Home | History | Annotate | Line # | Download | only in drm
drm_crtc.c revision 1.1.1.3
      1 /*	$NetBSD: drm_crtc.c,v 1.1.1.3 2018/08/27 01:34:41 riastradh Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2006-2008 Intel Corporation
      5  * Copyright (c) 2007 Dave Airlie <airlied (at) linux.ie>
      6  * Copyright (c) 2008 Red Hat Inc.
      7  *
      8  * DRM core CRTC related functions
      9  *
     10  * Permission to use, copy, modify, distribute, and sell this software and its
     11  * documentation for any purpose is hereby granted without fee, provided that
     12  * the above copyright notice appear in all copies and that both that copyright
     13  * notice and this permission notice appear in supporting documentation, and
     14  * that the name of the copyright holders not be used in advertising or
     15  * publicity pertaining to distribution of the software without specific,
     16  * written prior permission.  The copyright holders make no representations
     17  * about the suitability of this software for any purpose.  It is provided "as
     18  * is" without express or implied warranty.
     19  *
     20  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
     21  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
     22  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
     23  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
     24  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
     25  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
     26  * OF THIS SOFTWARE.
     27  *
     28  * Authors:
     29  *      Keith Packard
     30  *	Eric Anholt <eric (at) anholt.net>
     31  *      Dave Airlie <airlied (at) linux.ie>
     32  *      Jesse Barnes <jesse.barnes (at) intel.com>
     33  */
     34 #include <sys/cdefs.h>
     35 __KERNEL_RCSID(0, "$NetBSD: drm_crtc.c,v 1.1.1.3 2018/08/27 01:34:41 riastradh Exp $");
     36 
     37 #include <linux/ctype.h>
     38 #include <linux/list.h>
     39 #include <linux/slab.h>
     40 #include <linux/export.h>
     41 #include <drm/drmP.h>
     42 #include <drm/drm_crtc.h>
     43 #include <drm/drm_edid.h>
     44 #include <drm/drm_fourcc.h>
     45 #include <drm/drm_modeset_lock.h>
     46 #include <drm/drm_atomic.h>
     47 
     48 #include "drm_crtc_internal.h"
     49 #include "drm_internal.h"
     50 
     51 static struct drm_framebuffer *
     52 internal_framebuffer_create(struct drm_device *dev,
     53 			    struct drm_mode_fb_cmd2 *r,
     54 			    struct drm_file *file_priv);
     55 
     56 /* Avoid boilerplate.  I'm tired of typing. */
     57 #define DRM_ENUM_NAME_FN(fnname, list)				\
     58 	const char *fnname(int val)				\
     59 	{							\
     60 		int i;						\
     61 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
     62 			if (list[i].type == val)		\
     63 				return list[i].name;		\
     64 		}						\
     65 		return "(unknown)";				\
     66 	}
     67 
     68 /*
     69  * Global properties
     70  */
     71 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
     72 	{ DRM_MODE_DPMS_ON, "On" },
     73 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
     74 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
     75 	{ DRM_MODE_DPMS_OFF, "Off" }
     76 };
     77 
     78 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
     79 
     80 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
     81 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
     82 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
     83 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
     84 };
     85 
     86 /*
     87  * Optional properties
     88  */
     89 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
     90 	{ DRM_MODE_SCALE_NONE, "None" },
     91 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
     92 	{ DRM_MODE_SCALE_CENTER, "Center" },
     93 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
     94 };
     95 
     96 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
     97 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
     98 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
     99 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
    100 };
    101 
    102 /*
    103  * Non-global properties, but "required" for certain connectors.
    104  */
    105 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
    106 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
    107 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
    108 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
    109 };
    110 
    111 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
    112 
    113 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
    114 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
    115 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
    116 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
    117 };
    118 
    119 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
    120 		 drm_dvi_i_subconnector_enum_list)
    121 
    122 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
    123 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
    124 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
    125 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
    126 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
    127 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
    128 };
    129 
    130 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
    131 
    132 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
    133 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
    134 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
    135 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
    136 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
    137 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
    138 };
    139 
    140 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
    141 		 drm_tv_subconnector_enum_list)
    142 
    143 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
    144 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
    145 	{ DRM_MODE_DIRTY_ON,       "On"       },
    146 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
    147 };
    148 
    149 struct drm_conn_prop_enum_list {
    150 	int type;
    151 	const char *name;
    152 	struct ida ida;
    153 };
    154 
    155 /*
    156  * Connector and encoder types.
    157  */
    158 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
    159 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
    160 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
    161 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
    162 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
    163 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
    164 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
    165 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
    166 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
    167 	{ DRM_MODE_CONNECTOR_Component, "Component" },
    168 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
    169 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
    170 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
    171 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
    172 	{ DRM_MODE_CONNECTOR_TV, "TV" },
    173 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
    174 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
    175 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
    176 };
    177 
    178 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
    179 	{ DRM_MODE_ENCODER_NONE, "None" },
    180 	{ DRM_MODE_ENCODER_DAC, "DAC" },
    181 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
    182 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
    183 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
    184 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
    185 	{ DRM_MODE_ENCODER_DSI, "DSI" },
    186 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
    187 };
    188 
    189 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
    190 	{ SubPixelUnknown, "Unknown" },
    191 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
    192 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
    193 	{ SubPixelVerticalRGB, "Vertical RGB" },
    194 	{ SubPixelVerticalBGR, "Vertical BGR" },
    195 	{ SubPixelNone, "None" },
    196 };
    197 
    198 void drm_connector_ida_init(void)
    199 {
    200 	int i;
    201 
    202 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
    203 		ida_init(&drm_connector_enum_list[i].ida);
    204 }
    205 
    206 void drm_connector_ida_destroy(void)
    207 {
    208 	int i;
    209 
    210 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
    211 		ida_destroy(&drm_connector_enum_list[i].ida);
    212 }
    213 
    214 /**
    215  * drm_get_connector_status_name - return a string for connector status
    216  * @status: connector status to compute name of
    217  *
    218  * In contrast to the other drm_get_*_name functions this one here returns a
    219  * const pointer and hence is threadsafe.
    220  */
    221 const char *drm_get_connector_status_name(enum drm_connector_status status)
    222 {
    223 	if (status == connector_status_connected)
    224 		return "connected";
    225 	else if (status == connector_status_disconnected)
    226 		return "disconnected";
    227 	else
    228 		return "unknown";
    229 }
    230 EXPORT_SYMBOL(drm_get_connector_status_name);
    231 
    232 /**
    233  * drm_get_subpixel_order_name - return a string for a given subpixel enum
    234  * @order: enum of subpixel_order
    235  *
    236  * Note you could abuse this and return something out of bounds, but that
    237  * would be a caller error.  No unscrubbed user data should make it here.
    238  */
    239 const char *drm_get_subpixel_order_name(enum subpixel_order order)
    240 {
    241 	return drm_subpixel_enum_list[order].name;
    242 }
    243 EXPORT_SYMBOL(drm_get_subpixel_order_name);
    244 
    245 static char printable_char(int c)
    246 {
    247 	return isascii(c) && isprint(c) ? c : '?';
    248 }
    249 
    250 /**
    251  * drm_get_format_name - return a string for drm fourcc format
    252  * @format: format to compute name of
    253  *
    254  * Note that the buffer used by this function is globally shared and owned by
    255  * the function itself.
    256  *
    257  * FIXME: This isn't really multithreading safe.
    258  */
    259 const char *drm_get_format_name(uint32_t format)
    260 {
    261 	static char buf[32];
    262 
    263 	snprintf(buf, sizeof(buf),
    264 		 "%c%c%c%c %s-endian (0x%08x)",
    265 		 printable_char(format & 0xff),
    266 		 printable_char((format >> 8) & 0xff),
    267 		 printable_char((format >> 16) & 0xff),
    268 		 printable_char((format >> 24) & 0x7f),
    269 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
    270 		 format);
    271 
    272 	return buf;
    273 }
    274 EXPORT_SYMBOL(drm_get_format_name);
    275 
    276 /*
    277  * Internal function to assign a slot in the object idr and optionally
    278  * register the object into the idr.
    279  */
    280 static int drm_mode_object_get_reg(struct drm_device *dev,
    281 				   struct drm_mode_object *obj,
    282 				   uint32_t obj_type,
    283 				   bool register_obj)
    284 {
    285 	int ret;
    286 
    287 	mutex_lock(&dev->mode_config.idr_mutex);
    288 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
    289 	if (ret >= 0) {
    290 		/*
    291 		 * Set up the object linking under the protection of the idr
    292 		 * lock so that other users can't see inconsistent state.
    293 		 */
    294 		obj->id = ret;
    295 		obj->type = obj_type;
    296 	}
    297 	mutex_unlock(&dev->mode_config.idr_mutex);
    298 
    299 	return ret < 0 ? ret : 0;
    300 }
    301 
    302 /**
    303  * drm_mode_object_get - allocate a new modeset identifier
    304  * @dev: DRM device
    305  * @obj: object pointer, used to generate unique ID
    306  * @obj_type: object type
    307  *
    308  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
    309  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
    310  * modeset identifiers are _not_ reference counted. Hence don't use this for
    311  * reference counted modeset objects like framebuffers.
    312  *
    313  * Returns:
    314  * Zero on success, error code on failure.
    315  */
    316 int drm_mode_object_get(struct drm_device *dev,
    317 			struct drm_mode_object *obj, uint32_t obj_type)
    318 {
    319 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
    320 }
    321 
    322 static void drm_mode_object_register(struct drm_device *dev,
    323 				     struct drm_mode_object *obj)
    324 {
    325 	mutex_lock(&dev->mode_config.idr_mutex);
    326 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
    327 	mutex_unlock(&dev->mode_config.idr_mutex);
    328 }
    329 
    330 /**
    331  * drm_mode_object_put - free a modeset identifer
    332  * @dev: DRM device
    333  * @object: object to free
    334  *
    335  * Free @id from @dev's unique identifier pool. Note that despite the _get
    336  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
    337  * for reference counted modeset objects like framebuffers.
    338  */
    339 void drm_mode_object_put(struct drm_device *dev,
    340 			 struct drm_mode_object *object)
    341 {
    342 	mutex_lock(&dev->mode_config.idr_mutex);
    343 	idr_remove(&dev->mode_config.crtc_idr, object->id);
    344 	mutex_unlock(&dev->mode_config.idr_mutex);
    345 }
    346 
    347 static struct drm_mode_object *_object_find(struct drm_device *dev,
    348 		uint32_t id, uint32_t type)
    349 {
    350 	struct drm_mode_object *obj = NULL;
    351 
    352 	mutex_lock(&dev->mode_config.idr_mutex);
    353 	obj = idr_find(&dev->mode_config.crtc_idr, id);
    354 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
    355 		obj = NULL;
    356 	if (obj && obj->id != id)
    357 		obj = NULL;
    358 	/* don't leak out unref'd fb's */
    359 	if (obj &&
    360 	    (obj->type == DRM_MODE_OBJECT_FB ||
    361 	     obj->type == DRM_MODE_OBJECT_BLOB))
    362 		obj = NULL;
    363 	mutex_unlock(&dev->mode_config.idr_mutex);
    364 
    365 	return obj;
    366 }
    367 
    368 /**
    369  * drm_mode_object_find - look up a drm object with static lifetime
    370  * @dev: drm device
    371  * @id: id of the mode object
    372  * @type: type of the mode object
    373  *
    374  * Note that framebuffers cannot be looked up with this functions - since those
    375  * are reference counted, they need special treatment.  Even with
    376  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
    377  * rather than WARN_ON()).
    378  */
    379 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
    380 		uint32_t id, uint32_t type)
    381 {
    382 	struct drm_mode_object *obj = NULL;
    383 
    384 	/* Framebuffers are reference counted and need their own lookup
    385 	 * function.*/
    386 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
    387 	obj = _object_find(dev, id, type);
    388 	return obj;
    389 }
    390 EXPORT_SYMBOL(drm_mode_object_find);
    391 
    392 /**
    393  * drm_framebuffer_init - initialize a framebuffer
    394  * @dev: DRM device
    395  * @fb: framebuffer to be initialized
    396  * @funcs: ... with these functions
    397  *
    398  * Allocates an ID for the framebuffer's parent mode object, sets its mode
    399  * functions & device file and adds it to the master fd list.
    400  *
    401  * IMPORTANT:
    402  * This functions publishes the fb and makes it available for concurrent access
    403  * by other users. Which means by this point the fb _must_ be fully set up -
    404  * since all the fb attributes are invariant over its lifetime, no further
    405  * locking but only correct reference counting is required.
    406  *
    407  * Returns:
    408  * Zero on success, error code on failure.
    409  */
    410 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
    411 			 const struct drm_framebuffer_funcs *funcs)
    412 {
    413 	int ret;
    414 
    415 	mutex_lock(&dev->mode_config.fb_lock);
    416 	kref_init(&fb->refcount);
    417 	INIT_LIST_HEAD(&fb->filp_head);
    418 	fb->dev = dev;
    419 	fb->funcs = funcs;
    420 
    421 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
    422 	if (ret)
    423 		goto out;
    424 
    425 	dev->mode_config.num_fb++;
    426 	list_add(&fb->head, &dev->mode_config.fb_list);
    427 out:
    428 	mutex_unlock(&dev->mode_config.fb_lock);
    429 
    430 	return ret;
    431 }
    432 EXPORT_SYMBOL(drm_framebuffer_init);
    433 
    434 /* dev->mode_config.fb_lock must be held! */
    435 static void __drm_framebuffer_unregister(struct drm_device *dev,
    436 					 struct drm_framebuffer *fb)
    437 {
    438 	mutex_lock(&dev->mode_config.idr_mutex);
    439 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
    440 	mutex_unlock(&dev->mode_config.idr_mutex);
    441 
    442 	fb->base.id = 0;
    443 }
    444 
    445 static void drm_framebuffer_free(struct kref *kref)
    446 {
    447 	struct drm_framebuffer *fb =
    448 			container_of(kref, struct drm_framebuffer, refcount);
    449 	struct drm_device *dev = fb->dev;
    450 
    451 	/*
    452 	 * The lookup idr holds a weak reference, which has not necessarily been
    453 	 * removed at this point. Check for that.
    454 	 */
    455 	mutex_lock(&dev->mode_config.fb_lock);
    456 	if (fb->base.id) {
    457 		/* Mark fb as reaped and drop idr ref. */
    458 		__drm_framebuffer_unregister(dev, fb);
    459 	}
    460 	mutex_unlock(&dev->mode_config.fb_lock);
    461 
    462 	fb->funcs->destroy(fb);
    463 }
    464 
    465 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
    466 							uint32_t id)
    467 {
    468 	struct drm_mode_object *obj = NULL;
    469 	struct drm_framebuffer *fb;
    470 
    471 	mutex_lock(&dev->mode_config.idr_mutex);
    472 	obj = idr_find(&dev->mode_config.crtc_idr, id);
    473 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
    474 		fb = NULL;
    475 	else
    476 		fb = obj_to_fb(obj);
    477 	mutex_unlock(&dev->mode_config.idr_mutex);
    478 
    479 	return fb;
    480 }
    481 
    482 /**
    483  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
    484  * @dev: drm device
    485  * @id: id of the fb object
    486  *
    487  * If successful, this grabs an additional reference to the framebuffer -
    488  * callers need to make sure to eventually unreference the returned framebuffer
    489  * again, using @drm_framebuffer_unreference.
    490  */
    491 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
    492 					       uint32_t id)
    493 {
    494 	struct drm_framebuffer *fb;
    495 
    496 	mutex_lock(&dev->mode_config.fb_lock);
    497 	fb = __drm_framebuffer_lookup(dev, id);
    498 	if (fb) {
    499 		if (!kref_get_unless_zero(&fb->refcount))
    500 			fb = NULL;
    501 	}
    502 	mutex_unlock(&dev->mode_config.fb_lock);
    503 
    504 	return fb;
    505 }
    506 EXPORT_SYMBOL(drm_framebuffer_lookup);
    507 
    508 /**
    509  * drm_framebuffer_unreference - unref a framebuffer
    510  * @fb: framebuffer to unref
    511  *
    512  * This functions decrements the fb's refcount and frees it if it drops to zero.
    513  */
    514 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
    515 {
    516 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
    517 	kref_put(&fb->refcount, drm_framebuffer_free);
    518 }
    519 EXPORT_SYMBOL(drm_framebuffer_unreference);
    520 
    521 /**
    522  * drm_framebuffer_reference - incr the fb refcnt
    523  * @fb: framebuffer
    524  *
    525  * This functions increments the fb's refcount.
    526  */
    527 void drm_framebuffer_reference(struct drm_framebuffer *fb)
    528 {
    529 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
    530 	kref_get(&fb->refcount);
    531 }
    532 EXPORT_SYMBOL(drm_framebuffer_reference);
    533 
    534 /**
    535  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
    536  * @fb: fb to unregister
    537  *
    538  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
    539  * those used for fbdev. Note that the caller must hold a reference of it's own,
    540  * i.e. the object may not be destroyed through this call (since it'll lead to a
    541  * locking inversion).
    542  */
    543 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
    544 {
    545 	struct drm_device *dev;
    546 
    547 	if (!fb)
    548 		return;
    549 
    550 	dev = fb->dev;
    551 
    552 	mutex_lock(&dev->mode_config.fb_lock);
    553 	/* Mark fb as reaped and drop idr ref. */
    554 	__drm_framebuffer_unregister(dev, fb);
    555 	mutex_unlock(&dev->mode_config.fb_lock);
    556 }
    557 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
    558 
    559 /**
    560  * drm_framebuffer_cleanup - remove a framebuffer object
    561  * @fb: framebuffer to remove
    562  *
    563  * Cleanup framebuffer. This function is intended to be used from the drivers
    564  * ->destroy callback. It can also be used to clean up driver private
    565  *  framebuffers embedded into a larger structure.
    566  *
    567  * Note that this function does not remove the fb from active usuage - if it is
    568  * still used anywhere, hilarity can ensue since userspace could call getfb on
    569  * the id and get back -EINVAL. Obviously no concern at driver unload time.
    570  *
    571  * Also, the framebuffer will not be removed from the lookup idr - for
    572  * user-created framebuffers this will happen in in the rmfb ioctl. For
    573  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
    574  * drm_framebuffer_unregister_private.
    575  */
    576 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
    577 {
    578 	struct drm_device *dev = fb->dev;
    579 
    580 	mutex_lock(&dev->mode_config.fb_lock);
    581 	list_del(&fb->head);
    582 	dev->mode_config.num_fb--;
    583 	mutex_unlock(&dev->mode_config.fb_lock);
    584 }
    585 EXPORT_SYMBOL(drm_framebuffer_cleanup);
    586 
    587 /**
    588  * drm_framebuffer_remove - remove and unreference a framebuffer object
    589  * @fb: framebuffer to remove
    590  *
    591  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
    592  * using @fb, removes it, setting it to NULL. Then drops the reference to the
    593  * passed-in framebuffer. Might take the modeset locks.
    594  *
    595  * Note that this function optimizes the cleanup away if the caller holds the
    596  * last reference to the framebuffer. It is also guaranteed to not take the
    597  * modeset locks in this case.
    598  */
    599 void drm_framebuffer_remove(struct drm_framebuffer *fb)
    600 {
    601 	struct drm_device *dev;
    602 	struct drm_crtc *crtc;
    603 	struct drm_plane *plane;
    604 	struct drm_mode_set set;
    605 	int ret;
    606 
    607 	if (!fb)
    608 		return;
    609 
    610 	dev = fb->dev;
    611 
    612 	WARN_ON(!list_empty(&fb->filp_head));
    613 
    614 	/*
    615 	 * drm ABI mandates that we remove any deleted framebuffers from active
    616 	 * useage. But since most sane clients only remove framebuffers they no
    617 	 * longer need, try to optimize this away.
    618 	 *
    619 	 * Since we're holding a reference ourselves, observing a refcount of 1
    620 	 * means that we're the last holder and can skip it. Also, the refcount
    621 	 * can never increase from 1 again, so we don't need any barriers or
    622 	 * locks.
    623 	 *
    624 	 * Note that userspace could try to race with use and instate a new
    625 	 * usage _after_ we've cleared all current ones. End result will be an
    626 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
    627 	 * in this manner.
    628 	 */
    629 	if (atomic_read(&fb->refcount.refcount) > 1) {
    630 		drm_modeset_lock_all(dev);
    631 		/* remove from any CRTC */
    632 		drm_for_each_crtc(crtc, dev) {
    633 			if (crtc->primary->fb == fb) {
    634 				/* should turn off the crtc */
    635 				memset(&set, 0, sizeof(struct drm_mode_set));
    636 				set.crtc = crtc;
    637 				set.fb = NULL;
    638 				ret = drm_mode_set_config_internal(&set);
    639 				if (ret)
    640 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
    641 			}
    642 		}
    643 
    644 		drm_for_each_plane(plane, dev) {
    645 			if (plane->fb == fb)
    646 				drm_plane_force_disable(plane);
    647 		}
    648 		drm_modeset_unlock_all(dev);
    649 	}
    650 
    651 	drm_framebuffer_unreference(fb);
    652 }
    653 EXPORT_SYMBOL(drm_framebuffer_remove);
    654 
    655 DEFINE_WW_CLASS(crtc_ww_class);
    656 
    657 /**
    658  * drm_crtc_init_with_planes - Initialise a new CRTC object with
    659  *    specified primary and cursor planes.
    660  * @dev: DRM device
    661  * @crtc: CRTC object to init
    662  * @primary: Primary plane for CRTC
    663  * @cursor: Cursor plane for CRTC
    664  * @funcs: callbacks for the new CRTC
    665  *
    666  * Inits a new object created as base part of a driver crtc object.
    667  *
    668  * Returns:
    669  * Zero on success, error code on failure.
    670  */
    671 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
    672 			      struct drm_plane *primary,
    673 			      struct drm_plane *cursor,
    674 			      const struct drm_crtc_funcs *funcs)
    675 {
    676 	struct drm_mode_config *config = &dev->mode_config;
    677 	int ret;
    678 
    679 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
    680 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
    681 
    682 	crtc->dev = dev;
    683 	crtc->funcs = funcs;
    684 
    685 	drm_modeset_lock_init(&crtc->mutex);
    686 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
    687 	if (ret)
    688 		return ret;
    689 
    690 	crtc->base.properties = &crtc->properties;
    691 
    692 	list_add_tail(&crtc->head, &config->crtc_list);
    693 	config->num_crtc++;
    694 
    695 	crtc->primary = primary;
    696 	crtc->cursor = cursor;
    697 	if (primary)
    698 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
    699 	if (cursor)
    700 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
    701 
    702 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
    703 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
    704 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
    705 	}
    706 
    707 	return 0;
    708 }
    709 EXPORT_SYMBOL(drm_crtc_init_with_planes);
    710 
    711 /**
    712  * drm_crtc_cleanup - Clean up the core crtc usage
    713  * @crtc: CRTC to cleanup
    714  *
    715  * This function cleans up @crtc and removes it from the DRM mode setting
    716  * core. Note that the function does *not* free the crtc structure itself,
    717  * this is the responsibility of the caller.
    718  */
    719 void drm_crtc_cleanup(struct drm_crtc *crtc)
    720 {
    721 	struct drm_device *dev = crtc->dev;
    722 
    723 	kfree(crtc->gamma_store);
    724 	crtc->gamma_store = NULL;
    725 
    726 	drm_modeset_lock_fini(&crtc->mutex);
    727 
    728 	drm_mode_object_put(dev, &crtc->base);
    729 	list_del(&crtc->head);
    730 	dev->mode_config.num_crtc--;
    731 
    732 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
    733 	if (crtc->state && crtc->funcs->atomic_destroy_state)
    734 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
    735 
    736 	memset(crtc, 0, sizeof(*crtc));
    737 }
    738 EXPORT_SYMBOL(drm_crtc_cleanup);
    739 
    740 /**
    741  * drm_crtc_index - find the index of a registered CRTC
    742  * @crtc: CRTC to find index for
    743  *
    744  * Given a registered CRTC, return the index of that CRTC within a DRM
    745  * device's list of CRTCs.
    746  */
    747 unsigned int drm_crtc_index(struct drm_crtc *crtc)
    748 {
    749 	unsigned int index = 0;
    750 	struct drm_crtc *tmp;
    751 
    752 	drm_for_each_crtc(tmp, crtc->dev) {
    753 		if (tmp == crtc)
    754 			return index;
    755 
    756 		index++;
    757 	}
    758 
    759 	BUG();
    760 }
    761 EXPORT_SYMBOL(drm_crtc_index);
    762 
    763 /*
    764  * drm_mode_remove - remove and free a mode
    765  * @connector: connector list to modify
    766  * @mode: mode to remove
    767  *
    768  * Remove @mode from @connector's mode list, then free it.
    769  */
    770 static void drm_mode_remove(struct drm_connector *connector,
    771 			    struct drm_display_mode *mode)
    772 {
    773 	list_del(&mode->head);
    774 	drm_mode_destroy(connector->dev, mode);
    775 }
    776 
    777 /**
    778  * drm_display_info_set_bus_formats - set the supported bus formats
    779  * @info: display info to store bus formats in
    780  * @formats: array containing the supported bus formats
    781  * @num_formats: the number of entries in the fmts array
    782  *
    783  * Store the supported bus formats in display info structure.
    784  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
    785  * a full list of available formats.
