
765 
766 /**
767  * drm_crtc_index - find the index of a registered CRTC
768  * @crtc: CRTC to find index for
769  *
770  * Given a registered CRTC, return the index of that CRTC within a DRM
771  * device's list of CRTCs.
772  */
773 unsigned int drm_crtc_index(struct drm_crtc *crtc)
774 {
775 	unsigned int index = 0;
776 	struct drm_crtc *tmp;
777 
778 	drm_for_each_crtc(tmp, crtc->dev) {
779 		if (tmp == crtc)
780 			return index;
781 
782 		index++;
783 	}
784 
785 	BUG();
786 }
787 EXPORT_SYMBOL(drm_crtc_index);
788 
789 /*
790  * drm_mode_remove - remove and free a mode
791  * @connector: connector list to modify
792  * @mode: mode to remove
793  *
794  * Remove @mode from @connector's mode list, then free it.
795  */
796 static void drm_mode_remove(struct drm_connector *connector,
797 			    struct drm_display_mode *mode)
798 {
799 	list_del(&mode->head);
800 	drm_mode_destroy(connector->dev, mode);
801 }
802 
803 /**
804  * drm_display_info_set_bus_formats - set the supported bus formats
805  * @info: display info to store bus formats in
806  * @formats: array containing the supported bus formats
807  * @num_formats: the number of entries in the fmts array
808  *
809  * Store the supported bus formats in display info structure.
810  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
811  * a full list of available formats.
812  */
813 int drm_display_info_set_bus_formats(struct drm_display_info *info,
814 				     const u32 *formats,
815 				     unsigned int num_formats)
816 {
817 	u32 *fmts = NULL;
818 
819 	if (!formats && num_formats)
820 		return -EINVAL;
821 
822 	if (formats && num_formats) {
823 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
824 			       GFP_KERNEL);
825 		if (!fmts)
826 			return -ENOMEM;
827 	}
828 
829 	kfree(info->bus_formats);
830 	info->bus_formats = fmts;
831 	info->num_bus_formats = num_formats;
832 
833 	return 0;
834 }
835 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
836 
837 /**
838  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
839  * @connector: connector to quwery
840  *
841  * The kernel supports per-connector configration of its consoles through
842  * use of the video= parameter. This function parses that option and
843  * extracts the user's specified mode (or enable/disable status) for a
844  * particular connector. This is typically only used during the early fbdev
845  * setup.
846  */
847 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
848 {
849 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
850 	char *option = NULL;
851 
852 	if (fb_get_options(connector->name, &option))
853 		return;
854 
855 	if (!drm_mode_parse_command_line_for_connector(option,
856 						       connector,
857 						       mode))
858 		return;
859 
860 	if (mode->force) {
861 		const char *s;
862 
863 		switch (mode->force) {
864 		case DRM_FORCE_OFF:
865 			s = "OFF";
866 			break;
867 		case DRM_FORCE_ON_DIGITAL:
868 			s = "ON - dig";
869 			break;
870 		default:
871 		case DRM_FORCE_ON:
872 			s = "ON";
873 			break;
874 		}
875 
876 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
877 		connector->force = mode->force;
878 	}
879 
880 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
881 		      connector->name,
882 		      mode->xres, mode->yres,
883 		      mode->refresh_specified ? mode->refresh : 60,
884 		      mode->rb ? " reduced blanking" : "",
885 		      mode->margins ? " with margins" : "",
886 		      mode->interlace ?  " interlaced" : "");
887 }
888 
889 /**
890  * drm_connector_init - Init a preallocated connector
891  * @dev: DRM device
892  * @connector: the connector to init
893  * @funcs: callbacks for this connector
894  * @connector_type: user visible type of the connector
895  *
896  * Initialises a preallocated connector. Connectors should be
897  * subclassed as part of driver connector objects.
898  *
899  * Returns:
900  * Zero on success, error code on failure.
901  */
902 int drm_connector_init(struct drm_device *dev,
903 		       struct drm_connector *connector,
904 		       const struct drm_connector_funcs *funcs,
905 		       int connector_type)
906 {
907 	struct drm_mode_config *config = &dev->mode_config;
908 	int ret;
909 	struct ida *connector_ida =
910 		&drm_connector_enum_list[connector_type].ida;
911 
912 	drm_modeset_lock_all(dev);
913 
914 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
915 	if (ret)
916 		goto out_unlock;
917 
918 	connector->base.properties = &connector->properties;
919 	connector->dev = dev;
920 	connector->funcs = funcs;
921 	connector->connector_type = connector_type;
922 	connector->connector_type_id =
923 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
924 	if (connector->connector_type_id < 0) {
925 		ret = connector->connector_type_id;
926 		goto out_put;
927 	}
928 	connector->name =
929 		kasprintf(GFP_KERNEL, "%s-%d",
930 			  drm_connector_enum_list[connector_type].name,
931 			  connector->connector_type_id);
932 	if (!connector->name) {
933 		ret = -ENOMEM;
934 		goto out_put;
935 	}
936 
937 	INIT_LIST_HEAD(&connector->probed_modes);
938 	INIT_LIST_HEAD(&connector->modes);
939 	connector->edid_blob_ptr = NULL;
940 	connector->status = connector_status_unknown;
941 
942 	drm_connector_get_cmdline_mode(connector);
943 
944 	/* We should add connectors at the end to avoid upsetting the connector
945 	 * index too much. */
946 	list_add_tail(&connector->head, &config->connector_list);
947 	config->num_connector++;
948 
949 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
950 		drm_object_attach_property(&connector->base,
951 					      config->edid_property,
952 					      0);
953 
954 	drm_object_attach_property(&connector->base,
955 				      config->dpms_property, 0);
956 
957 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
958 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
959 	}
960 
961 	connector->debugfs_entry = NULL;
962 
963 out_put:
964 	if (ret)
965 		drm_mode_object_put(dev, &connector->base);
966 
967 out_unlock:
968 	drm_modeset_unlock_all(dev);
969 
970 	return ret;
971 }
972 EXPORT_SYMBOL(drm_connector_init);
973 
974 /**
975  * drm_connector_cleanup - cleans up an initialised connector
976  * @connector: connector to cleanup
977  *
978  * Cleans up the connector but doesn't free the object.
979  */
980 void drm_connector_cleanup(struct drm_connector *connector)
981 {
982 	struct drm_device *dev = connector->dev;
983 	struct drm_display_mode *mode, *t;
984 
985 	if (connector->tile_group) {
986 		drm_mode_put_tile_group(dev, connector->tile_group);
987 		connector->tile_group = NULL;
988 	}
989 
990 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
991 		drm_mode_remove(connector, mode);
992 
993 	list_for_each_entry_safe(mode, t, &connector->modes, head)
994 		drm_mode_remove(connector, mode);
995 
996 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
997 		   connector->connector_type_id);
998 
999 	kfree(connector->display_info.bus_formats);
1000 	drm_mode_object_put(dev, &connector->base);
1001 	kfree(connector->name);
1002 	connector->name = NULL;
1003 	list_del(&connector->head);
1004 	dev->mode_config.num_connector--;
1005 
1006 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
1007 	if (connector->state && connector->funcs->atomic_destroy_state)
1008 		connector->funcs->atomic_destroy_state(connector,
1009 						       connector->state);
1010 
1011 	memset(connector, 0, sizeof(*connector));
1012 }
1013 EXPORT_SYMBOL(drm_connector_cleanup);
1014 
1015 /**
1016  * drm_connector_index - find the index of a registered connector
1017  * @connector: connector to find index for
1018  *
1019  * Given a registered connector, return the index of that connector within a DRM
1020  * device's list of connectors.
1021  */
1022 unsigned int drm_connector_index(struct drm_connector *connector)
1023 {
1024 	unsigned int index = 0;
1025 	struct drm_connector *tmp;
1026 	struct drm_mode_config *config = &connector->dev->mode_config;
1027 
1028 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
1029 
1030 	drm_for_each_connector(tmp, connector->dev) {
1031 		if (tmp == connector)
1032 			return index;
1033 
1034 		index++;
1035 	}
1036 
1037 	BUG();
1038 }
1039 EXPORT_SYMBOL(drm_connector_index);
1040 
1041 /**
1042  * drm_connector_register - register a connector
1043  * @connector: the connector to register
1044  *
1045  * Register userspace interfaces for a connector
1046  *
1047  * Returns:
1048  * Zero on success, error code on failure.
1049  */
1050 int drm_connector_register(struct drm_connector *connector)
1051 {
1052 	int ret;
1053 
1054 	drm_mode_object_register(connector->dev, &connector->base);
1055 
1056 	ret = drm_sysfs_connector_add(connector);
1057 	if (ret)
1058 		return ret;
1059 
1060 	ret = drm_debugfs_connector_add(connector);
1061 	if (ret) {
1062 		drm_sysfs_connector_remove(connector);
1063 		return ret;
1064 	}
1065 
1066 	return 0;
1067 }
1068 EXPORT_SYMBOL(drm_connector_register);
1069 
1070 /**
1071  * drm_connector_unregister - unregister a connector
1072  * @connector: the connector to unregister
1073  *
1074  * Unregister userspace interfaces for a connector
1075  */
1076 void drm_connector_unregister(struct drm_connector *connector)
1077 {
1078 	drm_sysfs_connector_remove(connector);
1079 	drm_debugfs_connector_remove(connector);
1080 }
1081 EXPORT_SYMBOL(drm_connector_unregister);
1082 
1083 
1084 /**
1085  * drm_connector_unplug_all - unregister connector userspace interfaces
1086  * @dev: drm device
1087  *
1088  * This function unregisters all connector userspace interfaces in sysfs. Should
1089  * be call when the device is disconnected, e.g. from an usb driver's
1090  * ->disconnect callback.
1091  */
1092 void drm_connector_unplug_all(struct drm_device *dev)
1093 {
1094 	struct drm_connector *connector;
1095 
1096 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
1097 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1098 		drm_connector_unregister(connector);
1099 
1100 }
1101 EXPORT_SYMBOL(drm_connector_unplug_all);
1102 
1103 /**
1104  * drm_encoder_init - Init a preallocated encoder
1105  * @dev: drm device
1106  * @encoder: the encoder to init
1107  * @funcs: callbacks for this encoder
1108  * @encoder_type: user visible type of the encoder
1109  * @name: printf style format string for the encoder name, or NULL for default name
1110  *
1111  * Initialises a preallocated encoder. Encoder should be
1112  * subclassed as part of driver encoder objects.
1113  *
1114  * Returns:
1115  * Zero on success, error code on failure.
1116  */
1117 int drm_encoder_init(struct drm_device *dev,
1118 		      struct drm_encoder *encoder,
1119 		      const struct drm_encoder_funcs *funcs,
1120 		      int encoder_type, const char *name, ...)
1121 {
1122 	int ret;
1123 
1124 	drm_modeset_lock_all(dev);
1125 
1126 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1127 	if (ret)
1128 		goto out_unlock;
1129 
1130 	encoder->dev = dev;
1131 	encoder->encoder_type = encoder_type;
1132 	encoder->funcs = funcs;
1133 	if (name) {
1134 		va_list ap;
1135 
1136 		va_start(ap, name);
1137 		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
1138 		va_end(ap);
1139 	} else {
1140 		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
1141 					  drm_encoder_enum_list[encoder_type].name,
1142 					  encoder->base.id);
1143 	}
1144 	if (!encoder->name) {
1145 		ret = -ENOMEM;
1146 		goto out_put;
1147 	}
1148 
1149 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1150 	dev->mode_config.num_encoder++;
1151 
1152 out_put:
1153 	if (ret)
1154 		drm_mode_object_put(dev, &encoder->base);
1155 
1156 out_unlock:
1157 	drm_modeset_unlock_all(dev);
1158 
1159 	return ret;
1160 }
1161 EXPORT_SYMBOL(drm_encoder_init);
1162 
1163 /**
1164  * drm_encoder_cleanup - cleans up an initialised encoder
1165  * @encoder: encoder to cleanup
1166  *
1167  * Cleans up the encoder but doesn't free the object.
1168  */
1169 void drm_encoder_cleanup(struct drm_encoder *encoder)
1170 {
1171 	struct drm_device *dev = encoder->dev;
1172 
1173 	drm_modeset_lock_all(dev);
1174 	drm_mode_object_put(dev, &encoder->base);
1175 	kfree(encoder->name);
1176 	list_del(&encoder->head);
1177 	dev->mode_config.num_encoder--;
1178 	drm_modeset_unlock_all(dev);
1179 
1180 	memset(encoder, 0, sizeof(*encoder));
1181 }
1182 EXPORT_SYMBOL(drm_encoder_cleanup);
1183 
1184 static unsigned int drm_num_planes(struct drm_device *dev)
1185 {
1186 	unsigned int num = 0;
1187 	struct drm_plane *tmp;
1188 
1189 	drm_for_each_plane(tmp, dev) {
1190 		num++;
1191 	}
1192 
1193 	return num;
1194 }
1195 
1196 /**
1197  * drm_universal_plane_init - Initialize a new universal plane object
1198  * @dev: DRM device
1199  * @plane: plane object to init
1200  * @possible_crtcs: bitmask of possible CRTCs
1201  * @funcs: callbacks for the new plane
1202  * @formats: array of supported formats (%DRM_FORMAT_*)
1203  * @format_count: number of elements in @formats
1204  * @type: type of plane (overlay, primary, cursor)
1205  * @name: printf style format string for the plane name, or NULL for default name
1206  *
1207  * Initializes a plane object of type @type.
1208  *
1209  * Returns:
1210  * Zero on success, error code on failure.
1211  */
1212 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1213 			     unsigned long possible_crtcs,
1214 			     const struct drm_plane_funcs *funcs,
1215 			     const uint32_t *formats, unsigned int format_count,
1216 			     enum drm_plane_type type,
1217 			     const char *name, ...)
1218 {
1219 	struct drm_mode_config *config = &dev->mode_config;
1220 	int ret;
1221 
1222 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1223 	if (ret)
1224 		return ret;
1225 
1226 	drm_modeset_lock_init(&plane->mutex);
1227 
1228 	plane->base.properties = &plane->properties;
1229 	plane->dev = dev;
1230 	plane->funcs = funcs;
1231 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
1232 					    GFP_KERNEL);
1233 	if (!plane->format_types) {
1234 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1235 		drm_mode_object_put(dev, &plane->base);
1236 		return -ENOMEM;
1237 	}
1238 
1239 	if (name) {
1240 		va_list ap;
1241 
1242 		va_start(ap, name);
1243 		plane->name = kvasprintf(GFP_KERNEL, name, ap);
1244 		va_end(ap);
1245 	} else {
1246 		plane->name = kasprintf(GFP_KERNEL, "plane-%d",
1247 					drm_num_planes(dev));
1248 	}
1249 	if (!plane->name) {
1250 		kfree(plane->format_types);
1251 		drm_mode_object_put(dev, &plane->base);
1252 		return -ENOMEM;
1253 	}
1254 
1255 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1256 	plane->format_count = format_count;
1257 	plane->possible_crtcs = possible_crtcs;
1258 	plane->type = type;
1259 
1260 	list_add_tail(&plane->head, &config->plane_list);
1261 	config->num_total_plane++;
1262 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1263 		config->num_overlay_plane++;
1264 
1265 	drm_object_attach_property(&plane->base,
1266 				   config->plane_type_property,
1267 				   plane->type);
1268 
1269 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1270 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1271 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1272 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1273 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1274 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1275 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1276 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1277 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1278 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1279 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1280 	}
1281 
1282 	return 0;
1283 }
1284 EXPORT_SYMBOL(drm_universal_plane_init);
1285 
1286 /**
1287  * drm_plane_init - Initialize a legacy plane
1288  * @dev: DRM device
1289  * @plane: plane object to init
1290  * @possible_crtcs: bitmask of possible CRTCs
1291  * @funcs: callbacks for the new plane
1292  * @formats: array of supported formats (%DRM_FORMAT_*)
1293  * @format_count: number of elements in @formats
1294  * @is_primary: plane type (primary vs overlay)
1295  *
1296  * Legacy API to initialize a DRM plane.
1297  *
1298  * New drivers should call drm_universal_plane_init() instead.
1299  *
1300  * Returns:
1301  * Zero on success, error code on failure.
1302  */
1303 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1304 		   unsigned long possible_crtcs,
1305 		   const struct drm_plane_funcs *funcs,
1306 		   const uint32_t *formats, unsigned int format_count,
1307 		   bool is_primary)
1308 {
1309 	enum drm_plane_type type;
1310 
1311 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1312 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1313 					formats, format_count, type, NULL);
1314 }
1315 EXPORT_SYMBOL(drm_plane_init);
1316 
1317 /**
1318  * drm_plane_cleanup - Clean up the core plane usage
1319  * @plane: plane to cleanup
1320  *
1321  * This function cleans up @plane and removes it from the DRM mode setting
1322  * core. Note that the function does *not* free the plane structure itself,
1323  * this is the responsibility of the caller.
1324  */
1325 void drm_plane_cleanup(struct drm_plane *plane)
1326 {
1327 	struct drm_device *dev = plane->dev;
1328 
1329 	drm_modeset_lock_all(dev);
1330 	kfree(plane->format_types);
1331 	drm_mode_object_put(dev, &plane->base);
1332 
1333 	BUG_ON(list_empty(&plane->head));
1334 
1335 	list_del(&plane->head);
1336 	dev->mode_config.num_total_plane--;
1337 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1338 		dev->mode_config.num_overlay_plane--;
1339 	drm_modeset_unlock_all(dev);
1340 
1341 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1342 	if (plane->state && plane->funcs->atomic_destroy_state)
1343 		plane->funcs->atomic_destroy_state(plane, plane->state);
1344 
1345 	kfree(plane->name);
1346 
1347 	memset(plane, 0, sizeof(*plane));
1348 }
1349 EXPORT_SYMBOL(drm_plane_cleanup);
1350 
1351 /**
1352  * drm_plane_index - find the index of a registered plane
1353  * @plane: plane to find index for
1354  *
1355  * Given a registered plane, return the index of that CRTC within a DRM
1356  * device's list of planes.
1357  */
1358 unsigned int drm_plane_index(struct drm_plane *plane)
1359 {
1360 	unsigned int index = 0;
1361 	struct drm_plane *tmp;
1362 
1363 	drm_for_each_plane(tmp, plane->dev) {
1364 		if (tmp == plane)
1365 			return index;
1366 
1367 		index++;
1368 	}
1369 
1370 	BUG();
1371 }
1372 EXPORT_SYMBOL(drm_plane_index);
1373 
1374 /**
1375  * drm_plane_from_index - find the registered plane at an index
1376  * @dev: DRM device
1377  * @idx: index of registered plane to find for
1378  *
1379  * Given a plane index, return the registered plane from DRM device's
1380  * list of planes with matching index.
1381  */
1382 struct drm_plane *
1383 drm_plane_from_index(struct drm_device *dev, int idx)
1384 {
1385 	struct drm_plane *plane;
1386 	unsigned int i = 0;
1387 
1388 	drm_for_each_plane(plane, dev) {
1389 		if (i == idx)
1390 			return plane;
1391 		i++;
1392 	}
1393 	return NULL;
1394 }
1395 EXPORT_SYMBOL(drm_plane_from_index);
1396 
1397 /**
1398  * drm_plane_force_disable - Forcibly disable a plane
1399  * @plane: plane to disable
1400  *
1401  * Forces the plane to be disabled.
1402  *
1403  * Used when the plane's current framebuffer is destroyed,
1404  * and when restoring fbdev mode.
