Home | History | Annotate | Line # | Download | only in drm
drm_crtc.c revision 1.12
      1 /*	$NetBSD: drm_crtc.c,v 1.12 2020/02/14 04:30:04 riastradh Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2006-2008 Intel Corporation
      5  * Copyright (c) 2007 Dave Airlie <airlied (at) linux.ie>
      6  * Copyright (c) 2008 Red Hat Inc.
      7  *
      8  * DRM core CRTC related functions
      9  *
     10  * Permission to use, copy, modify, distribute, and sell this software and its
     11  * documentation for any purpose is hereby granted without fee, provided that
     12  * the above copyright notice appear in all copies and that both that copyright
     13  * notice and this permission notice appear in supporting documentation, and
     14  * that the name of the copyright holders not be used in advertising or
     15  * publicity pertaining to distribution of the software without specific,
     16  * written prior permission.  The copyright holders make no representations
     17  * about the suitability of this software for any purpose.  It is provided "as
     18  * is" without express or implied warranty.
     19  *
     20  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
     21  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
     22  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
     23  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
     24  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
     25  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
     26  * OF THIS SOFTWARE.
     27  *
     28  * Authors:
     29  *      Keith Packard
     30  *	Eric Anholt <eric (at) anholt.net>
     31  *      Dave Airlie <airlied (at) linux.ie>
     32  *      Jesse Barnes <jesse.barnes (at) intel.com>
     33  */
     34 #include <sys/cdefs.h>
     35 __KERNEL_RCSID(0, "$NetBSD: drm_crtc.c,v 1.12 2020/02/14 04:30:04 riastradh Exp $");
     36 
     37 #include <linux/err.h>
     38 #include <linux/spinlock.h>
     39 #include <linux/ctype.h>
     40 #include <linux/list.h>
     41 #include <linux/slab.h>
     42 #include <linux/export.h>
     43 #include <linux/errno.h>
     44 #include <asm/bug.h>
     45 #include <drm/drmP.h>
     46 #include <drm/drm_crtc.h>
     47 #include <drm/drm_edid.h>
     48 #include <drm/drm_fourcc.h>
     49 #include <drm/drm_modeset_lock.h>
     50 #include <drm/drm_atomic.h>
     51 
     52 #include "drm_crtc_internal.h"
     53 #include "drm_internal.h"
     54 
     55 static struct drm_framebuffer *
     56 internal_framebuffer_create(struct drm_device *dev,
     57 			    struct drm_mode_fb_cmd2 *r,
     58 			    struct drm_file *file_priv);
     59 
     60 /* Avoid boilerplate.  I'm tired of typing. */
     61 #define DRM_ENUM_NAME_FN(fnname, list)				\
     62 	const char *fnname(int val)				\
     63 	{							\
     64 		int i;						\
     65 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
     66 			if (list[i].type == val)		\
     67 				return list[i].name;		\
     68 		}						\
     69 		return "(unknown)";				\
     70 	}
     71 
     72 /*
     73  * Global properties
     74  */
     75 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
     76 	{ DRM_MODE_DPMS_ON, "On" },
     77 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
     78 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
     79 	{ DRM_MODE_DPMS_OFF, "Off" }
     80 };
     81 
     82 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
     83 
     84 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
     85 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
     86 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
     87 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
     88 };
     89 
     90 /*
     91  * Optional properties
     92  */
     93 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
     94 	{ DRM_MODE_SCALE_NONE, "None" },
     95 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
     96 	{ DRM_MODE_SCALE_CENTER, "Center" },
     97 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
     98 };
     99 
    100 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
    101 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
    102 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
    103 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
    104 };
    105 
    106 /*
    107  * Non-global properties, but "required" for certain connectors.
    108  */
    109 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
    110 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
    111 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
    112 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
    113 };
    114 
    115 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
    116 
    117 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
    118 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
    119 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
    120 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
    121 };
    122 
    123 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
    124 		 drm_dvi_i_subconnector_enum_list)
    125 
    126 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
    127 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
    128 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
    129 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
    130 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
    131 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
    132 };
    133 
    134 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
    135 
    136 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
    137 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
    138 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
    139 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
    140 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
    141 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
    142 };
    143 
    144 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
    145 		 drm_tv_subconnector_enum_list)
    146 
    147 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
    148 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
    149 	{ DRM_MODE_DIRTY_ON,       "On"       },
    150 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
    151 };
    152 
    153 struct drm_conn_prop_enum_list {
    154 	int type;
    155 	const char *name;
    156 	struct ida ida;
    157 };
    158 
    159 /*
    160  * Connector and encoder types.