    786  */
    787 int drm_display_info_set_bus_formats(struct drm_display_info *info,
    788 				     const u32 *formats,
    789 				     unsigned int num_formats)
    790 {
    791 	u32 *fmts = NULL;
    792 
    793 	if (!formats && num_formats)
    794 		return -EINVAL;
    795 
    796 	if (formats && num_formats) {
    797 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
    798 			       GFP_KERNEL);
    799 		if (!fmts)
    800 			return -ENOMEM;
    801 	}
    802 
    803 	kfree(info->bus_formats);
    804 	info->bus_formats = fmts;
    805 	info->num_bus_formats = num_formats;
    806 
    807 	return 0;
    808 }
    809 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
    810 
    811 /**
    812  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
    813  * @connector: connector to quwery
    814  *
    815  * The kernel supports per-connector configration of its consoles through
    816  * use of the video= parameter. This function parses that option and
    817  * extracts the user's specified mode (or enable/disable status) for a
    818  * particular connector. This is typically only used during the early fbdev
    819  * setup.
    820  */
    821 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
    822 {
    823 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
    824 	char *option = NULL;
    825 
    826 	if (fb_get_options(connector->name, &option))
    827 		return;
    828 
    829 	if (!drm_mode_parse_command_line_for_connector(option,
    830 						       connector,
    831 						       mode))
    832 		return;
    833 
    834 	if (mode->force) {
    835 		const char *s;
    836 
    837 		switch (mode->force) {
    838 		case DRM_FORCE_OFF:
    839 			s = "OFF";
    840 			break;
    841 		case DRM_FORCE_ON_DIGITAL:
    842 			s = "ON - dig";
    843 			break;
    844 		default:
    845 		case DRM_FORCE_ON:
    846 			s = "ON";
    847 			break;
    848 		}
    849 
    850 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
    851 		connector->force = mode->force;
    852 	}
    853 
    854 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
    855 		      connector->name,
    856 		      mode->xres, mode->yres,
    857 		      mode->refresh_specified ? mode->refresh : 60,
    858 		      mode->rb ? " reduced blanking" : "",
    859 		      mode->margins ? " with margins" : "",
    860 		      mode->interlace ?  " interlaced" : "");
    861 }
    862 
    863 /**
    864  * drm_connector_init - Init a preallocated connector
    865  * @dev: DRM device
    866  * @connector: the connector to init
    867  * @funcs: callbacks for this connector
    868  * @connector_type: user visible type of the connector
    869  *
    870  * Initialises a preallocated connector. Connectors should be
    871  * subclassed as part of driver connector objects.
    872  *
    873  * Returns:
    874  * Zero on success, error code on failure.
    875  */
    876 int drm_connector_init(struct drm_device *dev,
    877 		       struct drm_connector *connector,
    878 		       const struct drm_connector_funcs *funcs,
    879 		       int connector_type)
    880 {
    881 	struct drm_mode_config *config = &dev->mode_config;
    882 	int ret;
    883 	struct ida *connector_ida =
    884 		&drm_connector_enum_list[connector_type].ida;
    885 
    886 	drm_modeset_lock_all(dev);
    887 
    888 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
    889 	if (ret)
    890 		goto out_unlock;
    891 
    892 	connector->base.properties = &connector->properties;
    893 	connector->dev = dev;
    894 	connector->funcs = funcs;
    895 	connector->connector_type = connector_type;
    896 	connector->connector_type_id =
    897 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
    898 	if (connector->connector_type_id < 0) {
    899 		ret = connector->connector_type_id;
    900 		goto out_put;
    901 	}
    902 	connector->name =
    903 		kasprintf(GFP_KERNEL, "%s-%d",
    904 			  drm_connector_enum_list[connector_type].name,
    905 			  connector->connector_type_id);
    906 	if (!connector->name) {
    907 		ret = -ENOMEM;
    908 		goto out_put;
    909 	}
    910 
    911 	INIT_LIST_HEAD(&connector->probed_modes);
    912 	INIT_LIST_HEAD(&connector->modes);
    913 	connector->edid_blob_ptr = NULL;
    914 	connector->status = connector_status_unknown;
    915 
    916 	drm_connector_get_cmdline_mode(connector);
    917 
    918 	/* We should add connectors at the end to avoid upsetting the connector
    919 	 * index too much. */
    920 	list_add_tail(&connector->head, &config->connector_list);
    921 	config->num_connector++;
    922 
    923 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
    924 		drm_object_attach_property(&connector->base,
    925 					      config->edid_property,
    926 					      0);
    927 
    928 	drm_object_attach_property(&connector->base,
    929 				      config->dpms_property, 0);
    930 
    931 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
    932 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
    933 	}
    934 
    935 	connector->debugfs_entry = NULL;
    936 
    937 out_put:
    938 	if (ret)
    939 		drm_mode_object_put(dev, &connector->base);
    940 
    941 out_unlock:
    942 	drm_modeset_unlock_all(dev);
    943 
    944 	return ret;
    945 }
    946 EXPORT_SYMBOL(drm_connector_init);
    947 
    948 /**
    949  * drm_connector_cleanup - cleans up an initialised connector
    950  * @connector: connector to cleanup
    951  *
    952  * Cleans up the connector but doesn't free the object.
    953  */
    954 void drm_connector_cleanup(struct drm_connector *connector)
    955 {
    956 	struct drm_device *dev = connector->dev;
    957 	struct drm_display_mode *mode, *t;
    958 
    959 	if (connector->tile_group) {
    960 		drm_mode_put_tile_group(dev, connector->tile_group);
    961 		connector->tile_group = NULL;
    962 	}
    963 
    964 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
    965 		drm_mode_remove(connector, mode);
    966 
    967 	list_for_each_entry_safe(mode, t, &connector->modes, head)
    968 		drm_mode_remove(connector, mode);
    969 
    970 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
    971 		   connector->connector_type_id);
    972 
    973 	kfree(connector->display_info.bus_formats);
    974 	drm_mode_object_put(dev, &connector->base);
    975 	kfree(connector->name);
    976 	connector->name = NULL;
    977 	list_del(&connector->head);
    978 	dev->mode_config.num_connector--;
    979 
    980 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
    981 	if (connector->state && connector->funcs->atomic_destroy_state)
    982 		connector->funcs->atomic_destroy_state(connector,
    983 						       connector->state);
    984 
    985 	memset(connector, 0, sizeof(*connector));
    986 }
    987 EXPORT_SYMBOL(drm_connector_cleanup);
    988 
    989 /**
    990  * drm_connector_index - find the index of a registered connector
    991  * @connector: connector to find index for
    992  *
    993  * Given a registered connector, return the index of that connector within a DRM
    994  * device's list of connectors.
    995  */
    996 unsigned int drm_connector_index(struct drm_connector *connector)
    997 {
    998 	unsigned int index = 0;
    999 	struct drm_connector *tmp;
   1000 	struct drm_mode_config *config = &connector->dev->mode_config;
   1001 
   1002 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
   1003 
   1004 	drm_for_each_connector(tmp, connector->dev) {
   1005 		if (tmp == connector)
   1006 			return index;
   1007 
   1008 		index++;
   1009 	}
   1010 
   1011 	BUG();
   1012 }
   1013 EXPORT_SYMBOL(drm_connector_index);
   1014 
   1015 /**
   1016  * drm_connector_register - register a connector
   1017  * @connector: the connector to register
   1018  *
   1019  * Register userspace interfaces for a connector
   1020  *
   1021  * Returns:
   1022  * Zero on success, error code on failure.
   1023  */
   1024 int drm_connector_register(struct drm_connector *connector)
   1025 {
   1026 	int ret;
   1027 
   1028 	drm_mode_object_register(connector->dev, &connector->base);
   1029 
   1030 	ret = drm_sysfs_connector_add(connector);
   1031 	if (ret)
   1032 		return ret;
   1033 
   1034 	ret = drm_debugfs_connector_add(connector);
   1035 	if (ret) {
   1036 		drm_sysfs_connector_remove(connector);
   1037 		return ret;
   1038 	}
   1039 
   1040 	return 0;
   1041 }
   1042 EXPORT_SYMBOL(drm_connector_register);
   1043 
   1044 /**
   1045  * drm_connector_unregister - unregister a connector
   1046  * @connector: the connector to unregister
   1047  *
   1048  * Unregister userspace interfaces for a connector
   1049  */
   1050 void drm_connector_unregister(struct drm_connector *connector)
   1051 {
   1052 	drm_sysfs_connector_remove(connector);
   1053 	drm_debugfs_connector_remove(connector);
   1054 }
   1055 EXPORT_SYMBOL(drm_connector_unregister);
   1056 
   1057 
   1058 /**
   1059  * drm_connector_unplug_all - unregister connector userspace interfaces
   1060  * @dev: drm device
   1061  *
   1062  * This function unregisters all connector userspace interfaces in sysfs. Should
   1063  * be call when the device is disconnected, e.g. from an usb driver's
   1064  * ->disconnect callback.
   1065  */
   1066 void drm_connector_unplug_all(struct drm_device *dev)
   1067 {
   1068 	struct drm_connector *connector;
   1069 
   1070 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
   1071 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
   1072 		drm_connector_unregister(connector);
   1073 
   1074 }
   1075 EXPORT_SYMBOL(drm_connector_unplug_all);
   1076 
   1077 /**
   1078  * drm_encoder_init - Init a preallocated encoder
   1079  * @dev: drm device
   1080  * @encoder: the encoder to init
   1081  * @funcs: callbacks for this encoder
   1082  * @encoder_type: user visible type of the encoder
   1083  *
   1084  * Initialises a preallocated encoder. Encoder should be
   1085  * subclassed as part of driver encoder objects.
   1086  *
   1087  * Returns:
   1088  * Zero on success, error code on failure.
   1089  */
   1090 int drm_encoder_init(struct drm_device *dev,
   1091 		      struct drm_encoder *encoder,
   1092 		      const struct drm_encoder_funcs *funcs,
   1093 		      int encoder_type)
   1094 {
   1095 	int ret;
   1096 
   1097 	drm_modeset_lock_all(dev);
   1098 
   1099 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
   1100 	if (ret)
   1101 		goto out_unlock;
   1102 
   1103 	encoder->dev = dev;
   1104 	encoder->encoder_type = encoder_type;
   1105 	encoder->funcs = funcs;
   1106 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
   1107 				  drm_encoder_enum_list[encoder_type].name,
   1108 				  encoder->base.id);
   1109 	if (!encoder->name) {
   1110 		ret = -ENOMEM;
   1111 		goto out_put;
   1112 	}
   1113 
   1114 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
   1115 	dev->mode_config.num_encoder++;
   1116 
   1117 out_put:
   1118 	if (ret)
   1119 		drm_mode_object_put(dev, &encoder->base);
   1120 
   1121 out_unlock:
   1122 	drm_modeset_unlock_all(dev);
   1123 
   1124 	return ret;
   1125 }
   1126 EXPORT_SYMBOL(drm_encoder_init);
   1127 
   1128 /**
   1129  * drm_encoder_cleanup - cleans up an initialised encoder
   1130  * @encoder: encoder to cleanup
   1131  *
   1132  * Cleans up the encoder but doesn't free the object.
   1133  */
   1134 void drm_encoder_cleanup(struct drm_encoder *encoder)
   1135 {
   1136 	struct drm_device *dev = encoder->dev;
   1137 
   1138 	drm_modeset_lock_all(dev);
   1139 	drm_mode_object_put(dev, &encoder->base);
   1140 	kfree(encoder->name);
   1141 	list_del(&encoder->head);
   1142 	dev->mode_config.num_encoder--;
   1143 	drm_modeset_unlock_all(dev);
   1144 
   1145 	memset(encoder, 0, sizeof(*encoder));
   1146 }
   1147 EXPORT_SYMBOL(drm_encoder_cleanup);
   1148 
   1149 /**
   1150  * drm_universal_plane_init - Initialize a new universal plane object
   1151  * @dev: DRM device
   1152  * @plane: plane object to init
   1153  * @possible_crtcs: bitmask of possible CRTCs
   1154  * @funcs: callbacks for the new plane
   1155  * @formats: array of supported formats (%DRM_FORMAT_*)
   1156  * @format_count: number of elements in @formats
   1157  * @type: type of plane (overlay, primary, cursor)
   1158  *
   1159  * Initializes a plane object of type @type.
   1160  *
   1161  * Returns:
   1162  * Zero on success, error code on failure.
   1163  */
   1164 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
   1165 			     unsigned long possible_crtcs,
   1166 			     const struct drm_plane_funcs *funcs,
   1167 			     const uint32_t *formats, unsigned int format_count,
   1168 			     enum drm_plane_type type)
   1169 {
   1170 	struct drm_mode_config *config = &dev->mode_config;
   1171 	int ret;
   1172 
   1173 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
   1174 	if (ret)
   1175 		return ret;
   1176 
   1177 	drm_modeset_lock_init(&plane->mutex);
   1178 
   1179 	plane->base.properties = &plane->properties;
   1180 	plane->dev = dev;
   1181 	plane->funcs = funcs;
   1182 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
   1183 					    GFP_KERNEL);
   1184 	if (!plane->format_types) {
   1185 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
   1186 		drm_mode_object_put(dev, &plane->base);
   1187 		return -ENOMEM;
   1188 	}
   1189 
   1190 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
   1191 	plane->format_count = format_count;
   1192 	plane->possible_crtcs = possible_crtcs;
   1193 	plane->type = type;
   1194 
   1195 	list_add_tail(&plane->head, &config->plane_list);
   1196 	config->num_total_plane++;
   1197 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
   1198 		config->num_overlay_plane++;
   1199 
   1200 	drm_object_attach_property(&plane->base,
   1201 				   config->plane_type_property,
   1202 				   plane->type);
   1203 
   1204 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
   1205 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
   1206 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
   1207 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
   1208 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
   1209 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
   1210 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
   1211 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
   1212 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
   1213 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
   1214 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
   1215 	}
   1216 
   1217 	return 0;
   1218 }
   1219 EXPORT_SYMBOL(drm_universal_plane_init);
   1220 
   1221 /**
   1222  * drm_plane_init - Initialize a legacy plane
   1223  * @dev: DRM device
   1224  * @plane: plane object to init
   1225  * @possible_crtcs: bitmask of possible CRTCs
   1226  * @funcs: callbacks for the new plane
   1227  * @formats: array of supported formats (%DRM_FORMAT_*)
   1228  * @format_count: number of elements in @formats
   1229  * @is_primary: plane type (primary vs overlay)
   1230  *
   1231  * Legacy API to initialize a DRM plane.
   1232  *
   1233  * New drivers should call drm_universal_plane_init() instead.
   1234  *
   1235  * Returns:
   1236  * Zero on success, error code on failure.
   1237  */
   1238 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
   1239 		   unsigned long possible_crtcs,
   1240 		   const struct drm_plane_funcs *funcs,
   1241 		   const uint32_t *formats, unsigned int format_count,
   1242 		   bool is_primary)
   1243 {
   1244 	enum drm_plane_type type;
   1245 
   1246 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
   1247 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
   1248 					formats, format_count, type);
   1249 }
   1250 EXPORT_SYMBOL(drm_plane_init);
   1251 
   1252 /**
   1253  * drm_plane_cleanup - Clean up the core plane usage
   1254  * @plane: plane to cleanup
   1255  *
   1256  * This function cleans up @plane and removes it from the DRM mode setting
   1257  * core. Note that the function does *not* free the plane structure itself,
   1258  * this is the responsibility of the caller.
   1259  */
   1260 void drm_plane_cleanup(struct drm_plane *plane)
   1261 {
   1262 	struct drm_device *dev = plane->dev;
   1263 
   1264 	drm_modeset_lock_all(dev);
   1265 	kfree(plane->format_types);
   1266 	drm_mode_object_put(dev, &plane->base);
   1267 
   1268 	BUG_ON(list_empty(&plane->head));
   1269 
   1270 	list_del(&plane->head);
   1271 	dev->mode_config.num_total_plane--;
   1272 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
   1273 		dev->mode_config.num_overlay_plane--;
   1274 	drm_modeset_unlock_all(dev);
   1275 
   1276 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
   1277 	if (plane->state && plane->funcs->atomic_destroy_state)
   1278 		plane->funcs->atomic_destroy_state(plane, plane->state);
   1279 
   1280 	memset(plane, 0, sizeof(*plane));
   1281 }
   1282 EXPORT_SYMBOL(drm_plane_cleanup);
   1283 
   1284 /**
   1285  * drm_plane_index - find the index of a registered plane
   1286  * @plane: plane to find index for
   1287  *
   1288  * Given a registered plane, return the index of that CRTC within a DRM
   1289  * device's list of planes.
   1290  */
   1291 unsigned int drm_plane_index(struct drm_plane *plane)
   1292 {
   1293 	unsigned int index = 0;
   1294 	struct drm_plane *tmp;
   1295 
   1296 	drm_for_each_plane(tmp, plane->dev) {
   1297 		if (tmp == plane)
   1298 			return index;
   1299 
   1300 		index++;
   1301 	}
   1302 
   1303 	BUG();
   1304 }
   1305 EXPORT_SYMBOL(drm_plane_index);
   1306 
   1307 /**
   1308  * drm_plane_from_index - find the registered plane at an index
   1309  * @dev: DRM device
   1310  * @idx: index of registered plane to find for
   1311  *
   1312  * Given a plane index, return the registered plane from DRM device's
   1313  * list of planes with matching index.
   1314  */
   1315 struct drm_plane *
   1316 drm_plane_from_index(struct drm_device *dev, int idx)
   1317 {
   1318 	struct drm_plane *plane;
   1319 	unsigned int i = 0;
   1320 
   1321 	drm_for_each_plane(plane, dev) {
   1322 		if (i == idx)
   1323 			return plane;
   1324 		i++;
   1325 	}
   1326 	return NULL;
   1327 }
   1328 EXPORT_SYMBOL(drm_plane_from_index);
   1329 
   1330 /**
   1331  * drm_plane_force_disable - Forcibly disable a plane
   1332  * @plane: plane to disable
   1333  *
   1334  * Forces the plane to be disabled.
   1335  *
   1336  * Used when the plane's current framebuffer is destroyed,
   1337  * and when restoring fbdev mode.
   1338  */
   1339 void drm_plane_force_disable(struct drm_plane *plane)
   1340 {
   1341 	int ret;
   1342 
   1343 	if (!plane->fb)
   1344 		return;
   1345 
   1346 	plane->old_fb = plane->fb;
   1347 	ret = plane->funcs->disable_plane(plane);
   1348 	if (ret) {
   1349 		DRM_ERROR("failed to disable plane with busy fb\n");
   1350 		plane->old_fb = NULL;
   1351 		return;
   1352 	}
   1353 	/* disconnect the plane from the fb and crtc: */
   1354 	drm_framebuffer_unreference(plane->old_fb);
   1355 	plane->old_fb = NULL;
   1356 	plane->fb = NULL;
   1357 	plane->crtc = NULL;
   1358 }
   1359 EXPORT_SYMBOL(drm_plane_force_disable);
   1360 
   1361 static int drm_mode_create_standard_properties(struct drm_device *dev)
   1362 {
   1363 	struct drm_property *prop;
   1364 
   1365 	/*
   1366 	 * Standard properties (apply to all connectors)
   1367 	 */
   1368 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
   1369 				   DRM_MODE_PROP_IMMUTABLE,
   1370 				   "EDID", 0);
   1371 	if (!prop)
   1372 		return -ENOMEM;
   1373 	dev->mode_config.edid_property = prop;
   1374 
   1375 	prop = drm_property_create_enum(dev, 0,
   1376 				   "DPMS", drm_dpms_enum_list,
   1377 				   ARRAY_SIZE(drm_dpms_enum_list));
   1378 	if (!prop)
   1379 		return -ENOMEM;
   1380 	dev->mode_config.dpms_property = prop;
   1381 
   1382 	prop = drm_property_create(dev,
   1383 				   DRM_MODE_PROP_BLOB |
   1384 				   DRM_MODE_PROP_IMMUTABLE,
   1385 				   "PATH", 0);
   1386 	if (!prop)
   1387 		return -ENOMEM;
   1388 	dev->mode_config.path_property = prop;
   1389 
   1390 	prop = drm_property_create(dev,
   1391 				   DRM_MODE_PROP_BLOB |
   1392 				   DRM_MODE_PROP_IMMUTABLE,
   1393 				   "TILE", 0);
   1394 	if (!prop)
   1395 		return -ENOMEM;
   1396 	dev->mode_config.tile_property = prop;
   1397 
   1398 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1399 					"type", drm_plane_type_enum_list,
   1400 					ARRAY_SIZE(drm_plane_type_enum_list));
   1401 	if (!prop)
   1402 		return -ENOMEM;
   1403 	dev->mode_config.plane_type_property = prop;
   1404 
   1405 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1406 			"SRC_X", 0, UINT_MAX);
   1407 	if (!prop)
   1408 		return -ENOMEM;
   1409 	dev->mode_config.prop_src_x = prop;
   1410 
   1411 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1412 			"SRC_Y", 0, UINT_MAX);
   1413 	if (!prop)
   1414 		return -ENOMEM;
   1415 	dev->mode_config.prop_src_y = prop;
   1416 
   1417 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1418 			"SRC_W", 0, UINT_MAX);
   1419 	if (!prop)
   1420 		return -ENOMEM;
   1421 	dev->mode_config.prop_src_w = prop;
   1422 
   1423 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1424 			"SRC_H", 0, UINT_MAX);
   1425 	if (!prop)
   1426 		return -ENOMEM;
   1427 	dev->mode_config.prop_src_h = prop;
   1428 
   1429 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
   1430 			"CRTC_X", INT_MIN, INT_MAX);
   1431 	if (!prop)
   1432 		return -ENOMEM;
   1433 	dev->mode_config.prop_crtc_x = prop;
   1434 
   1435 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
   1436 			"CRTC_Y", INT_MIN, INT_MAX);
   1437 	if (!prop)
   1438 		return -ENOMEM;
   1439 	dev->mode_config.prop_crtc_y = prop;
   1440 
   1441 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1442 			"CRTC_W", 0, INT_MAX);
   1443 	if (!prop)
   1444 		return -ENOMEM;
   1445 	dev->mode_config.prop_crtc_w = prop;
   1446 
   1447 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1448 			"CRTC_H", 0, INT_MAX);
   1449 	if (!prop)
   1450 		return -ENOMEM;
   1451 	dev->mode_config.prop_crtc_h = prop;
   1452 
   1453 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
   1454 			"FB_ID", DRM_MODE_OBJECT_FB);
   1455 	if (!prop)
   1456 		return -ENOMEM;
   1457 	dev->mode_config.prop_fb_id = prop;
   1458 
   1459 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
   1460 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
   1461 	if (!prop)
   1462 		return -ENOMEM;
   1463 	dev->mode_config.prop_crtc_id = prop;
   1464 
   1465 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
   1466 			"ACTIVE");
   1467 	if (!prop)
   1468 		return -ENOMEM;
   1469 	dev->mode_config.prop_active = prop;
   1470 
   1471 	prop = drm_property_create(dev,
   1472 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
   1473 			"MODE_ID", 0);
   1474 	if (!prop)
   1475 		return -ENOMEM;
   1476 	dev->mode_config.prop_mode_id = prop;
   1477 
   1478 	return 0;
   1479 }
   1480 
   1481 /**
   1482  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
   1483  * @dev: DRM device
   1484  *
   1485  * Called by a driver the first time a DVI-I connector is made.
   1486  */
   1487 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
   1488 {
   1489 	struct drm_property *dvi_i_selector;
   1490 	struct drm_property *dvi_i_subconnector;
   1491 
   1492 	if (dev->mode_config.dvi_i_select_subconnector_property)
   1493 		return 0;
   1494 
   1495 	dvi_i_selector =
   1496 		drm_property_create_enum(dev, 0,
   1497 				    "select subconnector",
   1498 				    drm_dvi_i_select_enum_list,
   1499 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
   1500 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
   1501 
   1502 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1503 				    "subconnector",
   1504 				    drm_dvi_i_subconnector_enum_list,
   1505 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
   1506 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
   1507 
   1508 	return 0;
   1509 }
   1510 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
   1511 
   1512 /**
   1513  * drm_create_tv_properties - create TV specific connector properties
   1514  * @dev: DRM device
   1515  * @num_modes: number of different TV formats (modes) supported
   1516  * @modes: array of pointers to strings containing name of each format
   1517  *
   1518  * Called by a driver's TV initialization routine, this function creates
   1519  * the TV specific connector properties for a given device.  Caller is
   1520  * responsible for allocating a list of format names and passing them to
   1521  * this routine.
   1522  */
   1523 int drm_mode_create_tv_properties(struct drm_device *dev,
   1524 				  unsigned int num_modes,
   1525 				  const char * const modes[])
   1526 {
   1527 	struct drm_property *tv_selector;
   1528 	struct drm_property *tv_subconnector;
   1529 	unsigned int i;
   1530 
   1531 	if (dev->mode_config.tv_select_subconnector_property)
   1532 		return 0;
   1533 
   1534 	/*
   1535 	 * Basic connector properties
   1536 	 */
   1537 	tv_selector = drm_property_create_enum(dev, 0,
   1538 					  "select subconnector",
   1539 					  drm_tv_select_enum_list,
   1540 					  ARRAY_SIZE(drm_tv_select_enum_list));
   1541 	if (!tv_selector)
   1542 		goto nomem;
   1543 
   1544 	dev->mode_config.tv_select_subconnector_property = tv_selector;
   1545 
   1546 	tv_subconnector =
   1547 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1548 				    "subconnector",
   1549 				    drm_tv_subconnector_enum_list,
   1550 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
   1551 	if (!tv_subconnector)
   1552 		goto nomem;
   1553 	dev->mode_config.tv_subconnector_property = tv_subconnector;
   1554 
   1555 	/*
   1556 	 * Other, TV specific properties: margins & TV modes.