1405  */
1406 void drm_plane_force_disable(struct drm_plane *plane)
1407 {
1408 	int ret;
1409 
1410 	if (!plane->fb)
1411 		return;
1412 
1413 	plane->old_fb = plane->fb;
1414 	ret = plane->funcs->disable_plane(plane);
1415 	if (ret) {
1416 		DRM_ERROR("failed to disable plane with busy fb\n");
1417 		plane->old_fb = NULL;
1418 		return;
1419 	}
1420 	/* disconnect the plane from the fb and crtc: */
1421 	drm_framebuffer_unreference(plane->old_fb);
1422 	plane->old_fb = NULL;
1423 	plane->fb = NULL;
1424 	plane->crtc = NULL;
1425 }
1426 EXPORT_SYMBOL(drm_plane_force_disable);
1427 
1428 static int drm_mode_create_standard_properties(struct drm_device *dev)
1429 {
1430 	struct drm_property *prop;
1431 
1432 	/*
1433 	 * Standard properties (apply to all connectors)
1434 	 */
1435 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1436 				   DRM_MODE_PROP_IMMUTABLE,
1437 				   "EDID", 0);
1438 	if (!prop)
1439 		return -ENOMEM;
1440 	dev->mode_config.edid_property = prop;
1441 
1442 	prop = drm_property_create_enum(dev, 0,
1443 				   "DPMS", drm_dpms_enum_list,
1444 				   ARRAY_SIZE(drm_dpms_enum_list));
1445 	if (!prop)
1446 		return -ENOMEM;
1447 	dev->mode_config.dpms_property = prop;
1448 
1449 	prop = drm_property_create(dev,
1450 				   DRM_MODE_PROP_BLOB |
1451 				   DRM_MODE_PROP_IMMUTABLE,
1452 				   "PATH", 0);
1453 	if (!prop)
1454 		return -ENOMEM;
1455 	dev->mode_config.path_property = prop;
1456 
1457 	prop = drm_property_create(dev,
1458 				   DRM_MODE_PROP_BLOB |
1459 				   DRM_MODE_PROP_IMMUTABLE,
1460 				   "TILE", 0);
1461 	if (!prop)
1462 		return -ENOMEM;
1463 	dev->mode_config.tile_property = prop;
1464 
1465 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1466 					"type", drm_plane_type_enum_list,
1467 					ARRAY_SIZE(drm_plane_type_enum_list));
1468 	if (!prop)
1469 		return -ENOMEM;
1470 	dev->mode_config.plane_type_property = prop;
1471 
1472 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1473 			"SRC_X", 0, UINT_MAX);
1474 	if (!prop)
1475 		return -ENOMEM;
1476 	dev->mode_config.prop_src_x = prop;
1477 
1478 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1479 			"SRC_Y", 0, UINT_MAX);
1480 	if (!prop)
1481 		return -ENOMEM;
1482 	dev->mode_config.prop_src_y = prop;
1483 
1484 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1485 			"SRC_W", 0, UINT_MAX);
1486 	if (!prop)
1487 		return -ENOMEM;
1488 	dev->mode_config.prop_src_w = prop;
1489 
1490 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1491 			"SRC_H", 0, UINT_MAX);
1492 	if (!prop)
1493 		return -ENOMEM;
1494 	dev->mode_config.prop_src_h = prop;
1495 
1496 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1497 			"CRTC_X", INT_MIN, INT_MAX);
1498 	if (!prop)
1499 		return -ENOMEM;
1500 	dev->mode_config.prop_crtc_x = prop;
1501 
1502 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1503 			"CRTC_Y", INT_MIN, INT_MAX);
1504 	if (!prop)
1505 		return -ENOMEM;
1506 	dev->mode_config.prop_crtc_y = prop;
1507 
1508 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1509 			"CRTC_W", 0, INT_MAX);
1510 	if (!prop)
1511 		return -ENOMEM;
1512 	dev->mode_config.prop_crtc_w = prop;
1513 
1514 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1515 			"CRTC_H", 0, INT_MAX);
1516 	if (!prop)
1517 		return -ENOMEM;
1518 	dev->mode_config.prop_crtc_h = prop;
1519 
1520 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1521 			"FB_ID", DRM_MODE_OBJECT_FB);
1522 	if (!prop)
1523 		return -ENOMEM;
1524 	dev->mode_config.prop_fb_id = prop;
1525 
1526 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1527 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1528 	if (!prop)
1529 		return -ENOMEM;
1530 	dev->mode_config.prop_crtc_id = prop;
1531 
1532 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1533 			"ACTIVE");
1534 	if (!prop)
1535 		return -ENOMEM;
1536 	dev->mode_config.prop_active = prop;
1537 
1538 	prop = drm_property_create(dev,
1539 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
1540 			"MODE_ID", 0);
1541 	if (!prop)
1542 		return -ENOMEM;
1543 	dev->mode_config.prop_mode_id = prop;
1544 
1545 	return 0;
1546 }
1547 
1548 /**
1549  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1550  * @dev: DRM device
1551  *
1552  * Called by a driver the first time a DVI-I connector is made.
1553  */
1554 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1555 {
1556 	struct drm_property *dvi_i_selector;
1557 	struct drm_property *dvi_i_subconnector;
1558 
1559 	if (dev->mode_config.dvi_i_select_subconnector_property)
1560 		return 0;
1561 
1562 	dvi_i_selector =
1563 		drm_property_create_enum(dev, 0,
1564 				    "select subconnector",
1565 				    drm_dvi_i_select_enum_list,
1566 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1567 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1568 
1569 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1570 				    "subconnector",
1571 				    drm_dvi_i_subconnector_enum_list,
1572 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1573 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1574 
1575 	return 0;
1576 }
1577 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1578 
1579 /**
1580  * drm_create_tv_properties - create TV specific connector properties
1581  * @dev: DRM device
1582  * @num_modes: number of different TV formats (modes) supported
1583  * @modes: array of pointers to strings containing name of each format
1584  *
1585  * Called by a driver's TV initialization routine, this function creates
1586  * the TV specific connector properties for a given device.  Caller is
1587  * responsible for allocating a list of format names and passing them to
1588  * this routine.
1589  */
1590 int drm_mode_create_tv_properties(struct drm_device *dev,
1591 				  unsigned int num_modes,
1592 				  const char * const modes[])
1593 {
1594 	struct drm_property *tv_selector;
1595 	struct drm_property *tv_subconnector;
1596 	unsigned int i;
1597 
1598 	if (dev->mode_config.tv_select_subconnector_property)
1599 		return 0;
1600 
1601 	/*
1602 	 * Basic connector properties
1603 	 */
1604 	tv_selector = drm_property_create_enum(dev, 0,
1605 					  "select subconnector",
1606 					  drm_tv_select_enum_list,
1607 					  ARRAY_SIZE(drm_tv_select_enum_list));
1608 	if (!tv_selector)
1609 		goto nomem;
1610 
1611 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1612 
1613 	tv_subconnector =
1614 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1615 				    "subconnector",
1616 				    drm_tv_subconnector_enum_list,
1617 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1618 	if (!tv_subconnector)
1619 		goto nomem;
1620 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1621 
1622 	/*
1623 	 * Other, TV specific properties: margins & TV modes.
1624 	 */
1625 	dev->mode_config.tv_left_margin_property =
1626 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1627 	if (!dev->mode_config.tv_left_margin_property)
1628 		goto nomem;
1629 
1630 	dev->mode_config.tv_right_margin_property =
1631 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1632 	if (!dev->mode_config.tv_right_margin_property)
1633 		goto nomem;
1634 
1635 	dev->mode_config.tv_top_margin_property =
1636 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1637 	if (!dev->mode_config.tv_top_margin_property)
1638 		goto nomem;
1639 
1640 	dev->mode_config.tv_bottom_margin_property =
1641 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1642 	if (!dev->mode_config.tv_bottom_margin_property)
1643 		goto nomem;
1644 
1645 	dev->mode_config.tv_mode_property =
1646 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1647 				    "mode", num_modes);
1648 	if (!dev->mode_config.tv_mode_property)
1649 		goto nomem;
1650 
1651 	for (i = 0; i < num_modes; i++)
1652 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1653 				      i, modes[i]);
1654 
1655 	dev->mode_config.tv_brightness_property =
1656 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1657 	if (!dev->mode_config.tv_brightness_property)
1658 		goto nomem;
1659 
1660 	dev->mode_config.tv_contrast_property =
1661 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1662 	if (!dev->mode_config.tv_contrast_property)
1663 		goto nomem;
1664 
1665 	dev->mode_config.tv_flicker_reduction_property =
1666 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1667 	if (!dev->mode_config.tv_flicker_reduction_property)
1668 		goto nomem;
1669 
1670 	dev->mode_config.tv_overscan_property =
1671 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1672 	if (!dev->mode_config.tv_overscan_property)
1673 		goto nomem;
1674 
1675 	dev->mode_config.tv_saturation_property =
1676 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1677 	if (!dev->mode_config.tv_saturation_property)
1678 		goto nomem;
1679 
1680 	dev->mode_config.tv_hue_property =
1681 		drm_property_create_range(dev, 0, "hue", 0, 100);
1682 	if (!dev->mode_config.tv_hue_property)
1683 		goto nomem;
1684 
1685 	return 0;
1686 nomem:
1687 	return -ENOMEM;
1688 }
1689 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1690 
1691 /**
1692  * drm_mode_create_scaling_mode_property - create scaling mode property
1693  * @dev: DRM device
1694  *
1695  * Called by a driver the first time it's needed, must be attached to desired
1696  * connectors.
1697  */
1698 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1699 {
1700 	struct drm_property *scaling_mode;
1701 
1702 	if (dev->mode_config.scaling_mode_property)
1703 		return 0;
1704 
1705 	scaling_mode =
1706 		drm_property_create_enum(dev, 0, "scaling mode",
1707 				drm_scaling_mode_enum_list,
1708 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1709 
1710 	dev->mode_config.scaling_mode_property = scaling_mode;
1711 
1712 	return 0;
1713 }
1714 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1715 
1716 /**
1717  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1718  * @dev: DRM device
1719  *
1720  * Called by a driver the first time it's needed, must be attached to desired
1721  * connectors.
1722  *
1723  * Returns:
1724  * Zero on success, negative errno on failure.
1725  */
1726 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1727 {
1728 	if (dev->mode_config.aspect_ratio_property)
1729 		return 0;
1730 
1731 	dev->mode_config.aspect_ratio_property =
1732 		drm_property_create_enum(dev, 0, "aspect ratio",
1733 				drm_aspect_ratio_enum_list,
1734 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1735 
1736 	if (dev->mode_config.aspect_ratio_property == NULL)
1737 		return -ENOMEM;
1738 
1739 	return 0;
1740 }
1741 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1742 
1743 /**
1744  * drm_mode_create_dirty_property - create dirty property
1745  * @dev: DRM device
1746  *
1747  * Called by a driver the first time it's needed, must be attached to desired
1748  * connectors.
1749  */
1750 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1751 {
1752 	struct drm_property *dirty_info;
1753 
1754 	if (dev->mode_config.dirty_info_property)
1755 		return 0;
1756 
1757 	dirty_info =
1758 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1759 				    "dirty",
1760 				    drm_dirty_info_enum_list,
1761 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1762 	dev->mode_config.dirty_info_property = dirty_info;
1763 
1764 	return 0;
1765 }
1766 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1767 
1768 /**
1769  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1770  * @dev: DRM device
1771  *
1772  * Create the the suggested x/y offset property for connectors.
1773  */
1774 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1775 {
1776 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1777 		return 0;
1778 
1779 	dev->mode_config.suggested_x_property =
1780 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1781 
1782 	dev->mode_config.suggested_y_property =
1783 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1784 
1785 	if (dev->mode_config.suggested_x_property == NULL ||
1786 	    dev->mode_config.suggested_y_property == NULL)
1787 		return -ENOMEM;
1788 	return 0;
1789 }
1790 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1791 
1792 /**
1793  * drm_mode_getresources - get graphics configuration
1794  * @dev: drm device for the ioctl
1795  * @data: data pointer for the ioctl
1796  * @file_priv: drm file for the ioctl call
1797  *
1798  * Construct a set of configuration description structures and return
1799  * them to the user, including CRTC, connector and framebuffer configuration.
1800  *
1801  * Called by the user via ioctl.
1802  *
1803  * Returns:
1804  * Zero on success, negative errno on failure.
1805  */
1806 int drm_mode_getresources(struct drm_device *dev, void *data,
1807 			  struct drm_file *file_priv)
1808 {
1809 	struct drm_mode_card_res *card_res = data;
1810 	struct list_head *lh;
1811 	struct drm_framebuffer *fb;
1812 	struct drm_connector *connector;
1813 	struct drm_crtc *crtc;
1814 	struct drm_encoder *encoder;
1815 	int ret = 0;
1816 	int connector_count = 0;
1817 	int crtc_count = 0;
1818 	int fb_count = 0;
1819 	int encoder_count = 0;
1820 	int copied = 0;
1821 	uint32_t __user *fb_id;
1822 	uint32_t __user *crtc_id;
1823 	uint32_t __user *connector_id;
1824 	uint32_t __user *encoder_id;
1825 
1826 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1827 		return -EINVAL;
1828 
1829 
1830 	mutex_lock(&file_priv->fbs_lock);
1831 	/*
1832 	 * For the non-control nodes we need to limit the list of resources
1833 	 * by IDs in the group list for this node
1834 	 */
1835 	list_for_each(lh, &file_priv->fbs)
1836 		fb_count++;
1837 
1838 	/* handle this in 4 parts */
1839 	/* FBs */
1840 	if (card_res->count_fbs >= fb_count) {
1841 		copied = 0;
1842 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1843 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1844 			if (put_user(fb->base.id, fb_id + copied)) {
1845 				mutex_unlock(&file_priv->fbs_lock);
1846 				return -EFAULT;
1847 			}
1848 			copied++;
1849 		}
1850 	}
1851 	card_res->count_fbs = fb_count;
1852 	mutex_unlock(&file_priv->fbs_lock);
1853 
1854 	/* mode_config.mutex protects the connector list against e.g. DP MST
1855 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1856 	mutex_lock(&dev->mode_config.mutex);
1857 	drm_for_each_crtc(crtc, dev)
1858 		crtc_count++;
1859 
1860 	drm_for_each_connector(connector, dev)
1861 		connector_count++;
1862 
1863 	drm_for_each_encoder(encoder, dev)
1864 		encoder_count++;
1865 
1866 	card_res->max_height = dev->mode_config.max_height;
1867 	card_res->min_height = dev->mode_config.min_height;
1868 	card_res->max_width = dev->mode_config.max_width;
1869 	card_res->min_width = dev->mode_config.min_width;
1870 
1871 	/* CRTCs */
1872 	if (card_res->count_crtcs >= crtc_count) {
1873 		copied = 0;
1874 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1875 		drm_for_each_crtc(crtc, dev) {
1876 			DRM_DEBUG_KMS("[CRTC:%d:%s]\n",
1877 				      crtc->base.id, crtc->name);
1878 			if (put_user(crtc->base.id, crtc_id + copied)) {
1879 				ret = -EFAULT;
1880 				goto out;
1881 			}
1882 			copied++;
1883 		}
1884 	}
1885 	card_res->count_crtcs = crtc_count;
1886 
1887 	/* Encoders */
1888 	if (card_res->count_encoders >= encoder_count) {
1889 		copied = 0;
1890 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1891 		drm_for_each_encoder(encoder, dev) {
1892 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1893 					encoder->name);
1894 			if (put_user(encoder->base.id, encoder_id +
1895 				     copied)) {
1896 				ret = -EFAULT;
1897 				goto out;
1898 			}
1899 			copied++;
1900 		}
1901 	}
1902 	card_res->count_encoders = encoder_count;
1903 
1904 	/* Connectors */
1905 	if (card_res->count_connectors >= connector_count) {
1906 		copied = 0;
1907 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1908 		drm_for_each_connector(connector, dev) {
1909 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1910 				connector->base.id,
1911 				connector->name);
1912 			if (put_user(connector->base.id,
1913 				     connector_id + copied)) {
1914 				ret = -EFAULT;
1915 				goto out;
1916 			}
1917 			copied++;
1918 		}
1919 	}
1920 	card_res->count_connectors = connector_count;
1921 
1922 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1923 		  card_res->count_connectors, card_res->count_encoders);
1924 
1925 out:
1926 	mutex_unlock(&dev->mode_config.mutex);
1927 	return ret;
1928 }
1929 
1930 /**
1931  * drm_mode_getcrtc - get CRTC configuration
1932  * @dev: drm device for the ioctl
1933  * @data: data pointer for the ioctl
1934  * @file_priv: drm file for the ioctl call
1935  *
1936  * Construct a CRTC configuration structure to return to the user.
1937  *
1938  * Called by the user via ioctl.
1939  *
1940  * Returns:
1941  * Zero on success, negative errno on failure.
1942  */
1943 int drm_mode_getcrtc(struct drm_device *dev,
1944 		     void *data, struct drm_file *file_priv)
1945 {
1946 	struct drm_mode_crtc *crtc_resp = data;
1947 	struct drm_crtc *crtc;
1948 
1949 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1950 		return -EINVAL;
1951 
1952 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1953 	if (!crtc)
1954 		return -ENOENT;
1955 
1956 	drm_modeset_lock_crtc(crtc, crtc->primary);
1957 	crtc_resp->gamma_size = crtc->gamma_size;
1958 	if (crtc->primary->fb)
1959 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1960 	else
1961 		crtc_resp->fb_id = 0;
1962 
1963 	if (crtc->state) {
1964 		crtc_resp->x = crtc->primary->state->src_x >> 16;
1965 		crtc_resp->y = crtc->primary->state->src_y >> 16;
1966 		if (crtc->state->enable) {
1967 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
1968 			crtc_resp->mode_valid = 1;
1969 
1970 		} else {
1971 			crtc_resp->mode_valid = 0;
1972 		}
1973 	} else {
1974 		crtc_resp->x = crtc->x;
1975 		crtc_resp->y = crtc->y;
1976 		if (crtc->enabled) {
1977 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1978 			crtc_resp->mode_valid = 1;
1979 
1980 		} else {
1981 			crtc_resp->mode_valid = 0;
1982 		}
1983 	}
1984 	drm_modeset_unlock_crtc(crtc);
1985 
1986 	return 0;
1987 }
1988 
1989 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1990 					 const struct drm_file *file_priv)
1991 {
1992 	/*
1993 	 * If user-space hasn't configured the driver to expose the stereo 3D
1994 	 * modes, don't expose them.
1995 	 */
1996 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1997 		return false;
1998 
1999 	return true;
2000 }
2001 
2002 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
2003 {
2004 	/* For atomic drivers only state objects are synchronously updated and
2005 	 * protected by modeset locks, so check those first. */
2006 	if (connector->state)
2007 		return connector->state->best_encoder;
2008 	return connector->encoder;
2009 }
2010 
2011 /* helper for getconnector and getproperties ioctls */
2012 static int get_properties(struct drm_mode_object *obj, bool atomic,
2013 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
2014 		uint32_t *arg_count_props)
2015 {
2016 	int props_count;
2017 	int i, ret, copied;
2018 
2019 	props_count = obj->properties->count;
2020 	if (!atomic)
2021 		props_count -= obj->properties->atomic_count;
2022 
2023 	if ((*arg_count_props >= props_count) && props_count) {
2024 		for (i = 0, copied = 0; copied < props_count; i++) {
2025 			struct drm_property *prop = obj->properties->properties[i];
2026 			uint64_t val;
2027 
2028 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
2029 				continue;
2030 
2031 			ret = drm_object_property_get_value(obj, prop, &val);
2032 			if (ret)
2033 				return ret;
2034 
2035 			if (put_user(prop->base.id, prop_ptr + copied))
2036 				return -EFAULT;
2037 
2038 			if (put_user(val, prop_values + copied))
2039 				return -EFAULT;
2040 
2041 			copied++;
2042 		}
2043 	}
2044 	*arg_count_props = props_count;
2045 
2046 	return 0;
2047 }
2048 
2049 /**
2050  * drm_mode_getconnector - get connector configuration
2051  * @dev: drm device for the ioctl
2052  * @data: data pointer for the ioctl
2053  * @file_priv: drm file for the ioctl call
2054  *
2055  * Construct a connector configuration structure to return to the user.
2056  *
2057  * Called by the user via ioctl.
2058  *
2059  * Returns:
2060  * Zero on success, negative errno on failure.