    161  */
    162 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
    163 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
    164 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
    165 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
    166 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
    167 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
    168 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
    169 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
    170 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
    171 	{ DRM_MODE_CONNECTOR_Component, "Component" },
    172 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
    173 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
    174 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
    175 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
    176 	{ DRM_MODE_CONNECTOR_TV, "TV" },
    177 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
    178 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
    179 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
    180 };
    181 
    182 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
    183 	{ DRM_MODE_ENCODER_NONE, "None" },
    184 	{ DRM_MODE_ENCODER_DAC, "DAC" },
    185 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
    186 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
    187 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
    188 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
    189 	{ DRM_MODE_ENCODER_DSI, "DSI" },
    190 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
    191 };
    192 
    193 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
    194 	{ SubPixelUnknown, "Unknown" },
    195 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
    196 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
    197 	{ SubPixelVerticalRGB, "Vertical RGB" },
    198 	{ SubPixelVerticalBGR, "Vertical BGR" },
    199 	{ SubPixelNone, "None" },
    200 };
    201 
    202 void drm_connector_ida_init(void)
    203 {
    204 	int i;
    205 
    206 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
    207 		ida_init(&drm_connector_enum_list[i].ida);
    208 }
    209 
    210 void drm_connector_ida_destroy(void)
    211 {
    212 	int i;
    213 
    214 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
    215 		ida_destroy(&drm_connector_enum_list[i].ida);
    216 }
    217 
    218 /**
    219  * drm_get_connector_status_name - return a string for connector status
    220  * @status: connector status to compute name of
    221  *
    222  * In contrast to the other drm_get_*_name functions this one here returns a
    223  * const pointer and hence is threadsafe.
    224  */
    225 const char *drm_get_connector_status_name(enum drm_connector_status status)
    226 {
    227 	if (status == connector_status_connected)
    228 		return "connected";
    229 	else if (status == connector_status_disconnected)
    230 		return "disconnected";
    231 	else
    232 		return "unknown";
    233 }
    234 EXPORT_SYMBOL(drm_get_connector_status_name);
    235 
    236 /**
    237  * drm_get_subpixel_order_name - return a string for a given subpixel enum
    238  * @order: enum of subpixel_order
    239  *
    240  * Note you could abuse this and return something out of bounds, but that
    241  * would be a caller error.  No unscrubbed user data should make it here.
    242  */
    243 const char *drm_get_subpixel_order_name(enum subpixel_order order)
    244 {
    245 	return drm_subpixel_enum_list[order].name;
    246 }
    247 EXPORT_SYMBOL(drm_get_subpixel_order_name);
    248 
    249 static char printable_char(int c)
    250 {
    251 	return isascii(c) && isprint(c) ? c : '?';
    252 }
    253 
    254 /**
    255  * drm_get_format_name - return a string for drm fourcc format
    256  * @format: format to compute name of
    257  *
    258  * Note that the buffer used by this function is globally shared and owned by
    259  * the function itself.
    260  *
    261  * FIXME: This isn't really multithreading safe.
    262  */
    263 const char *drm_get_format_name(uint32_t format)
    264 {
    265 	static char buf[32];
    266 
    267 	snprintf(buf, sizeof(buf),
    268 		 "%c%c%c%c %s-endian (0x%08x)",
    269 		 printable_char(format & 0xff),
    270 		 printable_char((format >> 8) & 0xff),
    271 		 printable_char((format >> 16) & 0xff),
    272 		 printable_char((format >> 24) & 0x7f),
    273 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
    274 		 format);
    275 
    276 	return buf;
    277 }
    278 EXPORT_SYMBOL(drm_get_format_name);
    279 
    280 /*
    281  * Internal function to assign a slot in the object idr and optionally
    282  * register the object into the idr.
    283  */
    284 static int drm_mode_object_get_reg(struct drm_device *dev,
    285 				   struct drm_mode_object *obj,
    286 				   uint32_t obj_type,
    287 				   bool register_obj)
    288 {
    289 	int ret;
    290 
    291 	idr_preload(GFP_KERNEL);
    292 	mutex_lock(&dev->mode_config.idr_mutex);
    293 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
    294 	if (ret >= 0) {
    295 		/*
    296 		 * Set up the object linking under the protection of the idr
    297 		 * lock so that other users can't see inconsistent state.
    298 		 */
    299 		obj->id = ret;
    300 		obj->type = obj_type;
    301 	}
    302 	mutex_unlock(&dev->mode_config.idr_mutex);
    303 	idr_preload_end();
    304 
    305 	return ret < 0 ? ret : 0;
    306 }
    307 
    308 /**
    309  * drm_mode_object_get - allocate a new modeset identifier
    310  * @dev: DRM device
    311  * @obj: object pointer, used to generate unique ID
    312  * @obj_type: object type
    313  *
    314  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
    315  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
    316  * modeset identifiers are _not_ reference counted. Hence don't use this for
    317  * reference counted modeset objects like framebuffers.
    318  *
    319  * Returns:
    320  * Zero on success, error code on failure.