   1557 	 */
   1558 	dev->mode_config.tv_left_margin_property =
   1559 		drm_property_create_range(dev, 0, "left margin", 0, 100);
   1560 	if (!dev->mode_config.tv_left_margin_property)
   1561 		goto nomem;
   1562 
   1563 	dev->mode_config.tv_right_margin_property =
   1564 		drm_property_create_range(dev, 0, "right margin", 0, 100);
   1565 	if (!dev->mode_config.tv_right_margin_property)
   1566 		goto nomem;
   1567 
   1568 	dev->mode_config.tv_top_margin_property =
   1569 		drm_property_create_range(dev, 0, "top margin", 0, 100);
   1570 	if (!dev->mode_config.tv_top_margin_property)
   1571 		goto nomem;
   1572 
   1573 	dev->mode_config.tv_bottom_margin_property =
   1574 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
   1575 	if (!dev->mode_config.tv_bottom_margin_property)
   1576 		goto nomem;
   1577 
   1578 	dev->mode_config.tv_mode_property =
   1579 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
   1580 				    "mode", num_modes);
   1581 	if (!dev->mode_config.tv_mode_property)
   1582 		goto nomem;
   1583 
   1584 	for (i = 0; i < num_modes; i++)
   1585 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
   1586 				      i, modes[i]);
   1587 
   1588 	dev->mode_config.tv_brightness_property =
   1589 		drm_property_create_range(dev, 0, "brightness", 0, 100);
   1590 	if (!dev->mode_config.tv_brightness_property)
   1591 		goto nomem;
   1592 
   1593 	dev->mode_config.tv_contrast_property =
   1594 		drm_property_create_range(dev, 0, "contrast", 0, 100);
   1595 	if (!dev->mode_config.tv_contrast_property)
   1596 		goto nomem;
   1597 
   1598 	dev->mode_config.tv_flicker_reduction_property =
   1599 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
   1600 	if (!dev->mode_config.tv_flicker_reduction_property)
   1601 		goto nomem;
   1602 
   1603 	dev->mode_config.tv_overscan_property =
   1604 		drm_property_create_range(dev, 0, "overscan", 0, 100);
   1605 	if (!dev->mode_config.tv_overscan_property)
   1606 		goto nomem;
   1607 
   1608 	dev->mode_config.tv_saturation_property =
   1609 		drm_property_create_range(dev, 0, "saturation", 0, 100);
   1610 	if (!dev->mode_config.tv_saturation_property)
   1611 		goto nomem;
   1612 
   1613 	dev->mode_config.tv_hue_property =
   1614 		drm_property_create_range(dev, 0, "hue", 0, 100);
   1615 	if (!dev->mode_config.tv_hue_property)
   1616 		goto nomem;
   1617 
   1618 	return 0;
   1619 nomem:
   1620 	return -ENOMEM;
   1621 }
   1622 EXPORT_SYMBOL(drm_mode_create_tv_properties);
   1623 
   1624 /**
   1625  * drm_mode_create_scaling_mode_property - create scaling mode property
   1626  * @dev: DRM device
   1627  *
   1628  * Called by a driver the first time it's needed, must be attached to desired
   1629  * connectors.
   1630  */
   1631 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
   1632 {
   1633 	struct drm_property *scaling_mode;
   1634 
   1635 	if (dev->mode_config.scaling_mode_property)
   1636 		return 0;
   1637 
   1638 	scaling_mode =
   1639 		drm_property_create_enum(dev, 0, "scaling mode",
   1640 				drm_scaling_mode_enum_list,
   1641 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
   1642 
   1643 	dev->mode_config.scaling_mode_property = scaling_mode;
   1644 
   1645 	return 0;
   1646 }
   1647 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
   1648 
   1649 /**
   1650  * drm_mode_create_aspect_ratio_property - create aspect ratio property
   1651  * @dev: DRM device
   1652  *
   1653  * Called by a driver the first time it's needed, must be attached to desired
   1654  * connectors.
   1655  *
   1656  * Returns:
   1657  * Zero on success, negative errno on failure.
   1658  */
   1659 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
   1660 {
   1661 	if (dev->mode_config.aspect_ratio_property)
   1662 		return 0;
   1663 
   1664 	dev->mode_config.aspect_ratio_property =
   1665 		drm_property_create_enum(dev, 0, "aspect ratio",
   1666 				drm_aspect_ratio_enum_list,
   1667 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
   1668 
   1669 	if (dev->mode_config.aspect_ratio_property == NULL)
   1670 		return -ENOMEM;
   1671 
   1672 	return 0;
   1673 }
   1674 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
   1675 
   1676 /**
   1677  * drm_mode_create_dirty_property - create dirty property
   1678  * @dev: DRM device
   1679  *
   1680  * Called by a driver the first time it's needed, must be attached to desired
   1681  * connectors.
   1682  */
   1683 int drm_mode_create_dirty_info_property(struct drm_device *dev)
   1684 {
   1685 	struct drm_property *dirty_info;
   1686 
   1687 	if (dev->mode_config.dirty_info_property)
   1688 		return 0;
   1689 
   1690 	dirty_info =
   1691 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1692 				    "dirty",
   1693 				    drm_dirty_info_enum_list,
   1694 				    ARRAY_SIZE(drm_dirty_info_enum_list));
   1695 	dev->mode_config.dirty_info_property = dirty_info;
   1696 
   1697 	return 0;
   1698 }
   1699 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
   1700 
   1701 /**
   1702  * drm_mode_create_suggested_offset_properties - create suggests offset properties
   1703  * @dev: DRM device
   1704  *
   1705  * Create the the suggested x/y offset property for connectors.
   1706  */
   1707 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
   1708 {
   1709 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
   1710 		return 0;
   1711 
   1712 	dev->mode_config.suggested_x_property =
   1713 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
   1714 
   1715 	dev->mode_config.suggested_y_property =
   1716 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
   1717 
   1718 	if (dev->mode_config.suggested_x_property == NULL ||
   1719 	    dev->mode_config.suggested_y_property == NULL)
   1720 		return -ENOMEM;
   1721 	return 0;
   1722 }
   1723 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
   1724 
   1725 /**
   1726  * drm_mode_getresources - get graphics configuration
   1727  * @dev: drm device for the ioctl
   1728  * @data: data pointer for the ioctl
   1729  * @file_priv: drm file for the ioctl call
   1730  *
   1731  * Construct a set of configuration description structures and return
   1732  * them to the user, including CRTC, connector and framebuffer configuration.
   1733  *
   1734  * Called by the user via ioctl.
   1735  *
   1736  * Returns:
   1737  * Zero on success, negative errno on failure.
   1738  */
   1739 int drm_mode_getresources(struct drm_device *dev, void *data,
   1740 			  struct drm_file *file_priv)
   1741 {
   1742 	struct drm_mode_card_res *card_res = data;
   1743 	struct list_head *lh;
   1744 	struct drm_framebuffer *fb;
   1745 	struct drm_connector *connector;
   1746 	struct drm_crtc *crtc;
   1747 	struct drm_encoder *encoder;
   1748 	int ret = 0;
   1749 	int connector_count = 0;
   1750 	int crtc_count = 0;
   1751 	int fb_count = 0;
   1752 	int encoder_count = 0;
   1753 	int copied = 0;
   1754 	uint32_t __user *fb_id;
   1755 	uint32_t __user *crtc_id;
   1756 	uint32_t __user *connector_id;
   1757 	uint32_t __user *encoder_id;
   1758 
   1759 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   1760 		return -EINVAL;
   1761 
   1762 
   1763 	mutex_lock(&file_priv->fbs_lock);
   1764 	/*
   1765 	 * For the non-control nodes we need to limit the list of resources
   1766 	 * by IDs in the group list for this node
   1767 	 */
   1768 	list_for_each(lh, &file_priv->fbs)
   1769 		fb_count++;
   1770 
   1771 	/* handle this in 4 parts */
   1772 	/* FBs */
   1773 	if (card_res->count_fbs >= fb_count) {
   1774 		copied = 0;
   1775 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
   1776 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
   1777 			if (put_user(fb->base.id, fb_id + copied)) {
   1778 				mutex_unlock(&file_priv->fbs_lock);
   1779 				return -EFAULT;
   1780 			}
   1781 			copied++;
   1782 		}
   1783 	}
   1784 	card_res->count_fbs = fb_count;
   1785 	mutex_unlock(&file_priv->fbs_lock);
   1786 
   1787 	/* mode_config.mutex protects the connector list against e.g. DP MST
   1788 	 * connector hot-adding. CRTC/Plane lists are invariant. */
   1789 	mutex_lock(&dev->mode_config.mutex);
   1790 	drm_for_each_crtc(crtc, dev)
   1791 		crtc_count++;
   1792 
   1793 	drm_for_each_connector(connector, dev)
   1794 		connector_count++;
   1795 
   1796 	drm_for_each_encoder(encoder, dev)
   1797 		encoder_count++;
   1798 
   1799 	card_res->max_height = dev->mode_config.max_height;
   1800 	card_res->min_height = dev->mode_config.min_height;
   1801 	card_res->max_width = dev->mode_config.max_width;
   1802 	card_res->min_width = dev->mode_config.min_width;
   1803 
   1804 	/* CRTCs */
   1805 	if (card_res->count_crtcs >= crtc_count) {
   1806 		copied = 0;
   1807 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
   1808 		drm_for_each_crtc(crtc, dev) {
   1809 			DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
   1810 			if (put_user(crtc->base.id, crtc_id + copied)) {
   1811 				ret = -EFAULT;
   1812 				goto out;
   1813 			}
   1814 			copied++;
   1815 		}
   1816 	}
   1817 	card_res->count_crtcs = crtc_count;
   1818 
   1819 	/* Encoders */
   1820 	if (card_res->count_encoders >= encoder_count) {
   1821 		copied = 0;
   1822 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
   1823 		drm_for_each_encoder(encoder, dev) {
   1824 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
   1825 					encoder->name);
   1826 			if (put_user(encoder->base.id, encoder_id +
   1827 				     copied)) {
   1828 				ret = -EFAULT;
   1829 				goto out;
   1830 			}
   1831 			copied++;
   1832 		}
   1833 	}
   1834 	card_res->count_encoders = encoder_count;
   1835 
   1836 	/* Connectors */
   1837 	if (card_res->count_connectors >= connector_count) {
   1838 		copied = 0;
   1839 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
   1840 		drm_for_each_connector(connector, dev) {
   1841 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
   1842 				connector->base.id,
   1843 				connector->name);
   1844 			if (put_user(connector->base.id,
   1845 				     connector_id + copied)) {
   1846 				ret = -EFAULT;
   1847 				goto out;
   1848 			}
   1849 			copied++;
   1850 		}
   1851 	}
   1852 	card_res->count_connectors = connector_count;
   1853 
   1854 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
   1855 		  card_res->count_connectors, card_res->count_encoders);
   1856 
   1857 out:
   1858 	mutex_unlock(&dev->mode_config.mutex);
   1859 	return ret;
   1860 }
   1861 
   1862 /**
   1863  * drm_mode_getcrtc - get CRTC configuration
   1864  * @dev: drm device for the ioctl
   1865  * @data: data pointer for the ioctl
   1866  * @file_priv: drm file for the ioctl call
   1867  *
   1868  * Construct a CRTC configuration structure to return to the user.
   1869  *
   1870  * Called by the user via ioctl.
   1871  *
   1872  * Returns:
   1873  * Zero on success, negative errno on failure.
   1874  */
   1875 int drm_mode_getcrtc(struct drm_device *dev,
   1876 		     void *data, struct drm_file *file_priv)
   1877 {
   1878 	struct drm_mode_crtc *crtc_resp = data;
   1879 	struct drm_crtc *crtc;
   1880 
   1881 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   1882 		return -EINVAL;
   1883 
   1884 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
   1885 	if (!crtc)
   1886 		return -ENOENT;
   1887 
   1888 	drm_modeset_lock_crtc(crtc, crtc->primary);
   1889 	crtc_resp->gamma_size = crtc->gamma_size;
   1890 	if (crtc->primary->fb)
   1891 		crtc_resp->fb_id = crtc->primary->fb->base.id;
   1892 	else
   1893 		crtc_resp->fb_id = 0;
   1894 
   1895 	if (crtc->state) {
   1896 		crtc_resp->x = crtc->primary->state->src_x >> 16;
   1897 		crtc_resp->y = crtc->primary->state->src_y >> 16;
   1898 		if (crtc->state->enable) {
   1899 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
   1900 			crtc_resp->mode_valid = 1;
   1901 
   1902 		} else {
   1903 			crtc_resp->mode_valid = 0;
   1904 		}
   1905 	} else {
   1906 		crtc_resp->x = crtc->x;
   1907 		crtc_resp->y = crtc->y;
   1908 		if (crtc->enabled) {
   1909 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
   1910 			crtc_resp->mode_valid = 1;
   1911 
   1912 		} else {
   1913 			crtc_resp->mode_valid = 0;
   1914 		}
   1915 	}
   1916 	drm_modeset_unlock_crtc(crtc);
   1917 
   1918 	return 0;
   1919 }
   1920 
   1921 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
   1922 					 const struct drm_file *file_priv)
   1923 {
   1924 	/*
   1925 	 * If user-space hasn't configured the driver to expose the stereo 3D
   1926 	 * modes, don't expose them.
   1927 	 */
   1928 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
   1929 		return false;
   1930 
   1931 	return true;
   1932 }
   1933 
   1934 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
   1935 {
   1936 	/* For atomic drivers only state objects are synchronously updated and
   1937 	 * protected by modeset locks, so check those first. */
   1938 	if (connector->state)
   1939 		return connector->state->best_encoder;
   1940 	return connector->encoder;
   1941 }
   1942 
   1943 /* helper for getconnector and getproperties ioctls */
   1944 static int get_properties(struct drm_mode_object *obj, bool atomic,
   1945 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
   1946 		uint32_t *arg_count_props)
   1947 {
   1948 	int props_count;
   1949 	int i, ret, copied;
   1950 
   1951 	props_count = obj->properties->count;
   1952 	if (!atomic)
   1953 		props_count -= obj->properties->atomic_count;
   1954 
   1955 	if ((*arg_count_props >= props_count) && props_count) {
   1956 		for (i = 0, copied = 0; copied < props_count; i++) {
   1957 			struct drm_property *prop = obj->properties->properties[i];
   1958 			uint64_t val;
   1959 
   1960 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
   1961 				continue;
   1962 
   1963 			ret = drm_object_property_get_value(obj, prop, &val);
   1964 			if (ret)
   1965 				return ret;
   1966 
   1967 			if (put_user(prop->base.id, prop_ptr + copied))
   1968 				return -EFAULT;
   1969 
   1970 			if (put_user(val, prop_values + copied))
   1971 				return -EFAULT;
   1972 
   1973 			copied++;
   1974 		}
   1975 	}
   1976 	*arg_count_props = props_count;
   1977 
   1978 	return 0;
   1979 }
   1980 
   1981 /**
   1982  * drm_mode_getconnector - get connector configuration
   1983  * @dev: drm device for the ioctl
   1984  * @data: data pointer for the ioctl
   1985  * @file_priv: drm file for the ioctl call
   1986  *
   1987  * Construct a connector configuration structure to return to the user.
   1988  *
   1989  * Called by the user via ioctl.
   1990  *
   1991  * Returns:
   1992  * Zero on success, negative errno on failure.
   1993  */
   1994 int drm_mode_getconnector(struct drm_device *dev, void *data,
   1995 			  struct drm_file *file_priv)
   1996 {
   1997 	struct drm_mode_get_connector *out_resp = data;
   1998 	struct drm_connector *connector;
   1999 	struct drm_encoder *encoder;
   2000 	struct drm_display_mode *mode;
   2001 	int mode_count = 0;
   2002 	int encoders_count = 0;
   2003 	int ret = 0;
   2004 	int copied = 0;
   2005 	int i;
   2006 	struct drm_mode_modeinfo u_mode;
   2007 	struct drm_mode_modeinfo __user *mode_ptr;
   2008 	uint32_t __user *encoder_ptr;
   2009 
   2010 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2011 		return -EINVAL;
   2012 
   2013 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
   2014 
   2015 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
   2016 
   2017 	mutex_lock(&dev->mode_config.mutex);
   2018 
   2019 	connector = drm_connector_find(dev, out_resp->connector_id);
   2020 	if (!connector) {
   2021 		ret = -ENOENT;
   2022 		goto out_unlock;
   2023 	}
   2024 
   2025 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
   2026 		if (connector->encoder_ids[i] != 0)
   2027 			encoders_count++;
   2028 
   2029 	if (out_resp->count_modes == 0) {
   2030 		connector->funcs->fill_modes(connector,
   2031 					     dev->mode_config.max_width,
   2032 					     dev->mode_config.max_height);
   2033 	}
   2034 
   2035 	/* delayed so we get modes regardless of pre-fill_modes state */
   2036 	list_for_each_entry(mode, &connector->modes, head)
   2037 		if (drm_mode_expose_to_userspace(mode, file_priv))
   2038 			mode_count++;
   2039 
   2040 	out_resp->connector_id = connector->base.id;
   2041 	out_resp->connector_type = connector->connector_type;
   2042 	out_resp->connector_type_id = connector->connector_type_id;
   2043 	out_resp->mm_width = connector->display_info.width_mm;
   2044 	out_resp->mm_height = connector->display_info.height_mm;
   2045 	out_resp->subpixel = connector->display_info.subpixel_order;
   2046 	out_resp->connection = connector->status;
   2047 
   2048 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
   2049 	encoder = drm_connector_get_encoder(connector);
   2050 	if (encoder)
   2051 		out_resp->encoder_id = encoder->base.id;
   2052 	else
   2053 		out_resp->encoder_id = 0;
   2054 
   2055 	/*
   2056 	 * This ioctl is called twice, once to determine how much space is
   2057 	 * needed, and the 2nd time to fill it.
   2058 	 */
   2059 	if ((out_resp->count_modes >= mode_count) && mode_count) {
   2060 		copied = 0;
   2061 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
   2062 		list_for_each_entry(mode, &connector->modes, head) {
   2063 			if (!drm_mode_expose_to_userspace(mode, file_priv))
   2064 				continue;
   2065 
   2066 			drm_mode_convert_to_umode(&u_mode, mode);
   2067 			if (copy_to_user(mode_ptr + copied,
   2068 					 &u_mode, sizeof(u_mode))) {
   2069 				ret = -EFAULT;
   2070 				goto out;
   2071 			}
   2072 			copied++;
   2073 		}
   2074 	}
   2075 	out_resp->count_modes = mode_count;
   2076 
   2077 	ret = get_properties(&connector->base, file_priv->atomic,
   2078 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
   2079 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
   2080 			&out_resp->count_props);
   2081 	if (ret)
   2082 		goto out;
   2083 
   2084 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
   2085 		copied = 0;
   2086 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
   2087 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
   2088 			if (connector->encoder_ids[i] != 0) {
   2089 				if (put_user(connector->encoder_ids[i],
   2090 					     encoder_ptr + copied)) {
   2091 					ret = -EFAULT;
   2092 					goto out;
   2093 				}
   2094 				copied++;
   2095 			}
   2096 		}
   2097 	}
   2098 	out_resp->count_encoders = encoders_count;
   2099 
   2100 out:
   2101 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
   2102 
   2103 out_unlock:
   2104 	mutex_unlock(&dev->mode_config.mutex);
   2105 
   2106 	return ret;
   2107 }
   2108 
   2109 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
   2110 {
   2111 	struct drm_connector *connector;
   2112 	struct drm_device *dev = encoder->dev;
   2113 	bool uses_atomic = false;
   2114 
   2115 	/* For atomic drivers only state objects are synchronously updated and
   2116 	 * protected by modeset locks, so check those first. */
   2117 	drm_for_each_connector(connector, dev) {
   2118 		if (!connector->state)
   2119 			continue;
   2120 
   2121 		uses_atomic = true;
   2122 
   2123 		if (connector->state->best_encoder != encoder)
   2124 			continue;
   2125 
   2126 		return connector->state->crtc;
   2127 	}
   2128 
   2129 	/* Don't return stale data (e.g. pending async disable). */
   2130 	if (uses_atomic)
   2131 		return NULL;
   2132 
   2133 	return encoder->crtc;
   2134 }
   2135 
   2136 /**
   2137  * drm_mode_getencoder - get encoder configuration
   2138  * @dev: drm device for the ioctl
   2139  * @data: data pointer for the ioctl
   2140  * @file_priv: drm file for the ioctl call
   2141  *
   2142  * Construct a encoder configuration structure to return to the user.
   2143  *
   2144  * Called by the user via ioctl.
   2145  *
   2146  * Returns:
   2147  * Zero on success, negative errno on failure.
   2148  */
   2149 int drm_mode_getencoder(struct drm_device *dev, void *data,
   2150 			struct drm_file *file_priv)
   2151 {
   2152 	struct drm_mode_get_encoder *enc_resp = data;
   2153 	struct drm_encoder *encoder;
   2154 	struct drm_crtc *crtc;
   2155 
   2156 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2157 		return -EINVAL;
   2158 
   2159 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
   2160 	if (!encoder)
   2161 		return -ENOENT;
   2162 
   2163 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
   2164 	crtc = drm_encoder_get_crtc(encoder);
   2165 	if (crtc)
   2166 		enc_resp->crtc_id = crtc->base.id;
   2167 	else
   2168 		enc_resp->crtc_id = 0;
   2169 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
   2170 
   2171 	enc_resp->encoder_type = encoder->encoder_type;
   2172 	enc_resp->encoder_id = encoder->base.id;
   2173 	enc_resp->possible_crtcs = encoder->possible_crtcs;
   2174 	enc_resp->possible_clones = encoder->possible_clones;
   2175 
   2176 	return 0;
   2177 }
   2178 
   2179 /**
   2180  * drm_mode_getplane_res - enumerate all plane resources
   2181  * @dev: DRM device
   2182  * @data: ioctl data
   2183  * @file_priv: DRM file info
   2184  *
   2185  * Construct a list of plane ids to return to the user.
   2186  *
   2187  * Called by the user via ioctl.
   2188  *
   2189  * Returns:
   2190  * Zero on success, negative errno on failure.
   2191  */
   2192 int drm_mode_getplane_res(struct drm_device *dev, void *data,
   2193 			  struct drm_file *file_priv)
   2194 {
   2195 	struct drm_mode_get_plane_res *plane_resp = data;
   2196 	struct drm_mode_config *config;
   2197 	struct drm_plane *plane;
   2198 	uint32_t __user *plane_ptr;
   2199 	int copied = 0;
   2200 	unsigned num_planes;
   2201 
   2202 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2203 		return -EINVAL;
   2204 
   2205 	config = &dev->mode_config;
   2206 
   2207 	if (file_priv->universal_planes)
   2208 		num_planes = config->num_total_plane;
   2209 	else
   2210 		num_planes = config->num_overlay_plane;
   2211 
   2212 	/*
   2213 	 * This ioctl is called twice, once to determine how much space is
   2214 	 * needed, and the 2nd time to fill it.
   2215 	 */
   2216 	if (num_planes &&
   2217 	    (plane_resp->count_planes >= num_planes)) {
   2218 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
   2219 
   2220 		/* Plane lists are invariant, no locking needed. */
   2221 		drm_for_each_plane(plane, dev) {
   2222 			/*
   2223 			 * Unless userspace set the 'universal planes'
   2224 			 * capability bit, only advertise overlays.
   2225 			 */
   2226 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
   2227 			    !file_priv->universal_planes)
   2228 				continue;
   2229 
   2230 			if (put_user(plane->base.id, plane_ptr + copied))
   2231 				return -EFAULT;
   2232 			copied++;
   2233 		}
   2234 	}
   2235 	plane_resp->count_planes = num_planes;
   2236 
   2237 	return 0;
   2238 }
   2239 
   2240 /**
   2241  * drm_mode_getplane - get plane configuration
   2242  * @dev: DRM device
   2243  * @data: ioctl data
   2244  * @file_priv: DRM file info
   2245  *
   2246  * Construct a plane configuration structure to return to the user.
   2247  *
   2248  * Called by the user via ioctl.
   2249  *
   2250  * Returns:
   2251  * Zero on success, negative errno on failure.
   2252  */
   2253 int drm_mode_getplane(struct drm_device *dev, void *data,
   2254 		      struct drm_file *file_priv)
   2255 {
   2256 	struct drm_mode_get_plane *plane_resp = data;
   2257 	struct drm_plane *plane;
   2258 	uint32_t __user *format_ptr;
   2259 
   2260 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2261 		return -EINVAL;
   2262 
   2263 	plane = drm_plane_find(dev, plane_resp->plane_id);
   2264 	if (!plane)
   2265 		return -ENOENT;
   2266 
   2267 	drm_modeset_lock(&plane->mutex, NULL);
   2268 	if (plane->crtc)
   2269 		plane_resp->crtc_id = plane->crtc->base.id;
   2270 	else
   2271 		plane_resp->crtc_id = 0;
   2272 
   2273 	if (plane->fb)
   2274 		plane_resp->fb_id = plane->fb->base.id;
   2275 	else
   2276 		plane_resp->fb_id = 0;
   2277 	drm_modeset_unlock(&plane->mutex);
   2278 
   2279 	plane_resp->plane_id = plane->base.id;
   2280 	plane_resp->possible_crtcs = plane->possible_crtcs;
   2281 	plane_resp->gamma_size = 0;
   2282 
   2283 	/*
   2284 	 * This ioctl is called twice, once to determine how much space is
   2285 	 * needed, and the 2nd time to fill it.