2061  */
2062 int drm_mode_getconnector(struct drm_device *dev, void *data,
2063 			  struct drm_file *file_priv)
2064 {
2065 	struct drm_mode_get_connector *out_resp = data;
2066 	struct drm_connector *connector;
2067 	struct drm_encoder *encoder;
2068 	struct drm_display_mode *mode;
2069 	int mode_count = 0;
2070 	int encoders_count = 0;
2071 	int ret = 0;
2072 	int copied = 0;
2073 	int i;
2074 	struct drm_mode_modeinfo u_mode;
2075 	struct drm_mode_modeinfo __user *mode_ptr;
2076 	uint32_t __user *encoder_ptr;
2077 
2078 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2079 		return -EINVAL;
2080 
2081 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2082 
2083 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2084 
2085 	mutex_lock(&dev->mode_config.mutex);
2086 
2087 	connector = drm_connector_find(dev, out_resp->connector_id);
2088 	if (!connector) {
2089 		ret = -ENOENT;
2090 		goto out_unlock;
2091 	}
2092 
2093 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2094 		if (connector->encoder_ids[i] != 0)
2095 			encoders_count++;
2096 
2097 	if (out_resp->count_modes == 0) {
2098 		connector->funcs->fill_modes(connector,
2099 					     dev->mode_config.max_width,
2100 					     dev->mode_config.max_height);
2101 	}
2102 
2103 	/* delayed so we get modes regardless of pre-fill_modes state */
2104 	list_for_each_entry(mode, &connector->modes, head)
2105 		if (drm_mode_expose_to_userspace(mode, file_priv))
2106 			mode_count++;
2107 
2108 	out_resp->connector_id = connector->base.id;
2109 	out_resp->connector_type = connector->connector_type;
2110 	out_resp->connector_type_id = connector->connector_type_id;
2111 	out_resp->mm_width = connector->display_info.width_mm;
2112 	out_resp->mm_height = connector->display_info.height_mm;
2113 	out_resp->subpixel = connector->display_info.subpixel_order;
2114 	out_resp->connection = connector->status;
2115 
2116 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2117 	encoder = drm_connector_get_encoder(connector);
2118 	if (encoder)
2119 		out_resp->encoder_id = encoder->base.id;
2120 	else
2121 		out_resp->encoder_id = 0;
2122 
2123 	/*
2124 	 * This ioctl is called twice, once to determine how much space is
2125 	 * needed, and the 2nd time to fill it.
2126 	 */
2127 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2128 		copied = 0;
2129 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2130 		list_for_each_entry(mode, &connector->modes, head) {
2131 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2132 				continue;
2133 
2134 			drm_mode_convert_to_umode(&u_mode, mode);
2135 			if (copy_to_user(mode_ptr + copied,
2136 					 &u_mode, sizeof(u_mode))) {
2137 				ret = -EFAULT;
2138 				goto out;
2139 			}
2140 			copied++;
2141 		}
2142 	}
2143 	out_resp->count_modes = mode_count;
2144 
2145 	ret = get_properties(&connector->base, file_priv->atomic,
2146 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2147 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2148 			&out_resp->count_props);
2149 	if (ret)
2150 		goto out;
2151 
2152 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2153 		copied = 0;
2154 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2155 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2156 			if (connector->encoder_ids[i] != 0) {
2157 				if (put_user(connector->encoder_ids[i],
2158 					     encoder_ptr + copied)) {
2159 					ret = -EFAULT;
2160 					goto out;
2161 				}
2162 				copied++;
2163 			}
2164 		}
2165 	}
2166 	out_resp->count_encoders = encoders_count;
2167 
2168 out:
2169 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2170 
2171 out_unlock:
2172 	mutex_unlock(&dev->mode_config.mutex);
2173 
2174 	return ret;
2175 }
2176 
2177 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2178 {
2179 	struct drm_connector *connector;
2180 	struct drm_device *dev = encoder->dev;
2181 	bool uses_atomic = false;
2182 
2183 	/* For atomic drivers only state objects are synchronously updated and
2184 	 * protected by modeset locks, so check those first. */
2185 	drm_for_each_connector(connector, dev) {
2186 		if (!connector->state)
2187 			continue;
2188 
2189 		uses_atomic = true;
2190 
2191 		if (connector->state->best_encoder != encoder)
2192 			continue;
2193 
2194 		return connector->state->crtc;
2195 	}
2196 
2197 	/* Don't return stale data (e.g. pending async disable). */
2198 	if (uses_atomic)
2199 		return NULL;
2200 
2201 	return encoder->crtc;
2202 }
2203 
2204 /**
2205  * drm_mode_getencoder - get encoder configuration
2206  * @dev: drm device for the ioctl
2207  * @data: data pointer for the ioctl
2208  * @file_priv: drm file for the ioctl call
2209  *
2210  * Construct a encoder configuration structure to return to the user.
2211  *
2212  * Called by the user via ioctl.
2213  *
2214  * Returns:
2215  * Zero on success, negative errno on failure.
2216  */
2217 int drm_mode_getencoder(struct drm_device *dev, void *data,
2218 			struct drm_file *file_priv)
2219 {
2220 	struct drm_mode_get_encoder *enc_resp = data;
2221 	struct drm_encoder *encoder;
2222 	struct drm_crtc *crtc;
2223 
2224 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2225 		return -EINVAL;
2226 
2227 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2228 	if (!encoder)
2229 		return -ENOENT;
2230 
2231 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2232 	crtc = drm_encoder_get_crtc(encoder);
2233 	if (crtc)
2234 		enc_resp->crtc_id = crtc->base.id;
2235 	else
2236 		enc_resp->crtc_id = 0;
2237 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2238 
2239 	enc_resp->encoder_type = encoder->encoder_type;
2240 	enc_resp->encoder_id = encoder->base.id;
2241 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2242 	enc_resp->possible_clones = encoder->possible_clones;
2243 
2244 	return 0;
2245 }
2246 
2247 /**
2248  * drm_mode_getplane_res - enumerate all plane resources
2249  * @dev: DRM device
2250  * @data: ioctl data
2251  * @file_priv: DRM file info
2252  *
2253  * Construct a list of plane ids to return to the user.
2254  *
2255  * Called by the user via ioctl.
2256  *
2257  * Returns:
2258  * Zero on success, negative errno on failure.
2259  */
2260 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2261 			  struct drm_file *file_priv)
2262 {
2263 	struct drm_mode_get_plane_res *plane_resp = data;
2264 	struct drm_mode_config *config;
2265 	struct drm_plane *plane;
2266 	uint32_t __user *plane_ptr;
2267 	int copied = 0;
2268 	unsigned num_planes;
2269 
2270 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2271 		return -EINVAL;
2272 
2273 	config = &dev->mode_config;
2274 
2275 	if (file_priv->universal_planes)
2276 		num_planes = config->num_total_plane;
2277 	else
2278 		num_planes = config->num_overlay_plane;
2279 
2280 	/*
2281 	 * This ioctl is called twice, once to determine how much space is
2282 	 * needed, and the 2nd time to fill it.
2283 	 */
2284 	if (num_planes &&
2285 	    (plane_resp->count_planes >= num_planes)) {
2286 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2287 
2288 		/* Plane lists are invariant, no locking needed. */
2289 		drm_for_each_plane(plane, dev) {
2290 			/*
2291 			 * Unless userspace set the 'universal planes'
2292 			 * capability bit, only advertise overlays.
2293 			 */
2294 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2295 			    !file_priv->universal_planes)
2296 				continue;
2297 
2298 			if (put_user(plane->base.id, plane_ptr + copied))
2299 				return -EFAULT;
2300 			copied++;
2301 		}
2302 	}
2303 	plane_resp->count_planes = num_planes;
2304 
2305 	return 0;
2306 }
2307 
2308 /**
2309  * drm_mode_getplane - get plane configuration
2310  * @dev: DRM device
2311  * @data: ioctl data
2312  * @file_priv: DRM file info
2313  *
2314  * Construct a plane configuration structure to return to the user.
2315  *
2316  * Called by the user via ioctl.
2317  *
2318  * Returns:
2319  * Zero on success, negative errno on failure.
2320  */
2321 int drm_mode_getplane(struct drm_device *dev, void *data,
2322 		      struct drm_file *file_priv)
2323 {
2324 	struct drm_mode_get_plane *plane_resp = data;
2325 	struct drm_plane *plane;
2326 	uint32_t __user *format_ptr;
2327 
2328 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2329 		return -EINVAL;
2330 
2331 	plane = drm_plane_find(dev, plane_resp->plane_id);
2332 	if (!plane)
2333 		return -ENOENT;
2334 
2335 	drm_modeset_lock(&plane->mutex, NULL);
2336 	if (plane->crtc)
2337 		plane_resp->crtc_id = plane->crtc->base.id;
2338 	else
2339 		plane_resp->crtc_id = 0;
2340 
2341 	if (plane->fb)
2342 		plane_resp->fb_id = plane->fb->base.id;
2343 	else
2344 		plane_resp->fb_id = 0;
2345 	drm_modeset_unlock(&plane->mutex);
2346 
2347 	plane_resp->plane_id = plane->base.id;
2348 	plane_resp->possible_crtcs = plane->possible_crtcs;
2349 	plane_resp->gamma_size = 0;
2350 
2351 	/*
2352 	 * This ioctl is called twice, once to determine how much space is
2353 	 * needed, and the 2nd time to fill it.
2354 	 */
2355 	if (plane->format_count &&
2356 	    (plane_resp->count_format_types >= plane->format_count)) {
2357 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2358 		if (copy_to_user(format_ptr,
2359 				 plane->format_types,
2360 				 sizeof(uint32_t) * plane->format_count)) {
2361 			return -EFAULT;
2362 		}
2363 	}
2364 	plane_resp->count_format_types = plane->format_count;
2365 
2366 	return 0;
2367 }
2368 
2369 /**
2370  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
2371  * @plane: plane to check for format support
2372  * @format: the pixel format
2373  *
2374  * Returns:
2375  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
2376  * otherwise.
2377  */
2378 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
2379 {
2380 	unsigned int i;
2381 
2382 	for (i = 0; i < plane->format_count; i++) {
2383 		if (format == plane->format_types[i])
2384 			return 0;
2385 	}
2386 
2387 	return -EINVAL;
2388 }
2389 
2390 static int check_src_coords(uint32_t src_x, uint32_t src_y,
2391 			    uint32_t src_w, uint32_t src_h,
2392 			    const struct drm_framebuffer *fb)
2393 {
2394 	unsigned int fb_width, fb_height;
2395 
2396 	fb_width = fb->width << 16;
2397 	fb_height = fb->height << 16;
2398 
2399 	/* Make sure source coordinates are inside the fb. */
2400 	if (src_w > fb_width ||
2401 	    src_x > fb_width - src_w ||
2402 	    src_h > fb_height ||
2403 	    src_y > fb_height - src_h) {
2404 		DRM_DEBUG_KMS("Invalid source coordinates "
2405 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2406 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2407 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2408 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2409 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2410 		return -ENOSPC;
2411 	}
2412 
2413 	return 0;
2414 }
2415 
2416 /*
2417  * setplane_internal - setplane handler for internal callers
2418  *
2419  * Note that we assume an extra reference has already been taken on fb.  If the
2420  * update fails, this reference will be dropped before return; if it succeeds,
2421  * the previous framebuffer (if any) will be unreferenced instead.
2422  *
2423  * src_{x,y,w,h} are provided in 16.16 fixed point format
2424  */
2425 static int __setplane_internal(struct drm_plane *plane,
2426 			       struct drm_crtc *crtc,
2427 			       struct drm_framebuffer *fb,
2428 			       int32_t crtc_x, int32_t crtc_y,
2429 			       uint32_t crtc_w, uint32_t crtc_h,
2430 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2431 			       uint32_t src_x, uint32_t src_y,
2432 			       uint32_t src_w, uint32_t src_h)
2433 {
2434 	int ret = 0;
2435 
2436 	/* No fb means shut it down */
2437 	if (!fb) {
2438 		plane->old_fb = plane->fb;
2439 		ret = plane->funcs->disable_plane(plane);
2440 		if (!ret) {
2441 			plane->crtc = NULL;
2442 			plane->fb = NULL;
2443 		} else {
2444 			plane->old_fb = NULL;
2445 		}
2446 		goto out;
2447 	}
2448 
2449 	/* Check whether this plane is usable on this CRTC */
2450 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2451 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2452 		ret = -EINVAL;
2453 		goto out;
2454 	}
2455 
2456 	/* Check whether this plane supports the fb pixel format. */
2457 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
2458 	if (ret) {
2459 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2460 			      drm_get_format_name(fb->pixel_format));
2461 		goto out;
2462 	}
2463 
2464 	/* Give drivers some help against integer overflows */
2465 	if (crtc_w > INT_MAX ||
2466 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
2467 	    crtc_h > INT_MAX ||
2468 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
2469 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2470 			      crtc_w, crtc_h, crtc_x, crtc_y);
2471 		ret = -ERANGE;
2472 		goto out;
2473 	}
2474 
2475 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
2476 	if (ret)
2477 		goto out;
2478 
2479 	plane->old_fb = plane->fb;
2480 	ret = plane->funcs->update_plane(plane, crtc, fb,
2481 					 crtc_x, crtc_y, crtc_w, crtc_h,
2482 					 src_x, src_y, src_w, src_h);
2483 	if (!ret) {
2484 		plane->crtc = crtc;
2485 		plane->fb = fb;
2486 		fb = NULL;
2487 	} else {
2488 		plane->old_fb = NULL;
2489 	}
2490 
2491 out:
2492 	if (fb)
2493 		drm_framebuffer_unreference(fb);
2494 	if (plane->old_fb)
2495 		drm_framebuffer_unreference(plane->old_fb);
2496 	plane->old_fb = NULL;
2497 
2498 	return ret;
2499 }
2500 
2501 static int setplane_internal(struct drm_plane *plane,
2502 			     struct drm_crtc *crtc,
2503 			     struct drm_framebuffer *fb,
2504 			     int32_t crtc_x, int32_t crtc_y,
2505 			     uint32_t crtc_w, uint32_t crtc_h,
2506 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2507 			     uint32_t src_x, uint32_t src_y,
2508 			     uint32_t src_w, uint32_t src_h)
2509 {
2510 	int ret;
2511 
2512 	drm_modeset_lock_all(plane->dev);
2513 	ret = __setplane_internal(plane, crtc, fb,
2514 				  crtc_x, crtc_y, crtc_w, crtc_h,
2515 				  src_x, src_y, src_w, src_h);
2516 	drm_modeset_unlock_all(plane->dev);
2517 
2518 	return ret;
2519 }
2520 
2521 /**
2522  * drm_mode_setplane - configure a plane's configuration
2523  * @dev: DRM device
2524  * @data: ioctl data*
2525  * @file_priv: DRM file info
2526  *
2527  * Set plane configuration, including placement, fb, scaling, and other factors.
2528  * Or pass a NULL fb to disable (planes may be disabled without providing a
2529  * valid crtc).
2530  *
2531  * Returns:
2532  * Zero on success, negative errno on failure.
2533  */
2534 int drm_mode_setplane(struct drm_device *dev, void *data,
2535 		      struct drm_file *file_priv)
2536 {
2537 	struct drm_mode_set_plane *plane_req = data;
2538 	struct drm_plane *plane;
2539 	struct drm_crtc *crtc = NULL;
2540 	struct drm_framebuffer *fb = NULL;
2541 
2542 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2543 		return -EINVAL;
2544 
2545 	/*
2546 	 * First, find the plane, crtc, and fb objects.  If not available,
2547 	 * we don't bother to call the driver.
2548 	 */
2549 	plane = drm_plane_find(dev, plane_req->plane_id);
2550 	if (!plane) {
2551 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2552 			      plane_req->plane_id);
2553 		return -ENOENT;
2554 	}
2555 
2556 	if (plane_req->fb_id) {
2557 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2558 		if (!fb) {
2559 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2560 				      plane_req->fb_id);
2561 			return -ENOENT;
2562 		}
2563 
2564 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2565 		if (!crtc) {
2566 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2567 				      plane_req->crtc_id);
2568 			return -ENOENT;
2569 		}
2570 	}
2571 
2572 	/*
2573 	 * setplane_internal will take care of deref'ing either the old or new
2574 	 * framebuffer depending on success.
2575 	 */
2576 	return setplane_internal(plane, crtc, fb,
2577 				 plane_req->crtc_x, plane_req->crtc_y,
2578 				 plane_req->crtc_w, plane_req->crtc_h,
2579 				 plane_req->src_x, plane_req->src_y,
2580 				 plane_req->src_w, plane_req->src_h);
2581 }
2582 
2583 /**
2584  * drm_mode_set_config_internal - helper to call ->set_config
2585  * @set: modeset config to set
2586  *
2587  * This is a little helper to wrap internal calls to the ->set_config driver
2588  * interface. The only thing it adds is correct refcounting dance.
2589  *
2590  * Returns:
2591  * Zero on success, negative errno on failure.
2592  */
2593 int drm_mode_set_config_internal(struct drm_mode_set *set)
2594 {
2595 	struct drm_crtc *crtc = set->crtc;
2596 	struct drm_framebuffer *fb;
2597 	struct drm_crtc *tmp;
2598 	int ret;
2599 
2600 	/*
2601 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2602 	 * connectors from it), hence we need to refcount the fbs across all
2603 	 * crtcs. Atomic modeset will have saner semantics ...
2604 	 */
2605 	drm_for_each_crtc(tmp, crtc->dev)
2606 		tmp->primary->old_fb = tmp->primary->fb;
2607 
2608 	fb = set->fb;
2609 
2610 	ret = crtc->funcs->set_config(set);
2611 	if (ret == 0) {
2612 		crtc->primary->crtc = crtc;
2613 		crtc->primary->fb = fb;
2614 	}
2615 
2616 	drm_for_each_crtc(tmp, crtc->dev) {
2617 		if (tmp->primary->fb)
2618 			drm_framebuffer_reference(tmp->primary->fb);
2619 		if (tmp->primary->old_fb)
2620 			drm_framebuffer_unreference(tmp->primary->old_fb);
2621 		tmp->primary->old_fb = NULL;
2622 	}
2623 
2624 	return ret;
2625 }
2626 EXPORT_SYMBOL(drm_mode_set_config_internal);
2627 
2628 /**
2629  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2630  * @mode: mode to query
2631  * @hdisplay: hdisplay value to fill in
2632  * @vdisplay: vdisplay value to fill in
2633  *
2634  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2635  * the appropriate layout.
2636  */
2637 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2638 			    int *hdisplay, int *vdisplay)
2639 {
2640 	struct drm_display_mode adjusted;
2641 
2642 	drm_mode_copy(&adjusted, mode);
2643 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2644 	*hdisplay = adjusted.crtc_hdisplay;
2645 	*vdisplay = adjusted.crtc_vdisplay;
2646 }
2647 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2648 
2649 /**
2650  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2651  *     CRTC viewport
2652  * @crtc: CRTC that framebuffer will be displayed on
2653  * @x: x panning
2654  * @y: y panning
2655  * @mode: mode that framebuffer will be displayed under
2656  * @fb: framebuffer to check size of
2657  */
2658 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2659 			    int x, int y,
2660 			    const struct drm_display_mode *mode,
2661 			    const struct drm_framebuffer *fb)
2662 
2663 {
2664 	int hdisplay, vdisplay;
2665 
2666 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2667 
2668 	if (crtc->state &&
2669 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
2670 					      BIT(DRM_ROTATE_270)))
2671 		swap(hdisplay, vdisplay);
2672 
2673 	return check_src_coords(x << 16, y << 16,
2674 				hdisplay << 16, vdisplay << 16, fb);
2675 }
2676 EXPORT_SYMBOL(drm_crtc_check_viewport);
2677 
2678 /**
2679  * drm_mode_setcrtc - set CRTC configuration
2680  * @dev: drm device for the ioctl
2681  * @data: data pointer for the ioctl
2682  * @file_priv: drm file for the ioctl call
2683  *
2684  * Build a new CRTC configuration based on user request.
2685  *
2686  * Called by the user via ioctl.
2687  *
2688  * Returns:
2689  * Zero on success, negative errno on failure.
2690  */
2691 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2692 		     struct drm_file *file_priv)
2693 {
2694 	struct drm_mode_config *config = &dev->mode_config;
2695 	struct drm_mode_crtc *crtc_req = data;
2696 	struct drm_crtc *crtc;
2697 	struct drm_connector **connector_set = NULL, *connector;
2698 	struct drm_framebuffer *fb = NULL;
2699 	struct drm_display_mode *mode = NULL;
2700 	struct drm_mode_set set;
2701 	uint32_t __user *set_connectors_ptr;
2702 	int ret;
2703 	int i;
2704 
2705 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2706 		return -EINVAL;
2707 
2708 	/*
2709 	 * Universal plane src offsets are only 16.16, prevent havoc for
2710 	 * drivers using universal plane code internally.