    321  */
    322 int drm_mode_object_get(struct drm_device *dev,
    323 			struct drm_mode_object *obj, uint32_t obj_type)
    324 {
    325 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
    326 }
    327 
    328 static void drm_mode_object_register(struct drm_device *dev,
    329 				     struct drm_mode_object *obj)
    330 {
    331 	mutex_lock(&dev->mode_config.idr_mutex);
    332 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
    333 	mutex_unlock(&dev->mode_config.idr_mutex);
    334 }
    335 
    336 /**
    337  * drm_mode_object_put - free a modeset identifer
    338  * @dev: DRM device
    339  * @object: object to free
    340  *
    341  * Free @id from @dev's unique identifier pool. Note that despite the _get
    342  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
    343  * for reference counted modeset objects like framebuffers.
    344  */
    345 void drm_mode_object_put(struct drm_device *dev,
    346 			 struct drm_mode_object *object)
    347 {
    348 	mutex_lock(&dev->mode_config.idr_mutex);
    349 	idr_remove(&dev->mode_config.crtc_idr, object->id);
    350 	mutex_unlock(&dev->mode_config.idr_mutex);
    351 }
    352 
    353 static struct drm_mode_object *_object_find(struct drm_device *dev,
    354 		uint32_t id, uint32_t type)
    355 {
    356 	struct drm_mode_object *obj = NULL;
    357 
    358 	mutex_lock(&dev->mode_config.idr_mutex);
    359 	obj = idr_find(&dev->mode_config.crtc_idr, id);
    360 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
    361 		obj = NULL;
    362 	if (obj && obj->id != id)
    363 		obj = NULL;
    364 	/* don't leak out unref'd fb's */
    365 	if (obj &&
    366 	    (obj->type == DRM_MODE_OBJECT_FB ||
    367 	     obj->type == DRM_MODE_OBJECT_BLOB))
    368 		obj = NULL;
    369 	mutex_unlock(&dev->mode_config.idr_mutex);
    370 
    371 	return obj;
    372 }
    373 
    374 /**
    375  * drm_mode_object_find - look up a drm object with static lifetime
    376  * @dev: drm device
    377  * @id: id of the mode object
    378  * @type: type of the mode object
    379  *
    380  * Note that framebuffers cannot be looked up with this functions - since those
    381  * are reference counted, they need special treatment.  Even with
    382  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
    383  * rather than WARN_ON()).
    384  */
    385 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
    386 		uint32_t id, uint32_t type)
    387 {
    388 	struct drm_mode_object *obj = NULL;
    389 
    390 	/* Framebuffers are reference counted and need their own lookup
    391 	 * function.*/
    392 	WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
    393 	obj = _object_find(dev, id, type);
    394 	return obj;
    395 }
    396 EXPORT_SYMBOL(drm_mode_object_find);
    397 
    398 /**
    399  * drm_framebuffer_init - initialize a framebuffer
    400  * @dev: DRM device
    401  * @fb: framebuffer to be initialized
    402  * @funcs: ... with these functions
    403  *
    404  * Allocates an ID for the framebuffer's parent mode object, sets its mode
    405  * functions & device file and adds it to the master fd list.
    406  *
    407  * IMPORTANT:
    408  * This functions publishes the fb and makes it available for concurrent access
    409  * by other users. Which means by this point the fb _must_ be fully set up -
    410  * since all the fb attributes are invariant over its lifetime, no further
    411  * locking but only correct reference counting is required.
    412  *
    413  * Returns:
    414  * Zero on success, error code on failure.
    415  */
    416 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
    417 			 const struct drm_framebuffer_funcs *funcs)
    418 {
    419 	int ret;
    420 
    421 	mutex_lock(&dev->mode_config.fb_lock);
    422 	kref_init(&fb->refcount);
    423 	INIT_LIST_HEAD(&fb->filp_head);
    424 	fb->dev = dev;
    425 	fb->funcs = funcs;
    426 
    427 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
    428 	if (ret)
    429 		goto out;
    430 
    431 	dev->mode_config.num_fb++;
    432 	list_add(&fb->head, &dev->mode_config.fb_list);
    433 out:
    434 	mutex_unlock(&dev->mode_config.fb_lock);
    435 
    436 	return ret;
    437 }
    438 EXPORT_SYMBOL(drm_framebuffer_init);
    439 
    440 /* dev->mode_config.fb_lock must be held! */
    441 static void __drm_framebuffer_unregister(struct drm_device *dev,
    442 					 struct drm_framebuffer *fb)
    443 {
    444 	mutex_lock(&dev->mode_config.idr_mutex);
    445 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
    446 	mutex_unlock(&dev->mode_config.idr_mutex);
    447 
    448 	fb->base.id = 0;
    449 }
    450 
    451 static void drm_framebuffer_free(struct kref *kref)
    452 {
    453 	struct drm_framebuffer *fb =
    454 			container_of(kref, struct drm_framebuffer, refcount);
    455 	struct drm_device *dev = fb->dev;
    456 
    457 	/*
    458 	 * The lookup idr holds a weak reference, which has not necessarily been
    459 	 * removed at this point. Check for that.