   2286 	 */
   2287 	if (plane->format_count &&
   2288 	    (plane_resp->count_format_types >= plane->format_count)) {
   2289 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
   2290 		if (copy_to_user(format_ptr,
   2291 				 plane->format_types,
   2292 				 sizeof(uint32_t) * plane->format_count)) {
   2293 			return -EFAULT;
   2294 		}
   2295 	}
   2296 	plane_resp->count_format_types = plane->format_count;
   2297 
   2298 	return 0;
   2299 }
   2300 
   2301 /**
   2302  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
   2303  * @plane: plane to check for format support
   2304  * @format: the pixel format
   2305  *
   2306  * Returns:
   2307  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
   2308  * otherwise.
   2309  */
   2310 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
   2311 {
   2312 	unsigned int i;
   2313 
   2314 	for (i = 0; i < plane->format_count; i++) {
   2315 		if (format == plane->format_types[i])
   2316 			return 0;
   2317 	}
   2318 
   2319 	return -EINVAL;
   2320 }
   2321 
   2322 static int check_src_coords(uint32_t src_x, uint32_t src_y,
   2323 			    uint32_t src_w, uint32_t src_h,
   2324 			    const struct drm_framebuffer *fb)
   2325 {
   2326 	unsigned int fb_width, fb_height;
   2327 
   2328 	fb_width = fb->width << 16;
   2329 	fb_height = fb->height << 16;
   2330 
   2331 	/* Make sure source coordinates are inside the fb. */
   2332 	if (src_w > fb_width ||
   2333 	    src_x > fb_width - src_w ||
   2334 	    src_h > fb_height ||
   2335 	    src_y > fb_height - src_h) {
   2336 		DRM_DEBUG_KMS("Invalid source coordinates "
   2337 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
   2338 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
   2339 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
   2340 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
   2341 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
   2342 		return -ENOSPC;
   2343 	}
   2344 
   2345 	return 0;
   2346 }
   2347 
   2348 /*
   2349  * setplane_internal - setplane handler for internal callers
   2350  *
   2351  * Note that we assume an extra reference has already been taken on fb.  If the
   2352  * update fails, this reference will be dropped before return; if it succeeds,
   2353  * the previous framebuffer (if any) will be unreferenced instead.
   2354  *
   2355  * src_{x,y,w,h} are provided in 16.16 fixed point format
   2356  */
   2357 static int __setplane_internal(struct drm_plane *plane,
   2358 			       struct drm_crtc *crtc,
   2359 			       struct drm_framebuffer *fb,
   2360 			       int32_t crtc_x, int32_t crtc_y,
   2361 			       uint32_t crtc_w, uint32_t crtc_h,
   2362 			       /* src_{x,y,w,h} values are 16.16 fixed point */
   2363 			       uint32_t src_x, uint32_t src_y,
   2364 			       uint32_t src_w, uint32_t src_h)
   2365 {
   2366 	int ret = 0;
   2367 
   2368 	/* No fb means shut it down */
   2369 	if (!fb) {
   2370 		plane->old_fb = plane->fb;
   2371 		ret = plane->funcs->disable_plane(plane);
   2372 		if (!ret) {
   2373 			plane->crtc = NULL;
   2374 			plane->fb = NULL;
   2375 		} else {
   2376 			plane->old_fb = NULL;
   2377 		}
   2378 		goto out;
   2379 	}
   2380 
   2381 	/* Check whether this plane is usable on this CRTC */
   2382 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
   2383 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
   2384 		ret = -EINVAL;
   2385 		goto out;
   2386 	}
   2387 
   2388 	/* Check whether this plane supports the fb pixel format. */
   2389 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
   2390 	if (ret) {
   2391 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
   2392 			      drm_get_format_name(fb->pixel_format));
   2393 		goto out;
   2394 	}
   2395 
   2396 	/* Give drivers some help against integer overflows */
   2397 	if (crtc_w > INT_MAX ||
   2398 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
   2399 	    crtc_h > INT_MAX ||
   2400 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
   2401 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
   2402 			      crtc_w, crtc_h, crtc_x, crtc_y);
   2403 		ret = -ERANGE;
   2404 		goto out;
   2405 	}
   2406 
   2407 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
   2408 	if (ret)
   2409 		goto out;
   2410 
   2411 	plane->old_fb = plane->fb;
   2412 	ret = plane->funcs->update_plane(plane, crtc, fb,
   2413 					 crtc_x, crtc_y, crtc_w, crtc_h,
   2414 					 src_x, src_y, src_w, src_h);
   2415 	if (!ret) {
   2416 		plane->crtc = crtc;
   2417 		plane->fb = fb;
   2418 		fb = NULL;
   2419 	} else {
   2420 		plane->old_fb = NULL;
   2421 	}
   2422 
   2423 out:
   2424 	if (fb)
   2425 		drm_framebuffer_unreference(fb);
   2426 	if (plane->old_fb)
   2427 		drm_framebuffer_unreference(plane->old_fb);
   2428 	plane->old_fb = NULL;
   2429 
   2430 	return ret;
   2431 }
   2432 
   2433 static int setplane_internal(struct drm_plane *plane,
   2434 			     struct drm_crtc *crtc,
   2435 			     struct drm_framebuffer *fb,
   2436 			     int32_t crtc_x, int32_t crtc_y,
   2437 			     uint32_t crtc_w, uint32_t crtc_h,
   2438 			     /* src_{x,y,w,h} values are 16.16 fixed point */
   2439 			     uint32_t src_x, uint32_t src_y,
   2440 			     uint32_t src_w, uint32_t src_h)
   2441 {
   2442 	int ret;
   2443 
   2444 	drm_modeset_lock_all(plane->dev);
   2445 	ret = __setplane_internal(plane, crtc, fb,
   2446 				  crtc_x, crtc_y, crtc_w, crtc_h,
   2447 				  src_x, src_y, src_w, src_h);
   2448 	drm_modeset_unlock_all(plane->dev);
   2449 
   2450 	return ret;
   2451 }
   2452 
   2453 /**
   2454  * drm_mode_setplane - configure a plane's configuration
   2455  * @dev: DRM device
   2456  * @data: ioctl data*
   2457  * @file_priv: DRM file info
   2458  *
   2459  * Set plane configuration, including placement, fb, scaling, and other factors.
   2460  * Or pass a NULL fb to disable (planes may be disabled without providing a
   2461  * valid crtc).
   2462  *
   2463  * Returns:
   2464  * Zero on success, negative errno on failure.
   2465  */
   2466 int drm_mode_setplane(struct drm_device *dev, void *data,
   2467 		      struct drm_file *file_priv)
   2468 {
   2469 	struct drm_mode_set_plane *plane_req = data;
   2470 	struct drm_plane *plane;
   2471 	struct drm_crtc *crtc = NULL;
   2472 	struct drm_framebuffer *fb = NULL;
   2473 
   2474 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2475 		return -EINVAL;
   2476 
   2477 	/*
   2478 	 * First, find the plane, crtc, and fb objects.  If not available,
   2479 	 * we don't bother to call the driver.
   2480 	 */
   2481 	plane = drm_plane_find(dev, plane_req->plane_id);
   2482 	if (!plane) {
   2483 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
   2484 			      plane_req->plane_id);
   2485 		return -ENOENT;
   2486 	}
   2487 
   2488 	if (plane_req->fb_id) {
   2489 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
   2490 		if (!fb) {
   2491 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
   2492 				      plane_req->fb_id);
   2493 			return -ENOENT;
   2494 		}
   2495 
   2496 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
   2497 		if (!crtc) {
   2498 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
   2499 				      plane_req->crtc_id);
   2500 			return -ENOENT;
   2501 		}
   2502 	}
   2503 
   2504 	/*
   2505 	 * setplane_internal will take care of deref'ing either the old or new
   2506 	 * framebuffer depending on success.
   2507 	 */
   2508 	return setplane_internal(plane, crtc, fb,
   2509 				 plane_req->crtc_x, plane_req->crtc_y,
   2510 				 plane_req->crtc_w, plane_req->crtc_h,
   2511 				 plane_req->src_x, plane_req->src_y,
   2512 				 plane_req->src_w, plane_req->src_h);
   2513 }
   2514 
   2515 /**
   2516  * drm_mode_set_config_internal - helper to call ->set_config
   2517  * @set: modeset config to set
   2518  *
   2519  * This is a little helper to wrap internal calls to the ->set_config driver
   2520  * interface. The only thing it adds is correct refcounting dance.
   2521  *
   2522  * Returns:
   2523  * Zero on success, negative errno on failure.
   2524  */
   2525 int drm_mode_set_config_internal(struct drm_mode_set *set)
   2526 {
   2527 	struct drm_crtc *crtc = set->crtc;
   2528 	struct drm_framebuffer *fb;
   2529 	struct drm_crtc *tmp;
   2530 	int ret;
   2531 
   2532 	/*
   2533 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
   2534 	 * connectors from it), hence we need to refcount the fbs across all
   2535 	 * crtcs. Atomic modeset will have saner semantics ...
   2536 	 */
   2537 	drm_for_each_crtc(tmp, crtc->dev)
   2538 		tmp->primary->old_fb = tmp->primary->fb;
   2539 
   2540 	fb = set->fb;
   2541 
   2542 	ret = crtc->funcs->set_config(set);
   2543 	if (ret == 0) {
   2544 		crtc->primary->crtc = crtc;
   2545 		crtc->primary->fb = fb;
   2546 	}
   2547 
   2548 	drm_for_each_crtc(tmp, crtc->dev) {
   2549 		if (tmp->primary->fb)
   2550 			drm_framebuffer_reference(tmp->primary->fb);
   2551 		if (tmp->primary->old_fb)
   2552 			drm_framebuffer_unreference(tmp->primary->old_fb);
   2553 		tmp->primary->old_fb = NULL;
   2554 	}
   2555 
   2556 	return ret;
   2557 }
   2558 EXPORT_SYMBOL(drm_mode_set_config_internal);
   2559 
   2560 /**
   2561  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
   2562  * @mode: mode to query
   2563  * @hdisplay: hdisplay value to fill in
   2564  * @vdisplay: vdisplay value to fill in
   2565  *
   2566  * The vdisplay value will be doubled if the specified mode is a stereo mode of
   2567  * the appropriate layout.
   2568  */
   2569 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
   2570 			    int *hdisplay, int *vdisplay)
   2571 {
   2572 	struct drm_display_mode adjusted;
   2573 
   2574 	drm_mode_copy(&adjusted, mode);
   2575 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
   2576 	*hdisplay = adjusted.crtc_hdisplay;
   2577 	*vdisplay = adjusted.crtc_vdisplay;
   2578 }
   2579 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
   2580 
   2581 /**
   2582  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
   2583  *     CRTC viewport
   2584  * @crtc: CRTC that framebuffer will be displayed on
   2585  * @x: x panning
   2586  * @y: y panning
   2587  * @mode: mode that framebuffer will be displayed under
   2588  * @fb: framebuffer to check size of
   2589  */
   2590 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
   2591 			    int x, int y,
   2592 			    const struct drm_display_mode *mode,
   2593 			    const struct drm_framebuffer *fb)
   2594 
   2595 {
   2596 	int hdisplay, vdisplay;
   2597 
   2598 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
   2599 
   2600 	if (crtc->state &&
   2601 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
   2602 					      BIT(DRM_ROTATE_270)))
   2603 		swap(hdisplay, vdisplay);
   2604 
   2605 	return check_src_coords(x << 16, y << 16,
   2606 				hdisplay << 16, vdisplay << 16, fb);
   2607 }
   2608 EXPORT_SYMBOL(drm_crtc_check_viewport);
   2609 
   2610 /**
   2611  * drm_mode_setcrtc - set CRTC configuration
   2612  * @dev: drm device for the ioctl
   2613  * @data: data pointer for the ioctl
   2614  * @file_priv: drm file for the ioctl call
   2615  *
   2616  * Build a new CRTC configuration based on user request.
   2617  *
   2618  * Called by the user via ioctl.
   2619  *
   2620  * Returns:
   2621  * Zero on success, negative errno on failure.
   2622  */
   2623 int drm_mode_setcrtc(struct drm_device *dev, void *data,
   2624 		     struct drm_file *file_priv)
   2625 {
   2626 	struct drm_mode_config *config = &dev->mode_config;
   2627 	struct drm_mode_crtc *crtc_req = data;
   2628 	struct drm_crtc *crtc;
   2629 	struct drm_connector **connector_set = NULL, *connector;
   2630 	struct drm_framebuffer *fb = NULL;
   2631 	struct drm_display_mode *mode = NULL;
   2632 	struct drm_mode_set set;
   2633 	uint32_t __user *set_connectors_ptr;
   2634 	int ret;
   2635 	int i;
   2636 
   2637 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2638 		return -EINVAL;
   2639 
   2640 	/*
   2641 	 * Universal plane src offsets are only 16.16, prevent havoc for
   2642 	 * drivers using universal plane code internally.
   2643 	 */
   2644 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
   2645 		return -ERANGE;
   2646 
   2647 	drm_modeset_lock_all(dev);
   2648 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
   2649 	if (!crtc) {
   2650 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
   2651 		ret = -ENOENT;
   2652 		goto out;
   2653 	}
   2654 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
   2655 
   2656 	if (crtc_req->mode_valid) {
   2657 		/* If we have a mode we need a framebuffer. */
   2658 		/* If we pass -1, set the mode with the currently bound fb */
   2659 		if (crtc_req->fb_id == -1) {
   2660 			if (!crtc->primary->fb) {
   2661 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
   2662 				ret = -EINVAL;
   2663 				goto out;
   2664 			}
   2665 			fb = crtc->primary->fb;
   2666 			/* Make refcounting symmetric with the lookup path. */
   2667 			drm_framebuffer_reference(fb);
   2668 		} else {
   2669 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
   2670 			if (!fb) {
   2671 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
   2672 						crtc_req->fb_id);
   2673 				ret = -ENOENT;
   2674 				goto out;
   2675 			}
   2676 		}
   2677 
   2678 		mode = drm_mode_create(dev);
   2679 		if (!mode) {
   2680 			ret = -ENOMEM;
   2681 			goto out;
   2682 		}
   2683 
   2684 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
   2685 		if (ret) {
   2686 			DRM_DEBUG_KMS("Invalid mode\n");
   2687 			goto out;
   2688 		}
   2689 
   2690 		/*
   2691 		 * Check whether the primary plane supports the fb pixel format.
   2692 		 * Drivers not implementing the universal planes API use a
   2693 		 * default formats list provided by the DRM core which doesn't
   2694 		 * match real hardware capabilities. Skip the check in that
   2695 		 * case.
   2696 		 */
   2697 		if (!crtc->primary->format_default) {
   2698 			ret = drm_plane_check_pixel_format(crtc->primary,
   2699 							   fb->pixel_format);
   2700 			if (ret) {
   2701 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
   2702 					drm_get_format_name(fb->pixel_format));
   2703 				goto out;
   2704 			}
   2705 		}
   2706 
   2707 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
   2708 					      mode, fb);
   2709 		if (ret)
   2710 			goto out;
   2711 
   2712 	}
   2713 
   2714 	if (crtc_req->count_connectors == 0 && mode) {
   2715 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
   2716 		ret = -EINVAL;
   2717 		goto out;
   2718 	}
   2719 
   2720 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
   2721 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
   2722 			  crtc_req->count_connectors);
   2723 		ret = -EINVAL;
   2724 		goto out;
   2725 	}
   2726 
   2727 	if (crtc_req->count_connectors > 0) {
   2728 		u32 out_id;
   2729 
   2730 		/* Avoid unbounded kernel memory allocation */
   2731 		if (crtc_req->count_connectors > config->num_connector) {
   2732 			ret = -EINVAL;
   2733 			goto out;
   2734 		}
   2735 
   2736 		connector_set = kmalloc_array(crtc_req->count_connectors,
   2737 					      sizeof(struct drm_connector *),
   2738 					      GFP_KERNEL);
   2739 		if (!connector_set) {
   2740 			ret = -ENOMEM;
   2741 			goto out;
   2742 		}
   2743 
   2744 		for (i = 0; i < crtc_req->count_connectors; i++) {
   2745 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
   2746 			if (get_user(out_id, &set_connectors_ptr[i])) {
   2747 				ret = -EFAULT;
   2748 				goto out;
   2749 			}
   2750 
   2751 			connector = drm_connector_find(dev, out_id);
   2752 			if (!connector) {
   2753 				DRM_DEBUG_KMS("Connector id %d unknown\n",
   2754 						out_id);
   2755 				ret = -ENOENT;
   2756 				goto out;
   2757 			}
   2758 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
   2759 					connector->base.id,
   2760 					connector->name);
   2761 
   2762 			connector_set[i] = connector;
   2763 		}
   2764 	}
   2765 
   2766 	set.crtc = crtc;
   2767 	set.x = crtc_req->x;
   2768 	set.y = crtc_req->y;
   2769 	set.mode = mode;
   2770 	set.connectors = connector_set;
   2771 	set.num_connectors = crtc_req->count_connectors;
   2772 	set.fb = fb;
   2773 	ret = drm_mode_set_config_internal(&set);
   2774 
   2775 out:
   2776 	if (fb)
   2777 		drm_framebuffer_unreference(fb);
   2778 
   2779 	kfree(connector_set);
   2780 	drm_mode_destroy(dev, mode);
   2781 	drm_modeset_unlock_all(dev);
   2782 	return ret;
   2783 }
   2784 
   2785 /**
   2786  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
   2787  *     universal plane handler call
   2788  * @crtc: crtc to update cursor for
   2789  * @req: data pointer for the ioctl
   2790  * @file_priv: drm file for the ioctl call
   2791  *
   2792  * Legacy cursor ioctl's work directly with driver buffer handles.  To
   2793  * translate legacy ioctl calls into universal plane handler calls, we need to
   2794  * wrap the native buffer handle in a drm_framebuffer.
   2795  *
   2796  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
   2797  * buffer with a pitch of 4*width; the universal plane interface should be used
   2798  * directly in cases where the hardware can support other buffer settings and
   2799  * userspace wants to make use of these capabilities.
   2800  *
   2801  * Returns:
   2802  * Zero on success, negative errno on failure.
   2803  */
   2804 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
   2805 				     struct drm_mode_cursor2 *req,
   2806 				     struct drm_file *file_priv)
   2807 {
   2808 	struct drm_device *dev = crtc->dev;
   2809 	struct drm_framebuffer *fb = NULL;
   2810 	struct drm_mode_fb_cmd2 fbreq = {
   2811 		.width = req->width,
   2812 		.height = req->height,
   2813 		.pixel_format = DRM_FORMAT_ARGB8888,
   2814 		.pitches = { req->width * 4 },
   2815 		.handles = { req->handle },
   2816 	};
   2817 	int32_t crtc_x, crtc_y;
   2818 	uint32_t crtc_w = 0, crtc_h = 0;
   2819 	uint32_t src_w = 0, src_h = 0;
   2820 	int ret = 0;
   2821 
   2822 	BUG_ON(!crtc->cursor);
   2823 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
   2824 
   2825 	/*
   2826 	 * Obtain fb we'll be using (either new or existing) and take an extra
   2827 	 * reference to it if fb != null.  setplane will take care of dropping
   2828 	 * the reference if the plane update fails.
   2829 	 */
   2830 	if (req->flags & DRM_MODE_CURSOR_BO) {
   2831 		if (req->handle) {
   2832 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
   2833 			if (IS_ERR(fb)) {
   2834 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
   2835 				return PTR_ERR(fb);
   2836 			}
   2837 		} else {
   2838 			fb = NULL;
   2839 		}
   2840 	} else {
   2841 		fb = crtc->cursor->fb;
   2842 		if (fb)
   2843 			drm_framebuffer_reference(fb);
   2844 	}
   2845 
   2846 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
   2847 		crtc_x = req->x;
   2848 		crtc_y = req->y;
   2849 	} else {
   2850 		crtc_x = crtc->cursor_x;
   2851 		crtc_y = crtc->cursor_y;
   2852 	}
   2853 
   2854 	if (fb) {
   2855 		crtc_w = fb->width;
   2856 		crtc_h = fb->height;
   2857 		src_w = fb->width << 16;
   2858 		src_h = fb->height << 16;
   2859 	}
   2860 
   2861 	/*
   2862 	 * setplane_internal will take care of deref'ing either the old or new
   2863 	 * framebuffer depending on success.
   2864 	 */
   2865 	ret = __setplane_internal(crtc->cursor, crtc, fb,
   2866 				crtc_x, crtc_y, crtc_w, crtc_h,
   2867 				0, 0, src_w, src_h);
   2868 
   2869 	/* Update successful; save new cursor position, if necessary */
   2870 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
   2871 		crtc->cursor_x = req->x;
   2872 		crtc->cursor_y = req->y;
   2873 	}
   2874 
   2875 	return ret;
   2876 }
   2877 
   2878 static int drm_mode_cursor_common(struct drm_device *dev,
   2879 				  struct drm_mode_cursor2 *req,
   2880 				  struct drm_file *file_priv)
   2881 {
   2882 	struct drm_crtc *crtc;
   2883 	int ret = 0;
   2884 
   2885 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2886 		return -EINVAL;
   2887 
   2888 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
   2889 		return -EINVAL;
   2890 
   2891 	crtc = drm_crtc_find(dev, req->crtc_id);
   2892 	if (!crtc) {
   2893 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
   2894 		return -ENOENT;
   2895 	}
   2896 
   2897 	/*
   2898 	 * If this crtc has a universal cursor plane, call that plane's update
   2899 	 * handler rather than using legacy cursor handlers.
   2900 	 */
   2901 	drm_modeset_lock_crtc(crtc, crtc->cursor);
   2902 	if (crtc->cursor) {
   2903 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
   2904 		goto out;
   2905 	}
   2906 
   2907 	if (req->flags & DRM_MODE_CURSOR_BO) {
   2908 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
   2909 			ret = -ENXIO;
   2910 			goto out;
   2911 		}
   2912 		/* Turns off the cursor if handle is 0 */
   2913 		if (crtc->funcs->cursor_set2)
   2914 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
   2915 						      req->width, req->height, req->hot_x, req->hot_y);
   2916 		else
   2917 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
   2918 						      req->width, req->height);
   2919 	}
   2920 
   2921 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
   2922 		if (crtc->funcs->cursor_move) {
   2923 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
   2924 		} else {
   2925 			ret = -EFAULT;
   2926 			goto out;
   2927 		}
   2928 	}
   2929 out:
   2930 	drm_modeset_unlock_crtc(crtc);
   2931 
   2932 	return ret;
   2933 
   2934 }
   2935 
   2936 
   2937 /**
   2938  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
   2939  * @dev: drm device for the ioctl
   2940  * @data: data pointer for the ioctl
   2941  * @file_priv: drm file for the ioctl call
   2942  *
   2943  * Set the cursor configuration based on user request.
   2944  *
   2945  * Called by the user via ioctl.
   2946  *
   2947  * Returns:
   2948  * Zero on success, negative errno on failure.
   2949  */
   2950 int drm_mode_cursor_ioctl(struct drm_device *dev,
   2951 			  void *data, struct drm_file *file_priv)
   2952 {
   2953 	struct drm_mode_cursor *req = data;
   2954 	struct drm_mode_cursor2 new_req;
   2955 
   2956 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
   2957 	new_req.hot_x = new_req.hot_y = 0;
   2958 
   2959 	return drm_mode_cursor_common(dev, &new_req, file_priv);
   2960 }
   2961 
   2962 /**
   2963  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
   2964  * @dev: drm device for the ioctl
   2965  * @data: data pointer for the ioctl
   2966  * @file_priv: drm file for the ioctl call
   2967  *
   2968  * Set the cursor configuration based on user request. This implements the 2nd
   2969  * version of the cursor ioctl, which allows userspace to additionally specify
   2970  * the hotspot of the pointer.
   2971  *
   2972  * Called by the user via ioctl.
   2973  *
   2974  * Returns:
   2975  * Zero on success, negative errno on failure.
   2976  */
   2977 int drm_mode_cursor2_ioctl(struct drm_device *dev,
   2978 			   void *data, struct drm_file *file_priv)
   2979 {
   2980 	struct drm_mode_cursor2 *req = data;
   2981 
   2982 	return drm_mode_cursor_common(dev, req, file_priv);
   2983 }
   2984 
   2985 /**
   2986  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
   2987  * @bpp: bits per pixels
   2988  * @depth: bit depth per pixel
   2989  *
   2990  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
   2991  * Useful in fbdev emulation code, since that deals in those values.
   2992  */
   2993 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
   2994 {
   2995 	uint32_t fmt;
   2996 
   2997 	switch (bpp) {
   2998 	case 8:
   2999 		fmt = DRM_FORMAT_C8;
   3000 		break;
   3001 	case 16:
   3002 		if (depth == 15)
   3003 			fmt = DRM_FORMAT_XRGB1555;
   3004 		else
   3005 			fmt = DRM_FORMAT_RGB565;
   3006 		break;
   3007 	case 24:
   3008 		fmt = DRM_FORMAT_RGB888;
   3009 		break;
   3010 	case 32:
   3011 		if (depth == 24)
   3012 			fmt = DRM_FORMAT_XRGB8888;
   3013 		else if (depth == 30)
   3014 			fmt = DRM_FORMAT_XRGB2101010;
   3015 		else
   3016 			fmt = DRM_FORMAT_ARGB8888;
   3017 		break;
   3018 	default:
   3019 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
   3020 		fmt = DRM_FORMAT_XRGB8888;
   3021 		break;
   3022 	}
   3023 
   3024 	return fmt;
   3025 }
   3026 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
   3027 
   3028 /**
   3029  * drm_mode_addfb - add an FB to the graphics configuration
   3030  * @dev: drm device for the ioctl
   3031  * @data: data pointer for the ioctl
   3032  * @file_priv: drm file for the ioctl call
   3033  *
   3034  * Add a new FB to the specified CRTC, given a user request. This is the
   3035  * original addfb ioctl which only supported RGB formats.