2711 	 */
2712 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2713 		return -ERANGE;
2714 
2715 	drm_modeset_lock_all(dev);
2716 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2717 	if (!crtc) {
2718 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2719 		ret = -ENOENT;
2720 		goto out;
2721 	}
2722 	DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name);
2723 
2724 	if (crtc_req->mode_valid) {
2725 		/* If we have a mode we need a framebuffer. */
2726 		/* If we pass -1, set the mode with the currently bound fb */
2727 		if (crtc_req->fb_id == -1) {
2728 			if (!crtc->primary->fb) {
2729 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2730 				ret = -EINVAL;
2731 				goto out;
2732 			}
2733 			fb = crtc->primary->fb;
2734 			/* Make refcounting symmetric with the lookup path. */
2735 			drm_framebuffer_reference(fb);
2736 		} else {
2737 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2738 			if (!fb) {
2739 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2740 						crtc_req->fb_id);
2741 				ret = -ENOENT;
2742 				goto out;
2743 			}
2744 		}
2745 
2746 		mode = drm_mode_create(dev);
2747 		if (!mode) {
2748 			ret = -ENOMEM;
2749 			goto out;
2750 		}
2751 
2752 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
2753 		if (ret) {
2754 			DRM_DEBUG_KMS("Invalid mode\n");
2755 			goto out;
2756 		}
2757 
2758 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2759 
2760 		/*
2761 		 * Check whether the primary plane supports the fb pixel format.
2762 		 * Drivers not implementing the universal planes API use a
2763 		 * default formats list provided by the DRM core which doesn't
2764 		 * match real hardware capabilities. Skip the check in that
2765 		 * case.
2766 		 */
2767 		if (!crtc->primary->format_default) {
2768 			ret = drm_plane_check_pixel_format(crtc->primary,
2769 							   fb->pixel_format);
2770 			if (ret) {
2771 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
2772 					drm_get_format_name(fb->pixel_format));
2773 				goto out;
2774 			}
2775 		}
2776 
2777 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2778 					      mode, fb);
2779 		if (ret)
2780 			goto out;
2781 
2782 	}
2783 
2784 	if (crtc_req->count_connectors == 0 && mode) {
2785 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2786 		ret = -EINVAL;
2787 		goto out;
2788 	}
2789 
2790 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2791 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2792 			  crtc_req->count_connectors);
2793 		ret = -EINVAL;
2794 		goto out;
2795 	}
2796 
2797 	if (crtc_req->count_connectors > 0) {
2798 		u32 out_id;
2799 
2800 		/* Avoid unbounded kernel memory allocation */
2801 		if (crtc_req->count_connectors > config->num_connector) {
2802 			ret = -EINVAL;
2803 			goto out;
2804 		}
2805 
2806 		connector_set = kmalloc_array(crtc_req->count_connectors,
2807 					      sizeof(struct drm_connector *),
2808 					      GFP_KERNEL);
2809 		if (!connector_set) {
2810 			ret = -ENOMEM;
2811 			goto out;
2812 		}
2813 
2814 		for (i = 0; i < crtc_req->count_connectors; i++) {
2815 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2816 			if (get_user(out_id, &set_connectors_ptr[i])) {
2817 				ret = -EFAULT;
2818 				goto out;
2819 			}
2820 
2821 			connector = drm_connector_find(dev, out_id);
2822 			if (!connector) {
2823 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2824 						out_id);
2825 				ret = -ENOENT;
2826 				goto out;
2827 			}
2828 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2829 					connector->base.id,
2830 					connector->name);
2831 
2832 			connector_set[i] = connector;
2833 		}
2834 	}
2835 
2836 	set.crtc = crtc;
2837 	set.x = crtc_req->x;
2838 	set.y = crtc_req->y;
2839 	set.mode = mode;
2840 	set.connectors = connector_set;
2841 	set.num_connectors = crtc_req->count_connectors;
2842 	set.fb = fb;
2843 	ret = drm_mode_set_config_internal(&set);
2844 
2845 out:
2846 	if (fb)
2847 		drm_framebuffer_unreference(fb);
2848 
2849 	kfree(connector_set);
2850 	drm_mode_destroy(dev, mode);
2851 	drm_modeset_unlock_all(dev);
2852 	return ret;
2853 }
2854 
2855 /**
2856  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2857  *     universal plane handler call
2858  * @crtc: crtc to update cursor for
2859  * @req: data pointer for the ioctl
2860  * @file_priv: drm file for the ioctl call
2861  *
2862  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2863  * translate legacy ioctl calls into universal plane handler calls, we need to
2864  * wrap the native buffer handle in a drm_framebuffer.
2865  *
2866  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2867  * buffer with a pitch of 4*width; the universal plane interface should be used
2868  * directly in cases where the hardware can support other buffer settings and
2869  * userspace wants to make use of these capabilities.
2870  *
2871  * Returns:
2872  * Zero on success, negative errno on failure.
2873  */
2874 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2875 				     struct drm_mode_cursor2 *req,
2876 				     struct drm_file *file_priv)
2877 {
2878 	struct drm_device *dev = crtc->dev;
2879 	struct drm_framebuffer *fb = NULL;
2880 	struct drm_mode_fb_cmd2 fbreq = {
2881 		.width = req->width,
2882 		.height = req->height,
2883 		.pixel_format = DRM_FORMAT_ARGB8888,
2884 		.pitches = { req->width * 4 },
2885 		.handles = { req->handle },
2886 	};
2887 	int32_t crtc_x, crtc_y;
2888 	uint32_t crtc_w = 0, crtc_h = 0;
2889 	uint32_t src_w = 0, src_h = 0;
2890 	int ret = 0;
2891 
2892 	BUG_ON(!crtc->cursor);
2893 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2894 
2895 	/*
2896 	 * Obtain fb we'll be using (either new or existing) and take an extra
2897 	 * reference to it if fb != null.  setplane will take care of dropping
2898 	 * the reference if the plane update fails.
2899 	 */
2900 	if (req->flags & DRM_MODE_CURSOR_BO) {
2901 		if (req->handle) {
2902 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2903 			if (IS_ERR(fb)) {
2904 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2905 				return PTR_ERR(fb);
2906 			}
2907 		} else {
2908 			fb = NULL;
2909 		}
2910 	} else {
2911 		fb = crtc->cursor->fb;
2912 		if (fb)
2913 			drm_framebuffer_reference(fb);
2914 	}
2915 
2916 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2917 		crtc_x = req->x;
2918 		crtc_y = req->y;
2919 	} else {
2920 		crtc_x = crtc->cursor_x;
2921 		crtc_y = crtc->cursor_y;
2922 	}
2923 
2924 	if (fb) {
2925 		crtc_w = fb->width;
2926 		crtc_h = fb->height;
2927 		src_w = fb->width << 16;
2928 		src_h = fb->height << 16;
2929 	}
2930 
2931 	/*
2932 	 * setplane_internal will take care of deref'ing either the old or new
2933 	 * framebuffer depending on success.
2934 	 */
2935 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2936 				crtc_x, crtc_y, crtc_w, crtc_h,
2937 				0, 0, src_w, src_h);
2938 
2939 	/* Update successful; save new cursor position, if necessary */
2940 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2941 		crtc->cursor_x = req->x;
2942 		crtc->cursor_y = req->y;
2943 	}
2944 
2945 	return ret;
2946 }
2947 
2948 static int drm_mode_cursor_common(struct drm_device *dev,
2949 				  struct drm_mode_cursor2 *req,
2950 				  struct drm_file *file_priv)
2951 {
2952 	struct drm_crtc *crtc;
2953 	int ret = 0;
2954 
2955 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2956 		return -EINVAL;
2957 
2958 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2959 		return -EINVAL;
2960 
2961 	crtc = drm_crtc_find(dev, req->crtc_id);
2962 	if (!crtc) {
2963 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2964 		return -ENOENT;
2965 	}
2966 
2967 	/*
2968 	 * If this crtc has a universal cursor plane, call that plane's update
2969 	 * handler rather than using legacy cursor handlers.
2970 	 */
2971 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2972 	if (crtc->cursor) {
2973 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2974 		goto out;
2975 	}
2976 
2977 	if (req->flags & DRM_MODE_CURSOR_BO) {
2978 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2979 			ret = -ENXIO;
2980 			goto out;
2981 		}
2982 		/* Turns off the cursor if handle is 0 */
2983 		if (crtc->funcs->cursor_set2)
2984 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2985 						      req->width, req->height, req->hot_x, req->hot_y);
2986 		else
2987 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2988 						      req->width, req->height);
2989 	}
2990 
2991 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2992 		if (crtc->funcs->cursor_move) {
2993 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2994 		} else {
2995 			ret = -EFAULT;
2996 			goto out;
2997 		}
2998 	}
2999 out:
3000 	drm_modeset_unlock_crtc(crtc);
3001 
3002 	return ret;
3003 
3004 }
3005 
3006 
3007 /**
3008  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
3009  * @dev: drm device for the ioctl
3010  * @data: data pointer for the ioctl
3011  * @file_priv: drm file for the ioctl call
3012  *
3013  * Set the cursor configuration based on user request.
3014  *
3015  * Called by the user via ioctl.
3016  *
3017  * Returns:
3018  * Zero on success, negative errno on failure.
3019  */
3020 int drm_mode_cursor_ioctl(struct drm_device *dev,
3021 			  void *data, struct drm_file *file_priv)
3022 {
3023 	struct drm_mode_cursor *req = data;
3024 	struct drm_mode_cursor2 new_req;
3025 
3026 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
3027 	new_req.hot_x = new_req.hot_y = 0;
3028 
3029 	return drm_mode_cursor_common(dev, &new_req, file_priv);
3030 }
3031 
3032 /**
3033  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
3034  * @dev: drm device for the ioctl
3035  * @data: data pointer for the ioctl
3036  * @file_priv: drm file for the ioctl call
3037  *
3038  * Set the cursor configuration based on user request. This implements the 2nd
3039  * version of the cursor ioctl, which allows userspace to additionally specify
3040  * the hotspot of the pointer.
3041  *
3042  * Called by the user via ioctl.
3043  *
3044  * Returns:
3045  * Zero on success, negative errno on failure.
3046  */
3047 int drm_mode_cursor2_ioctl(struct drm_device *dev,
3048 			   void *data, struct drm_file *file_priv)
3049 {
3050 	struct drm_mode_cursor2 *req = data;
3051 
3052 	return drm_mode_cursor_common(dev, req, file_priv);
3053 }
3054 
3055 /**
3056  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3057  * @bpp: bits per pixels
3058  * @depth: bit depth per pixel
3059  *
3060  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3061  * Useful in fbdev emulation code, since that deals in those values.
3062  */
3063 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3064 {
3065 	uint32_t fmt;
3066 
3067 	switch (bpp) {
3068 	case 8:
3069 		fmt = DRM_FORMAT_C8;
3070 		break;
3071 	case 16:
3072 		if (depth == 15)
3073 			fmt = DRM_FORMAT_XRGB1555;
3074 		else
3075 			fmt = DRM_FORMAT_RGB565;
3076 		break;
3077 	case 24:
3078 		fmt = DRM_FORMAT_RGB888;
3079 		break;
3080 	case 32:
3081 		if (depth == 24)
3082 			fmt = DRM_FORMAT_XRGB8888;
3083 		else if (depth == 30)
3084 			fmt = DRM_FORMAT_XRGB2101010;
3085 		else
3086 			fmt = DRM_FORMAT_ARGB8888;
3087 		break;
3088 	default:
3089 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3090 		fmt = DRM_FORMAT_XRGB8888;
3091 		break;
3092 	}
3093 
3094 	return fmt;
3095 }
3096 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3097 
3098 /**
3099  * drm_mode_addfb - add an FB to the graphics configuration
3100  * @dev: drm device for the ioctl
3101  * @data: data pointer for the ioctl
3102  * @file_priv: drm file for the ioctl call
3103  *
3104  * Add a new FB to the specified CRTC, given a user request. This is the
3105  * original addfb ioctl which only supported RGB formats.
3106  *
3107  * Called by the user via ioctl.
3108  *
3109  * Returns:
3110  * Zero on success, negative errno on failure.
3111  */
3112 int drm_mode_addfb(struct drm_device *dev,
3113 		   void *data, struct drm_file *file_priv)
3114 {
3115 	struct drm_mode_fb_cmd *or = data;
3116 	struct drm_mode_fb_cmd2 r = {};
3117 	int ret;
3118 
3119 	/* convert to new format and call new ioctl */
3120 	r.fb_id = or->fb_id;
3121 	r.width = or->width;
3122 	r.height = or->height;
3123 	r.pitches[0] = or->pitch;
3124 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3125 	r.handles[0] = or->handle;
3126 
3127 	ret = drm_mode_addfb2(dev, &r, file_priv);
3128 	if (ret)
3129 		return ret;
3130 
3131 	or->fb_id = r.fb_id;
3132 
3133 	return 0;
3134 }
3135 
3136 static int format_check(const struct drm_mode_fb_cmd2 *r)
3137 {
3138 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3139 
3140 	switch (format) {
3141 	case DRM_FORMAT_C8:
3142 	case DRM_FORMAT_RGB332:
3143 	case DRM_FORMAT_BGR233:
3144 	case DRM_FORMAT_XRGB4444:
3145 	case DRM_FORMAT_XBGR4444:
3146 	case DRM_FORMAT_RGBX4444:
3147 	case DRM_FORMAT_BGRX4444:
3148 	case DRM_FORMAT_ARGB4444:
3149 	case DRM_FORMAT_ABGR4444:
3150 	case DRM_FORMAT_RGBA4444:
3151 	case DRM_FORMAT_BGRA4444:
3152 	case DRM_FORMAT_XRGB1555:
3153 	case DRM_FORMAT_XBGR1555:
3154 	case DRM_FORMAT_RGBX5551:
3155 	case DRM_FORMAT_BGRX5551:
3156 	case DRM_FORMAT_ARGB1555:
3157 	case DRM_FORMAT_ABGR1555:
3158 	case DRM_FORMAT_RGBA5551:
3159 	case DRM_FORMAT_BGRA5551:
3160 	case DRM_FORMAT_RGB565:
3161 	case DRM_FORMAT_BGR565:
3162 	case DRM_FORMAT_RGB888:
3163 	case DRM_FORMAT_BGR888:
3164 	case DRM_FORMAT_XRGB8888:
3165 	case DRM_FORMAT_XBGR8888:
3166 	case DRM_FORMAT_RGBX8888:
3167 	case DRM_FORMAT_BGRX8888:
3168 	case DRM_FORMAT_ARGB8888:
3169 	case DRM_FORMAT_ABGR8888:
3170 	case DRM_FORMAT_RGBA8888:
3171 	case DRM_FORMAT_BGRA8888:
3172 	case DRM_FORMAT_XRGB2101010:
3173 	case DRM_FORMAT_XBGR2101010:
3174 	case DRM_FORMAT_RGBX1010102:
3175 	case DRM_FORMAT_BGRX1010102:
3176 	case DRM_FORMAT_ARGB2101010:
3177 	case DRM_FORMAT_ABGR2101010:
3178 	case DRM_FORMAT_RGBA1010102:
3179 	case DRM_FORMAT_BGRA1010102:
3180 	case DRM_FORMAT_YUYV:
3181 	case DRM_FORMAT_YVYU:
3182 	case DRM_FORMAT_UYVY:
3183 	case DRM_FORMAT_VYUY:
3184 	case DRM_FORMAT_AYUV:
3185 	case DRM_FORMAT_NV12:
3186 	case DRM_FORMAT_NV21:
3187 	case DRM_FORMAT_NV16:
3188 	case DRM_FORMAT_NV61:
3189 	case DRM_FORMAT_NV24:
3190 	case DRM_FORMAT_NV42:
3191 	case DRM_FORMAT_YUV410:
3192 	case DRM_FORMAT_YVU410:
3193 	case DRM_FORMAT_YUV411:
3194 	case DRM_FORMAT_YVU411:
3195 	case DRM_FORMAT_YUV420:
3196 	case DRM_FORMAT_YVU420:
3197 	case DRM_FORMAT_YUV422:
3198 	case DRM_FORMAT_YVU422:
3199 	case DRM_FORMAT_YUV444:
3200 	case DRM_FORMAT_YVU444:
3201 		return 0;
3202 	default:
3203 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3204 			      drm_get_format_name(r->pixel_format));
3205 		return -EINVAL;
3206 	}
3207 }
3208 
3209 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3210 {
3211 	int ret, hsub, vsub, num_planes, i;
3212 
3213 	ret = format_check(r);
3214 	if (ret) {
3215 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3216 			      drm_get_format_name(r->pixel_format));
3217 		return ret;
3218 	}
3219 
3220 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3221 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3222 	num_planes = drm_format_num_planes(r->pixel_format);
3223 
3224 	if (r->width == 0 || r->width % hsub) {
3225 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3226 		return -EINVAL;
3227 	}
3228 
3229 	if (r->height == 0 || r->height % vsub) {
3230 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3231 		return -EINVAL;
3232 	}
3233 
3234 	for (i = 0; i < num_planes; i++) {
3235 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3236 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3237 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3238 
3239 		if (!r->handles[i]) {
3240 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3241 			return -EINVAL;
3242 		}
3243 
3244 		if ((uint64_t) width * cpp > UINT_MAX)
3245 			return -ERANGE;
3246 
3247 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3248 			return -ERANGE;
3249 
3250 		if (r->pitches[i] < width * cpp) {
3251 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3252 			return -EINVAL;
3253 		}
3254 
3255 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
3256 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
3257 				      r->modifier[i], i);
3258 			return -EINVAL;
3259 		}
3260 
3261 		/* modifier specific checks: */
3262 		switch (r->modifier[i]) {
3263 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
3264 			/* NOTE: the pitch restriction may be lifted later if it turns
3265 			 * out that no hw has this restriction:
3266 			 */
3267 			if (r->pixel_format != DRM_FORMAT_NV12 ||
3268 					width % 128 || height % 32 ||
3269 					r->pitches[i] % 128) {
3270 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
3271 				return -EINVAL;
3272 			}
3273 			break;
3274 
3275 		default:
3276 			break;
3277 		}
3278 	}
3279 
3280 	for (i = num_planes; i < 4; i++) {
3281 		if (r->modifier[i]) {
3282 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
3283 			return -EINVAL;
3284 		}
3285 
3286 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
3287 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
3288 			continue;
3289 
3290 		if (r->handles[i]) {
3291 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
3292 			return -EINVAL;
3293 		}
3294 
3295 		if (r->pitches[i]) {
3296 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
3297 			return -EINVAL;
3298 		}
3299 
3300 		if (r->offsets[i]) {
3301 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
3302 			return -EINVAL;
3303 		}
3304 	}
3305 
3306 	return 0;
3307 }
3308 
3309 static struct drm_framebuffer *
3310 internal_framebuffer_create(struct drm_device *dev,
3311 			    const struct drm_mode_fb_cmd2 *r,
3312 			    struct drm_file *file_priv)
3313 {
3314 	struct drm_mode_config *config = &dev->mode_config;
3315 	struct drm_framebuffer *fb;
3316 	int ret;
3317 
3318 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
3319 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3320 		return ERR_PTR(-EINVAL);
3321 	}
3322 
3323 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3324 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3325 			  r->width, config->min_width, config->max_width);
3326 		return ERR_PTR(-EINVAL);
3327 	}
3328 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3329 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3330 			  r->height, config->min_height, config->max_height);
3331 		return ERR_PTR(-EINVAL);
3332 	}
3333 
3334 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
3335 	    !dev->mode_config.allow_fb_modifiers) {
3336 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
3337 		return ERR_PTR(-EINVAL);
3338 	}
3339 
3340 	ret = framebuffer_check(r);
3341 	if (ret)
3342 		return ERR_PTR(ret);
3343 
3344 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3345 	if (IS_ERR(fb)) {
3346 		DRM_DEBUG_KMS("could not create framebuffer\n");
3347 		return fb;
3348 	}
3349 
3350 	return fb;
3351 }
3352 
3353 /**
3354  * drm_mode_addfb2 - add an FB to the graphics configuration
3355  * @dev: drm device for the ioctl
3356  * @data: data pointer for the ioctl
3357  * @file_priv: drm file for the ioctl call
3358  *
3359  * Add a new FB to the specified CRTC, given a user request with format. This is
3360  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3361  * and uses fourcc codes as pixel format specifiers.
3362  *
3363  * Called by the user via ioctl.
3364  *
3365  * Returns:
3366  * Zero on success, negative errno on failure.
3367  */
3368 int drm_mode_addfb2(struct drm_device *dev,
3369 		    void *data, struct drm_file *file_priv)
3370 {
3371 	struct drm_mode_fb_cmd2 *r = data;
3372 	struct drm_framebuffer *fb;
3373 
3374 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3375 		return -EINVAL;
3376 
3377 	fb = internal_framebuffer_create(dev, r, file_priv);
3378 	if (IS_ERR(fb))
3379 		return PTR_ERR(fb);
3380 
3381 	/* Transfer ownership to the filp for reaping on close */
3382 
3383 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3384 	mutex_lock(&file_priv->fbs_lock);
3385 	r->fb_id = fb->base.id;
3386 	list_add(&fb->filp_head, &file_priv->fbs);
3387 	mutex_unlock(&file_priv->fbs_lock);
3388 
3389 	return 0;
3390 }
3391 
3392 /**
3393  * drm_mode_rmfb - remove an FB from the configuration
3394  * @dev: drm device for the ioctl
3395  * @data: data pointer for the ioctl
3396  * @file_priv: drm file for the ioctl call
3397  *
3398  * Remove the FB specified by the user.