    460 	 */
    461 	mutex_lock(&dev->mode_config.fb_lock);
    462 	if (fb->base.id) {
    463 		/* Mark fb as reaped and drop idr ref. */
    464 		__drm_framebuffer_unregister(dev, fb);
    465 	}
    466 	mutex_unlock(&dev->mode_config.fb_lock);
    467 
    468 	fb->funcs->destroy(fb);
    469 }
    470 
    471 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
    472 							uint32_t id)
    473 {
    474 	struct drm_mode_object *obj = NULL;
    475 	struct drm_framebuffer *fb;
    476 
    477 	mutex_lock(&dev->mode_config.idr_mutex);
    478 	obj = idr_find(&dev->mode_config.crtc_idr, id);
    479 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
    480 		fb = NULL;
    481 	else
    482 		fb = obj_to_fb(obj);
    483 	mutex_unlock(&dev->mode_config.idr_mutex);
    484 
    485 	return fb;
    486 }
    487 
    488 /**
    489  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
    490  * @dev: drm device
    491  * @id: id of the fb object
    492  *
    493  * If successful, this grabs an additional reference to the framebuffer -
    494  * callers need to make sure to eventually unreference the returned framebuffer
    495  * again, using @drm_framebuffer_unreference.
    496  */
    497 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
    498 					       uint32_t id)
    499 {
    500 	struct drm_framebuffer *fb;
    501 
    502 	mutex_lock(&dev->mode_config.fb_lock);
    503 	fb = __drm_framebuffer_lookup(dev, id);
    504 	if (fb) {
    505 		if (!kref_get_unless_zero(&fb->refcount))
    506 			fb = NULL;
    507 	}
    508 	mutex_unlock(&dev->mode_config.fb_lock);
    509 
    510 	return fb;
    511 }
    512 EXPORT_SYMBOL(drm_framebuffer_lookup);
    513 
    514 /**
    515  * drm_framebuffer_unreference - unref a framebuffer
    516  * @fb: framebuffer to unref
    517  *
    518  * This functions decrements the fb's refcount and frees it if it drops to zero.
    519  */
    520 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
    521 {
    522 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, fb->refcount.kr_count);
    523 	kref_put(&fb->refcount, drm_framebuffer_free);
    524 }
    525 EXPORT_SYMBOL(drm_framebuffer_unreference);
    526 
    527 /**
    528  * drm_framebuffer_reference - incr the fb refcnt
    529  * @fb: framebuffer
    530  *
    531  * This functions increments the fb's refcount.
    532  */
    533 void drm_framebuffer_reference(struct drm_framebuffer *fb)
    534 {
    535 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, fb->refcount.kr_count);
    536 	kref_get(&fb->refcount);
    537 }
    538 EXPORT_SYMBOL(drm_framebuffer_reference);
    539 
    540 /**
    541  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
    542  * @fb: fb to unregister
    543  *
    544  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
    545  * those used for fbdev. Note that the caller must hold a reference of it's own,
    546  * i.e. the object may not be destroyed through this call (since it'll lead to a
    547  * locking inversion).
    548  */
    549 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
    550 {
    551 	struct drm_device *dev;
    552 
    553 	if (!fb)
    554 		return;
    555 
    556 	dev = fb->dev;
    557 
    558 	mutex_lock(&dev->mode_config.fb_lock);
    559 	/* Mark fb as reaped and drop idr ref. */
    560 	__drm_framebuffer_unregister(dev, fb);
    561 	mutex_unlock(&dev->mode_config.fb_lock);
    562 }
    563 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
    564 
    565 /**
    566  * drm_framebuffer_cleanup - remove a framebuffer object
    567  * @fb: framebuffer to remove
    568  *
    569  * Cleanup framebuffer. This function is intended to be used from the drivers
    570  * ->destroy callback. It can also be used to clean up driver private
    571  *  framebuffers embedded into a larger structure.
    572  *
    573  * Note that this function does not remove the fb from active usuage - if it is
    574  * still used anywhere, hilarity can ensue since userspace could call getfb on
    575  * the id and get back -EINVAL. Obviously no concern at driver unload time.
    576  *
    577  * Also, the framebuffer will not be removed from the lookup idr - for
    578  * user-created framebuffers this will happen in in the rmfb ioctl. For
    579  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
    580  * drm_framebuffer_unregister_private.