   3036  *
   3037  * Called by the user via ioctl.
   3038  *
   3039  * Returns:
   3040  * Zero on success, negative errno on failure.
   3041  */
   3042 int drm_mode_addfb(struct drm_device *dev,
   3043 		   void *data, struct drm_file *file_priv)
   3044 {
   3045 	struct drm_mode_fb_cmd *or = data;
   3046 	struct drm_mode_fb_cmd2 r = {};
   3047 	int ret;
   3048 
   3049 	/* convert to new format and call new ioctl */
   3050 	r.fb_id = or->fb_id;
   3051 	r.width = or->width;
   3052 	r.height = or->height;
   3053 	r.pitches[0] = or->pitch;
   3054 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
   3055 	r.handles[0] = or->handle;
   3056 
   3057 	ret = drm_mode_addfb2(dev, &r, file_priv);
   3058 	if (ret)
   3059 		return ret;
   3060 
   3061 	or->fb_id = r.fb_id;
   3062 
   3063 	return 0;
   3064 }
   3065 
   3066 static int format_check(const struct drm_mode_fb_cmd2 *r)
   3067 {
   3068 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
   3069 
   3070 	switch (format) {
   3071 	case DRM_FORMAT_C8:
   3072 	case DRM_FORMAT_RGB332:
   3073 	case DRM_FORMAT_BGR233:
   3074 	case DRM_FORMAT_XRGB4444:
   3075 	case DRM_FORMAT_XBGR4444:
   3076 	case DRM_FORMAT_RGBX4444:
   3077 	case DRM_FORMAT_BGRX4444:
   3078 	case DRM_FORMAT_ARGB4444:
   3079 	case DRM_FORMAT_ABGR4444:
   3080 	case DRM_FORMAT_RGBA4444:
   3081 	case DRM_FORMAT_BGRA4444:
   3082 	case DRM_FORMAT_XRGB1555:
   3083 	case DRM_FORMAT_XBGR1555:
   3084 	case DRM_FORMAT_RGBX5551:
   3085 	case DRM_FORMAT_BGRX5551:
   3086 	case DRM_FORMAT_ARGB1555:
   3087 	case DRM_FORMAT_ABGR1555:
   3088 	case DRM_FORMAT_RGBA5551:
   3089 	case DRM_FORMAT_BGRA5551:
   3090 	case DRM_FORMAT_RGB565:
   3091 	case DRM_FORMAT_BGR565:
   3092 	case DRM_FORMAT_RGB888:
   3093 	case DRM_FORMAT_BGR888:
   3094 	case DRM_FORMAT_XRGB8888:
   3095 	case DRM_FORMAT_XBGR8888:
   3096 	case DRM_FORMAT_RGBX8888:
   3097 	case DRM_FORMAT_BGRX8888:
   3098 	case DRM_FORMAT_ARGB8888:
   3099 	case DRM_FORMAT_ABGR8888:
   3100 	case DRM_FORMAT_RGBA8888:
   3101 	case DRM_FORMAT_BGRA8888:
   3102 	case DRM_FORMAT_XRGB2101010:
   3103 	case DRM_FORMAT_XBGR2101010:
   3104 	case DRM_FORMAT_RGBX1010102:
   3105 	case DRM_FORMAT_BGRX1010102:
   3106 	case DRM_FORMAT_ARGB2101010:
   3107 	case DRM_FORMAT_ABGR2101010:
   3108 	case DRM_FORMAT_RGBA1010102:
   3109 	case DRM_FORMAT_BGRA1010102:
   3110 	case DRM_FORMAT_YUYV:
   3111 	case DRM_FORMAT_YVYU:
   3112 	case DRM_FORMAT_UYVY:
   3113 	case DRM_FORMAT_VYUY:
   3114 	case DRM_FORMAT_AYUV:
   3115 	case DRM_FORMAT_NV12:
   3116 	case DRM_FORMAT_NV21:
   3117 	case DRM_FORMAT_NV16:
   3118 	case DRM_FORMAT_NV61:
   3119 	case DRM_FORMAT_NV24:
   3120 	case DRM_FORMAT_NV42:
   3121 	case DRM_FORMAT_YUV410:
   3122 	case DRM_FORMAT_YVU410:
   3123 	case DRM_FORMAT_YUV411:
   3124 	case DRM_FORMAT_YVU411:
   3125 	case DRM_FORMAT_YUV420:
   3126 	case DRM_FORMAT_YVU420:
   3127 	case DRM_FORMAT_YUV422:
   3128 	case DRM_FORMAT_YVU422:
   3129 	case DRM_FORMAT_YUV444:
   3130 	case DRM_FORMAT_YVU444:
   3131 		return 0;
   3132 	default:
   3133 		DRM_DEBUG_KMS("invalid pixel format %s\n",
   3134 			      drm_get_format_name(r->pixel_format));
   3135 		return -EINVAL;
   3136 	}
   3137 }
   3138 
   3139 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
   3140 {
   3141 	int ret, hsub, vsub, num_planes, i;
   3142 
   3143 	ret = format_check(r);
   3144 	if (ret) {
   3145 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
   3146 			      drm_get_format_name(r->pixel_format));
   3147 		return ret;
   3148 	}
   3149 
   3150 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
   3151 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
   3152 	num_planes = drm_format_num_planes(r->pixel_format);
   3153 
   3154 	if (r->width == 0 || r->width % hsub) {
   3155 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
   3156 		return -EINVAL;
   3157 	}
   3158 
   3159 	if (r->height == 0 || r->height % vsub) {
   3160 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
   3161 		return -EINVAL;
   3162 	}
   3163 
   3164 	for (i = 0; i < num_planes; i++) {
   3165 		unsigned int width = r->width / (i != 0 ? hsub : 1);
   3166 		unsigned int height = r->height / (i != 0 ? vsub : 1);
   3167 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
   3168 
   3169 		if (!r->handles[i]) {
   3170 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
   3171 			return -EINVAL;
   3172 		}
   3173 
   3174 		if ((uint64_t) width * cpp > UINT_MAX)
   3175 			return -ERANGE;
   3176 
   3177 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
   3178 			return -ERANGE;
   3179 
   3180 		if (r->pitches[i] < width * cpp) {
   3181 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
   3182 			return -EINVAL;
   3183 		}
   3184 
   3185 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
   3186 			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
   3187 				      r->modifier[i], i);
   3188 			return -EINVAL;
   3189 		}
   3190 
   3191 		/* modifier specific checks: */
   3192 		switch (r->modifier[i]) {
   3193 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
   3194 			/* NOTE: the pitch restriction may be lifted later if it turns
   3195 			 * out that no hw has this restriction:
   3196 			 */
   3197 			if (r->pixel_format != DRM_FORMAT_NV12 ||
   3198 					width % 128 || height % 32 ||
   3199 					r->pitches[i] % 128) {
   3200 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
   3201 				return -EINVAL;
   3202 			}
   3203 			break;
   3204 
   3205 		default:
   3206 			break;
   3207 		}
   3208 	}
   3209 
   3210 	for (i = num_planes; i < 4; i++) {
   3211 		if (r->modifier[i]) {
   3212 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
   3213 			return -EINVAL;
   3214 		}
   3215 
   3216 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
   3217 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
   3218 			continue;
   3219 
   3220 		if (r->handles[i]) {
   3221 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
   3222 			return -EINVAL;
   3223 		}
   3224 
   3225 		if (r->pitches[i]) {
   3226 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
   3227 			return -EINVAL;
   3228 		}
   3229 
   3230 		if (r->offsets[i]) {
   3231 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
   3232 			return -EINVAL;
   3233 		}
   3234 	}
   3235 
   3236 	return 0;
   3237 }
   3238 
   3239 static struct drm_framebuffer *
   3240 internal_framebuffer_create(struct drm_device *dev,
   3241 			    struct drm_mode_fb_cmd2 *r,
   3242 			    struct drm_file *file_priv)
   3243 {
   3244 	struct drm_mode_config *config = &dev->mode_config;
   3245 	struct drm_framebuffer *fb;
   3246 	int ret;
   3247 
   3248 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
   3249 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
   3250 		return ERR_PTR(-EINVAL);
   3251 	}
   3252 
   3253 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
   3254 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
   3255 			  r->width, config->min_width, config->max_width);
   3256 		return ERR_PTR(-EINVAL);
   3257 	}
   3258 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
   3259 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
   3260 			  r->height, config->min_height, config->max_height);
   3261 		return ERR_PTR(-EINVAL);
   3262 	}
   3263 
   3264 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
   3265 	    !dev->mode_config.allow_fb_modifiers) {
   3266 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
   3267 		return ERR_PTR(-EINVAL);
   3268 	}
   3269 
   3270 	ret = framebuffer_check(r);
   3271 	if (ret)
   3272 		return ERR_PTR(ret);
   3273 
   3274 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
   3275 	if (IS_ERR(fb)) {
   3276 		DRM_DEBUG_KMS("could not create framebuffer\n");
   3277 		return fb;
   3278 	}
   3279 
   3280 	return fb;
   3281 }
   3282 
   3283 /**
   3284  * drm_mode_addfb2 - add an FB to the graphics configuration
   3285  * @dev: drm device for the ioctl
   3286  * @data: data pointer for the ioctl
   3287  * @file_priv: drm file for the ioctl call
   3288  *
   3289  * Add a new FB to the specified CRTC, given a user request with format. This is
   3290  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
   3291  * and uses fourcc codes as pixel format specifiers.
   3292  *
   3293  * Called by the user via ioctl.
   3294  *
   3295  * Returns:
   3296  * Zero on success, negative errno on failure.
   3297  */
   3298 int drm_mode_addfb2(struct drm_device *dev,
   3299 		    void *data, struct drm_file *file_priv)
   3300 {
   3301 	struct drm_mode_fb_cmd2 *r = data;
   3302 	struct drm_framebuffer *fb;
   3303 
   3304 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3305 		return -EINVAL;
   3306 
   3307 	fb = internal_framebuffer_create(dev, r, file_priv);
   3308 	if (IS_ERR(fb))
   3309 		return PTR_ERR(fb);
   3310 
   3311 	/* Transfer ownership to the filp for reaping on close */
   3312 
   3313 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
   3314 	mutex_lock(&file_priv->fbs_lock);
   3315 	r->fb_id = fb->base.id;
   3316 	list_add(&fb->filp_head, &file_priv->fbs);
   3317 	mutex_unlock(&file_priv->fbs_lock);
   3318 
   3319 	return 0;
   3320 }
   3321 
   3322 struct drm_mode_rmfb_work {
   3323 	struct work_struct work;
   3324 	struct list_head fbs;
   3325 };
   3326 
   3327 static void drm_mode_rmfb_work_fn(struct work_struct *w)
   3328 {
   3329 	struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work);
   3330 
   3331 	while (!list_empty(&arg->fbs)) {
   3332 		struct drm_framebuffer *fb =
   3333 			list_first_entry(&arg->fbs, typeof(*fb), filp_head);
   3334 
   3335 		list_del_init(&fb->filp_head);
   3336 		drm_framebuffer_remove(fb);
   3337 	}
   3338 }
   3339 
   3340 /**
   3341  * drm_mode_rmfb - remove an FB from the configuration
   3342  * @dev: drm device for the ioctl
   3343  * @data: data pointer for the ioctl
   3344  * @file_priv: drm file for the ioctl call
   3345  *
   3346  * Remove the FB specified by the user.
   3347  *
   3348  * Called by the user via ioctl.
   3349  *
   3350  * Returns:
   3351  * Zero on success, negative errno on failure.
   3352  */
   3353 int drm_mode_rmfb(struct drm_device *dev,
   3354 		   void *data, struct drm_file *file_priv)
   3355 {
   3356 	struct drm_framebuffer *fb = NULL;
   3357 	struct drm_framebuffer *fbl = NULL;
   3358 	uint32_t *id = data;
   3359 	int found = 0;
   3360 
   3361 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3362 		return -EINVAL;
   3363 
   3364 	mutex_lock(&file_priv->fbs_lock);
   3365 	mutex_lock(&dev->mode_config.fb_lock);
   3366 	fb = __drm_framebuffer_lookup(dev, *id);
   3367 	if (!fb)
   3368 		goto fail_lookup;
   3369 
   3370 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
   3371 		if (fb == fbl)
   3372 			found = 1;
   3373 	if (!found)
   3374 		goto fail_lookup;
   3375 
   3376 	list_del_init(&fb->filp_head);
   3377 	mutex_unlock(&dev->mode_config.fb_lock);
   3378 	mutex_unlock(&file_priv->fbs_lock);
   3379 
   3380 	/*
   3381 	 * we now own the reference that was stored in the fbs list
   3382 	 *
   3383 	 * drm_framebuffer_remove may fail with -EINTR on pending signals,
   3384 	 * so run this in a separate stack as there's no way to correctly
   3385 	 * handle this after the fb is already removed from the lookup table.
   3386 	 */
   3387 	if (atomic_read(&fb->refcount.refcount) > 1) {
   3388 		struct drm_mode_rmfb_work arg;
   3389 
   3390 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
   3391 		INIT_LIST_HEAD(&arg.fbs);
   3392 		list_add_tail(&fb->filp_head, &arg.fbs);
   3393 
   3394 		schedule_work(&arg.work);
   3395 		flush_work(&arg.work);
   3396 		destroy_work_on_stack(&arg.work);
   3397 	} else
   3398 		drm_framebuffer_unreference(fb);
   3399 
   3400 	return 0;
   3401 
   3402 fail_lookup:
   3403 	mutex_unlock(&dev->mode_config.fb_lock);
   3404 	mutex_unlock(&file_priv->fbs_lock);
   3405 
   3406 	return -ENOENT;
   3407 }
   3408 
   3409 /**
   3410  * drm_mode_getfb - get FB info
   3411  * @dev: drm device for the ioctl
   3412  * @data: data pointer for the ioctl
   3413  * @file_priv: drm file for the ioctl call
   3414  *
   3415  * Lookup the FB given its ID and return info about it.
   3416  *
   3417  * Called by the user via ioctl.
   3418  *
   3419  * Returns:
   3420  * Zero on success, negative errno on failure.
   3421  */
   3422 int drm_mode_getfb(struct drm_device *dev,
   3423 		   void *data, struct drm_file *file_priv)
   3424 {
   3425 	struct drm_mode_fb_cmd *r = data;
   3426 	struct drm_framebuffer *fb;
   3427 	int ret;
   3428 
   3429 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3430 		return -EINVAL;
   3431 
   3432 	fb = drm_framebuffer_lookup(dev, r->fb_id);
   3433 	if (!fb)
   3434 		return -ENOENT;
   3435 
   3436 	r->height = fb->height;
   3437 	r->width = fb->width;
   3438 	r->depth = fb->depth;
   3439 	r->bpp = fb->bits_per_pixel;
   3440 	r->pitch = fb->pitches[0];
   3441 	if (fb->funcs->create_handle) {
   3442 		if (file_priv->is_master || capable(CAP_SYS_ADMIN) ||
   3443 		    drm_is_control_client(file_priv)) {
   3444 			ret = fb->funcs->create_handle(fb, file_priv,
   3445 						       &r->handle);
   3446 		} else {
   3447 			/* GET_FB() is an unprivileged ioctl so we must not
   3448 			 * return a buffer-handle to non-master processes! For
   3449 			 * backwards-compatibility reasons, we cannot make
   3450 			 * GET_FB() privileged, so just return an invalid handle
   3451 			 * for non-masters. */
   3452 			r->handle = 0;
   3453 			ret = 0;
   3454 		}
   3455 	} else {
   3456 		ret = -ENODEV;
   3457 	}
   3458 
   3459 	drm_framebuffer_unreference(fb);
   3460 
   3461 	return ret;
   3462 }
   3463 
   3464 /**
   3465  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
   3466  * @dev: drm device for the ioctl
   3467  * @data: data pointer for the ioctl
   3468  * @file_priv: drm file for the ioctl call
   3469  *
   3470  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
   3471  * rectangle list. Generic userspace which does frontbuffer rendering must call
   3472  * this ioctl to flush out the changes on manual-update display outputs, e.g.
   3473  * usb display-link, mipi manual update panels or edp panel self refresh modes.
   3474  *
   3475  * Modesetting drivers which always update the frontbuffer do not need to
   3476  * implement the corresponding ->dirty framebuffer callback.
   3477  *
   3478  * Called by the user via ioctl.
   3479  *
   3480  * Returns:
   3481  * Zero on success, negative errno on failure.
   3482  */
   3483 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
   3484 			   void *data, struct drm_file *file_priv)
   3485 {
   3486 	struct drm_clip_rect __user *clips_ptr;
   3487 	struct drm_clip_rect *clips = NULL;
   3488 	struct drm_mode_fb_dirty_cmd *r = data;
   3489 	struct drm_framebuffer *fb;
   3490 	unsigned flags;
   3491 	int num_clips;
   3492 	int ret;
   3493 
   3494 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3495 		return -EINVAL;
   3496 
   3497 	fb = drm_framebuffer_lookup(dev, r->fb_id);
   3498 	if (!fb)
   3499 		return -ENOENT;
   3500 
   3501 	num_clips = r->num_clips;
   3502 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
   3503 
   3504 	if (!num_clips != !clips_ptr) {
   3505 		ret = -EINVAL;
   3506 		goto out_err1;
   3507 	}
   3508 
   3509 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
   3510 
   3511 	/* If userspace annotates copy, clips must come in pairs */
   3512 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
   3513 		ret = -EINVAL;
   3514 		goto out_err1;
   3515 	}
   3516 
   3517 	if (num_clips && clips_ptr) {
   3518 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
   3519 			ret = -EINVAL;
   3520 			goto out_err1;
   3521 		}
   3522 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
   3523 		if (!clips) {
   3524 			ret = -ENOMEM;
   3525 			goto out_err1;
   3526 		}
   3527 
   3528 		ret = copy_from_user(clips, clips_ptr,
   3529 				     num_clips * sizeof(*clips));
   3530 		if (ret) {
   3531 			ret = -EFAULT;
   3532 			goto out_err2;
   3533 		}
   3534 	}
   3535 
   3536 	if (fb->funcs->dirty) {
   3537 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
   3538 				       clips, num_clips);
   3539 	} else {
   3540 		ret = -ENOSYS;
   3541 	}
   3542 
   3543 out_err2:
   3544 	kfree(clips);
   3545 out_err1:
   3546 	drm_framebuffer_unreference(fb);
   3547 
   3548 	return ret;
   3549 }
   3550 
   3551 /**
   3552  * drm_fb_release - remove and free the FBs on this file
   3553  * @priv: drm file for the ioctl
   3554  *
   3555  * Destroy all the FBs associated with @filp.
   3556  *
   3557  * Called by the user via ioctl.
   3558  *
   3559  * Returns:
   3560  * Zero on success, negative errno on failure.
   3561  */
   3562 void drm_fb_release(struct drm_file *priv)
   3563 {
   3564 	struct drm_framebuffer *fb, *tfb;
   3565 	struct drm_mode_rmfb_work arg;
   3566 
   3567 	INIT_LIST_HEAD(&arg.fbs);
   3568 
   3569 	/*
   3570 	 * When the file gets released that means no one else can access the fb
   3571 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
   3572 	 * avoid upsetting lockdep since the universal cursor code adds a
   3573 	 * framebuffer while holding mutex locks.
   3574 	 *
   3575 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
   3576 	 * locks is impossible here since no one else but this function can get
   3577 	 * at it any more.
   3578 	 */
   3579 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
   3580 		if (atomic_read(&fb->refcount.refcount) > 1) {
   3581 			list_move_tail(&fb->filp_head, &arg.fbs);
   3582 		} else {
   3583 			list_del_init(&fb->filp_head);
   3584 
   3585 			/* This drops the fpriv->fbs reference. */
   3586 			drm_framebuffer_unreference(fb);
   3587 		}
   3588 	}
   3589 
   3590 	if (!list_empty(&arg.fbs)) {
   3591 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
   3592 
   3593 		schedule_work(&arg.work);
   3594 		flush_work(&arg.work);
   3595 		destroy_work_on_stack(&arg.work);
   3596 	}
   3597 }
   3598 
   3599 /**
   3600  * drm_property_create - create a new property type
   3601  * @dev: drm device
   3602  * @flags: flags specifying the property type
   3603  * @name: name of the property
   3604  * @num_values: number of pre-defined values
   3605  *
   3606  * This creates a new generic drm property which can then be attached to a drm
   3607  * object with drm_object_attach_property. The returned property object must be
   3608  * freed with drm_property_destroy.
   3609  *
   3610  * Note that the DRM core keeps a per-device list of properties and that, if
   3611  * drm_mode_config_cleanup() is called, it will destroy all properties created
   3612  * by the driver.
   3613  *
   3614  * Returns:
   3615  * A pointer to the newly created property on success, NULL on failure.
   3616  */
   3617 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
   3618 					 const char *name, int num_values)
   3619 {
   3620 	struct drm_property *property = NULL;
   3621 	int ret;
   3622 
   3623 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
   3624 	if (!property)
   3625 		return NULL;
   3626 
   3627 	property->dev = dev;
   3628 
   3629 	if (num_values) {
   3630 		property->values = kcalloc(num_values, sizeof(uint64_t),
   3631 					   GFP_KERNEL);
   3632 		if (!property->values)
   3633 			goto fail;
   3634 	}
   3635 
   3636 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
   3637 	if (ret)
   3638 		goto fail;
   3639 
   3640 	property->flags = flags;
   3641 	property->num_values = num_values;
   3642 	INIT_LIST_HEAD(&property->enum_list);
   3643 
   3644 	if (name) {
   3645 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
   3646 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
   3647 	}
   3648 
   3649 	list_add_tail(&property->head, &dev->mode_config.property_list);
   3650 
   3651 	WARN_ON(!drm_property_type_valid(property));
   3652 
   3653 	return property;
   3654 fail:
   3655 	kfree(property->values);
   3656 	kfree(property);
   3657 	return NULL;
   3658 }
   3659 EXPORT_SYMBOL(drm_property_create);
   3660 
   3661 /**
   3662  * drm_property_create_enum - create a new enumeration property type
   3663  * @dev: drm device
   3664  * @flags: flags specifying the property type
   3665  * @name: name of the property
   3666  * @props: enumeration lists with property values
   3667  * @num_values: number of pre-defined values
   3668  *
   3669  * This creates a new generic drm property which can then be attached to a drm
   3670  * object with drm_object_attach_property. The returned property object must be
   3671  * freed with drm_property_destroy.
   3672  *
   3673  * Userspace is only allowed to set one of the predefined values for enumeration
   3674  * properties.
   3675  *
   3676  * Returns:
   3677  * A pointer to the newly created property on success, NULL on failure.
   3678  */
   3679 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
   3680 					 const char *name,
   3681 					 const struct drm_prop_enum_list *props,
   3682 					 int num_values)
   3683 {
   3684 	struct drm_property *property;
   3685 	int i, ret;
   3686 
   3687 	flags |= DRM_MODE_PROP_ENUM;
   3688 
   3689 	property = drm_property_create(dev, flags, name, num_values);
   3690 	if (!property)
   3691 		return NULL;
   3692 
   3693 	for (i = 0; i < num_values; i++) {
   3694 		ret = drm_property_add_enum(property, i,
   3695 				      props[i].type,
   3696 				      props[i].name);
   3697 		if (ret) {
   3698 			drm_property_destroy(dev, property);
   3699 			return NULL;
   3700 		}
   3701 	}
   3702 
   3703 	return property;
   3704 }
   3705 EXPORT_SYMBOL(drm_property_create_enum);
   3706 
   3707 /**
   3708  * drm_property_create_bitmask - create a new bitmask property type
   3709  * @dev: drm device
   3710  * @flags: flags specifying the property type
   3711  * @name: name of the property
   3712  * @props: enumeration lists with property bitflags
   3713  * @num_props: size of the @props array
   3714  * @supported_bits: bitmask of all supported enumeration values
   3715  *
   3716  * This creates a new bitmask drm property which can then be attached to a drm
   3717  * object with drm_object_attach_property. The returned property object must be
   3718  * freed with drm_property_destroy.
   3719  *
   3720  * Compared to plain enumeration properties userspace is allowed to set any
   3721  * or'ed together combination of the predefined property bitflag values
   3722  *
   3723  * Returns:
   3724  * A pointer to the newly created property on success, NULL on failure.