3399  *
3400  * Called by the user via ioctl.
3401  *
3402  * Returns:
3403  * Zero on success, negative errno on failure.
3404  */
3405 int drm_mode_rmfb(struct drm_device *dev,
3406 		   void *data, struct drm_file *file_priv)
3407 {
3408 	struct drm_framebuffer *fb = NULL;
3409 	struct drm_framebuffer *fbl = NULL;
3410 	uint32_t *id = data;
3411 	int found = 0;
3412 
3413 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3414 		return -EINVAL;
3415 
3416 	mutex_lock(&file_priv->fbs_lock);
3417 	mutex_lock(&dev->mode_config.fb_lock);
3418 	fb = __drm_framebuffer_lookup(dev, *id);
3419 	if (!fb)
3420 		goto fail_lookup;
3421 
3422 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3423 		if (fb == fbl)
3424 			found = 1;
3425 	if (!found)
3426 		goto fail_lookup;
3427 
3428 	list_del_init(&fb->filp_head);
3429 	mutex_unlock(&dev->mode_config.fb_lock);
3430 	mutex_unlock(&file_priv->fbs_lock);
3431 
3432 	drm_framebuffer_unreference(fb);
3433 
3434 	return 0;
3435 
3436 fail_lookup:
3437 	mutex_unlock(&dev->mode_config.fb_lock);
3438 	mutex_unlock(&file_priv->fbs_lock);
3439 
3440 	return -ENOENT;
3441 }
3442 
3443 /**
3444  * drm_mode_getfb - get FB info
3445  * @dev: drm device for the ioctl
3446  * @data: data pointer for the ioctl
3447  * @file_priv: drm file for the ioctl call
3448  *
3449  * Lookup the FB given its ID and return info about it.
3450  *
3451  * Called by the user via ioctl.
3452  *
3453  * Returns:
3454  * Zero on success, negative errno on failure.
3455  */
3456 int drm_mode_getfb(struct drm_device *dev,
3457 		   void *data, struct drm_file *file_priv)
3458 {
3459 	struct drm_mode_fb_cmd *r = data;
3460 	struct drm_framebuffer *fb;
3461 	int ret;
3462 
3463 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3464 		return -EINVAL;
3465 
3466 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3467 	if (!fb)
3468 		return -ENOENT;
3469 
3470 	r->height = fb->height;
3471 	r->width = fb->width;
3472 	r->depth = fb->depth;
3473 	r->bpp = fb->bits_per_pixel;
3474 	r->pitch = fb->pitches[0];
3475 	if (fb->funcs->create_handle) {
3476 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
3477 		    drm_is_control_client(file_priv)) {
3478 			ret = fb->funcs->create_handle(fb, file_priv,
3479 						       &r->handle);
3480 		} else {
3481 			/* GET_FB() is an unprivileged ioctl so we must not
3482 			 * return a buffer-handle to non-master processes! For
3483 			 * backwards-compatibility reasons, we cannot make
3484 			 * GET_FB() privileged, so just return an invalid handle
3485 			 * for non-masters. */
3486 			r->handle = 0;
3487 			ret = 0;
3488 		}
3489 	} else {
3490 		ret = -ENODEV;
3491 	}
3492 
3493 	drm_framebuffer_unreference(fb);
3494 
3495 	return ret;
3496 }
3497 
3498 /**
3499  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3500  * @dev: drm device for the ioctl
3501  * @data: data pointer for the ioctl
3502  * @file_priv: drm file for the ioctl call
3503  *
3504  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3505  * rectangle list. Generic userspace which does frontbuffer rendering must call
3506  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3507  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3508  *
3509  * Modesetting drivers which always update the frontbuffer do not need to
3510  * implement the corresponding ->dirty framebuffer callback.
3511  *
3512  * Called by the user via ioctl.
3513  *
3514  * Returns:
3515  * Zero on success, negative errno on failure.
3516  */
3517 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3518 			   void *data, struct drm_file *file_priv)
3519 {
3520 	struct drm_clip_rect __user *clips_ptr;
3521 	struct drm_clip_rect *clips = NULL;
3522 	struct drm_mode_fb_dirty_cmd *r = data;
3523 	struct drm_framebuffer *fb;
3524 	unsigned flags;
3525 	int num_clips;
3526 	int ret;
3527 
3528 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3529 		return -EINVAL;
3530 
3531 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3532 	if (!fb)
3533 		return -ENOENT;
3534 
3535 	num_clips = r->num_clips;
3536 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3537 
3538 	if (!num_clips != !clips_ptr) {
3539 		ret = -EINVAL;
3540 		goto out_err1;
3541 	}
3542 
3543 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3544 
3545 	/* If userspace annotates copy, clips must come in pairs */
3546 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3547 		ret = -EINVAL;
3548 		goto out_err1;
3549 	}
3550 
3551 	if (num_clips && clips_ptr) {
3552 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3553 			ret = -EINVAL;
3554 			goto out_err1;
3555 		}
3556 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3557 		if (!clips) {
3558 			ret = -ENOMEM;
3559 			goto out_err1;
3560 		}
3561 
3562 		ret = copy_from_user(clips, clips_ptr,
3563 				     num_clips * sizeof(*clips));
3564 		if (ret) {
3565 			ret = -EFAULT;
3566 			goto out_err2;
3567 		}
3568 	}
3569 
3570 	if (fb->funcs->dirty) {
3571 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3572 				       clips, num_clips);
3573 	} else {
3574 		ret = -ENOSYS;
3575 	}
3576 
3577 out_err2:
3578 	kfree(clips);
3579 out_err1:
3580 	drm_framebuffer_unreference(fb);
3581 
3582 	return ret;
3583 }
3584 
3585 
3586 /**
3587  * drm_fb_release - remove and free the FBs on this file
3588  * @priv: drm file for the ioctl
3589  *
3590  * Destroy all the FBs associated with @filp.
3591  *
3592  * Called by the user via ioctl.
3593  *
3594  * Returns:
3595  * Zero on success, negative errno on failure.
3596  */
3597 void drm_fb_release(struct drm_file *priv)
3598 {
3599 	struct drm_framebuffer *fb, *tfb;
3600 
3601 	/*
3602 	 * When the file gets released that means no one else can access the fb
3603 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3604 	 * avoid upsetting lockdep since the universal cursor code adds a
3605 	 * framebuffer while holding mutex locks.
3606 	 *
3607 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3608 	 * locks is impossible here since no one else but this function can get
3609 	 * at it any more.
3610 	 */
3611 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3612 		list_del_init(&fb->filp_head);
3613 
3614 		/* This drops the fpriv->fbs reference. */
3615 		drm_framebuffer_unreference(fb);
3616 	}
3617 }
3618 
3619 /**
3620  * drm_property_create - create a new property type
3621  * @dev: drm device
3622  * @flags: flags specifying the property type
3623  * @name: name of the property
3624  * @num_values: number of pre-defined values
3625  *
3626  * This creates a new generic drm property which can then be attached to a drm
3627  * object with drm_object_attach_property. The returned property object must be
3628  * freed with drm_property_destroy.
3629  *
3630  * Note that the DRM core keeps a per-device list of properties and that, if
3631  * drm_mode_config_cleanup() is called, it will destroy all properties created
3632  * by the driver.
3633  *
3634  * Returns:
3635  * A pointer to the newly created property on success, NULL on failure.
3636  */
3637 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3638 					 const char *name, int num_values)
3639 {
3640 	struct drm_property *property = NULL;
3641 	int ret;
3642 
3643 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3644 	if (!property)
3645 		return NULL;
3646 
3647 	property->dev = dev;
3648 
3649 	if (num_values) {
3650 		property->values = kcalloc(num_values, sizeof(uint64_t),
3651 					   GFP_KERNEL);
3652 		if (!property->values)
3653 			goto fail;
3654 	}
3655 
3656 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3657 	if (ret)
3658 		goto fail;
3659 
3660 	property->flags = flags;
3661 	property->num_values = num_values;
3662 	INIT_LIST_HEAD(&property->enum_list);
3663 
3664 	if (name) {
3665 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3666 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3667 	}
3668 
3669 	list_add_tail(&property->head, &dev->mode_config.property_list);
3670 
3671 	WARN_ON(!drm_property_type_valid(property));
3672 
3673 	return property;
3674 fail:
3675 	kfree(property->values);
3676 	kfree(property);
3677 	return NULL;
3678 }
3679 EXPORT_SYMBOL(drm_property_create);
3680 
3681 /**
3682  * drm_property_create_enum - create a new enumeration property type
3683  * @dev: drm device
3684  * @flags: flags specifying the property type
3685  * @name: name of the property
3686  * @props: enumeration lists with property values
3687  * @num_values: number of pre-defined values
3688  *
3689  * This creates a new generic drm property which can then be attached to a drm
3690  * object with drm_object_attach_property. The returned property object must be
3691  * freed with drm_property_destroy.
3692  *
3693  * Userspace is only allowed to set one of the predefined values for enumeration
3694  * properties.
3695  *
3696  * Returns:
3697  * A pointer to the newly created property on success, NULL on failure.
3698  */
3699 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3700 					 const char *name,
3701 					 const struct drm_prop_enum_list *props,
3702 					 int num_values)
3703 {
3704 	struct drm_property *property;
3705 	int i, ret;
3706 
3707 	flags |= DRM_MODE_PROP_ENUM;
3708 
3709 	property = drm_property_create(dev, flags, name, num_values);
3710 	if (!property)
3711 		return NULL;
3712 
3713 	for (i = 0; i < num_values; i++) {
3714 		ret = drm_property_add_enum(property, i,
3715 				      props[i].type,
3716 				      props[i].name);
3717 		if (ret) {
3718 			drm_property_destroy(dev, property);
3719 			return NULL;
3720 		}
3721 	}
3722 
3723 	return property;
3724 }
3725 EXPORT_SYMBOL(drm_property_create_enum);
3726 
3727 /**
3728  * drm_property_create_bitmask - create a new bitmask property type
3729  * @dev: drm device
3730  * @flags: flags specifying the property type
3731  * @name: name of the property
3732  * @props: enumeration lists with property bitflags
3733  * @num_props: size of the @props array
3734  * @supported_bits: bitmask of all supported enumeration values
3735  *
3736  * This creates a new bitmask drm property which can then be attached to a drm
3737  * object with drm_object_attach_property. The returned property object must be
3738  * freed with drm_property_destroy.
3739  *
3740  * Compared to plain enumeration properties userspace is allowed to set any
3741  * or'ed together combination of the predefined property bitflag values
3742  *
3743  * Returns:
3744  * A pointer to the newly created property on success, NULL on failure.
3745  */
3746 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3747 					 int flags, const char *name,
3748 					 const struct drm_prop_enum_list *props,
3749 					 int num_props,
3750 					 uint64_t supported_bits)
3751 {
3752 	struct drm_property *property;
3753 	int i, ret, index = 0;
3754 	int num_values = hweight64(supported_bits);
3755 
3756 	flags |= DRM_MODE_PROP_BITMASK;
3757 
3758 	property = drm_property_create(dev, flags, name, num_values);
3759 	if (!property)
3760 		return NULL;
3761 	for (i = 0; i < num_props; i++) {
3762 		if (!(supported_bits & (1ULL << props[i].type)))
3763 			continue;
3764 
3765 		if (WARN_ON(index >= num_values)) {
3766 			drm_property_destroy(dev, property);
3767 			return NULL;
3768 		}
3769 
3770 		ret = drm_property_add_enum(property, index++,
3771 				      props[i].type,
3772 				      props[i].name);
3773 		if (ret) {
3774 			drm_property_destroy(dev, property);
3775 			return NULL;
3776 		}
3777 	}
3778 
3779 	return property;
3780 }
3781 EXPORT_SYMBOL(drm_property_create_bitmask);
3782 
3783 static struct drm_property *property_create_range(struct drm_device *dev,
3784 					 int flags, const char *name,
3785 					 uint64_t min, uint64_t max)
3786 {
3787 	struct drm_property *property;
3788 
3789 	property = drm_property_create(dev, flags, name, 2);
3790 	if (!property)
3791 		return NULL;
3792 
3793 	property->values[0] = min;
3794 	property->values[1] = max;
3795 
3796 	return property;
3797 }
3798 
3799 /**
3800  * drm_property_create_range - create a new unsigned ranged property type
3801  * @dev: drm device
3802  * @flags: flags specifying the property type
3803  * @name: name of the property
3804  * @min: minimum value of the property
3805  * @max: maximum value of the property
3806  *
3807  * This creates a new generic drm property which can then be attached to a drm
3808  * object with drm_object_attach_property. The returned property object must be
3809  * freed with drm_property_destroy.
3810  *
3811  * Userspace is allowed to set any unsigned integer value in the (min, max)
3812  * range inclusive.
3813  *
3814  * Returns:
3815  * A pointer to the newly created property on success, NULL on failure.
3816  */
3817 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3818 					 const char *name,
3819 					 uint64_t min, uint64_t max)
3820 {
3821 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3822 			name, min, max);
3823 }
3824 EXPORT_SYMBOL(drm_property_create_range);
3825 
3826 /**
3827  * drm_property_create_signed_range - create a new signed ranged property type
3828  * @dev: drm device
3829  * @flags: flags specifying the property type
3830  * @name: name of the property
3831  * @min: minimum value of the property
3832  * @max: maximum value of the property
3833  *
3834  * This creates a new generic drm property which can then be attached to a drm
3835  * object with drm_object_attach_property. The returned property object must be
3836  * freed with drm_property_destroy.
3837  *
3838  * Userspace is allowed to set any signed integer value in the (min, max)
3839  * range inclusive.
3840  *
3841  * Returns:
3842  * A pointer to the newly created property on success, NULL on failure.
3843  */
3844 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3845 					 int flags, const char *name,
3846 					 int64_t min, int64_t max)
3847 {
3848 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3849 			name, I642U64(min), I642U64(max));
3850 }
3851 EXPORT_SYMBOL(drm_property_create_signed_range);
3852 
3853 /**
3854  * drm_property_create_object - create a new object property type
3855  * @dev: drm device
3856  * @flags: flags specifying the property type
3857  * @name: name of the property
3858  * @type: object type from DRM_MODE_OBJECT_* defines
3859  *
3860  * This creates a new generic drm property which can then be attached to a drm
3861  * object with drm_object_attach_property. The returned property object must be
3862  * freed with drm_property_destroy.
3863  *
3864  * Userspace is only allowed to set this to any property value of the given
3865  * @type. Only useful for atomic properties, which is enforced.
3866  *
3867  * Returns:
3868  * A pointer to the newly created property on success, NULL on failure.
3869  */
3870 struct drm_property *drm_property_create_object(struct drm_device *dev,
3871 					 int flags, const char *name, uint32_t type)
3872 {
3873 	struct drm_property *property;
3874 
3875 	flags |= DRM_MODE_PROP_OBJECT;
3876 
3877 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3878 		return NULL;
3879 
3880 	property = drm_property_create(dev, flags, name, 1);
3881 	if (!property)
3882 		return NULL;
3883 
3884 	property->values[0] = type;
3885 
3886 	return property;
3887 }
3888 EXPORT_SYMBOL(drm_property_create_object);
3889 
3890 /**
3891  * drm_property_create_bool - create a new boolean property type
3892  * @dev: drm device
3893  * @flags: flags specifying the property type
3894  * @name: name of the property
3895  *
3896  * This creates a new generic drm property which can then be attached to a drm
3897  * object with drm_object_attach_property. The returned property object must be
3898  * freed with drm_property_destroy.
3899  *
3900  * This is implemented as a ranged property with only {0, 1} as valid values.
3901  *
3902  * Returns:
3903  * A pointer to the newly created property on success, NULL on failure.
3904  */
3905 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3906 					 const char *name)
3907 {
3908 	return drm_property_create_range(dev, flags, name, 0, 1);
3909 }
3910 EXPORT_SYMBOL(drm_property_create_bool);
3911 
3912 /**
3913  * drm_property_add_enum - add a possible value to an enumeration property
3914  * @property: enumeration property to change
3915  * @index: index of the new enumeration
3916  * @value: value of the new enumeration
3917  * @name: symbolic name of the new enumeration
3918  *
3919  * This functions adds enumerations to a property.
3920  *
3921  * It's use is deprecated, drivers should use one of the more specific helpers
3922  * to directly create the property with all enumerations already attached.
3923  *
3924  * Returns:
3925  * Zero on success, error code on failure.
3926  */
3927 int drm_property_add_enum(struct drm_property *property, int index,
3928 			  uint64_t value, const char *name)
3929 {
3930 	struct drm_property_enum *prop_enum;
3931 
3932 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3933 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3934 		return -EINVAL;
3935 
3936 	/*
3937 	 * Bitmask enum properties have the additional constraint of values
3938 	 * from 0 to 63
3939 	 */
3940 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3941 			(value > 63))
3942 		return -EINVAL;
3943 
3944 	if (!list_empty(&property->enum_list)) {
3945 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3946 			if (prop_enum->value == value) {
3947 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3948 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3949 				return 0;
3950 			}
3951 		}
3952 	}
3953 
3954 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3955 	if (!prop_enum)
3956 		return -ENOMEM;
3957 
3958 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3959 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3960 	prop_enum->value = value;
3961 
3962 	property->values[index] = value;
3963 	list_add_tail(&prop_enum->head, &property->enum_list);
3964 	return 0;
3965 }
3966 EXPORT_SYMBOL(drm_property_add_enum);
3967 
3968 /**
3969  * drm_property_destroy - destroy a drm property
3970  * @dev: drm device
3971  * @property: property to destry
3972  *
3973  * This function frees a property including any attached resources like
3974  * enumeration values.
3975  */
3976 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3977 {
3978 	struct drm_property_enum *prop_enum, *pt;
3979 
3980 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3981 		list_del(&prop_enum->head);
3982 		kfree(prop_enum);
3983 	}
3984 
3985 	if (property->num_values)
3986 		kfree(property->values);
3987 	drm_mode_object_put(dev, &property->base);
3988 	list_del(&property->head);
3989 	kfree(property);
3990 }
3991 EXPORT_SYMBOL(drm_property_destroy);
3992 
3993 /**
3994  * drm_object_attach_property - attach a property to a modeset object
3995  * @obj: drm modeset object
3996  * @property: property to attach
3997  * @init_val: initial value of the property
3998  *
3999  * This attaches the given property to the modeset object with the given initial
4000  * value. Currently this function cannot fail since the properties are stored in
4001  * a statically sized array.
4002  */
4003 void drm_object_attach_property(struct drm_mode_object *obj,
4004 				struct drm_property *property,
4005 				uint64_t init_val)
4006 {
4007 	int count = obj->properties->count;
4008 
4009 	if (count == DRM_OBJECT_MAX_PROPERTY) {
4010 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
4011 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
4012 			"you see this message on the same object type.\n",
4013 			obj->type);
4014 		return;
4015 	}
4016 
4017 	obj->properties->properties[count] = property;
4018 	obj->properties->values[count] = init_val;
4019 	obj->properties->count++;
4020 	if (property->flags & DRM_MODE_PROP_ATOMIC)
4021 		obj->properties->atomic_count++;
4022 }
4023 EXPORT_SYMBOL(drm_object_attach_property);
4024 
4025 /**
4026  * drm_object_property_set_value - set the value of a property
4027  * @obj: drm mode object to set property value for
4028  * @property: property to set
4029  * @val: value the property should be set to
4030  *
4031  * This functions sets a given property on a given object. This function only
4032  * changes the software state of the property, it does not call into the
4033  * driver's ->set_property callback.
4034  *
4035  * Returns:
4036  * Zero on success, error code on failure.
4037  */
4038 int drm_object_property_set_value(struct drm_mode_object *obj,
4039 				  struct drm_property *property, uint64_t val)
4040 {
4041 	int i;
4042 
4043 	for (i = 0; i < obj->properties->count; i++) {
4044 		if (obj->properties->properties[i] == property) {
4045 			obj->properties->values[i] = val;
4046 			return 0;
4047 		}
4048 	}
4049 
4050 	return -EINVAL;
4051 }
4052 EXPORT_SYMBOL(drm_object_property_set_value);
4053 
4054 /**
4055  * drm_object_property_get_value - retrieve the value of a property
4056  * @obj: drm mode object to get property value from
4057  * @property: property to retrieve
4058  * @val: storage for the property value
4059  *
4060  * This function retrieves the softare state of the given property for the given
4061  * property. Since there is no driver callback to retrieve the current property
4062  * value this might be out of sync with the hardware, depending upon the driver
4063  * and property.