    581  */
    582 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
    583 {
    584 	struct drm_device *dev = fb->dev;
    585 
    586 	mutex_lock(&dev->mode_config.fb_lock);
    587 	list_del(&fb->head);
    588 	dev->mode_config.num_fb--;
    589 	mutex_unlock(&dev->mode_config.fb_lock);
    590 }
    591 EXPORT_SYMBOL(drm_framebuffer_cleanup);
    592 
    593 /**
    594  * drm_framebuffer_remove - remove and unreference a framebuffer object
    595  * @fb: framebuffer to remove
    596  *
    597  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
    598  * using @fb, removes it, setting it to NULL. Then drops the reference to the
    599  * passed-in framebuffer. Might take the modeset locks.
    600  *
    601  * Note that this function optimizes the cleanup away if the caller holds the
    602  * last reference to the framebuffer. It is also guaranteed to not take the
    603  * modeset locks in this case.
    604  */
    605 void drm_framebuffer_remove(struct drm_framebuffer *fb)
    606 {
    607 	struct drm_device *dev;
    608 	struct drm_crtc *crtc;
    609 	struct drm_plane *plane;
    610 	struct drm_mode_set set;
    611 	int ret;
    612 
    613 	if (!fb)
    614 		return;
    615 
    616 	dev = fb->dev;
    617 
    618 	WARN_ON(!list_empty(&fb->filp_head));
    619 
    620 	/*
    621 	 * drm ABI mandates that we remove any deleted framebuffers from active
    622 	 * useage. But since most sane clients only remove framebuffers they no
    623 	 * longer need, try to optimize this away.
    624 	 *
    625 	 * Since we're holding a reference ourselves, observing a refcount of 1
    626 	 * means that we're the last holder and can skip it. Also, the refcount
    627 	 * can never increase from 1 again, so we don't need any barriers or
    628 	 * locks.
    629 	 *
    630 	 * Note that userspace could try to race with use and instate a new
    631 	 * usage _after_ we've cleared all current ones. End result will be an
    632 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
    633 	 * in this manner.
    634 	 */
    635 	if (!kref_exclusive_p(&fb->refcount)) {
    636 		drm_modeset_lock_all(dev);
    637 		/* remove from any CRTC */
    638 		drm_for_each_crtc(crtc, dev) {
    639 			if (crtc->primary->fb == fb) {
    640 				/* should turn off the crtc */
    641 				memset(&set, 0, sizeof(struct drm_mode_set));
    642 				set.crtc = crtc;
    643 				set.fb = NULL;
    644 				ret = drm_mode_set_config_internal(&set);
    645 				if (ret)
    646 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
    647 			}
    648 		}
    649 
    650 		drm_for_each_plane(plane, dev) {
    651 			if (plane->fb == fb)
    652 				drm_plane_force_disable(plane);
    653 		}
    654 		drm_modeset_unlock_all(dev);
    655 	}
    656 
    657 	drm_framebuffer_unreference(fb);
    658 }
    659 EXPORT_SYMBOL(drm_framebuffer_remove);
    660 
    661 DEFINE_WW_CLASS(crtc_ww_class);
    662 
    663 /**
    664  * drm_crtc_init_with_planes - Initialise a new CRTC object with
    665  *    specified primary and cursor planes.
    666  * @dev: DRM device
    667  * @crtc: CRTC object to init
    668  * @primary: Primary plane for CRTC
    669  * @cursor: Cursor plane for CRTC
    670  * @funcs: callbacks for the new CRTC
    671  *
    672  * Inits a new object created as base part of a driver crtc object.
    673  *
    674  * Returns:
    675  * Zero on success, error code on failure.
    676  */
    677 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
    678 			      struct drm_plane *primary,
    679 			      struct drm_plane *cursor,
    680 			      const struct drm_crtc_funcs *funcs)
    681 {
    682 	struct drm_mode_config *config = &dev->mode_config;
    683 	int ret;
    684 
    685 	WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY);
    686 	WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR);
    687 
    688 	crtc->dev = dev;
    689 	crtc->funcs = funcs;
    690 
    691 	drm_modeset_lock_init(&crtc->mutex);
    692 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
    693 	if (ret)
    694 		return ret;
    695 
    696 	crtc->base.properties = &crtc->properties;
    697 
    698 	list_add_tail(&crtc->head, &config->crtc_list);
    699 	config->num_crtc++;
    700 
    701 	crtc->primary = primary;
    702 	crtc->cursor = cursor;
    703 	if (primary)
    704 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
    705 	if (cursor)
    706 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
    707 
    708 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
    709 		drm_object_attach_property(&crtc->base, config->prop_active, 0);
    710 		drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
    711 	}
    712 
    713 	return 0;
    714 }
    715 EXPORT_SYMBOL(drm_crtc_init_with_planes);
    716 
    717 /**
    718  * drm_crtc_cleanup - Clean up the core crtc usage
    719  * @crtc: CRTC to cleanup
    720  *
    721  * This function cleans up @crtc and removes it from the DRM mode setting
    722  * core. Note that the function does *not* free the crtc structure itself,
    723  * this is the responsibility of the caller.