   3725  */
   3726 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
   3727 					 int flags, const char *name,
   3728 					 const struct drm_prop_enum_list *props,
   3729 					 int num_props,
   3730 					 uint64_t supported_bits)
   3731 {
   3732 	struct drm_property *property;
   3733 	int i, ret, index = 0;
   3734 	int num_values = hweight64(supported_bits);
   3735 
   3736 	flags |= DRM_MODE_PROP_BITMASK;
   3737 
   3738 	property = drm_property_create(dev, flags, name, num_values);
   3739 	if (!property)
   3740 		return NULL;
   3741 	for (i = 0; i < num_props; i++) {
   3742 		if (!(supported_bits & (1ULL << props[i].type)))
   3743 			continue;
   3744 
   3745 		if (WARN_ON(index >= num_values)) {
   3746 			drm_property_destroy(dev, property);
   3747 			return NULL;
   3748 		}
   3749 
   3750 		ret = drm_property_add_enum(property, index++,
   3751 				      props[i].type,
   3752 				      props[i].name);
   3753 		if (ret) {
   3754 			drm_property_destroy(dev, property);
   3755 			return NULL;
   3756 		}
   3757 	}
   3758 
   3759 	return property;
   3760 }
   3761 EXPORT_SYMBOL(drm_property_create_bitmask);
   3762 
   3763 static struct drm_property *property_create_range(struct drm_device *dev,
   3764 					 int flags, const char *name,
   3765 					 uint64_t min, uint64_t max)
   3766 {
   3767 	struct drm_property *property;
   3768 
   3769 	property = drm_property_create(dev, flags, name, 2);
   3770 	if (!property)
   3771 		return NULL;
   3772 
   3773 	property->values[0] = min;
   3774 	property->values[1] = max;
   3775 
   3776 	return property;
   3777 }
   3778 
   3779 /**
   3780  * drm_property_create_range - create a new unsigned ranged property type
   3781  * @dev: drm device
   3782  * @flags: flags specifying the property type
   3783  * @name: name of the property
   3784  * @min: minimum value of the property
   3785  * @max: maximum value of the property
   3786  *
   3787  * This creates a new generic drm property which can then be attached to a drm
   3788  * object with drm_object_attach_property. The returned property object must be
   3789  * freed with drm_property_destroy.
   3790  *
   3791  * Userspace is allowed to set any unsigned integer value in the (min, max)
   3792  * range inclusive.
   3793  *
   3794  * Returns:
   3795  * A pointer to the newly created property on success, NULL on failure.
   3796  */
   3797 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
   3798 					 const char *name,
   3799 					 uint64_t min, uint64_t max)
   3800 {
   3801 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
   3802 			name, min, max);
   3803 }
   3804 EXPORT_SYMBOL(drm_property_create_range);
   3805 
   3806 /**
   3807  * drm_property_create_signed_range - create a new signed ranged property type
   3808  * @dev: drm device
   3809  * @flags: flags specifying the property type
   3810  * @name: name of the property
   3811  * @min: minimum value of the property
   3812  * @max: maximum value of the property
   3813  *
   3814  * This creates a new generic drm property which can then be attached to a drm
   3815  * object with drm_object_attach_property. The returned property object must be
   3816  * freed with drm_property_destroy.
   3817  *
   3818  * Userspace is allowed to set any signed integer value in the (min, max)
   3819  * range inclusive.
   3820  *
   3821  * Returns:
   3822  * A pointer to the newly created property on success, NULL on failure.
   3823  */
   3824 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
   3825 					 int flags, const char *name,
   3826 					 int64_t min, int64_t max)
   3827 {
   3828 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
   3829 			name, I642U64(min), I642U64(max));
   3830 }
   3831 EXPORT_SYMBOL(drm_property_create_signed_range);
   3832 
   3833 /**
   3834  * drm_property_create_object - create a new object property type
   3835  * @dev: drm device
   3836  * @flags: flags specifying the property type
   3837  * @name: name of the property
   3838  * @type: object type from DRM_MODE_OBJECT_* defines
   3839  *
   3840  * This creates a new generic drm property which can then be attached to a drm
   3841  * object with drm_object_attach_property. The returned property object must be
   3842  * freed with drm_property_destroy.
   3843  *
   3844  * Userspace is only allowed to set this to any property value of the given
   3845  * @type. Only useful for atomic properties, which is enforced.
   3846  *
   3847  * Returns:
   3848  * A pointer to the newly created property on success, NULL on failure.
   3849  */
   3850 struct drm_property *drm_property_create_object(struct drm_device *dev,
   3851 					 int flags, const char *name, uint32_t type)
   3852 {
   3853 	struct drm_property *property;
   3854 
   3855 	flags |= DRM_MODE_PROP_OBJECT;
   3856 
   3857 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
   3858 		return NULL;
   3859 
   3860 	property = drm_property_create(dev, flags, name, 1);
   3861 	if (!property)
   3862 		return NULL;
   3863 
   3864 	property->values[0] = type;
   3865 
   3866 	return property;
   3867 }
   3868 EXPORT_SYMBOL(drm_property_create_object);
   3869 
   3870 /**
   3871  * drm_property_create_bool - create a new boolean property type
   3872  * @dev: drm device
   3873  * @flags: flags specifying the property type
   3874  * @name: name of the property
   3875  *
   3876  * This creates a new generic drm property which can then be attached to a drm
   3877  * object with drm_object_attach_property. The returned property object must be
   3878  * freed with drm_property_destroy.
   3879  *
   3880  * This is implemented as a ranged property with only {0, 1} as valid values.
   3881  *
   3882  * Returns:
   3883  * A pointer to the newly created property on success, NULL on failure.
   3884  */
   3885 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
   3886 					 const char *name)
   3887 {
   3888 	return drm_property_create_range(dev, flags, name, 0, 1);
   3889 }
   3890 EXPORT_SYMBOL(drm_property_create_bool);
   3891 
   3892 /**
   3893  * drm_property_add_enum - add a possible value to an enumeration property
   3894  * @property: enumeration property to change
   3895  * @index: index of the new enumeration
   3896  * @value: value of the new enumeration
   3897  * @name: symbolic name of the new enumeration
   3898  *
   3899  * This functions adds enumerations to a property.
   3900  *
   3901  * It's use is deprecated, drivers should use one of the more specific helpers
   3902  * to directly create the property with all enumerations already attached.
   3903  *
   3904  * Returns:
   3905  * Zero on success, error code on failure.
   3906  */
   3907 int drm_property_add_enum(struct drm_property *property, int index,
   3908 			  uint64_t value, const char *name)
   3909 {
   3910 	struct drm_property_enum *prop_enum;
   3911 
   3912 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   3913 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
   3914 		return -EINVAL;
   3915 
   3916 	/*
   3917 	 * Bitmask enum properties have the additional constraint of values
   3918 	 * from 0 to 63
   3919 	 */
   3920 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
   3921 			(value > 63))
   3922 		return -EINVAL;
   3923 
   3924 	if (!list_empty(&property->enum_list)) {
   3925 		list_for_each_entry(prop_enum, &property->enum_list, head) {
   3926 			if (prop_enum->value == value) {
   3927 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
   3928 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
   3929 				return 0;
   3930 			}
   3931 		}
   3932 	}
   3933 
   3934 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
   3935 	if (!prop_enum)
   3936 		return -ENOMEM;
   3937 
   3938 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
   3939 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
   3940 	prop_enum->value = value;
   3941 
   3942 	property->values[index] = value;
   3943 	list_add_tail(&prop_enum->head, &property->enum_list);
   3944 	return 0;
   3945 }
   3946 EXPORT_SYMBOL(drm_property_add_enum);
   3947 
   3948 /**
   3949  * drm_property_destroy - destroy a drm property
   3950  * @dev: drm device
   3951  * @property: property to destry
   3952  *
   3953  * This function frees a property including any attached resources like
   3954  * enumeration values.
   3955  */
   3956 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
   3957 {
   3958 	struct drm_property_enum *prop_enum, *pt;
   3959 
   3960 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
   3961 		list_del(&prop_enum->head);
   3962 		kfree(prop_enum);
   3963 	}
   3964 
   3965 	if (property->num_values)
   3966 		kfree(property->values);
   3967 	drm_mode_object_put(dev, &property->base);
   3968 	list_del(&property->head);
   3969 	kfree(property);
   3970 }
   3971 EXPORT_SYMBOL(drm_property_destroy);
   3972 
   3973 /**
   3974  * drm_object_attach_property - attach a property to a modeset object
   3975  * @obj: drm modeset object
   3976  * @property: property to attach
   3977  * @init_val: initial value of the property
   3978  *
   3979  * This attaches the given property to the modeset object with the given initial
   3980  * value. Currently this function cannot fail since the properties are stored in
   3981  * a statically sized array.
   3982  */
   3983 void drm_object_attach_property(struct drm_mode_object *obj,
   3984 				struct drm_property *property,
   3985 				uint64_t init_val)
   3986 {
   3987 	int count = obj->properties->count;
   3988 
   3989 	if (count == DRM_OBJECT_MAX_PROPERTY) {
   3990 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
   3991 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
   3992 			"you see this message on the same object type.\n",
   3993 			obj->type);
   3994 		return;
   3995 	}
   3996 
   3997 	obj->properties->properties[count] = property;
   3998 	obj->properties->values[count] = init_val;
   3999 	obj->properties->count++;
   4000 	if (property->flags & DRM_MODE_PROP_ATOMIC)
   4001 		obj->properties->atomic_count++;
   4002 }
   4003 EXPORT_SYMBOL(drm_object_attach_property);
   4004 
   4005 /**
   4006  * drm_object_property_set_value - set the value of a property
   4007  * @obj: drm mode object to set property value for
   4008  * @property: property to set
   4009  * @val: value the property should be set to
   4010  *
   4011  * This functions sets a given property on a given object. This function only
   4012  * changes the software state of the property, it does not call into the
   4013  * driver's ->set_property callback.
   4014  *
   4015  * Returns:
   4016  * Zero on success, error code on failure.
   4017  */
   4018 int drm_object_property_set_value(struct drm_mode_object *obj,
   4019 				  struct drm_property *property, uint64_t val)
   4020 {
   4021 	int i;
   4022 
   4023 	for (i = 0; i < obj->properties->count; i++) {
   4024 		if (obj->properties->properties[i] == property) {
   4025 			obj->properties->values[i] = val;
   4026 			return 0;
   4027 		}
   4028 	}
   4029 
   4030 	return -EINVAL;
   4031 }
   4032 EXPORT_SYMBOL(drm_object_property_set_value);
   4033 
   4034 /**
   4035  * drm_object_property_get_value - retrieve the value of a property
   4036  * @obj: drm mode object to get property value from
   4037  * @property: property to retrieve
   4038  * @val: storage for the property value
   4039  *
   4040  * This function retrieves the softare state of the given property for the given
   4041  * property. Since there is no driver callback to retrieve the current property
   4042  * value this might be out of sync with the hardware, depending upon the driver
   4043  * and property.
   4044  *
   4045  * Returns:
   4046  * Zero on success, error code on failure.
   4047  */
   4048 int drm_object_property_get_value(struct drm_mode_object *obj,
   4049 				  struct drm_property *property, uint64_t *val)
   4050 {
   4051 	int i;
   4052 
   4053 	/* read-only properties bypass atomic mechanism and still store
   4054 	 * their value in obj->properties->values[].. mostly to avoid
   4055 	 * having to deal w/ EDID and similar props in atomic paths:
   4056 	 */
   4057 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
   4058 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
   4059 		return drm_atomic_get_property(obj, property, val);
   4060 
   4061 	for (i = 0; i < obj->properties->count; i++) {
   4062 		if (obj->properties->properties[i] == property) {
   4063 			*val = obj->properties->values[i];
   4064 			return 0;
   4065 		}
   4066 	}
   4067 
   4068 	return -EINVAL;
   4069 }
   4070 EXPORT_SYMBOL(drm_object_property_get_value);
   4071 
   4072 /**
   4073  * drm_mode_getproperty_ioctl - get the property metadata
   4074  * @dev: DRM device
   4075  * @data: ioctl data
   4076  * @file_priv: DRM file info
   4077  *
   4078  * This function retrieves the metadata for a given property, like the different
   4079  * possible values for an enum property or the limits for a range property.
   4080  *
   4081  * Blob properties are special
   4082  *
   4083  * Called by the user via ioctl.
   4084  *
   4085  * Returns:
   4086  * Zero on success, negative errno on failure.
   4087  */
   4088 int drm_mode_getproperty_ioctl(struct drm_device *dev,
   4089 			       void *data, struct drm_file *file_priv)
   4090 {
   4091 	struct drm_mode_get_property *out_resp = data;
   4092 	struct drm_property *property;
   4093 	int enum_count = 0;
   4094 	int value_count = 0;
   4095 	int ret = 0, i;
   4096 	int copied;
   4097 	struct drm_property_enum *prop_enum;
   4098 	struct drm_mode_property_enum __user *enum_ptr;
   4099 	uint64_t __user *values_ptr;
   4100 
   4101 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4102 		return -EINVAL;
   4103 
   4104 	drm_modeset_lock_all(dev);
   4105 	property = drm_property_find(dev, out_resp->prop_id);
   4106 	if (!property) {
   4107 		ret = -ENOENT;
   4108 		goto done;
   4109 	}
   4110 
   4111 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   4112 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4113 		list_for_each_entry(prop_enum, &property->enum_list, head)
   4114 			enum_count++;
   4115 	}
   4116 
   4117 	value_count = property->num_values;
   4118 
   4119 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
   4120 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
   4121 	out_resp->flags = property->flags;
   4122 
   4123 	if ((out_resp->count_values >= value_count) && value_count) {
   4124 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
   4125 		for (i = 0; i < value_count; i++) {
   4126 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
   4127 				ret = -EFAULT;
   4128 				goto done;
   4129 			}
   4130 		}
   4131 	}
   4132 	out_resp->count_values = value_count;
   4133 
   4134 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   4135 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4136 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
   4137 			copied = 0;
   4138 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
   4139 			list_for_each_entry(prop_enum, &property->enum_list, head) {
   4140 
   4141 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
   4142 					ret = -EFAULT;
   4143 					goto done;
   4144 				}
   4145 
   4146 				if (copy_to_user(&enum_ptr[copied].name,
   4147 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
   4148 					ret = -EFAULT;
   4149 					goto done;
   4150 				}
   4151 				copied++;
   4152 			}
   4153 		}
   4154 		out_resp->count_enum_blobs = enum_count;
   4155 	}
   4156 
   4157 	/*
   4158 	 * NOTE: The idea seems to have been to use this to read all the blob
   4159 	 * property values. But nothing ever added them to the corresponding
   4160 	 * list, userspace always used the special-purpose get_blob ioctl to
   4161 	 * read the value for a blob property. It also doesn't make a lot of
   4162 	 * sense to return values here when everything else is just metadata for
   4163 	 * the property itself.
   4164 	 */
   4165 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
   4166 		out_resp->count_enum_blobs = 0;
   4167 done:
   4168 	drm_modeset_unlock_all(dev);
   4169 	return ret;
   4170 }
   4171 
   4172 /**
   4173  * drm_property_create_blob - Create new blob property
   4174  *
   4175  * Creates a new blob property for a specified DRM device, optionally
   4176  * copying data.
   4177  *
   4178  * @dev: DRM device to create property for
   4179  * @length: Length to allocate for blob data
   4180  * @data: If specified, copies data into blob
   4181  *
   4182  * Returns:
   4183  * New blob property with a single reference on success, or an ERR_PTR
   4184  * value on failure.
   4185  */
   4186 struct drm_property_blob *
   4187 drm_property_create_blob(struct drm_device *dev, size_t length,
   4188 			 const void *data)
   4189 {
   4190 	struct drm_property_blob *blob;
   4191 	int ret;
   4192 
   4193 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
   4194 		return ERR_PTR(-EINVAL);
   4195 
   4196 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
   4197 	if (!blob)
   4198 		return ERR_PTR(-ENOMEM);
   4199 
   4200 	/* This must be explicitly initialised, so we can safely call list_del
   4201 	 * on it in the removal handler, even if it isn't in a file list. */
   4202 	INIT_LIST_HEAD(&blob->head_file);
   4203 	blob->length = length;
   4204 	blob->dev = dev;
   4205 
   4206 	if (data)
   4207 		memcpy(blob->data, data, length);
   4208 
   4209 	mutex_lock(&dev->mode_config.blob_lock);
   4210 
   4211 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
   4212 	if (ret) {
   4213 		kfree(blob);
   4214 		mutex_unlock(&dev->mode_config.blob_lock);
   4215 		return ERR_PTR(-EINVAL);
   4216 	}
   4217 
   4218 	kref_init(&blob->refcount);
   4219 
   4220 	list_add_tail(&blob->head_global,
   4221 	              &dev->mode_config.property_blob_list);
   4222 
   4223 	mutex_unlock(&dev->mode_config.blob_lock);
   4224 
   4225 	return blob;
   4226 }
   4227 EXPORT_SYMBOL(drm_property_create_blob);
   4228 
   4229 /**
   4230  * drm_property_free_blob - Blob property destructor
   4231  *
   4232  * Internal free function for blob properties; must not be used directly.
   4233  *
   4234  * @kref: Reference
   4235  */
   4236 static void drm_property_free_blob(struct kref *kref)
   4237 {
   4238 	struct drm_property_blob *blob =
   4239 		container_of(kref, struct drm_property_blob, refcount);
   4240 
   4241 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
   4242 
   4243 	list_del(&blob->head_global);
   4244 	list_del(&blob->head_file);
   4245 	drm_mode_object_put(blob->dev, &blob->base);
   4246 
   4247 	kfree(blob);
   4248 }
   4249 
   4250 /**
   4251  * drm_property_unreference_blob - Unreference a blob property
   4252  *
   4253  * Drop a reference on a blob property. May free the object.
   4254  *
   4255  * @blob: Pointer to blob property
   4256  */
   4257 void drm_property_unreference_blob(struct drm_property_blob *blob)
   4258 {
   4259 	struct drm_device *dev;
   4260 
   4261 	if (!blob)
   4262 		return;
   4263 
   4264 	dev = blob->dev;
   4265 
   4266 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
   4267 
   4268 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
   4269 			   &dev->mode_config.blob_lock))
   4270 		mutex_unlock(&dev->mode_config.blob_lock);
   4271 	else
   4272 		might_lock(&dev->mode_config.blob_lock);
   4273 }
   4274 EXPORT_SYMBOL(drm_property_unreference_blob);
   4275 
   4276 /**
   4277  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
   4278  *
   4279  * Drop a reference on a blob property. May free the object. This must be
   4280  * called with blob_lock held.
   4281  *
   4282  * @blob: Pointer to blob property
   4283  */
   4284 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
   4285 {
   4286 	if (!blob)
   4287 		return;
   4288 
   4289 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
   4290 
   4291 	kref_put(&blob->refcount, drm_property_free_blob);
   4292 }
   4293 
   4294 /**
   4295  * drm_property_destroy_user_blobs - destroy all blobs created by this client
   4296  * @dev:       DRM device
   4297  * @file_priv: destroy all blobs owned by this file handle
   4298  */
   4299 void drm_property_destroy_user_blobs(struct drm_device *dev,
   4300 				     struct drm_file *file_priv)
   4301 {
   4302 	struct drm_property_blob *blob, *bt;
   4303 
   4304 	mutex_lock(&dev->mode_config.blob_lock);
   4305 
   4306 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
   4307 		list_del_init(&blob->head_file);
   4308 		drm_property_unreference_blob_locked(blob);
   4309 	}
   4310 
   4311 	mutex_unlock(&dev->mode_config.blob_lock);
   4312 }
   4313 
   4314 /**
   4315  * drm_property_reference_blob - Take a reference on an existing property
   4316  *
   4317  * Take a new reference on an existing blob property.
   4318  *
   4319  * @blob: Pointer to blob property
   4320  */
   4321 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
   4322 {
   4323 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, atomic_read(&blob->refcount.refcount));
   4324 	kref_get(&blob->refcount);
   4325 	return blob;
   4326 }
   4327 EXPORT_SYMBOL(drm_property_reference_blob);
   4328 
   4329 /*
   4330  * Like drm_property_lookup_blob, but does not return an additional reference.
   4331  * Must be called with blob_lock held.
   4332  */
   4333 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
   4334 							    uint32_t id)
   4335 {
   4336 	struct drm_mode_object *obj = NULL;
   4337 	struct drm_property_blob *blob;
   4338 
   4339 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
   4340 
   4341 	mutex_lock(&dev->mode_config.idr_mutex);
   4342 	obj = idr_find(&dev->mode_config.crtc_idr, id);
   4343 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
   4344 		blob = NULL;
   4345 	else
   4346 		blob = obj_to_blob(obj);
   4347 	mutex_unlock(&dev->mode_config.idr_mutex);
   4348 
   4349 	return blob;
   4350 }
   4351 
   4352 /**
   4353  * drm_property_lookup_blob - look up a blob property and take a reference
   4354  * @dev: drm device
   4355  * @id: id of the blob property
   4356  *
   4357  * If successful, this takes an additional reference to the blob property.
   4358  * callers need to make sure to eventually unreference the returned property
   4359  * again, using @drm_property_unreference_blob.
   4360  */
   4361 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
   4362 					           uint32_t id)
   4363 {
   4364 	struct drm_property_blob *blob;
   4365 
   4366 	mutex_lock(&dev->mode_config.blob_lock);
   4367 	blob = __drm_property_lookup_blob(dev, id);
   4368 	if (blob) {
   4369 		if (!kref_get_unless_zero(&blob->refcount))
   4370 			blob = NULL;
   4371 	}
   4372 	mutex_unlock(&dev->mode_config.blob_lock);
   4373 
   4374 	return blob;
   4375 }
   4376 EXPORT_SYMBOL(drm_property_lookup_blob);
   4377 
   4378 /**
   4379  * drm_property_replace_global_blob - atomically replace existing blob property
   4380  * @dev: drm device
   4381  * @replace: location of blob property pointer to be replaced
   4382  * @length: length of data for new blob, or 0 for no data
   4383  * @data: content for new blob, or NULL for no data
   4384  * @obj_holds_id: optional object for property holding blob ID
   4385  * @prop_holds_id: optional property holding blob ID
   4386  * @return 0 on success or error on failure
   4387  *
   4388  * This function will atomically replace a global property in the blob list,
   4389  * optionally updating a property which holds the ID of that property. It is
   4390  * guaranteed to be atomic: no caller will be allowed to see intermediate
   4391  * results, and either the entire operation will succeed and clean up the
   4392  * previous property, or it will fail and the state will be unchanged.
   4393  *
   4394  * If length is 0 or data is NULL, no new blob will be created, and the holding
   4395  * property, if specified, will be set to 0.
   4396  *
   4397  * Access to the replace pointer is assumed to be protected by the caller, e.g.
   4398  * by holding the relevant modesetting object lock for its parent.
   4399  *
   4400  * For example, a drm_connector has a 'PATH' property, which contains the ID
   4401  * of a blob property with the value of the MST path information. Calling this
   4402  * function with replace pointing to the connector's path_blob_ptr, length and
   4403  * data set for the new path information, obj_holds_id set to the connector's
   4404  * base object, and prop_holds_id set to the path property name, will perform
   4405  * a completely atomic update. The access to path_blob_ptr is protected by the
   4406  * caller holding a lock on the connector.
   4407  */
   4408 static int drm_property_replace_global_blob(struct drm_device *dev,
   4409                                             struct drm_property_blob **replace,
   4410                                             size_t length,
   4411                                             const void *data,
   4412                                             struct drm_mode_object *obj_holds_id,
   4413                                             struct drm_property *prop_holds_id)
   4414 {
   4415 	struct drm_property_blob *new_blob = NULL;
   4416 	struct drm_property_blob *old_blob = NULL;
   4417 	int ret;
   4418 
   4419 	WARN_ON(replace == NULL);
   4420 
   4421 	old_blob = *replace;
   4422 
   4423 	if (length && data) {
   4424 		new_blob = drm_property_create_blob(dev, length, data);
   4425 		if (IS_ERR(new_blob))
   4426 			return PTR_ERR(new_blob);
   4427 	}
   4428 
   4429 	/* This does not need to be synchronised with blob_lock, as the
   4430 	 * get_properties ioctl locks all modesetting objects, and
   4431 	 * obj_holds_id must be locked before calling here, so we cannot
   4432 	 * have its value out of sync with the list membership modified
   4433 	 * below under blob_lock. */
   4434 	if (obj_holds_id) {
   4435 		ret = drm_object_property_set_value(obj_holds_id,
   4436 						    prop_holds_id,
   4437 						    new_blob ?
   4438 						        new_blob->base.id : 0);
   4439 		if (ret != 0)
   4440 			goto err_created;
   4441 	}
   4442 
   4443 	drm_property_unreference_blob(old_blob);
   4444 	*replace = new_blob;
   4445 
   4446 	return 0;
   4447 
   4448 err_created:
   4449 	drm_property_unreference_blob(new_blob);
   4450 	return ret;
   4451 }
   4452 
   4453 /**
   4454  * drm_mode_getblob_ioctl - get the contents of a blob property value
   4455  * @dev: DRM device
   4456  * @data: ioctl data
   4457  * @file_priv: DRM file info
   4458  *
   4459  * This function retrieves the contents of a blob property. The value stored in
   4460  * an object's blob property is just a normal modeset object id.
   4461  *
   4462  * Called by the user via ioctl.
   4463  *
   4464  * Returns:
   4465  * Zero on success, negative errno on failure.
   4466  */
   4467 int drm_mode_getblob_ioctl(struct drm_device *dev,
   4468 			   void *data, struct drm_file *file_priv)
   4469 {
   4470 	struct drm_mode_get_blob *out_resp = data;
   4471 	struct drm_property_blob *blob;
   4472 	int ret = 0;
   4473 	void __user *blob_ptr;
   4474 
   4475 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4476 		return -EINVAL;
   4477 
   4478 	drm_modeset_lock_all(dev);
   4479 	mutex_lock(&dev->mode_config.blob_lock);
   4480 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
   4481 	if (!blob) {
   4482 		ret = -ENOENT;
   4483 		goto done;
   4484 	}
   4485 
   4486 	if (out_resp->length == blob->length) {
   4487 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
   4488 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
   4489 			ret = -EFAULT;
   4490 			goto done;
   4491 		}
   4492 	}
   4493 	out_resp->length = blob->length;
   4494 
   4495 done:
   4496 	mutex_unlock(&dev->mode_config.blob_lock);
   4497 	drm_modeset_unlock_all(dev);
   4498 	return ret;
   4499 }
   4500 
   4501 /**
   4502  * drm_mode_createblob_ioctl - create a new blob property
   4503  * @dev: DRM device
   4504  * @data: ioctl data
   4505  * @file_priv: DRM file info
   4506  *
   4507  * This function creates a new blob property with user-defined values. In order
   4508  * to give us sensible validation and checking when creating, rather than at
   4509  * every potential use, we also require a type to be provided upfront.