4064  *
4065  * Returns:
4066  * Zero on success, error code on failure.
4067  */
4068 int drm_object_property_get_value(struct drm_mode_object *obj,
4069 				  struct drm_property *property, uint64_t *val)
4070 {
4071 	int i;
4072 
4073 	/* read-only properties bypass atomic mechanism and still store
4074 	 * their value in obj->properties->values[].. mostly to avoid
4075 	 * having to deal w/ EDID and similar props in atomic paths:
4076 	 */
4077 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4078 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4079 		return drm_atomic_get_property(obj, property, val);
4080 
4081 	for (i = 0; i < obj->properties->count; i++) {
4082 		if (obj->properties->properties[i] == property) {
4083 			*val = obj->properties->values[i];
4084 			return 0;
4085 		}
4086 	}
4087 
4088 	return -EINVAL;
4089 }
4090 EXPORT_SYMBOL(drm_object_property_get_value);
4091 
4092 /**
4093  * drm_mode_getproperty_ioctl - get the property metadata
4094  * @dev: DRM device
4095  * @data: ioctl data
4096  * @file_priv: DRM file info
4097  *
4098  * This function retrieves the metadata for a given property, like the different
4099  * possible values for an enum property or the limits for a range property.
4100  *
4101  * Blob properties are special
4102  *
4103  * Called by the user via ioctl.
4104  *
4105  * Returns:
4106  * Zero on success, negative errno on failure.
4107  */
4108 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4109 			       void *data, struct drm_file *file_priv)
4110 {
4111 	struct drm_mode_get_property *out_resp = data;
4112 	struct drm_property *property;
4113 	int enum_count = 0;
4114 	int value_count = 0;
4115 	int ret = 0, i;
4116 	int copied;
4117 	struct drm_property_enum *prop_enum;
4118 	struct drm_mode_property_enum __user *enum_ptr;
4119 	uint64_t __user *values_ptr;
4120 
4121 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4122 		return -EINVAL;
4123 
4124 	drm_modeset_lock_all(dev);
4125 	property = drm_property_find(dev, out_resp->prop_id);
4126 	if (!property) {
4127 		ret = -ENOENT;
4128 		goto done;
4129 	}
4130 
4131 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4132 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4133 		list_for_each_entry(prop_enum, &property->enum_list, head)
4134 			enum_count++;
4135 	}
4136 
4137 	value_count = property->num_values;
4138 
4139 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4140 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4141 	out_resp->flags = property->flags;
4142 
4143 	if ((out_resp->count_values >= value_count) && value_count) {
4144 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4145 		for (i = 0; i < value_count; i++) {
4146 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4147 				ret = -EFAULT;
4148 				goto done;
4149 			}
4150 		}
4151 	}
4152 	out_resp->count_values = value_count;
4153 
4154 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4155 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4156 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4157 			copied = 0;
4158 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4159 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4160 
4161 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4162 					ret = -EFAULT;
4163 					goto done;
4164 				}
4165 
4166 				if (copy_to_user(&enum_ptr[copied].name,
4167 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4168 					ret = -EFAULT;
4169 					goto done;
4170 				}
4171 				copied++;
4172 			}
4173 		}
4174 		out_resp->count_enum_blobs = enum_count;
4175 	}
4176 
4177 	/*
4178 	 * NOTE: The idea seems to have been to use this to read all the blob
4179 	 * property values. But nothing ever added them to the corresponding
4180 	 * list, userspace always used the special-purpose get_blob ioctl to
4181 	 * read the value for a blob property. It also doesn't make a lot of
4182 	 * sense to return values here when everything else is just metadata for
4183 	 * the property itself.
4184 	 */
4185 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4186 		out_resp->count_enum_blobs = 0;
4187 done:
4188 	drm_modeset_unlock_all(dev);
4189 	return ret;
4190 }
4191 
4192 /**
4193  * drm_property_create_blob - Create new blob property
4194  *
4195  * Creates a new blob property for a specified DRM device, optionally
4196  * copying data.
4197  *
4198  * @dev: DRM device to create property for
4199  * @length: Length to allocate for blob data
4200  * @data: If specified, copies data into blob
4201  *
4202  * Returns:
4203  * New blob property with a single reference on success, or an ERR_PTR
4204  * value on failure.
4205  */
4206 struct drm_property_blob *
4207 drm_property_create_blob(struct drm_device *dev, size_t length,
4208 			 const void *data)
4209 {
4210 	struct drm_property_blob *blob;
4211 	int ret;
4212 
4213 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
4214 		return ERR_PTR(-EINVAL);
4215 
4216 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4217 	if (!blob)
4218 		return ERR_PTR(-ENOMEM);
4219 
4220 	/* This must be explicitly initialised, so we can safely call list_del
4221 	 * on it in the removal handler, even if it isn't in a file list. */
4222 	INIT_LIST_HEAD(&blob->head_file);
4223 	blob->length = length;
4224 	blob->dev = dev;
4225 
4226 	if (data)
4227 		memcpy(blob->data, data, length);
4228 
4229 	mutex_lock(&dev->mode_config.blob_lock);
4230 
4231 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4232 	if (ret) {
4233 		kfree(blob);
4234 		mutex_unlock(&dev->mode_config.blob_lock);
4235 		return ERR_PTR(-EINVAL);
4236 	}
4237 
4238 	kref_init(&blob->refcount);
4239 
4240 	list_add_tail(&blob->head_global,
4241 	              &dev->mode_config.property_blob_list);
4242 
4243 	mutex_unlock(&dev->mode_config.blob_lock);
4244 
4245 	return blob;
4246 }
4247 EXPORT_SYMBOL(drm_property_create_blob);
4248 
4249 /**
4250  * drm_property_free_blob - Blob property destructor
4251  *
4252  * Internal free function for blob properties; must not be used directly.
4253  *
4254  * @kref: Reference
4255  */
4256 static void drm_property_free_blob(struct kref *kref)
4257 {
4258 	struct drm_property_blob *blob =
4259 		container_of(kref, struct drm_property_blob, refcount);
4260 
4261 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
4262 
4263 	list_del(&blob->head_global);
4264 	list_del(&blob->head_file);
4265 	drm_mode_object_put(blob->dev, &blob->base);
4266 
4267 	kfree(blob);
4268 }
4269 
4270 /**
4271  * drm_property_unreference_blob - Unreference a blob property
4272  *
4273  * Drop a reference on a blob property. May free the object.
4274  *
4275  * @blob: Pointer to blob property
4276  */
4277 void drm_property_unreference_blob(struct drm_property_blob *blob)
4278 {
4279 	struct drm_device *dev;
4280 
4281 	if (!blob)
4282 		return;
4283 
4284 	dev = blob->dev;
4285 
4286 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4287 
4288 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
4289 			   &dev->mode_config.blob_lock))
4290 		mutex_unlock(&dev->mode_config.blob_lock);
4291 	else
4292 		might_lock(&dev->mode_config.blob_lock);
4293 }
4294 EXPORT_SYMBOL(drm_property_unreference_blob);
4295 
4296 /**
4297  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
4298  *
4299  * Drop a reference on a blob property. May free the object. This must be
4300  * called with blob_lock held.
4301  *
4302  * @blob: Pointer to blob property
4303  */
4304 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
4305 {
4306 	if (!blob)
4307 		return;
4308 
4309 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4310 
4311 	kref_put(&blob->refcount, drm_property_free_blob);
4312 }
4313 
4314 /**
4315  * drm_property_destroy_user_blobs - destroy all blobs created by this client
4316  * @dev:       DRM device
4317  * @file_priv: destroy all blobs owned by this file handle
4318  */
4319 void drm_property_destroy_user_blobs(struct drm_device *dev,
4320 				     struct drm_file *file_priv)
4321 {
4322 	struct drm_property_blob *blob, *bt;
4323 
4324 	mutex_lock(&dev->mode_config.blob_lock);
4325 
4326 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
4327 		list_del_init(&blob->head_file);
4328 		drm_property_unreference_blob_locked(blob);
4329 	}
4330 
4331 	mutex_unlock(&dev->mode_config.blob_lock);
4332 }
4333 
4334 /**
4335  * drm_property_reference_blob - Take a reference on an existing property
4336  *
4337  * Take a new reference on an existing blob property.
4338  *
4339  * @blob: Pointer to blob property
4340  */
4341 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
4342 {
4343 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
4344 	kref_get(&blob->refcount);
4345 	return blob;
4346 }
4347 EXPORT_SYMBOL(drm_property_reference_blob);
4348 
4349 /*
4350  * Like drm_property_lookup_blob, but does not return an additional reference.
4351  * Must be called with blob_lock held.
4352  */
4353 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
4354 							    uint32_t id)
4355 {
4356 	struct drm_mode_object *obj = NULL;
4357 	struct drm_property_blob *blob;
4358 
4359 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
4360 
4361 	mutex_lock(&dev->mode_config.idr_mutex);
4362 	obj = idr_find(&dev->mode_config.crtc_idr, id);
4363 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
4364 		blob = NULL;
4365 	else
4366 		blob = obj_to_blob(obj);
4367 	mutex_unlock(&dev->mode_config.idr_mutex);
4368 
4369 	return blob;
4370 }
4371 
4372 /**
4373  * drm_property_lookup_blob - look up a blob property and take a reference
4374  * @dev: drm device
4375  * @id: id of the blob property
4376  *
4377  * If successful, this takes an additional reference to the blob property.
4378  * callers need to make sure to eventually unreference the returned property
4379  * again, using @drm_property_unreference_blob.
4380  */
4381 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
4382 					           uint32_t id)
4383 {
4384 	struct drm_property_blob *blob;
4385 
4386 	mutex_lock(&dev->mode_config.blob_lock);
4387 	blob = __drm_property_lookup_blob(dev, id);
4388 	if (blob) {
4389 		if (!kref_get_unless_zero(&blob->refcount))
4390 			blob = NULL;
4391 	}
4392 	mutex_unlock(&dev->mode_config.blob_lock);
4393 
4394 	return blob;
4395 }
4396 EXPORT_SYMBOL(drm_property_lookup_blob);
4397 
4398 /**
4399  * drm_property_replace_global_blob - atomically replace existing blob property
4400  * @dev: drm device
4401  * @replace: location of blob property pointer to be replaced
4402  * @length: length of data for new blob, or 0 for no data
4403  * @data: content for new blob, or NULL for no data
4404  * @obj_holds_id: optional object for property holding blob ID
4405  * @prop_holds_id: optional property holding blob ID
4406  * @return 0 on success or error on failure
4407  *
4408  * This function will atomically replace a global property in the blob list,
4409  * optionally updating a property which holds the ID of that property. It is
4410  * guaranteed to be atomic: no caller will be allowed to see intermediate
4411  * results, and either the entire operation will succeed and clean up the
4412  * previous property, or it will fail and the state will be unchanged.
4413  *
4414  * If length is 0 or data is NULL, no new blob will be created, and the holding
4415  * property, if specified, will be set to 0.
4416  *
4417  * Access to the replace pointer is assumed to be protected by the caller, e.g.
4418  * by holding the relevant modesetting object lock for its parent.
4419  *
4420  * For example, a drm_connector has a 'PATH' property, which contains the ID
4421  * of a blob property with the value of the MST path information. Calling this
4422  * function with replace pointing to the connector's path_blob_ptr, length and
4423  * data set for the new path information, obj_holds_id set to the connector's
4424  * base object, and prop_holds_id set to the path property name, will perform
4425  * a completely atomic update. The access to path_blob_ptr is protected by the
4426  * caller holding a lock on the connector.
4427  */
4428 static int drm_property_replace_global_blob(struct drm_device *dev,
4429                                             struct drm_property_blob **replace,
4430                                             size_t length,
4431                                             const void *data,
4432                                             struct drm_mode_object *obj_holds_id,
4433                                             struct drm_property *prop_holds_id)
4434 {
4435 	struct drm_property_blob *new_blob = NULL;
4436 	struct drm_property_blob *old_blob = NULL;
4437 	int ret;
4438 
4439 	WARN_ON(replace == NULL);
4440 
4441 	old_blob = *replace;
4442 
4443 	if (length && data) {
4444 		new_blob = drm_property_create_blob(dev, length, data);
4445 		if (IS_ERR(new_blob))
4446 			return PTR_ERR(new_blob);
4447 	}
4448 
4449 	/* This does not need to be synchronised with blob_lock, as the
4450 	 * get_properties ioctl locks all modesetting objects, and
4451 	 * obj_holds_id must be locked before calling here, so we cannot
4452 	 * have its value out of sync with the list membership modified
4453 	 * below under blob_lock. */
4454 	if (obj_holds_id) {
4455 		ret = drm_object_property_set_value(obj_holds_id,
4456 						    prop_holds_id,
4457 						    new_blob ?
4458 						        new_blob->base.id : 0);
4459 		if (ret != 0)
4460 			goto err_created;
4461 	}
4462 
4463 	drm_property_unreference_blob(old_blob);
4464 	*replace = new_blob;
4465 
4466 	return 0;
4467 
4468 err_created:
4469 	drm_property_unreference_blob(new_blob);
4470 	return ret;
4471 }
4472 
4473 /**
4474  * drm_mode_getblob_ioctl - get the contents of a blob property value
4475  * @dev: DRM device
4476  * @data: ioctl data
4477  * @file_priv: DRM file info
4478  *
4479  * This function retrieves the contents of a blob property. The value stored in
4480  * an object's blob property is just a normal modeset object id.
4481  *
4482  * Called by the user via ioctl.
4483  *
4484  * Returns:
4485  * Zero on success, negative errno on failure.
4486  */
4487 int drm_mode_getblob_ioctl(struct drm_device *dev,
4488 			   void *data, struct drm_file *file_priv)
4489 {
4490 	struct drm_mode_get_blob *out_resp = data;
4491 	struct drm_property_blob *blob;
4492 	int ret = 0;
4493 	void __user *blob_ptr;
4494 
4495 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4496 		return -EINVAL;
4497 
4498 	drm_modeset_lock_all(dev);
4499 	mutex_lock(&dev->mode_config.blob_lock);
4500 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4501 	if (!blob) {
4502 		ret = -ENOENT;
4503 		goto done;
4504 	}
4505 
4506 	if (out_resp->length == blob->length) {
4507 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4508 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4509 			ret = -EFAULT;
4510 			goto done;
4511 		}
4512 	}
4513 	out_resp->length = blob->length;
4514 
4515 done:
4516 	mutex_unlock(&dev->mode_config.blob_lock);
4517 	drm_modeset_unlock_all(dev);
4518 	return ret;
4519 }
4520 
4521 /**
4522  * drm_mode_createblob_ioctl - create a new blob property
4523  * @dev: DRM device
4524  * @data: ioctl data
4525  * @file_priv: DRM file info
4526  *
4527  * This function creates a new blob property with user-defined values. In order
4528  * to give us sensible validation and checking when creating, rather than at
4529  * every potential use, we also require a type to be provided upfront.
4530  *
4531  * Called by the user via ioctl.
4532  *
4533  * Returns:
4534  * Zero on success, negative errno on failure.
4535  */
4536 int drm_mode_createblob_ioctl(struct drm_device *dev,
4537 			      void *data, struct drm_file *file_priv)
4538 {
4539 	struct drm_mode_create_blob *out_resp = data;
4540 	struct drm_property_blob *blob;
4541 	void __user *blob_ptr;
4542 	int ret = 0;
4543 
4544 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4545 		return -EINVAL;
4546 
4547 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
4548 	if (IS_ERR(blob))
4549 		return PTR_ERR(blob);
4550 
4551 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
4552 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
4553 		ret = -EFAULT;
4554 		goto out_blob;
4555 	}
4556 
4557 	/* Dropping the lock between create_blob and our access here is safe
4558 	 * as only the same file_priv can remove the blob; at this point, it is
4559 	 * not associated with any file_priv. */
4560 	mutex_lock(&dev->mode_config.blob_lock);
4561 	out_resp->blob_id = blob->base.id;
4562 	list_add_tail(&blob->head_file, &file_priv->blobs);
4563 	mutex_unlock(&dev->mode_config.blob_lock);
4564 
4565 	return 0;
4566 
4567 out_blob:
4568 	drm_property_unreference_blob(blob);
4569 	return ret;
4570 }
4571 
4572 /**
4573  * drm_mode_destroyblob_ioctl - destroy a user blob property
4574  * @dev: DRM device
4575  * @data: ioctl data
4576  * @file_priv: DRM file info
4577  *
4578  * Destroy an existing user-defined blob property.
4579  *
4580  * Called by the user via ioctl.
4581  *
4582  * Returns:
4583  * Zero on success, negative errno on failure.
4584  */
4585 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
4586 			       void *data, struct drm_file *file_priv)
4587 {
4588 	struct drm_mode_destroy_blob *out_resp = data;
4589 	struct drm_property_blob *blob = NULL, *bt;
4590 	bool found = false;
4591 	int ret = 0;
4592 
4593 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4594 		return -EINVAL;
4595 
4596 	mutex_lock(&dev->mode_config.blob_lock);
4597 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
4598 	if (!blob) {
4599 		ret = -ENOENT;
4600 		goto err;
4601 	}
4602 
4603 	/* Ensure the property was actually created by this user. */
4604 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
4605 		if (bt == blob) {
4606 			found = true;
4607 			break;
4608 		}
4609 	}
4610 
4611 	if (!found) {
4612 		ret = -EPERM;
4613 		goto err;
4614 	}
4615 
4616 	/* We must drop head_file here, because we may not be the last
4617 	 * reference on the blob. */
4618 	list_del_init(&blob->head_file);
4619 	drm_property_unreference_blob_locked(blob);
4620 	mutex_unlock(&dev->mode_config.blob_lock);
4621 
4622 	return 0;
4623 
4624 err:
4625 	mutex_unlock(&dev->mode_config.blob_lock);
4626 	return ret;
4627 }
4628 
4629 /**
4630  * drm_mode_connector_set_path_property - set tile property on connector
4631  * @connector: connector to set property on.
4632  * @path: path to use for property; must not be NULL.
4633  *
4634  * This creates a property to expose to userspace to specify a
4635  * connector path. This is mainly used for DisplayPort MST where
4636  * connectors have a topology and we want to allow userspace to give
4637  * them more meaningful names.
4638  *
4639  * Returns:
4640  * Zero on success, negative errno on failure.
4641  */
4642 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4643 					 const char *path)
4644 {
4645 	struct drm_device *dev = connector->dev;
4646 	int ret;
4647 
4648 	ret = drm_property_replace_global_blob(dev,
4649 	                                       &connector->path_blob_ptr,
4650 	                                       strlen(path) + 1,
4651 	                                       path,
4652 	                                       &connector->base,
4653 	                                       dev->mode_config.path_property);
4654 	return ret;
4655 }
4656 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4657 
4658 /**
4659  * drm_mode_connector_set_tile_property - set tile property on connector
4660  * @connector: connector to set property on.
4661  *
4662  * This looks up the tile information for a connector, and creates a
4663  * property for userspace to parse if it exists. The property is of
4664  * the form of 8 integers using ':' as a separator.
4665  *
4666  * Returns:
4667  * Zero on success, errno on failure.
4668  */
4669 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4670 {
4671 	struct drm_device *dev = connector->dev;
4672 	char tile[256];
4673 	int ret;
4674 
4675 	if (!connector->has_tile) {
4676 		ret  = drm_property_replace_global_blob(dev,
4677 		                                        &connector->tile_blob_ptr,
4678 		                                        0,
4679 		                                        NULL,
4680 		                                        &connector->base,
4681 		                                        dev->mode_config.tile_property);
4682 		return ret;
4683 	}
4684 
4685 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4686 		 connector->tile_group->id, connector->tile_is_single_monitor,
4687 		 connector->num_h_tile, connector->num_v_tile,
4688 		 connector->tile_h_loc, connector->tile_v_loc,
4689 		 connector->tile_h_size, connector->tile_v_size);
4690 
4691 	ret = drm_property_replace_global_blob(dev,
4692 	                                       &connector->tile_blob_ptr,
4693 	                                       strlen(tile) + 1,
4694 	                                       tile,
4695 	                                       &connector->base,
4696 	                                       dev->mode_config.tile_property);
4697 	return ret;
4698 }
4699 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4700 
4701 /**
4702  * drm_mode_connector_update_edid_property - update the edid property of a connector
4703  * @connector: drm connector
4704  * @edid: new value of the edid property
4705  *
4706  * This function creates a new blob modeset object and assigns its id to the
4707  * connector's edid property.