    724  */
    725 void drm_crtc_cleanup(struct drm_crtc *crtc)
    726 {
    727 	struct drm_device *dev = crtc->dev;
    728 
    729 	kfree(crtc->gamma_store);
    730 	crtc->gamma_store = NULL;
    731 
    732 	drm_modeset_lock_fini(&crtc->mutex);
    733 
    734 	drm_mode_object_put(dev, &crtc->base);
    735 	list_del(&crtc->head);
    736 	dev->mode_config.num_crtc--;
    737 
    738 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
    739 	if (crtc->state && crtc->funcs->atomic_destroy_state)
    740 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
    741 
    742 	memset(crtc, 0, sizeof(*crtc));
    743 }
    744 EXPORT_SYMBOL(drm_crtc_cleanup);
    745 
    746 /**
    747  * drm_crtc_index - find the index of a registered CRTC
    748  * @crtc: CRTC to find index for
    749  *
    750  * Given a registered CRTC, return the index of that CRTC within a DRM
    751  * device's list of CRTCs.
    752  */
    753 unsigned int drm_crtc_index(struct drm_crtc *crtc)
    754 {
    755 	unsigned int index = 0;
    756 	struct drm_crtc *tmp;
    757 
    758 	drm_for_each_crtc(tmp, crtc->dev) {
    759 		if (tmp == crtc)
    760 			return index;
    761 
    762 		index++;
    763 	}
    764 
    765 	BUG();
    766 }
    767 EXPORT_SYMBOL(drm_crtc_index);
    768 
    769 /*
    770  * drm_mode_remove - remove and free a mode
    771  * @connector: connector list to modify
    772  * @mode: mode to remove
    773  *
    774  * Remove @mode from @connector's mode list, then free it.
    775  */
    776 static void drm_mode_remove(struct drm_connector *connector,
    777 			    struct drm_display_mode *mode)
    778 {
    779 	list_del(&mode->head);
    780 	drm_mode_destroy(connector->dev, mode);
    781 }
    782 
    783 /**
    784  * drm_display_info_set_bus_formats - set the supported bus formats
    785  * @info: display info to store bus formats in
    786  * @formats: array containing the supported bus formats
    787  * @num_formats: the number of entries in the fmts array
    788  *
    789  * Store the supported bus formats in display info structure.
    790  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
    791  * a full list of available formats.
    792  */
    793 int drm_display_info_set_bus_formats(struct drm_display_info *info,
    794 				     const u32 *formats,
    795 				     unsigned int num_formats)
    796 {
    797 	u32 *fmts = NULL;
    798 
    799 	if (!formats && num_formats)
    800 		return -EINVAL;
    801 
    802 	if (formats && num_formats) {
    803 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
    804 			       GFP_KERNEL);
    805 		if (!fmts)
    806 			return -ENOMEM;
    807 	}
    808 
    809 	kfree(info->bus_formats);
    810 	info->bus_formats = fmts;
    811 	info->num_bus_formats = num_formats;
    812 
    813 	return 0;
    814 }
    815 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
    816 
    817 /**
    818  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
    819  * @connector: connector to quwery
    820  *
    821  * The kernel supports per-connector configration of its consoles through
    822  * use of the video= parameter. This function parses that option and
    823  * extracts the user's specified mode (or enable/disable status) for a
    824  * particular connector. This is typically only used during the early fbdev
    825  * setup.
    826  */
    827 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
    828 {
    829 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
    830 	char *option = NULL;
    831 
    832 #ifdef __NetBSD__
    833 	prop_dictionary_t prop = device_properties(connector->dev->dev);
    834 	if (!prop_dictionary_get_cstring(prop, connector->name, &option))
    835 		return;
    836 #else
    837 	if (fb_get_options(connector->name, &option))
    838 		return;
    839 #endif
    840 
    841 	if (!drm_mode_parse_command_line_for_connector(option,
    842 						       connector,
    843 						       mode))
    844 		return;
    845 
    846 	if (mode->force) {
    847 		const char *s;
    848 
    849 		switch (mode->force) {
    850 		case DRM_FORCE_OFF:
    851 			s = "OFF";
    852 			break;
    853 		case DRM_FORCE_ON_DIGITAL:
    854 			s = "ON - dig";
    855 			break;
    856 		default:
    857 		case DRM_FORCE_ON:
    858 			s = "ON";
    859 			break;
    860 		}
    861 
    862 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
    863 		connector->force = mode->force;
    864 	}
    865 
    866 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
    867 		      connector->name,
    868 		      mode->xres, mode->yres,
    869 		      mode->refresh_specified ? mode->refresh : 60,
    870 		      mode->rb ? " reduced blanking" : "",
    871 		      mode->margins ? " with margins" : "",
    872 		      mode->interlace ?  " interlaced" : "");
    873 }
    874 
    875 /**
    876  * drm_connector_init - Init a preallocated connector
    877  * @dev: DRM device
    878  * @connector: the connector to init
    879  * @funcs: callbacks for this connector
    880  * @connector_type: user visible type of the connector
    881  *
    882  * Initialises a preallocated connector. Connectors should be
    883  * subclassed as part of driver connector objects.