   4510  *
   4511  * Called by the user via ioctl.
   4512  *
   4513  * Returns:
   4514  * Zero on success, negative errno on failure.
   4515  */
   4516 int drm_mode_createblob_ioctl(struct drm_device *dev,
   4517 			      void *data, struct drm_file *file_priv)
   4518 {
   4519 	struct drm_mode_create_blob *out_resp = data;
   4520 	struct drm_property_blob *blob;
   4521 	void __user *blob_ptr;
   4522 	int ret = 0;
   4523 
   4524 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4525 		return -EINVAL;
   4526 
   4527 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
   4528 	if (IS_ERR(blob))
   4529 		return PTR_ERR(blob);
   4530 
   4531 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
   4532 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
   4533 		ret = -EFAULT;
   4534 		goto out_blob;
   4535 	}
   4536 
   4537 	/* Dropping the lock between create_blob and our access here is safe
   4538 	 * as only the same file_priv can remove the blob; at this point, it is
   4539 	 * not associated with any file_priv. */
   4540 	mutex_lock(&dev->mode_config.blob_lock);
   4541 	out_resp->blob_id = blob->base.id;
   4542 	list_add_tail(&blob->head_file, &file_priv->blobs);
   4543 	mutex_unlock(&dev->mode_config.blob_lock);
   4544 
   4545 	return 0;
   4546 
   4547 out_blob:
   4548 	drm_property_unreference_blob(blob);
   4549 	return ret;
   4550 }
   4551 
   4552 /**
   4553  * drm_mode_destroyblob_ioctl - destroy a user blob property
   4554  * @dev: DRM device
   4555  * @data: ioctl data
   4556  * @file_priv: DRM file info
   4557  *
   4558  * Destroy an existing user-defined blob property.
   4559  *
   4560  * Called by the user via ioctl.
   4561  *
   4562  * Returns:
   4563  * Zero on success, negative errno on failure.
   4564  */
   4565 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
   4566 			       void *data, struct drm_file *file_priv)
   4567 {
   4568 	struct drm_mode_destroy_blob *out_resp = data;
   4569 	struct drm_property_blob *blob = NULL, *bt;
   4570 	bool found = false;
   4571 	int ret = 0;
   4572 
   4573 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4574 		return -EINVAL;
   4575 
   4576 	mutex_lock(&dev->mode_config.blob_lock);
   4577 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
   4578 	if (!blob) {
   4579 		ret = -ENOENT;
   4580 		goto err;
   4581 	}
   4582 
   4583 	/* Ensure the property was actually created by this user. */
   4584 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
   4585 		if (bt == blob) {
   4586 			found = true;
   4587 			break;
   4588 		}
   4589 	}
   4590 
   4591 	if (!found) {
   4592 		ret = -EPERM;
   4593 		goto err;
   4594 	}
   4595 
   4596 	/* We must drop head_file here, because we may not be the last
   4597 	 * reference on the blob. */
   4598 	list_del_init(&blob->head_file);
   4599 	drm_property_unreference_blob_locked(blob);
   4600 	mutex_unlock(&dev->mode_config.blob_lock);
   4601 
   4602 	return 0;
   4603 
   4604 err:
   4605 	mutex_unlock(&dev->mode_config.blob_lock);
   4606 	return ret;
   4607 }
   4608 
   4609 /**
   4610  * drm_mode_connector_set_path_property - set tile property on connector
   4611  * @connector: connector to set property on.
   4612  * @path: path to use for property; must not be NULL.
   4613  *
   4614  * This creates a property to expose to userspace to specify a
   4615  * connector path. This is mainly used for DisplayPort MST where
   4616  * connectors have a topology and we want to allow userspace to give
   4617  * them more meaningful names.
   4618  *
   4619  * Returns:
   4620  * Zero on success, negative errno on failure.
   4621  */
   4622 int drm_mode_connector_set_path_property(struct drm_connector *connector,
   4623 					 const char *path)
   4624 {
   4625 	struct drm_device *dev = connector->dev;
   4626 	int ret;
   4627 
   4628 	ret = drm_property_replace_global_blob(dev,
   4629 	                                       &connector->path_blob_ptr,
   4630 	                                       strlen(path) + 1,
   4631 	                                       path,
   4632 	                                       &connector->base,
   4633 	                                       dev->mode_config.path_property);
   4634 	return ret;
   4635 }
   4636 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
   4637 
   4638 /**
   4639  * drm_mode_connector_set_tile_property - set tile property on connector
   4640  * @connector: connector to set property on.
   4641  *
   4642  * This looks up the tile information for a connector, and creates a
   4643  * property for userspace to parse if it exists. The property is of
   4644  * the form of 8 integers using ':' as a separator.
   4645  *
   4646  * Returns:
   4647  * Zero on success, errno on failure.
   4648  */
   4649 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
   4650 {
   4651 	struct drm_device *dev = connector->dev;
   4652 	char tile[256];
   4653 	int ret;
   4654 
   4655 	if (!connector->has_tile) {
   4656 		ret  = drm_property_replace_global_blob(dev,
   4657 		                                        &connector->tile_blob_ptr,
   4658 		                                        0,
   4659 		                                        NULL,
   4660 		                                        &connector->base,
   4661 		                                        dev->mode_config.tile_property);
   4662 		return ret;
   4663 	}
   4664 
   4665 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
   4666 		 connector->tile_group->id, connector->tile_is_single_monitor,
   4667 		 connector->num_h_tile, connector->num_v_tile,
   4668 		 connector->tile_h_loc, connector->tile_v_loc,
   4669 		 connector->tile_h_size, connector->tile_v_size);
   4670 
   4671 	ret = drm_property_replace_global_blob(dev,
   4672 	                                       &connector->tile_blob_ptr,
   4673 	                                       strlen(tile) + 1,
   4674 	                                       tile,
   4675 	                                       &connector->base,
   4676 	                                       dev->mode_config.tile_property);
   4677 	return ret;
   4678 }
   4679 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
   4680 
   4681 /**
   4682  * drm_mode_connector_update_edid_property - update the edid property of a connector
   4683  * @connector: drm connector
   4684  * @edid: new value of the edid property
   4685  *
   4686  * This function creates a new blob modeset object and assigns its id to the
   4687  * connector's edid property.
   4688  *
   4689  * Returns:
   4690  * Zero on success, negative errno on failure.
   4691  */
   4692 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
   4693 					    const struct edid *edid)
   4694 {
   4695 	struct drm_device *dev = connector->dev;
   4696 	size_t size = 0;
   4697 	int ret;
   4698 
   4699 	/* ignore requests to set edid when overridden */
   4700 	if (connector->override_edid)
   4701 		return 0;
   4702 
   4703 	if (edid)
   4704 		size = EDID_LENGTH * (1 + edid->extensions);
   4705 
   4706 	ret = drm_property_replace_global_blob(dev,
   4707 					       &connector->edid_blob_ptr,
   4708 	                                       size,
   4709 	                                       edid,
   4710 	                                       &connector->base,
   4711 	                                       dev->mode_config.edid_property);
   4712 	return ret;
   4713 }
   4714 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
   4715 
   4716 /* Some properties could refer to dynamic refcnt'd objects, or things that
   4717  * need special locking to handle lifetime issues (ie. to ensure the prop
   4718  * value doesn't become invalid part way through the property update due to
   4719  * race).  The value returned by reference via 'obj' should be passed back
   4720  * to drm_property_change_valid_put() after the property is set (and the
   4721  * object to which the property is attached has a chance to take it's own
   4722  * reference).
   4723  */
   4724 bool drm_property_change_valid_get(struct drm_property *property,
   4725 					 uint64_t value, struct drm_mode_object **ref)
   4726 {
   4727 	int i;
   4728 
   4729 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
   4730 		return false;
   4731 
   4732 	*ref = NULL;
   4733 
   4734 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
   4735 		if (value < property->values[0] || value > property->values[1])
   4736 			return false;
   4737 		return true;
   4738 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
   4739 		int64_t svalue = U642I64(value);
   4740 
   4741 		if (svalue < U642I64(property->values[0]) ||
   4742 				svalue > U642I64(property->values[1]))
   4743 			return false;
   4744 		return true;
   4745 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4746 		uint64_t valid_mask = 0;
   4747 
   4748 		for (i = 0; i < property->num_values; i++)
   4749 			valid_mask |= (1ULL << property->values[i]);
   4750 		return !(value & ~valid_mask);
   4751 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
   4752 		struct drm_property_blob *blob;
   4753 
   4754 		if (value == 0)
   4755 			return true;
   4756 
   4757 		blob = drm_property_lookup_blob(property->dev, value);
   4758 		if (blob) {
   4759 			*ref = &blob->base;
   4760 			return true;
   4761 		} else {
   4762 			return false;
   4763 		}
   4764 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
   4765 		/* a zero value for an object property translates to null: */
   4766 		if (value == 0)
   4767 			return true;
   4768 
   4769 		/* handle refcnt'd objects specially: */
   4770 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
   4771 			struct drm_framebuffer *fb;
   4772 			fb = drm_framebuffer_lookup(property->dev, value);
   4773 			if (fb) {
   4774 				*ref = &fb->base;
   4775 				return true;
   4776 			} else {
   4777 				return false;
   4778 			}
   4779 		} else {
   4780 			return _object_find(property->dev, value, property->values[0]) != NULL;
   4781 		}
   4782 	}
   4783 
   4784 	for (i = 0; i < property->num_values; i++)
   4785 		if (property->values[i] == value)
   4786 			return true;
   4787 	return false;
   4788 }
   4789 
   4790 void drm_property_change_valid_put(struct drm_property *property,
   4791 		struct drm_mode_object *ref)
   4792 {
   4793 	if (!ref)
   4794 		return;
   4795 
   4796 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
   4797 		if (property->values[0] == DRM_MODE_OBJECT_FB)
   4798 			drm_framebuffer_unreference(obj_to_fb(ref));
   4799 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
   4800 		drm_property_unreference_blob(obj_to_blob(ref));
   4801 }
   4802 
   4803 /**
   4804  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
   4805  * @dev: DRM device
   4806  * @data: ioctl data
   4807  * @file_priv: DRM file info
   4808  *
   4809  * This function sets the current value for a connectors's property. It also
   4810  * calls into a driver's ->set_property callback to update the hardware state
   4811  *
   4812  * Called by the user via ioctl.
   4813  *
   4814  * Returns:
   4815  * Zero on success, negative errno on failure.
   4816  */
   4817 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
   4818 				       void *data, struct drm_file *file_priv)
   4819 {
   4820 	struct drm_mode_connector_set_property *conn_set_prop = data;
   4821 	struct drm_mode_obj_set_property obj_set_prop = {
   4822 		.value = conn_set_prop->value,
   4823 		.prop_id = conn_set_prop->prop_id,
   4824 		.obj_id = conn_set_prop->connector_id,
   4825 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
   4826 	};
   4827 
   4828 	/* It does all the locking and checking we need */
   4829 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
   4830 }
   4831 
   4832 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
   4833 					   struct drm_property *property,
   4834 					   uint64_t value)
   4835 {
   4836 	int ret = -EINVAL;
   4837 	struct drm_connector *connector = obj_to_connector(obj);
   4838 
   4839 	/* Do DPMS ourselves */
   4840 	if (property == connector->dev->mode_config.dpms_property) {
   4841 		ret = 0;
   4842 		if (connector->funcs->dpms)
   4843 			ret = (*connector->funcs->dpms)(connector, (int)value);
   4844 	} else if (connector->funcs->set_property)
   4845 		ret = connector->funcs->set_property(connector, property, value);
   4846 
   4847 	/* store the property value if successful */
   4848 	if (!ret)
   4849 		drm_object_property_set_value(&connector->base, property, value);
   4850 	return ret;
   4851 }
   4852 
   4853 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
   4854 				      struct drm_property *property,
   4855 				      uint64_t value)
   4856 {
   4857 	int ret = -EINVAL;
   4858 	struct drm_crtc *crtc = obj_to_crtc(obj);
   4859 
   4860 	if (crtc->funcs->set_property)
   4861 		ret = crtc->funcs->set_property(crtc, property, value);
   4862 	if (!ret)
   4863 		drm_object_property_set_value(obj, property, value);
   4864 
   4865 	return ret;
   4866 }
   4867 
   4868 /**
   4869  * drm_mode_plane_set_obj_prop - set the value of a property
   4870  * @plane: drm plane object to set property value for
   4871  * @property: property to set
   4872  * @value: value the property should be set to
   4873  *
   4874  * This functions sets a given property on a given plane object. This function
   4875  * calls the driver's ->set_property callback and changes the software state of
   4876  * the property if the callback succeeds.
   4877  *
   4878  * Returns:
   4879  * Zero on success, error code on failure.
   4880  */
   4881 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
   4882 				struct drm_property *property,
   4883 				uint64_t value)
   4884 {
   4885 	int ret = -EINVAL;
   4886 	struct drm_mode_object *obj = &plane->base;
   4887 
   4888 	if (plane->funcs->set_property)
   4889 		ret = plane->funcs->set_property(plane, property, value);
   4890 	if (!ret)
   4891 		drm_object_property_set_value(obj, property, value);
   4892 
   4893 	return ret;
   4894 }
   4895 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
   4896 
   4897 /**
   4898  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
   4899  * @dev: DRM device
   4900  * @data: ioctl data
   4901  * @file_priv: DRM file info
   4902  *
   4903  * This function retrieves the current value for an object's property. Compared
   4904  * to the connector specific ioctl this one is extended to also work on crtc and
   4905  * plane objects.
   4906  *
   4907  * Called by the user via ioctl.
   4908  *
   4909  * Returns:
   4910  * Zero on success, negative errno on failure.
   4911  */
   4912 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
   4913 				      struct drm_file *file_priv)
   4914 {
   4915 	struct drm_mode_obj_get_properties *arg = data;
   4916 	struct drm_mode_object *obj;
   4917 	int ret = 0;
   4918 
   4919 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4920 		return -EINVAL;
   4921 
   4922 	drm_modeset_lock_all(dev);
   4923 
   4924 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
   4925 	if (!obj) {
   4926 		ret = -ENOENT;
   4927 		goto out;
   4928 	}
   4929 	if (!obj->properties) {
   4930 		ret = -EINVAL;
   4931 		goto out;
   4932 	}
   4933 
   4934 	ret = get_properties(obj, file_priv->atomic,
   4935 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
   4936 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
   4937 			&arg->count_props);
   4938 
   4939 out:
   4940 	drm_modeset_unlock_all(dev);
   4941 	return ret;
   4942 }
   4943 
   4944 /**
   4945  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
   4946  * @dev: DRM device
   4947  * @data: ioctl data
   4948  * @file_priv: DRM file info
   4949  *
   4950  * This function sets the current value for an object's property. It also calls
   4951  * into a driver's ->set_property callback to update the hardware state.
   4952  * Compared to the connector specific ioctl this one is extended to also work on
   4953  * crtc and plane objects.
   4954  *
   4955  * Called by the user via ioctl.
   4956  *
   4957  * Returns:
   4958  * Zero on success, negative errno on failure.
   4959  */
   4960 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
   4961 				    struct drm_file *file_priv)
   4962 {
   4963 	struct drm_mode_obj_set_property *arg = data;
   4964 	struct drm_mode_object *arg_obj;
   4965 	struct drm_mode_object *prop_obj;
   4966 	struct drm_property *property;
   4967 	int i, ret = -EINVAL;
   4968 	struct drm_mode_object *ref;
   4969 
   4970 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4971 		return -EINVAL;
   4972 
   4973 	drm_modeset_lock_all(dev);
   4974 
   4975 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
   4976 	if (!arg_obj) {
   4977 		ret = -ENOENT;
   4978 		goto out;
   4979 	}
   4980 	if (!arg_obj->properties)
   4981 		goto out;
   4982 
   4983 	for (i = 0; i < arg_obj->properties->count; i++)
   4984 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
   4985 			break;
   4986 
   4987 	if (i == arg_obj->properties->count)
   4988 		goto out;
   4989 
   4990 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
   4991 					DRM_MODE_OBJECT_PROPERTY);
   4992 	if (!prop_obj) {
   4993 		ret = -ENOENT;
   4994 		goto out;
   4995 	}
   4996 	property = obj_to_property(prop_obj);
   4997 
   4998 	if (!drm_property_change_valid_get(property, arg->value, &ref))
   4999 		goto out;
   5000 
   5001 	switch (arg_obj->type) {
   5002 	case DRM_MODE_OBJECT_CONNECTOR:
   5003 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
   5004 						      arg->value);
   5005 		break;
   5006 	case DRM_MODE_OBJECT_CRTC:
   5007 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
   5008 		break;
   5009 	case DRM_MODE_OBJECT_PLANE:
   5010 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
   5011 						  property, arg->value);
   5012 		break;
   5013 	}
   5014 
   5015 	drm_property_change_valid_put(property, ref);
   5016 
   5017 out:
   5018 	drm_modeset_unlock_all(dev);
   5019 	return ret;
   5020 }
   5021 
   5022 /**
   5023  * drm_mode_connector_attach_encoder - attach a connector to an encoder
   5024  * @connector: connector to attach
   5025  * @encoder: encoder to attach @connector to
   5026  *
   5027  * This function links up a connector to an encoder. Note that the routing
   5028  * restrictions between encoders and crtcs are exposed to userspace through the
   5029  * possible_clones and possible_crtcs bitmasks.
   5030  *
   5031  * Returns:
   5032  * Zero on success, negative errno on failure.
   5033  */
   5034 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
   5035 				      struct drm_encoder *encoder)
   5036 {
   5037 	int i;
   5038 
   5039 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
   5040 		if (connector->encoder_ids[i] == 0) {
   5041 			connector->encoder_ids[i] = encoder->base.id;
   5042 			return 0;
   5043 		}
   5044 	}
   5045 	return -ENOMEM;
   5046 }
   5047 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
   5048 
   5049 /**
   5050  * drm_mode_crtc_set_gamma_size - set the gamma table size
   5051  * @crtc: CRTC to set the gamma table size for
   5052  * @gamma_size: size of the gamma table
   5053  *
   5054  * Drivers which support gamma tables should set this to the supported gamma
   5055  * table size when initializing the CRTC. Currently the drm core only supports a
   5056  * fixed gamma table size.
   5057  *
   5058  * Returns:
   5059  * Zero on success, negative errno on failure.
   5060  */
   5061 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
   5062 				 int gamma_size)
   5063 {
   5064 	crtc->gamma_size = gamma_size;
   5065 
   5066 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
   5067 				    GFP_KERNEL);
   5068 	if (!crtc->gamma_store) {
   5069 		crtc->gamma_size = 0;
   5070 		return -ENOMEM;
   5071 	}
   5072 
   5073 	return 0;
   5074 }
   5075 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
   5076 
   5077 /**
   5078  * drm_mode_gamma_set_ioctl - set the gamma table
   5079  * @dev: DRM device
   5080  * @data: ioctl data
   5081  * @file_priv: DRM file info
   5082  *
   5083  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
   5084  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
   5085  *
   5086  * Called by the user via ioctl.
   5087  *
   5088  * Returns:
   5089  * Zero on success, negative errno on failure.
   5090  */
   5091 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
   5092 			     void *data, struct drm_file *file_priv)
   5093 {
   5094 	struct drm_mode_crtc_lut *crtc_lut = data;
   5095 	struct drm_crtc *crtc;
   5096 	void *r_base, *g_base, *b_base;
   5097 	int size;
   5098 	int ret = 0;
   5099 
   5100 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5101 		return -EINVAL;
   5102 
   5103 	drm_modeset_lock_all(dev);
   5104 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
   5105 	if (!crtc) {
   5106 		ret = -ENOENT;
   5107 		goto out;
   5108 	}
   5109 
   5110 	if (crtc->funcs->gamma_set == NULL) {
   5111 		ret = -ENOSYS;
   5112 		goto out;
   5113 	}
   5114 
   5115 	/* memcpy into gamma store */
   5116 	if (crtc_lut->gamma_size != crtc->gamma_size) {
   5117 		ret = -EINVAL;
   5118 		goto out;
   5119 	}
   5120 
   5121 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
   5122 	r_base = crtc->gamma_store;
   5123 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
   5124 		ret = -EFAULT;
   5125 		goto out;
   5126 	}
   5127 
   5128 	g_base = r_base + size;
   5129 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
   5130 		ret = -EFAULT;
   5131 		goto out;
   5132 	}
   5133 
   5134 	b_base = g_base + size;
   5135 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
   5136 		ret = -EFAULT;
   5137 		goto out;
   5138 	}
   5139 
   5140 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
   5141 
   5142 out:
   5143 	drm_modeset_unlock_all(dev);
   5144 	return ret;
   5145 
   5146 }
   5147 
   5148 /**
   5149  * drm_mode_gamma_get_ioctl - get the gamma table
   5150  * @dev: DRM device
   5151  * @data: ioctl data
   5152  * @file_priv: DRM file info
   5153  *
   5154  * Copy the current gamma table into the storage provided. This also provides
   5155  * the gamma table size the driver expects, which can be used to size the
   5156  * allocated storage.
   5157  *
   5158  * Called by the user via ioctl.
   5159  *
   5160  * Returns:
   5161  * Zero on success, negative errno on failure.
   5162  */
   5163 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
   5164 			     void *data, struct drm_file *file_priv)
   5165 {
   5166 	struct drm_mode_crtc_lut *crtc_lut = data;
   5167 	struct drm_crtc *crtc;
   5168 	void *r_base, *g_base, *b_base;
   5169 	int size;
   5170 	int ret = 0;
   5171 
   5172 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5173 		return -EINVAL;
   5174 
   5175 	drm_modeset_lock_all(dev);
   5176 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
   5177 	if (!crtc) {
   5178 		ret = -ENOENT;
   5179 		goto out;
   5180 	}
   5181 
   5182 	/* memcpy into gamma store */
   5183 	if (crtc_lut->gamma_size != crtc->gamma_size) {
   5184 		ret = -EINVAL;
   5185 		goto out;
   5186 	}
   5187 
   5188 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
   5189 	r_base = crtc->gamma_store;
   5190 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
   5191 		ret = -EFAULT;
   5192 		goto out;
   5193 	}
   5194 
   5195 	g_base = r_base + size;
   5196 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
   5197 		ret = -EFAULT;
   5198 		goto out;
   5199 	}
   5200 
   5201 	b_base = g_base + size;
   5202 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
   5203 		ret = -EFAULT;
   5204 		goto out;
   5205 	}
   5206 out:
   5207 	drm_modeset_unlock_all(dev);
   5208 	return ret;
   5209 }
   5210 
   5211 /**
   5212  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
   5213  * @dev: DRM device
   5214  * @data: ioctl data
   5215  * @file_priv: DRM file info
   5216  *
   5217  * This schedules an asynchronous update on a given CRTC, called page flip.
   5218  * Optionally a drm event is generated to signal the completion of the event.
   5219  * Generic drivers cannot assume that a pageflip with changed framebuffer
   5220  * properties (including driver specific metadata like tiling layout) will work,
   5221  * but some drivers support e.g. pixel format changes through the pageflip
   5222  * ioctl.
   5223  *
   5224  * Called by the user via ioctl.
   5225  *
   5226  * Returns:
   5227  * Zero on success, negative errno on failure.
   5228  */
   5229 int drm_mode_page_flip_ioctl(struct drm_device *dev,
   5230 			     void *data, struct drm_file *file_priv)
   5231 {
   5232 	struct drm_mode_crtc_page_flip *page_flip = data;
   5233 	struct drm_crtc *crtc;
   5234 	struct drm_framebuffer *fb = NULL;
   5235 	struct drm_pending_vblank_event *e = NULL;
   5236 	unsigned long flags;
   5237 	int ret = -EINVAL;
   5238 
   5239 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5240 		return -EINVAL;
   5241 
   5242 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
   5243 	    page_flip->reserved != 0)
   5244 		return -EINVAL;
   5245 
   5246 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
   5247 		return -EINVAL;
   5248 
   5249 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
   5250 	if (!crtc)
   5251 		return -ENOENT;
   5252 
   5253 	drm_modeset_lock_crtc(crtc, crtc->primary);
   5254 	if (crtc->primary->fb == NULL) {
   5255 		/* The framebuffer is currently unbound, presumably
   5256 		 * due to a hotplug event, that userspace has not
   5257 		 * yet discovered.