4708  *
4709  * Returns:
4710  * Zero on success, negative errno on failure.
4711  */
4712 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4713 					    const struct edid *edid)
4714 {
4715 	struct drm_device *dev = connector->dev;
4716 	size_t size = 0;
4717 	int ret;
4718 
4719 	/* ignore requests to set edid when overridden */
4720 	if (connector->override_edid)
4721 		return 0;
4722 
4723 	if (edid)
4724 		size = EDID_LENGTH * (1 + edid->extensions);
4725 
4726 	ret = drm_property_replace_global_blob(dev,
4727 					       &connector->edid_blob_ptr,
4728 	                                       size,
4729 	                                       edid,
4730 	                                       &connector->base,
4731 	                                       dev->mode_config.edid_property);
4732 	return ret;
4733 }
4734 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4735 
4736 /* Some properties could refer to dynamic refcnt'd objects, or things that
4737  * need special locking to handle lifetime issues (ie. to ensure the prop
4738  * value doesn't become invalid part way through the property update due to
4739  * race).  The value returned by reference via 'obj' should be passed back
4740  * to drm_property_change_valid_put() after the property is set (and the
4741  * object to which the property is attached has a chance to take it's own
4742  * reference).
4743  */
4744 bool drm_property_change_valid_get(struct drm_property *property,
4745 					 uint64_t value, struct drm_mode_object **ref)
4746 {
4747 	int i;
4748 
4749 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4750 		return false;
4751 
4752 	*ref = NULL;
4753 
4754 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4755 		if (value < property->values[0] || value > property->values[1])
4756 			return false;
4757 		return true;
4758 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4759 		int64_t svalue = U642I64(value);
4760 
4761 		if (svalue < U642I64(property->values[0]) ||
4762 				svalue > U642I64(property->values[1]))
4763 			return false;
4764 		return true;
4765 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4766 		uint64_t valid_mask = 0;
4767 
4768 		for (i = 0; i < property->num_values; i++)
4769 			valid_mask |= (1ULL << property->values[i]);
4770 		return !(value & ~valid_mask);
4771 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4772 		struct drm_property_blob *blob;
4773 
4774 		if (value == 0)
4775 			return true;
4776 
4777 		blob = drm_property_lookup_blob(property->dev, value);
4778 		if (blob) {
4779 			*ref = &blob->base;
4780 			return true;
4781 		} else {
4782 			return false;
4783 		}
4784 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4785 		/* a zero value for an object property translates to null: */
4786 		if (value == 0)
4787 			return true;
4788 
4789 		/* handle refcnt'd objects specially: */
4790 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4791 			struct drm_framebuffer *fb;
4792 			fb = drm_framebuffer_lookup(property->dev, value);
4793 			if (fb) {
4794 				*ref = &fb->base;
4795 				return true;
4796 			} else {
4797 				return false;
4798 			}
4799 		} else {
4800 			return _object_find(property->dev, value, property->values[0]) != NULL;
4801 		}
4802 	}
4803 
4804 	for (i = 0; i < property->num_values; i++)
4805 		if (property->values[i] == value)
4806 			return true;
4807 	return false;
4808 }
4809 
4810 void drm_property_change_valid_put(struct drm_property *property,
4811 		struct drm_mode_object *ref)
4812 {
4813 	if (!ref)
4814 		return;
4815 
4816 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4817 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4818 			drm_framebuffer_unreference(obj_to_fb(ref));
4819 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4820 		drm_property_unreference_blob(obj_to_blob(ref));
4821 }
4822 
4823 /**
4824  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4825  * @dev: DRM device
4826  * @data: ioctl data
4827  * @file_priv: DRM file info
4828  *
4829  * This function sets the current value for a connectors's property. It also
4830  * calls into a driver's ->set_property callback to update the hardware state
4831  *
4832  * Called by the user via ioctl.
4833  *
4834  * Returns:
4835  * Zero on success, negative errno on failure.
4836  */
4837 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4838 				       void *data, struct drm_file *file_priv)
4839 {
4840 	struct drm_mode_connector_set_property *conn_set_prop = data;
4841 	struct drm_mode_obj_set_property obj_set_prop = {
4842 		.value = conn_set_prop->value,
4843 		.prop_id = conn_set_prop->prop_id,
4844 		.obj_id = conn_set_prop->connector_id,
4845 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4846 	};
4847 
4848 	/* It does all the locking and checking we need */
4849 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4850 }
4851 
4852 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4853 					   struct drm_property *property,
4854 					   uint64_t value)
4855 {
4856 	int ret = -EINVAL;
4857 	struct drm_connector *connector = obj_to_connector(obj);
4858 
4859 	/* Do DPMS ourselves */
4860 	if (property == connector->dev->mode_config.dpms_property) {
4861 		ret = (*connector->funcs->dpms)(connector, (int)value);
4862 	} else if (connector->funcs->set_property)
4863 		ret = connector->funcs->set_property(connector, property, value);
4864 
4865 	/* store the property value if successful */
4866 	if (!ret)
4867 		drm_object_property_set_value(&connector->base, property, value);
4868 	return ret;
4869 }
4870 
4871 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4872 				      struct drm_property *property,
4873 				      uint64_t value)
4874 {
4875 	int ret = -EINVAL;
4876 	struct drm_crtc *crtc = obj_to_crtc(obj);
4877 
4878 	if (crtc->funcs->set_property)
4879 		ret = crtc->funcs->set_property(crtc, property, value);
4880 	if (!ret)
4881 		drm_object_property_set_value(obj, property, value);
4882 
4883 	return ret;
4884 }
4885 
4886 /**
4887  * drm_mode_plane_set_obj_prop - set the value of a property
4888  * @plane: drm plane object to set property value for
4889  * @property: property to set
4890  * @value: value the property should be set to
4891  *
4892  * This functions sets a given property on a given plane object. This function
4893  * calls the driver's ->set_property callback and changes the software state of
4894  * the property if the callback succeeds.
4895  *
4896  * Returns:
4897  * Zero on success, error code on failure.
4898  */
4899 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4900 				struct drm_property *property,
4901 				uint64_t value)
4902 {
4903 	int ret = -EINVAL;
4904 	struct drm_mode_object *obj = &plane->base;
4905 
4906 	if (plane->funcs->set_property)
4907 		ret = plane->funcs->set_property(plane, property, value);
4908 	if (!ret)
4909 		drm_object_property_set_value(obj, property, value);
4910 
4911 	return ret;
4912 }
4913 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4914 
4915 /**
4916  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4917  * @dev: DRM device
4918  * @data: ioctl data
4919  * @file_priv: DRM file info
4920  *
4921  * This function retrieves the current value for an object's property. Compared
4922  * to the connector specific ioctl this one is extended to also work on crtc and
4923  * plane objects.
4924  *
4925  * Called by the user via ioctl.
4926  *
4927  * Returns:
4928  * Zero on success, negative errno on failure.
4929  */
4930 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4931 				      struct drm_file *file_priv)
4932 {
4933 	struct drm_mode_obj_get_properties *arg = data;
4934 	struct drm_mode_object *obj;
4935 	int ret = 0;
4936 
4937 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4938 		return -EINVAL;
4939 
4940 	drm_modeset_lock_all(dev);
4941 
4942 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4943 	if (!obj) {
4944 		ret = -ENOENT;
4945 		goto out;
4946 	}
4947 	if (!obj->properties) {
4948 		ret = -EINVAL;
4949 		goto out;
4950 	}
4951 
4952 	ret = get_properties(obj, file_priv->atomic,
4953 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4954 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4955 			&arg->count_props);
4956 
4957 out:
4958 	drm_modeset_unlock_all(dev);
4959 	return ret;
4960 }
4961 
4962 /**
4963  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4964  * @dev: DRM device
4965  * @data: ioctl data
4966  * @file_priv: DRM file info
4967  *
4968  * This function sets the current value for an object's property. It also calls
4969  * into a driver's ->set_property callback to update the hardware state.
4970  * Compared to the connector specific ioctl this one is extended to also work on
4971  * crtc and plane objects.
4972  *
4973  * Called by the user via ioctl.
4974  *
4975  * Returns:
4976  * Zero on success, negative errno on failure.
4977  */
4978 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4979 				    struct drm_file *file_priv)
4980 {
4981 	struct drm_mode_obj_set_property *arg = data;
4982 	struct drm_mode_object *arg_obj;
4983 	struct drm_mode_object *prop_obj;
4984 	struct drm_property *property;
4985 	int i, ret = -EINVAL;
4986 	struct drm_mode_object *ref;
4987 
4988 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4989 		return -EINVAL;
4990 
4991 	drm_modeset_lock_all(dev);
4992 
4993 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4994 	if (!arg_obj) {
4995 		ret = -ENOENT;
4996 		goto out;
4997 	}
4998 	if (!arg_obj->properties)
4999 		goto out;
5000 
5001 	for (i = 0; i < arg_obj->properties->count; i++)
5002 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
5003 			break;
5004 
5005 	if (i == arg_obj->properties->count)
5006 		goto out;
5007 
5008 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
5009 					DRM_MODE_OBJECT_PROPERTY);
5010 	if (!prop_obj) {
5011 		ret = -ENOENT;
5012 		goto out;
5013 	}
5014 	property = obj_to_property(prop_obj);
5015 
5016 	if (!drm_property_change_valid_get(property, arg->value, &ref))
5017 		goto out;
5018 
5019 	switch (arg_obj->type) {
5020 	case DRM_MODE_OBJECT_CONNECTOR:
5021 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
5022 						      arg->value);
5023 		break;
5024 	case DRM_MODE_OBJECT_CRTC:
5025 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
5026 		break;
5027 	case DRM_MODE_OBJECT_PLANE:
5028 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
5029 						  property, arg->value);
5030 		break;
5031 	}
5032 
5033 	drm_property_change_valid_put(property, ref);
5034 
5035 out:
5036 	drm_modeset_unlock_all(dev);
5037 	return ret;
5038 }
5039 
5040 /**
5041  * drm_mode_connector_attach_encoder - attach a connector to an encoder
5042  * @connector: connector to attach
5043  * @encoder: encoder to attach @connector to
5044  *
5045  * This function links up a connector to an encoder. Note that the routing
5046  * restrictions between encoders and crtcs are exposed to userspace through the
5047  * possible_clones and possible_crtcs bitmasks.
5048  *
5049  * Returns:
5050  * Zero on success, negative errno on failure.
5051  */
5052 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
5053 				      struct drm_encoder *encoder)
5054 {
5055 	int i;
5056 
5057 	/*
5058 	 * In the past, drivers have attempted to model the static association
5059 	 * of connector to encoder in simple connector/encoder devices using a
5060 	 * direct assignment of connector->encoder = encoder. This connection
5061 	 * is a logical one and the responsibility of the core, so drivers are
5062 	 * expected not to mess with this.
5063 	 *
5064 	 * Note that the error return should've been enough here, but a large
5065 	 * majority of drivers ignores the return value, so add in a big WARN
5066 	 * to get people's attention.
5067 	 */
5068 	if (WARN_ON(connector->encoder))
5069 		return -EINVAL;
5070 
5071 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
5072 		if (connector->encoder_ids[i] == 0) {
5073 			connector->encoder_ids[i] = encoder->base.id;
5074 			return 0;
5075 		}
5076 	}
5077 	return -ENOMEM;
5078 }
5079 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
5080 
5081 /**
5082  * drm_mode_crtc_set_gamma_size - set the gamma table size
5083  * @crtc: CRTC to set the gamma table size for
5084  * @gamma_size: size of the gamma table
5085  *
5086  * Drivers which support gamma tables should set this to the supported gamma
5087  * table size when initializing the CRTC. Currently the drm core only supports a
5088  * fixed gamma table size.
5089  *
5090  * Returns:
5091  * Zero on success, negative errno on failure.
5092  */
5093 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
5094 				 int gamma_size)
5095 {
5096 	crtc->gamma_size = gamma_size;
5097 
5098 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
5099 				    GFP_KERNEL);
5100 	if (!crtc->gamma_store) {
5101 		crtc->gamma_size = 0;
5102 		return -ENOMEM;
5103 	}
5104 
5105 	return 0;
5106 }
5107 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
5108 
5109 /**
5110  * drm_mode_gamma_set_ioctl - set the gamma table
5111  * @dev: DRM device
5112  * @data: ioctl data
5113  * @file_priv: DRM file info
5114  *
5115  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
5116  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
5117  *
5118  * Called by the user via ioctl.
5119  *
5120  * Returns:
5121  * Zero on success, negative errno on failure.
5122  */
5123 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
5124 			     void *data, struct drm_file *file_priv)
5125 {
5126 	struct drm_mode_crtc_lut *crtc_lut = data;
5127 	struct drm_crtc *crtc;
5128 	void *r_base, *g_base, *b_base;
5129 	int size;
5130 	int ret = 0;
5131 
5132 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5133 		return -EINVAL;
5134 
5135 	drm_modeset_lock_all(dev);
5136 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5137 	if (!crtc) {
5138 		ret = -ENOENT;
5139 		goto out;
5140 	}
5141 
5142 	if (crtc->funcs->gamma_set == NULL) {
5143 		ret = -ENOSYS;
5144 		goto out;
5145 	}
5146 
5147 	/* memcpy into gamma store */
5148 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5149 		ret = -EINVAL;
5150 		goto out;
5151 	}
5152 
5153 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5154 	r_base = crtc->gamma_store;
5155 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
5156 		ret = -EFAULT;
5157 		goto out;
5158 	}
5159 
5160 	g_base = r_base + size;
5161 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
5162 		ret = -EFAULT;
5163 		goto out;
5164 	}
5165 
5166 	b_base = g_base + size;
5167 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
5168 		ret = -EFAULT;
5169 		goto out;
5170 	}
5171 
5172 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
5173 
5174 out:
5175 	drm_modeset_unlock_all(dev);
5176 	return ret;
5177 
5178 }
5179 
5180 /**
5181  * drm_mode_gamma_get_ioctl - get the gamma table
5182  * @dev: DRM device
5183  * @data: ioctl data
5184  * @file_priv: DRM file info
5185  *
5186  * Copy the current gamma table into the storage provided. This also provides
5187  * the gamma table size the driver expects, which can be used to size the
5188  * allocated storage.
5189  *
5190  * Called by the user via ioctl.
5191  *
5192  * Returns:
5193  * Zero on success, negative errno on failure.
5194  */
5195 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
5196 			     void *data, struct drm_file *file_priv)
5197 {
5198 	struct drm_mode_crtc_lut *crtc_lut = data;
5199 	struct drm_crtc *crtc;
5200 	void *r_base, *g_base, *b_base;
5201 	int size;
5202 	int ret = 0;
5203 
5204 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
5205 		return -EINVAL;
5206 
5207 	drm_modeset_lock_all(dev);
5208 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
5209 	if (!crtc) {
5210 		ret = -ENOENT;
5211 		goto out;
5212 	}
5213 
5214 	/* memcpy into gamma store */
5215 	if (crtc_lut->gamma_size != crtc->gamma_size) {
5216 		ret = -EINVAL;
5217 		goto out;
5218 	}
5219 
5220 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
5221 	r_base = crtc->gamma_store;
5222 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
5223 		ret = -EFAULT;
5224 		goto out;
5225 	}
5226 
5227 	g_base = r_base + size;
5228 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
5229 		ret = -EFAULT;
5230 		goto out;
5231 	}
5232 
5233 	b_base = g_base + size;
5234 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
5235 		ret = -EFAULT;
5236 		goto out;
5237 	}
5238 out:
5239 	drm_modeset_unlock_all(dev);
5240 	return ret;
5241 }
5242 
5243 /**
5244  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
5245  * @dev: DRM device
5246  * @data: ioctl data
5247  * @file_priv: DRM file info
5248  *
5249  * This schedules an asynchronous update on a given CRTC, called page flip.
5250  * Optionally a drm event is generated to signal the completion of the event.
5251  * Generic drivers cannot assume that a pageflip with changed framebuffer
5252  * properties (including driver specific metadata like tiling layout) will work,
5253  * but some drivers support e.g. pixel format changes through the pageflip
5254  * ioctl.
5255  *
5256  * Called by the user via ioctl.
5257  *
5258  * Returns:
5259  * Zero on success, negative errno on failure.
5260  */
5261 int drm_mode_page_flip_ioctl(struct drm_device *dev,
5262 			     void *data, struct drm_file *file_priv)
5263 {
5264 	struct drm_mode_crtc_page_flip *page_flip = data;
5265 	struct drm_crtc *crtc;
5266 	struct drm_framebuffer *fb = NULL;
5267 	struct drm_pending_vblank_event *e = NULL;
5268 	int ret = -EINVAL;
5269 
5270 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
5271 	    page_flip->reserved != 0)
5272 		return -EINVAL;
5273 
5274 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
5275 		return -EINVAL;
5276 
5277 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
5278 	if (!crtc)
5279 		return -ENOENT;
5280 
5281 	drm_modeset_lock_crtc(crtc, crtc->primary);
5282 	if (crtc->primary->fb == NULL) {
5283 		/* The framebuffer is currently unbound, presumably
5284 		 * due to a hotplug event, that userspace has not
5285 		 * yet discovered.
5286 		 */
5287 		ret = -EBUSY;
5288 		goto out;
5289 	}
5290 
5291 	if (crtc->funcs->page_flip == NULL)
5292 		goto out;
5293 
5294 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
5295 	if (!fb) {
5296 		ret = -ENOENT;
5297 		goto out;
5298 	}
5299 
5300 	if (crtc->state) {
5301 		const struct drm_plane_state *state = crtc->primary->state;
5302 
5303 		ret = check_src_coords(state->src_x, state->src_y,
5304 				       state->src_w, state->src_h, fb);
5305 	} else {
5306 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
5307 	}
5308 	if (ret)
5309 		goto out;
5310 
5311 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
5312 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
5313 		ret = -EINVAL;
5314 		goto out;
5315 	}
5316 
5317 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
5318 		e = kzalloc(sizeof *e, GFP_KERNEL);
5319 		if (!e) {
5320 			ret = -ENOMEM;
5321 			goto out;
5322 		}
5323 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
5324 		e->event.base.length = sizeof(e->event);
5325 		e->event.user_data = page_flip->user_data;
5326 		ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
5327 		if (ret) {
5328 			kfree(e);
5329 			goto out;
5330 		}
5331 	}
5332 
5333 	crtc->primary->old_fb = crtc->primary->fb;
5334 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
5335 	if (ret) {
5336 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
5337 			drm_event_cancel_free(dev, &e->base);
5338 		/* Keep the old fb, don't unref it. */
5339 		crtc->primary->old_fb = NULL;
5340 	} else {
5341 		crtc->primary->fb = fb;
5342 		/* Unref only the old framebuffer. */
5343 		fb = NULL;
5344 	}
5345 
5346 out:
5347 	if (fb)
5348 		drm_framebuffer_unreference(fb);
5349 	if (crtc->primary->old_fb)
5350 		drm_framebuffer_unreference(crtc->primary->old_fb);
5351 	crtc->primary->old_fb = NULL;
5352 	drm_modeset_unlock_crtc(crtc);
5353 
5354 	return ret;
5355 }
5356 
5357 /**
5358  * drm_mode_config_reset - call ->reset callbacks
5359  * @dev: drm device
5360  *
5361  * This functions calls all the crtc's, encoder's and connector's ->reset
5362  * callback. Drivers can use this in e.g. their driver load or resume code to
5363  * reset hardware and software state.
5364  */
5365 void drm_mode_config_reset(struct drm_device *dev)
5366 {
5367 	struct drm_crtc *crtc;
5368 	struct drm_plane *plane;
5369 	struct drm_encoder *encoder;
5370 	struct drm_connector *connector;
5371 
5372 	drm_for_each_plane(plane, dev)
5373 		if (plane->funcs->reset)
5374 			plane->funcs->reset(plane);
5375 
5376 	drm_for_each_crtc(crtc, dev)
5377 		if (crtc->funcs->reset)
5378 			crtc->funcs->reset(crtc);
5379 
5380 	drm_for_each_encoder(encoder, dev)
5381 		if (encoder->funcs->reset)
5382 			encoder->funcs->reset(encoder);
5383 
5384 	mutex_lock(&dev->mode_config.mutex);
5385 	drm_for_each_connector(connector, dev)
5386 		if (connector->funcs->reset)
5387 			connector->funcs->reset(connector);
5388 	mutex_unlock(&dev->mode_config.mutex);
5389 }
5390 EXPORT_SYMBOL(drm_mode_config_reset);
5391 
5392 /**
5393  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5394  * @dev: DRM device
5395  * @data: ioctl data
5396  * @file_priv: DRM file info
5397  *
5398  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5399  * TTM or something else entirely) and returns the resulting buffer handle. This
5400  * handle can then be wrapped up into a framebuffer modeset object.