    884  *
    885  * Returns:
    886  * Zero on success, error code on failure.
    887  */
    888 int drm_connector_init(struct drm_device *dev,
    889 		       struct drm_connector *connector,
    890 		       const struct drm_connector_funcs *funcs,
    891 		       int connector_type)
    892 {
    893 	struct drm_mode_config *config = &dev->mode_config;
    894 	int ret;
    895 	struct ida *connector_ida =
    896 		&drm_connector_enum_list[connector_type].ida;
    897 
    898 	drm_modeset_lock_all(dev);
    899 
    900 	ret = drm_mode_object_get_reg(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR, false);
    901 	if (ret)
    902 		goto out_unlock;
    903 
    904 	connector->base.properties = &connector->properties;
    905 	connector->dev = dev;
    906 	connector->kdev = dev->dev;
    907 	connector->funcs = funcs;
    908 	connector->connector_type = connector_type;
    909 	connector->connector_type_id =
    910 		ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
    911 	if (connector->connector_type_id < 0) {
    912 		ret = connector->connector_type_id;
    913 		goto out_put;
    914 	}
    915 	connector->name =
    916 		kasprintf(GFP_KERNEL, "%s-%d",
    917 			  drm_connector_enum_list[connector_type].name,
    918 			  connector->connector_type_id);
    919 	if (!connector->name) {
    920 		ret = -ENOMEM;
    921 		goto out_put;
    922 	}
    923 
    924 	INIT_LIST_HEAD(&connector->probed_modes);
    925 	INIT_LIST_HEAD(&connector->modes);
    926 	connector->edid_blob_ptr = NULL;
    927 	connector->status = connector_status_unknown;
    928 
    929 	drm_connector_get_cmdline_mode(connector);
    930 
    931 	/* We should add connectors at the end to avoid upsetting the connector
    932 	 * index too much. */
    933 	list_add_tail(&connector->head, &config->connector_list);
    934 	config->num_connector++;
    935 
    936 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
    937 		drm_object_attach_property(&connector->base,
    938 					      config->edid_property,
    939 					      0);
    940 
    941 	drm_object_attach_property(&connector->base,
    942 				      config->dpms_property, 0);
    943 
    944 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
    945 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
    946 	}
    947 
    948 	connector->debugfs_entry = NULL;
    949 
    950 out_put:
    951 	if (ret)
    952 		drm_mode_object_put(dev, &connector->base);
    953 
    954 out_unlock:
    955 	drm_modeset_unlock_all(dev);
    956 
    957 	return ret;
    958 }
    959 EXPORT_SYMBOL(drm_connector_init);
    960 
    961 /**
    962  * drm_connector_cleanup - cleans up an initialised connector
    963  * @connector: connector to cleanup
    964  *
    965  * Cleans up the connector but doesn't free the object.
    966  */
    967 void drm_connector_cleanup(struct drm_connector *connector)
    968 {
    969 	struct drm_device *dev = connector->dev;
    970 	struct drm_display_mode *mode, *t;
    971 
    972 	if (connector->tile_group) {
    973 		drm_mode_put_tile_group(dev, connector->tile_group);
    974 		connector->tile_group = NULL;
    975 	}
    976 
    977 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
    978 		drm_mode_remove(connector, mode);
    979 
    980 	list_for_each_entry_safe(mode, t, &connector->modes, head)
    981 		drm_mode_remove(connector, mode);
    982 
    983 	ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
    984 		   connector->connector_type_id);
    985 
    986 	kfree(connector->display_info.bus_formats);
    987 	drm_mode_object_put(dev, &connector->base);
    988 	kfree(connector->name);
    989 	connector->name = NULL;
    990 	list_del(&connector->head);
    991 	dev->mode_config.num_connector--;
    992 
    993 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
    994 	if (connector->state && connector->funcs->atomic_destroy_state)
    995 		connector->funcs->atomic_destroy_state(connector,
    996 						       connector->state);
    997 
    998 	memset(connector, 0, sizeof(*connector));
    999 }
   1000 EXPORT_SYMBOL(drm_connector_cleanup);
   1001 
   1002 /**
   1003  * drm_connector_index - find the index of a registered connector
   1004  * @connector: connector to find index for
   1005  *
   1006  * Given a registered connector, return the index of that connector within a DRM
   1007  * device's list of connectors.