   5258 		 */
   5259 		ret = -EBUSY;
   5260 		goto out;
   5261 	}
   5262 
   5263 	if (crtc->funcs->page_flip == NULL)
   5264 		goto out;
   5265 
   5266 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
   5267 	if (!fb) {
   5268 		ret = -ENOENT;
   5269 		goto out;
   5270 	}
   5271 
   5272 	if (crtc->state) {
   5273 		const struct drm_plane_state *state = crtc->primary->state;
   5274 
   5275 		ret = check_src_coords(state->src_x, state->src_y,
   5276 				       state->src_w, state->src_h, fb);
   5277 	} else {
   5278 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
   5279 	}
   5280 	if (ret)
   5281 		goto out;
   5282 
   5283 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
   5284 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
   5285 		ret = -EINVAL;
   5286 		goto out;
   5287 	}
   5288 
   5289 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
   5290 		ret = -ENOMEM;
   5291 		spin_lock_irqsave(&dev->event_lock, flags);
   5292 		if (file_priv->event_space < sizeof(e->event)) {
   5293 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5294 			goto out;
   5295 		}
   5296 		file_priv->event_space -= sizeof(e->event);
   5297 		spin_unlock_irqrestore(&dev->event_lock, flags);
   5298 
   5299 		e = kzalloc(sizeof(*e), GFP_KERNEL);
   5300 		if (e == NULL) {
   5301 			spin_lock_irqsave(&dev->event_lock, flags);
   5302 			file_priv->event_space += sizeof(e->event);
   5303 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5304 			goto out;
   5305 		}
   5306 
   5307 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
   5308 		e->event.base.length = sizeof(e->event);
   5309 		e->event.user_data = page_flip->user_data;
   5310 		e->base.event = &e->event.base;
   5311 		e->base.file_priv = file_priv;
   5312 		e->base.destroy =
   5313 			(void (*) (struct drm_pending_event *)) kfree;
   5314 	}
   5315 
   5316 	crtc->primary->old_fb = crtc->primary->fb;
   5317 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
   5318 	if (ret) {
   5319 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
   5320 			spin_lock_irqsave(&dev->event_lock, flags);
   5321 			file_priv->event_space += sizeof(e->event);
   5322 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5323 			kfree(e);
   5324 		}
   5325 		/* Keep the old fb, don't unref it. */
   5326 		crtc->primary->old_fb = NULL;
   5327 	} else {
   5328 		crtc->primary->fb = fb;
   5329 		/* Unref only the old framebuffer. */
   5330 		fb = NULL;
   5331 	}
   5332 
   5333 out:
   5334 	if (fb)
   5335 		drm_framebuffer_unreference(fb);
   5336 	if (crtc->primary->old_fb)
   5337 		drm_framebuffer_unreference(crtc->primary->old_fb);
   5338 	crtc->primary->old_fb = NULL;
   5339 	drm_modeset_unlock_crtc(crtc);
   5340 
   5341 	return ret;
   5342 }
   5343 
   5344 /**
   5345  * drm_mode_config_reset - call ->reset callbacks
   5346  * @dev: drm device
   5347  *
   5348  * This functions calls all the crtc's, encoder's and connector's ->reset
   5349  * callback. Drivers can use this in e.g. their driver load or resume code to
   5350  * reset hardware and software state.
   5351  */
   5352 void drm_mode_config_reset(struct drm_device *dev)
   5353 {
   5354 	struct drm_crtc *crtc;
   5355 	struct drm_plane *plane;
   5356 	struct drm_encoder *encoder;
   5357 	struct drm_connector *connector;
   5358 
   5359 	drm_for_each_plane(plane, dev)
   5360 		if (plane->funcs->reset)
   5361 			plane->funcs->reset(plane);
   5362 
   5363 	drm_for_each_crtc(crtc, dev)
   5364 		if (crtc->funcs->reset)
   5365 			crtc->funcs->reset(crtc);
   5366 
   5367 	drm_for_each_encoder(encoder, dev)
   5368 		if (encoder->funcs->reset)
   5369 			encoder->funcs->reset(encoder);
   5370 
   5371 	mutex_lock(&dev->mode_config.mutex);
   5372 	drm_for_each_connector(connector, dev)
   5373 		if (connector->funcs->reset)
   5374 			connector->funcs->reset(connector);
   5375 	mutex_unlock(&dev->mode_config.mutex);
   5376 }
   5377 EXPORT_SYMBOL(drm_mode_config_reset);
   5378 
   5379 /**
   5380  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
   5381  * @dev: DRM device
   5382  * @data: ioctl data
   5383  * @file_priv: DRM file info
   5384  *
   5385  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
   5386  * TTM or something else entirely) and returns the resulting buffer handle. This
   5387  * handle can then be wrapped up into a framebuffer modeset object.
   5388  *
   5389  * Note that userspace is not allowed to use such objects for render
   5390  * acceleration - drivers must create their own private ioctls for such a use
   5391  * case.
   5392  *
   5393  * Called by the user via ioctl.
   5394  *
   5395  * Returns:
   5396  * Zero on success, negative errno on failure.
   5397  */
   5398 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
   5399 			       void *data, struct drm_file *file_priv)
   5400 {
   5401 	struct drm_mode_create_dumb *args = data;
   5402 	u32 cpp, stride, size;
   5403 
   5404 	if (!dev->driver->dumb_create)
   5405 		return -ENOSYS;
   5406 	if (!args->width || !args->height || !args->bpp)
   5407 		return -EINVAL;
   5408 
   5409 	/* overflow checks for 32bit size calculations */
   5410 	/* NOTE: DIV_ROUND_UP() can overflow */
   5411 	cpp = DIV_ROUND_UP(args->bpp, 8);
   5412 	if (!cpp || cpp > 0xffffffffU / args->width)
   5413 		return -EINVAL;
   5414 	stride = cpp * args->width;
   5415 	if (args->height > 0xffffffffU / stride)
   5416 		return -EINVAL;
   5417 
   5418 	/* test for wrap-around */
   5419 	size = args->height * stride;
   5420 	if (PAGE_ALIGN(size) == 0)
   5421 		return -EINVAL;
   5422 
   5423 	/*
   5424 	 * handle, pitch and size are output parameters. Zero them out to
   5425 	 * prevent drivers from accidentally using uninitialized data. Since
   5426 	 * not all existing userspace is clearing these fields properly we
   5427 	 * cannot reject IOCTL with garbage in them.
   5428 	 */
   5429 	args->handle = 0;
   5430 	args->pitch = 0;
   5431 	args->size = 0;
   5432 
   5433 	return dev->driver->dumb_create(file_priv, dev, args);
   5434 }
   5435 
   5436 /**
   5437  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
   5438  * @dev: DRM device
   5439  * @data: ioctl data
   5440  * @file_priv: DRM file info
   5441  *
   5442  * Allocate an offset in the drm device node's address space to be able to
   5443  * memory map a dumb buffer.
   5444  *
   5445  * Called by the user via ioctl.
   5446  *
   5447  * Returns:
   5448  * Zero on success, negative errno on failure.
   5449  */
   5450 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
   5451 			     void *data, struct drm_file *file_priv)
   5452 {
   5453 	struct drm_mode_map_dumb *args = data;
   5454 
   5455 	/* call driver ioctl to get mmap offset */
   5456 	if (!dev->driver->dumb_map_offset)
   5457 		return -ENOSYS;
   5458 
   5459 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
   5460 }
   5461 
   5462 /**
   5463  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
   5464  * @dev: DRM device
   5465  * @data: ioctl data
   5466  * @file_priv: DRM file info
   5467  *
   5468  * This destroys the userspace handle for the given dumb backing storage buffer.
   5469  * Since buffer objects must be reference counted in the kernel a buffer object
   5470  * won't be immediately freed if a framebuffer modeset object still uses it.
   5471  *
   5472  * Called by the user via ioctl.
   5473  *
   5474  * Returns:
   5475  * Zero on success, negative errno on failure.
   5476  */
   5477 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
   5478 				void *data, struct drm_file *file_priv)
   5479 {
   5480 	struct drm_mode_destroy_dumb *args = data;
   5481 
   5482 	if (!dev->driver->dumb_destroy)
   5483 		return -ENOSYS;
   5484 
   5485 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
   5486 }
   5487 
   5488 /**
   5489  * drm_fb_get_bpp_depth - get the bpp/depth values for format
   5490  * @format: pixel format (DRM_FORMAT_*)
   5491  * @depth: storage for the depth value
   5492  * @bpp: storage for the bpp value
   5493  *
   5494  * This only supports RGB formats here for compat with code that doesn't use
   5495  * pixel formats directly yet.
   5496  */
   5497 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
   5498 			  int *bpp)
   5499 {
   5500 	switch (format) {
   5501 	case DRM_FORMAT_C8:
   5502 	case DRM_FORMAT_RGB332:
   5503 	case DRM_FORMAT_BGR233:
   5504 		*depth = 8;
   5505 		*bpp = 8;
   5506 		break;
   5507 	case DRM_FORMAT_XRGB1555:
   5508 	case DRM_FORMAT_XBGR1555:
   5509 	case DRM_FORMAT_RGBX5551:
   5510 	case DRM_FORMAT_BGRX5551:
   5511 	case DRM_FORMAT_ARGB1555:
   5512 	case DRM_FORMAT_ABGR1555:
   5513 	case DRM_FORMAT_RGBA5551:
   5514 	case DRM_FORMAT_BGRA5551:
   5515 		*depth = 15;
   5516 		*bpp = 16;
   5517 		break;
   5518 	case DRM_FORMAT_RGB565:
   5519 	case DRM_FORMAT_BGR565:
   5520 		*depth = 16;
   5521 		*bpp = 16;
   5522 		break;
   5523 	case DRM_FORMAT_RGB888:
   5524 	case DRM_FORMAT_BGR888:
   5525 		*depth = 24;
   5526 		*bpp = 24;
   5527 		break;
   5528 	case DRM_FORMAT_XRGB8888:
   5529 	case DRM_FORMAT_XBGR8888:
   5530 	case DRM_FORMAT_RGBX8888:
   5531 	case DRM_FORMAT_BGRX8888:
   5532 		*depth = 24;
   5533 		*bpp = 32;
   5534 		break;
   5535 	case DRM_FORMAT_XRGB2101010:
   5536 	case DRM_FORMAT_XBGR2101010:
   5537 	case DRM_FORMAT_RGBX1010102:
   5538 	case DRM_FORMAT_BGRX1010102:
   5539 	case DRM_FORMAT_ARGB2101010:
   5540 	case DRM_FORMAT_ABGR2101010:
   5541 	case DRM_FORMAT_RGBA1010102:
   5542 	case DRM_FORMAT_BGRA1010102:
   5543 		*depth = 30;
   5544 		*bpp = 32;
   5545 		break;
   5546 	case DRM_FORMAT_ARGB8888:
   5547 	case DRM_FORMAT_ABGR8888:
   5548 	case DRM_FORMAT_RGBA8888:
   5549 	case DRM_FORMAT_BGRA8888:
   5550 		*depth = 32;
   5551 		*bpp = 32;
   5552 		break;
   5553 	default:
   5554 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
   5555 			      drm_get_format_name(format));
   5556 		*depth = 0;
   5557 		*bpp = 0;
   5558 		break;
   5559 	}
   5560 }
   5561 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
   5562 
   5563 /**
   5564  * drm_format_num_planes - get the number of planes for format
   5565  * @format: pixel format (DRM_FORMAT_*)
   5566  *
   5567  * Returns:
   5568  * The number of planes used by the specified pixel format.
   5569  */
   5570 int drm_format_num_planes(uint32_t format)
   5571 {
   5572 	switch (format) {
   5573 	case DRM_FORMAT_YUV410:
   5574 	case DRM_FORMAT_YVU410:
   5575 	case DRM_FORMAT_YUV411:
   5576 	case DRM_FORMAT_YVU411:
   5577 	case DRM_FORMAT_YUV420:
   5578 	case DRM_FORMAT_YVU420:
   5579 	case DRM_FORMAT_YUV422:
   5580 	case DRM_FORMAT_YVU422:
   5581 	case DRM_FORMAT_YUV444:
   5582 	case DRM_FORMAT_YVU444:
   5583 		return 3;
   5584 	case DRM_FORMAT_NV12:
   5585 	case DRM_FORMAT_NV21:
   5586 	case DRM_FORMAT_NV16:
   5587 	case DRM_FORMAT_NV61:
   5588 	case DRM_FORMAT_NV24:
   5589 	case DRM_FORMAT_NV42:
   5590 		return 2;
   5591 	default:
   5592 		return 1;
   5593 	}
   5594 }
   5595 EXPORT_SYMBOL(drm_format_num_planes);
   5596 
   5597 /**
   5598  * drm_format_plane_cpp - determine the bytes per pixel value
   5599  * @format: pixel format (DRM_FORMAT_*)
   5600  * @plane: plane index
   5601  *
   5602  * Returns:
   5603  * The bytes per pixel value for the specified plane.
   5604  */
   5605 int drm_format_plane_cpp(uint32_t format, int plane)
   5606 {
   5607 	unsigned int depth;
   5608 	int bpp;
   5609 
   5610 	if (plane >= drm_format_num_planes(format))
   5611 		return 0;
   5612 
   5613 	switch (format) {
   5614 	case DRM_FORMAT_YUYV:
   5615 	case DRM_FORMAT_YVYU:
   5616 	case DRM_FORMAT_UYVY:
   5617 	case DRM_FORMAT_VYUY:
   5618 		return 2;
   5619 	case DRM_FORMAT_NV12:
   5620 	case DRM_FORMAT_NV21:
   5621 	case DRM_FORMAT_NV16:
   5622 	case DRM_FORMAT_NV61:
   5623 	case DRM_FORMAT_NV24:
   5624 	case DRM_FORMAT_NV42:
   5625 		return plane ? 2 : 1;
   5626 	case DRM_FORMAT_YUV410:
   5627 	case DRM_FORMAT_YVU410:
   5628 	case DRM_FORMAT_YUV411:
   5629 	case DRM_FORMAT_YVU411:
   5630 	case DRM_FORMAT_YUV420:
   5631 	case DRM_FORMAT_YVU420:
   5632 	case DRM_FORMAT_YUV422:
   5633 	case DRM_FORMAT_YVU422:
   5634 	case DRM_FORMAT_YUV444:
   5635 	case DRM_FORMAT_YVU444:
   5636 		return 1;
   5637 	default:
   5638 		drm_fb_get_bpp_depth(format, &depth, &bpp);
   5639 		return bpp >> 3;
   5640 	}
   5641 }
   5642 EXPORT_SYMBOL(drm_format_plane_cpp);
   5643 
   5644 /**
   5645  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
   5646  * @format: pixel format (DRM_FORMAT_*)
   5647  *
   5648  * Returns:
   5649  * The horizontal chroma subsampling factor for the
   5650  * specified pixel format.
   5651  */
   5652 int drm_format_horz_chroma_subsampling(uint32_t format)
   5653 {
   5654 	switch (format) {
   5655 	case DRM_FORMAT_YUV411:
   5656 	case DRM_FORMAT_YVU411:
   5657 	case DRM_FORMAT_YUV410:
   5658 	case DRM_FORMAT_YVU410:
   5659 		return 4;
   5660 	case DRM_FORMAT_YUYV:
   5661 	case DRM_FORMAT_YVYU:
   5662 	case DRM_FORMAT_UYVY:
   5663 	case DRM_FORMAT_VYUY:
   5664 	case DRM_FORMAT_NV12:
   5665 	case DRM_FORMAT_NV21:
   5666 	case DRM_FORMAT_NV16:
   5667 	case DRM_FORMAT_NV61:
   5668 	case DRM_FORMAT_YUV422:
   5669 	case DRM_FORMAT_YVU422:
   5670 	case DRM_FORMAT_YUV420:
   5671 	case DRM_FORMAT_YVU420:
   5672 		return 2;
   5673 	default:
   5674 		return 1;
   5675 	}
   5676 }
   5677 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
   5678 
   5679 /**
   5680  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
   5681  * @format: pixel format (DRM_FORMAT_*)
   5682  *
   5683  * Returns:
   5684  * The vertical chroma subsampling factor for the
   5685  * specified pixel format.
   5686  */
   5687 int drm_format_vert_chroma_subsampling(uint32_t format)
   5688 {
   5689 	switch (format) {
   5690 	case DRM_FORMAT_YUV410:
   5691 	case DRM_FORMAT_YVU410:
   5692 		return 4;
   5693 	case DRM_FORMAT_YUV420:
   5694 	case DRM_FORMAT_YVU420:
   5695 	case DRM_FORMAT_NV12:
   5696 	case DRM_FORMAT_NV21:
   5697 		return 2;
   5698 	default:
   5699 		return 1;
   5700 	}
   5701 }
   5702 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
   5703 
   5704 /**
   5705  * drm_rotation_simplify() - Try to simplify the rotation
   5706  * @rotation: Rotation to be simplified
   5707  * @supported_rotations: Supported rotations
   5708  *
   5709  * Attempt to simplify the rotation to a form that is supported.
   5710  * Eg. if the hardware supports everything except DRM_REFLECT_X
   5711  * one could call this function like this:
   5712  *
   5713  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
   5714  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
   5715  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
   5716  *
   5717  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
   5718  * transforms the hardware supports, this function may not
   5719  * be able to produce a supported transform, so the caller should
   5720  * check the result afterwards.
   5721  */
   5722 unsigned int drm_rotation_simplify(unsigned int rotation,
   5723 				   unsigned int supported_rotations)
   5724 {
   5725 	if (rotation & ~supported_rotations) {
   5726 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
   5727 		rotation = (rotation & DRM_REFLECT_MASK) |
   5728 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
   5729 	}
   5730 
   5731 	return rotation;
   5732 }
   5733 EXPORT_SYMBOL(drm_rotation_simplify);
   5734 
   5735 /**
   5736  * drm_mode_config_init - initialize DRM mode_configuration structure
   5737  * @dev: DRM device
   5738  *
   5739  * Initialize @dev's mode_config structure, used for tracking the graphics
   5740  * configuration of @dev.
   5741  *
   5742  * Since this initializes the modeset locks, no locking is possible. Which is no
   5743  * problem, since this should happen single threaded at init time. It is the
   5744  * driver's problem to ensure this guarantee.
   5745  *
   5746  */
   5747 void drm_mode_config_init(struct drm_device *dev)
   5748 {
   5749 	mutex_init(&dev->mode_config.mutex);
   5750 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
   5751 	mutex_init(&dev->mode_config.idr_mutex);
   5752 	mutex_init(&dev->mode_config.fb_lock);
   5753 	mutex_init(&dev->mode_config.blob_lock);
   5754 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
   5755 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
   5756 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
   5757 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
   5758 	INIT_LIST_HEAD(&dev->mode_config.property_list);
   5759 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
   5760 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
   5761 	idr_init(&dev->mode_config.crtc_idr);
   5762 	idr_init(&dev->mode_config.tile_idr);
   5763 
   5764 	drm_modeset_lock_all(dev);
   5765 	drm_mode_create_standard_properties(dev);
   5766 	drm_modeset_unlock_all(dev);
   5767 
   5768 	/* Just to be sure */
   5769 	dev->mode_config.num_fb = 0;
   5770 	dev->mode_config.num_connector = 0;
   5771 	dev->mode_config.num_crtc = 0;
   5772 	dev->mode_config.num_encoder = 0;
   5773 	dev->mode_config.num_overlay_plane = 0;
   5774 	dev->mode_config.num_total_plane = 0;
   5775 }
   5776 EXPORT_SYMBOL(drm_mode_config_init);
   5777 
   5778 /**
   5779  * drm_mode_config_cleanup - free up DRM mode_config info
   5780  * @dev: DRM device
   5781  *
   5782  * Free up all the connectors and CRTCs associated with this DRM device, then
   5783  * free up the framebuffers and associated buffer objects.
   5784  *
   5785  * Note that since this /should/ happen single-threaded at driver/device
   5786  * teardown time, no locking is required. It's the driver's job to ensure that
   5787  * this guarantee actually holds true.
   5788  *
   5789  * FIXME: cleanup any dangling user buffer objects too
   5790  */
   5791 void drm_mode_config_cleanup(struct drm_device *dev)
   5792 {
   5793 	struct drm_connector *connector, *ot;
   5794 	struct drm_crtc *crtc, *ct;
   5795 	struct drm_encoder *encoder, *enct;
   5796 	struct drm_framebuffer *fb, *fbt;
   5797 	struct drm_property *property, *pt;
   5798 	struct drm_property_blob *blob, *bt;
   5799 	struct drm_plane *plane, *plt;
   5800 
   5801 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
   5802 				 head) {
   5803 		encoder->funcs->destroy(encoder);
   5804 	}
   5805 
   5806 	list_for_each_entry_safe(connector, ot,
   5807 				 &dev->mode_config.connector_list, head) {
   5808 		connector->funcs->destroy(connector);
   5809 	}
   5810 
   5811 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
   5812 				 head) {
   5813 		drm_property_destroy(dev, property);
   5814 	}
   5815 
   5816 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
   5817 				 head_global) {
   5818 		drm_property_unreference_blob(blob);
   5819 	}
   5820 
   5821 	/*
   5822 	 * Single-threaded teardown context, so it's not required to grab the
   5823 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
   5824 	 * would actually deadlock with the drm_framebuffer_cleanup function.
   5825 	 *
   5826 	 * Also, if there are any framebuffers left, that's a driver leak now,
   5827 	 * so politely WARN about this.
   5828 	 */
   5829 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
   5830 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
   5831 		drm_framebuffer_free(&fb->refcount);
   5832 	}
   5833 
   5834 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
   5835 				 head) {
   5836 		plane->funcs->destroy(plane);
   5837 	}
   5838 
   5839 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
   5840 		crtc->funcs->destroy(crtc);
   5841 	}
   5842 
   5843 	idr_destroy(&dev->mode_config.tile_idr);
   5844 	idr_destroy(&dev->mode_config.crtc_idr);
   5845 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
   5846 }
   5847 EXPORT_SYMBOL(drm_mode_config_cleanup);
   5848 
   5849 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
   5850 						       unsigned int supported_rotations)
   5851 {
   5852 	static const struct drm_prop_enum_list props[] = {
   5853 		{ DRM_ROTATE_0,   "rotate-0" },
   5854 		{ DRM_ROTATE_90,  "rotate-90" },
   5855 		{ DRM_ROTATE_180, "rotate-180" },
   5856 		{ DRM_ROTATE_270, "rotate-270" },
   5857 		{ DRM_REFLECT_X,  "reflect-x" },
   5858 		{ DRM_REFLECT_Y,  "reflect-y" },
   5859 	};
   5860 
   5861 	return drm_property_create_bitmask(dev, 0, "rotation",
   5862 					   props, ARRAY_SIZE(props),
   5863 					   supported_rotations);
   5864 }
   5865 EXPORT_SYMBOL(drm_mode_create_rotation_property);
   5866 
   5867 /**
   5868  * DOC: Tile group
   5869  *
   5870  * Tile groups are used to represent tiled monitors with a unique
   5871  * integer identifier. Tiled monitors using DisplayID v1.3 have
   5872  * a unique 8-byte handle, we store this in a tile group, so we
   5873  * have a common identifier for all tiles in a monitor group.
   5874  */
   5875 static void drm_tile_group_free(struct kref *kref)
   5876 {
   5877 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
   5878 	struct drm_device *dev = tg->dev;
   5879 	mutex_lock(&dev->mode_config.idr_mutex);
   5880 	idr_remove(&dev->mode_config.tile_idr, tg->id);
   5881 	mutex_unlock(&dev->mode_config.idr_mutex);
   5882 	kfree(tg);
   5883 }
   5884 
   5885 /**
   5886  * drm_mode_put_tile_group - drop a reference to a tile group.
   5887  * @dev: DRM device
   5888  * @tg: tile group to drop reference to.
   5889  *
   5890  * drop reference to tile group and free if 0.
   5891  */
   5892 void drm_mode_put_tile_group(struct drm_device *dev,
   5893 			     struct drm_tile_group *tg)
   5894 {
   5895 	kref_put(&tg->refcount, drm_tile_group_free);
   5896 }
   5897 
   5898 /**
   5899  * drm_mode_get_tile_group - get a reference to an existing tile group
   5900  * @dev: DRM device
   5901  * @topology: 8-bytes unique per monitor.
   5902  *
   5903  * Use the unique bytes to get a reference to an existing tile group.
   5904  *
   5905  * RETURNS:
   5906  * tile group or NULL if not found.
   5907  */
   5908 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
   5909 					       char topology[8])
   5910 {
   5911 	struct drm_tile_group *tg;
   5912 	int id;
   5913 	mutex_lock(&dev->mode_config.idr_mutex);
   5914 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
   5915 		if (!memcmp(tg->group_data, topology, 8)) {
   5916 			if (!kref_get_unless_zero(&tg->refcount))
   5917 				tg = NULL;
   5918 			mutex_unlock(&dev->mode_config.idr_mutex);
   5919 			return tg;
   5920 		}
   5921 	}
   5922 	mutex_unlock(&dev->mode_config.idr_mutex);
   5923 	return NULL;
   5924 }
   5925 EXPORT_SYMBOL(drm_mode_get_tile_group);
   5926 
   5927 /**
   5928  * drm_mode_create_tile_group - create a tile group from a displayid description
   5929  * @dev: DRM device
   5930  * @topology: 8-bytes unique per monitor.
   5931  *
   5932  * Create a tile group for the unique monitor, and get a unique
   5933  * identifier for the tile group.
   5934  *
   5935  * RETURNS:
   5936  * new tile group or error.
   5937  */
   5938 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
   5939 						  char topology[8])
   5940 {
   5941 	struct drm_tile_group *tg;
   5942 	int ret;
   5943 
   5944 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
   5945 	if (!tg)
   5946 		return ERR_PTR(-ENOMEM);
   5947 
   5948 	kref_init(&tg->refcount);
   5949 	memcpy(tg->group_data, topology, 8);
   5950 	tg->dev = dev;
   5951 
   5952 	mutex_lock(&dev->mode_config.idr_mutex);
   5953 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
   5954 	if (ret >= 0) {
   5955 		tg->id = ret;
   5956 	} else {
   5957 		kfree(tg);
   5958 		tg = ERR_PTR(ret);
   5959 	}
   5960 
   5961 	mutex_unlock(&dev->mode_config.idr_mutex);
   5962 	return tg;
   5963 }
   5964 EXPORT_SYMBOL(drm_mode_create_tile_group);
   5965