5401  *
5402  * Note that userspace is not allowed to use such objects for render
5403  * acceleration - drivers must create their own private ioctls for such a use
5404  * case.
5405  *
5406  * Called by the user via ioctl.
5407  *
5408  * Returns:
5409  * Zero on success, negative errno on failure.
5410  */
5411 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5412 			       void *data, struct drm_file *file_priv)
5413 {
5414 	struct drm_mode_create_dumb *args = data;
5415 	u32 cpp, stride, size;
5416 
5417 	if (!dev->driver->dumb_create)
5418 		return -ENOSYS;
5419 	if (!args->width || !args->height || !args->bpp)
5420 		return -EINVAL;
5421 
5422 	/* overflow checks for 32bit size calculations */
5423 	/* NOTE: DIV_ROUND_UP() can overflow */
5424 	cpp = DIV_ROUND_UP(args->bpp, 8);
5425 	if (!cpp || cpp > 0xffffffffU / args->width)
5426 		return -EINVAL;
5427 	stride = cpp * args->width;
5428 	if (args->height > 0xffffffffU / stride)
5429 		return -EINVAL;
5430 
5431 	/* test for wrap-around */
5432 	size = args->height * stride;
5433 	if (PAGE_ALIGN(size) == 0)
5434 		return -EINVAL;
5435 
5436 	/*
5437 	 * handle, pitch and size are output parameters. Zero them out to
5438 	 * prevent drivers from accidentally using uninitialized data. Since
5439 	 * not all existing userspace is clearing these fields properly we
5440 	 * cannot reject IOCTL with garbage in them.
5441 	 */
5442 	args->handle = 0;
5443 	args->pitch = 0;
5444 	args->size = 0;
5445 
5446 	return dev->driver->dumb_create(file_priv, dev, args);
5447 }
5448 
5449 /**
5450  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5451  * @dev: DRM device
5452  * @data: ioctl data
5453  * @file_priv: DRM file info
5454  *
5455  * Allocate an offset in the drm device node's address space to be able to
5456  * memory map a dumb buffer.
5457  *
5458  * Called by the user via ioctl.
5459  *
5460  * Returns:
5461  * Zero on success, negative errno on failure.
5462  */
5463 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5464 			     void *data, struct drm_file *file_priv)
5465 {
5466 	struct drm_mode_map_dumb *args = data;
5467 
5468 	/* call driver ioctl to get mmap offset */
5469 	if (!dev->driver->dumb_map_offset)
5470 		return -ENOSYS;
5471 
5472 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5473 }
5474 
5475 /**
5476  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5477  * @dev: DRM device
5478  * @data: ioctl data
5479  * @file_priv: DRM file info
5480  *
5481  * This destroys the userspace handle for the given dumb backing storage buffer.
5482  * Since buffer objects must be reference counted in the kernel a buffer object
5483  * won't be immediately freed if a framebuffer modeset object still uses it.
5484  *
5485  * Called by the user via ioctl.
5486  *
5487  * Returns:
5488  * Zero on success, negative errno on failure.
5489  */
5490 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5491 				void *data, struct drm_file *file_priv)
5492 {
5493 	struct drm_mode_destroy_dumb *args = data;
5494 
5495 	if (!dev->driver->dumb_destroy)
5496 		return -ENOSYS;
5497 
5498 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5499 }
5500 
5501 /**
5502  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5503  * @format: pixel format (DRM_FORMAT_*)
5504  * @depth: storage for the depth value
5505  * @bpp: storage for the bpp value
5506  *
5507  * This only supports RGB formats here for compat with code that doesn't use
5508  * pixel formats directly yet.
5509  */
5510 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5511 			  int *bpp)
5512 {
5513 	switch (format) {
5514 	case DRM_FORMAT_C8:
5515 	case DRM_FORMAT_RGB332:
5516 	case DRM_FORMAT_BGR233:
5517 		*depth = 8;
5518 		*bpp = 8;
5519 		break;
5520 	case DRM_FORMAT_XRGB1555:
5521 	case DRM_FORMAT_XBGR1555:
5522 	case DRM_FORMAT_RGBX5551:
5523 	case DRM_FORMAT_BGRX5551:
5524 	case DRM_FORMAT_ARGB1555:
5525 	case DRM_FORMAT_ABGR1555:
5526 	case DRM_FORMAT_RGBA5551:
5527 	case DRM_FORMAT_BGRA5551:
5528 		*depth = 15;
5529 		*bpp = 16;
5530 		break;
5531 	case DRM_FORMAT_RGB565:
5532 	case DRM_FORMAT_BGR565:
5533 		*depth = 16;
5534 		*bpp = 16;
5535 		break;
5536 	case DRM_FORMAT_RGB888:
5537 	case DRM_FORMAT_BGR888:
5538 		*depth = 24;
5539 		*bpp = 24;
5540 		break;
5541 	case DRM_FORMAT_XRGB8888:
5542 	case DRM_FORMAT_XBGR8888:
5543 	case DRM_FORMAT_RGBX8888:
5544 	case DRM_FORMAT_BGRX8888:
5545 		*depth = 24;
5546 		*bpp = 32;
5547 		break;
5548 	case DRM_FORMAT_XRGB2101010:
5549 	case DRM_FORMAT_XBGR2101010:
5550 	case DRM_FORMAT_RGBX1010102:
5551 	case DRM_FORMAT_BGRX1010102:
5552 	case DRM_FORMAT_ARGB2101010:
5553 	case DRM_FORMAT_ABGR2101010:
5554 	case DRM_FORMAT_RGBA1010102:
5555 	case DRM_FORMAT_BGRA1010102:
5556 		*depth = 30;
5557 		*bpp = 32;
5558 		break;
5559 	case DRM_FORMAT_ARGB8888:
5560 	case DRM_FORMAT_ABGR8888:
5561 	case DRM_FORMAT_RGBA8888:
5562 	case DRM_FORMAT_BGRA8888:
5563 		*depth = 32;
5564 		*bpp = 32;
5565 		break;
5566 	default:
5567 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5568 			      drm_get_format_name(format));
5569 		*depth = 0;
5570 		*bpp = 0;
5571 		break;
5572 	}
5573 }
5574 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5575 
5576 /**
5577  * drm_format_num_planes - get the number of planes for format
5578  * @format: pixel format (DRM_FORMAT_*)
5579  *
5580  * Returns:
5581  * The number of planes used by the specified pixel format.
5582  */
5583 int drm_format_num_planes(uint32_t format)
5584 {
5585 	switch (format) {
5586 	case DRM_FORMAT_YUV410:
5587 	case DRM_FORMAT_YVU410:
5588 	case DRM_FORMAT_YUV411:
5589 	case DRM_FORMAT_YVU411:
5590 	case DRM_FORMAT_YUV420:
5591 	case DRM_FORMAT_YVU420:
5592 	case DRM_FORMAT_YUV422:
5593 	case DRM_FORMAT_YVU422:
5594 	case DRM_FORMAT_YUV444:
5595 	case DRM_FORMAT_YVU444:
5596 		return 3;
5597 	case DRM_FORMAT_NV12:
5598 	case DRM_FORMAT_NV21:
5599 	case DRM_FORMAT_NV16:
5600 	case DRM_FORMAT_NV61:
5601 	case DRM_FORMAT_NV24:
5602 	case DRM_FORMAT_NV42:
5603 		return 2;
5604 	default:
5605 		return 1;
5606 	}
5607 }
5608 EXPORT_SYMBOL(drm_format_num_planes);
5609 
5610 /**
5611  * drm_format_plane_cpp - determine the bytes per pixel value
5612  * @format: pixel format (DRM_FORMAT_*)
5613  * @plane: plane index
5614  *
5615  * Returns:
5616  * The bytes per pixel value for the specified plane.
5617  */
5618 int drm_format_plane_cpp(uint32_t format, int plane)
5619 {
5620 	unsigned int depth;
5621 	int bpp;
5622 
5623 	if (plane >= drm_format_num_planes(format))
5624 		return 0;
5625 
5626 	switch (format) {
5627 	case DRM_FORMAT_YUYV:
5628 	case DRM_FORMAT_YVYU:
5629 	case DRM_FORMAT_UYVY:
5630 	case DRM_FORMAT_VYUY:
5631 		return 2;
5632 	case DRM_FORMAT_NV12:
5633 	case DRM_FORMAT_NV21:
5634 	case DRM_FORMAT_NV16:
5635 	case DRM_FORMAT_NV61:
5636 	case DRM_FORMAT_NV24:
5637 	case DRM_FORMAT_NV42:
5638 		return plane ? 2 : 1;
5639 	case DRM_FORMAT_YUV410:
5640 	case DRM_FORMAT_YVU410:
5641 	case DRM_FORMAT_YUV411:
5642 	case DRM_FORMAT_YVU411:
5643 	case DRM_FORMAT_YUV420:
5644 	case DRM_FORMAT_YVU420:
5645 	case DRM_FORMAT_YUV422:
5646 	case DRM_FORMAT_YVU422:
5647 	case DRM_FORMAT_YUV444:
5648 	case DRM_FORMAT_YVU444:
5649 		return 1;
5650 	default:
5651 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5652 		return bpp >> 3;
5653 	}
5654 }
5655 EXPORT_SYMBOL(drm_format_plane_cpp);
5656 
5657 /**
5658  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5659  * @format: pixel format (DRM_FORMAT_*)
5660  *
5661  * Returns:
5662  * The horizontal chroma subsampling factor for the
5663  * specified pixel format.
5664  */
5665 int drm_format_horz_chroma_subsampling(uint32_t format)
5666 {
5667 	switch (format) {
5668 	case DRM_FORMAT_YUV411:
5669 	case DRM_FORMAT_YVU411:
5670 	case DRM_FORMAT_YUV410:
5671 	case DRM_FORMAT_YVU410:
5672 		return 4;
5673 	case DRM_FORMAT_YUYV:
5674 	case DRM_FORMAT_YVYU:
5675 	case DRM_FORMAT_UYVY:
5676 	case DRM_FORMAT_VYUY:
5677 	case DRM_FORMAT_NV12:
5678 	case DRM_FORMAT_NV21:
5679 	case DRM_FORMAT_NV16:
5680 	case DRM_FORMAT_NV61:
5681 	case DRM_FORMAT_YUV422:
5682 	case DRM_FORMAT_YVU422:
5683 	case DRM_FORMAT_YUV420:
5684 	case DRM_FORMAT_YVU420:
5685 		return 2;
5686 	default:
5687 		return 1;
5688 	}
5689 }
5690 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5691 
5692 /**
5693  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5694  * @format: pixel format (DRM_FORMAT_*)
5695  *
5696  * Returns:
5697  * The vertical chroma subsampling factor for the
5698  * specified pixel format.
5699  */
5700 int drm_format_vert_chroma_subsampling(uint32_t format)
5701 {
5702 	switch (format) {
5703 	case DRM_FORMAT_YUV410:
5704 	case DRM_FORMAT_YVU410:
5705 		return 4;
5706 	case DRM_FORMAT_YUV420:
5707 	case DRM_FORMAT_YVU420:
5708 	case DRM_FORMAT_NV12:
5709 	case DRM_FORMAT_NV21:
5710 		return 2;
5711 	default:
5712 		return 1;
5713 	}
5714 }
5715 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5716 
5717 /**
5718  * drm_rotation_simplify() - Try to simplify the rotation
5719  * @rotation: Rotation to be simplified
5720  * @supported_rotations: Supported rotations
5721  *
5722  * Attempt to simplify the rotation to a form that is supported.
5723  * Eg. if the hardware supports everything except DRM_REFLECT_X
5724  * one could call this function like this:
5725  *
5726  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5727  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5728  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5729  *
5730  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5731  * transforms the hardware supports, this function may not
5732  * be able to produce a supported transform, so the caller should
5733  * check the result afterwards.
5734  */
5735 unsigned int drm_rotation_simplify(unsigned int rotation,
5736 				   unsigned int supported_rotations)
5737 {
5738 	if (rotation & ~supported_rotations) {
5739 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5740 		rotation = (rotation & DRM_REFLECT_MASK) |
5741 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
5742 	}
5743 
5744 	return rotation;
5745 }
5746 EXPORT_SYMBOL(drm_rotation_simplify);
5747 
5748 /**
5749  * drm_mode_config_init - initialize DRM mode_configuration structure
5750  * @dev: DRM device
5751  *
5752  * Initialize @dev's mode_config structure, used for tracking the graphics
5753  * configuration of @dev.
5754  *
5755  * Since this initializes the modeset locks, no locking is possible. Which is no
5756  * problem, since this should happen single threaded at init time. It is the
5757  * driver's problem to ensure this guarantee.
5758  *
5759  */
5760 void drm_mode_config_init(struct drm_device *dev)
5761 {
5762 	mutex_init(&dev->mode_config.mutex);
5763 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5764 	mutex_init(&dev->mode_config.idr_mutex);
5765 	mutex_init(&dev->mode_config.fb_lock);
5766 	mutex_init(&dev->mode_config.blob_lock);
5767 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5768 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5769 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5770 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5771 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5772 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5773 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5774 	idr_init(&dev->mode_config.crtc_idr);
5775 	idr_init(&dev->mode_config.tile_idr);
5776 
5777 	drm_modeset_lock_all(dev);
5778 	drm_mode_create_standard_properties(dev);
5779 	drm_modeset_unlock_all(dev);
5780 
5781 	/* Just to be sure */
5782 	dev->mode_config.num_fb = 0;
5783 	dev->mode_config.num_connector = 0;
5784 	dev->mode_config.num_crtc = 0;
5785 	dev->mode_config.num_encoder = 0;
5786 	dev->mode_config.num_overlay_plane = 0;
5787 	dev->mode_config.num_total_plane = 0;
5788 }
5789 EXPORT_SYMBOL(drm_mode_config_init);
5790 
5791 /**
5792  * drm_mode_config_cleanup - free up DRM mode_config info
5793  * @dev: DRM device
5794  *
5795  * Free up all the connectors and CRTCs associated with this DRM device, then
5796  * free up the framebuffers and associated buffer objects.
5797  *
5798  * Note that since this /should/ happen single-threaded at driver/device
5799  * teardown time, no locking is required. It's the driver's job to ensure that
5800  * this guarantee actually holds true.
5801  *
5802  * FIXME: cleanup any dangling user buffer objects too
5803  */
5804 void drm_mode_config_cleanup(struct drm_device *dev)
5805 {
5806 	struct drm_connector *connector, *ot;
5807 	struct drm_crtc *crtc, *ct;
5808 	struct drm_encoder *encoder, *enct;
5809 	struct drm_framebuffer *fb, *fbt;
5810 	struct drm_property *property, *pt;
5811 	struct drm_property_blob *blob, *bt;
5812 	struct drm_plane *plane, *plt;
5813 
5814 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5815 				 head) {
5816 		encoder->funcs->destroy(encoder);
5817 	}
5818 
5819 	list_for_each_entry_safe(connector, ot,
5820 				 &dev->mode_config.connector_list, head) {
5821 		connector->funcs->destroy(connector);
5822 	}
5823 
5824 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5825 				 head) {
5826 		drm_property_destroy(dev, property);
5827 	}
5828 
5829 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5830 				 head_global) {
5831 		drm_property_unreference_blob(blob);
5832 	}
5833 
5834 	/*
5835 	 * Single-threaded teardown context, so it's not required to grab the
5836 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5837 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5838 	 *
5839 	 * Also, if there are any framebuffers left, that's a driver leak now,
5840 	 * so politely WARN about this.
5841 	 */
5842 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5843 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5844 		drm_framebuffer_free(&fb->refcount);
5845 	}
5846 
5847 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5848 				 head) {
5849 		plane->funcs->destroy(plane);
5850 	}
5851 
5852 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5853 		crtc->funcs->destroy(crtc);
5854 	}
5855 
5856 	idr_destroy(&dev->mode_config.tile_idr);
5857 	idr_destroy(&dev->mode_config.crtc_idr);
5858 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5859 }
5860 EXPORT_SYMBOL(drm_mode_config_cleanup);
5861 
5862 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5863 						       unsigned int supported_rotations)
5864 {
5865 	static const struct drm_prop_enum_list props[] = {
5866 		{ DRM_ROTATE_0,   "rotate-0" },
5867 		{ DRM_ROTATE_90,  "rotate-90" },
5868 		{ DRM_ROTATE_180, "rotate-180" },
5869 		{ DRM_ROTATE_270, "rotate-270" },
5870 		{ DRM_REFLECT_X,  "reflect-x" },
5871 		{ DRM_REFLECT_Y,  "reflect-y" },
5872 	};
5873 
5874 	return drm_property_create_bitmask(dev, 0, "rotation",
5875 					   props, ARRAY_SIZE(props),
5876 					   supported_rotations);
5877 }
5878 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5879 
5880 /**
5881  * DOC: Tile group
5882  *
5883  * Tile groups are used to represent tiled monitors with a unique
5884  * integer identifier. Tiled monitors using DisplayID v1.3 have
5885  * a unique 8-byte handle, we store this in a tile group, so we
5886  * have a common identifier for all tiles in a monitor group.
5887  */
5888 static void drm_tile_group_free(struct kref *kref)
5889 {
5890 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5891 	struct drm_device *dev = tg->dev;
5892 	mutex_lock(&dev->mode_config.idr_mutex);
5893 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5894 	mutex_unlock(&dev->mode_config.idr_mutex);
5895 	kfree(tg);
5896 }
5897 
5898 /**
5899  * drm_mode_put_tile_group - drop a reference to a tile group.
5900  * @dev: DRM device
5901  * @tg: tile group to drop reference to.
5902  *
5903  * drop reference to tile group and free if 0.
5904  */
5905 void drm_mode_put_tile_group(struct drm_device *dev,
5906 			     struct drm_tile_group *tg)
5907 {
5908 	kref_put(&tg->refcount, drm_tile_group_free);
5909 }
5910 
5911 /**
5912  * drm_mode_get_tile_group - get a reference to an existing tile group
5913  * @dev: DRM device
5914  * @topology: 8-bytes unique per monitor.
5915  *
5916  * Use the unique bytes to get a reference to an existing tile group.
5917  *
5918  * RETURNS:
5919  * tile group or NULL if not found.
5920  */
5921 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5922 					       char topology[8])
5923 {
5924 	struct drm_tile_group *tg;
5925 	int id;
5926 	mutex_lock(&dev->mode_config.idr_mutex);
5927 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5928 		if (!memcmp(tg->group_data, topology, 8)) {
5929 			if (!kref_get_unless_zero(&tg->refcount))
5930 				tg = NULL;
5931 			mutex_unlock(&dev->mode_config.idr_mutex);
5932 			return tg;
5933 		}
5934 	}
5935 	mutex_unlock(&dev->mode_config.idr_mutex);
5936 	return NULL;
5937 }
5938 EXPORT_SYMBOL(drm_mode_get_tile_group);
5939 
5940 /**
5941  * drm_mode_create_tile_group - create a tile group from a displayid description
5942  * @dev: DRM device
5943  * @topology: 8-bytes unique per monitor.
5944  *
5945  * Create a tile group for the unique monitor, and get a unique
5946  * identifier for the tile group.
5947  *
5948  * RETURNS:
5949  * new tile group or error.
5950  */
5951 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5952 						  char topology[8])
5953 {
5954 	struct drm_tile_group *tg;
5955 	int ret;
5956 
5957 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5958 	if (!tg)
5959 		return ERR_PTR(-ENOMEM);
5960 
5961 	kref_init(&tg->refcount);
5962 	memcpy(tg->group_data, topology, 8);
5963 	tg->dev = dev;
5964 
5965 	mutex_lock(&dev->mode_config.idr_mutex);
5966 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5967 	if (ret >= 0) {
5968 		tg->id = ret;
5969 	} else {
5970 		kfree(tg);
5971 		tg = ERR_PTR(ret);
5972 	}
5973 
5974 	mutex_unlock(&dev->mode_config.idr_mutex);
5975 	return tg;
5976 }
5977 EXPORT_SYMBOL(drm_mode_create_tile_group);
5978