   1008  */
   1009 unsigned int drm_connector_index(struct drm_connector *connector)
   1010 {
   1011 	unsigned int index = 0;
   1012 	struct drm_connector *tmp;
   1013 	struct drm_mode_config *config = &connector->dev->mode_config;
   1014 
   1015 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
   1016 
   1017 	drm_for_each_connector(tmp, connector->dev) {
   1018 		if (tmp == connector)
   1019 			return index;
   1020 
   1021 		index++;
   1022 	}
   1023 
   1024 	BUG();
   1025 }
   1026 EXPORT_SYMBOL(drm_connector_index);
   1027 
   1028 /**
   1029  * drm_connector_register - register a connector
   1030  * @connector: the connector to register
   1031  *
   1032  * Register userspace interfaces for a connector
   1033  *
   1034  * Returns:
   1035  * Zero on success, error code on failure.
   1036  */
   1037 int drm_connector_register(struct drm_connector *connector)
   1038 {
   1039 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
   1040 	int ret;
   1041 #endif
   1042 
   1043 	drm_mode_object_register(connector->dev, &connector->base);
   1044 
   1045 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
   1046 	ret = drm_sysfs_connector_add(connector);
   1047 	if (ret)
   1048 		return ret;
   1049 
   1050 	ret = drm_debugfs_connector_add(connector);
   1051 	if (ret) {
   1052 		drm_sysfs_connector_remove(connector);
   1053 		return ret;
   1054 	}
   1055 #endif
   1056 
   1057 	return 0;
   1058 }
   1059 EXPORT_SYMBOL(drm_connector_register);
   1060 
   1061 /**
   1062  * drm_connector_unregister - unregister a connector
   1063  * @connector: the connector to unregister
   1064  *
   1065  * Unregister userspace interfaces for a connector
   1066  */
   1067 void drm_connector_unregister(struct drm_connector *connector)
   1068 {
   1069 #ifndef __NetBSD__		/* XXX sysfs, debugfs */
   1070 	drm_sysfs_connector_remove(connector);
   1071 	drm_debugfs_connector_remove(connector);
   1072 #endif
   1073 }
   1074 EXPORT_SYMBOL(drm_connector_unregister);
   1075 
   1076 
   1077 /**
   1078  * drm_connector_unplug_all - unregister connector userspace interfaces
   1079  * @dev: drm device
   1080  *
   1081  * This function unregisters all connector userspace interfaces in sysfs. Should
   1082  * be call when the device is disconnected, e.g. from an usb driver's
   1083  * ->disconnect callback.
   1084  */
   1085 void drm_connector_unplug_all(struct drm_device *dev)
   1086 {
   1087 	struct drm_connector *connector;
   1088 
   1089 	/* FIXME: taking the mode config mutex ends up in a clash with sysfs */
   1090 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
   1091 		drm_connector_unregister(connector);
   1092 
   1093 }
   1094 EXPORT_SYMBOL(drm_connector_unplug_all);
   1095 
   1096 /**
   1097  * drm_encoder_init - Init a preallocated encoder
   1098  * @dev: drm device
   1099  * @encoder: the encoder to init
   1100  * @funcs: callbacks for this encoder
   1101  * @encoder_type: user visible type of the encoder
   1102  *
   1103  * Initialises a preallocated encoder. Encoder should be
   1104  * subclassed as part of driver encoder objects.
   1105  *
   1106  * Returns:
   1107  * Zero on success, error code on failure.
   1108  */
   1109 int drm_encoder_init(struct drm_device *dev,
   1110 		      struct drm_encoder *encoder,
   1111 		      const struct drm_encoder_funcs *funcs,
   1112 		      int encoder_type)
   1113 {
   1114 	int ret;
   1115 
   1116 	drm_modeset_lock_all(dev);
   1117 
   1118 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
   1119 	if (ret)
   1120 		goto out_unlock;
   1121 
   1122 	encoder->dev = dev;
   1123 	encoder->encoder_type = encoder_type;
   1124 	encoder->funcs = funcs;
   1125 	encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
   1126 				  drm_encoder_enum_list[encoder_type].name,
   1127 				  encoder->base.id);
   1128 	if (!encoder->name) {
   1129 		ret = -ENOMEM;
   1130 		goto out_put;
   1131 	}
   1132 
   1133 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
   1134 	dev->mode_config.num_encoder++;
   1135 
   1136 out_put:
   1137 	if (ret)
   1138 		drm_mode_object_put(dev, &encoder->base);
   1139 
   1140 out_unlock:
   1141 	drm_modeset_unlock_all(dev);
   1142 
   1143 	return ret;
   1144 }
   1145 EXPORT_SYMBOL(drm_encoder_init);
   1146 
   1147 /**
   1148  * drm_encoder_cleanup - cleans up an initialised encoder
   1149  * @encoder: encoder to cleanup
   1150  *
   1151  * Cleans up the encoder but doesn't free the object.
   1152  */
   1153 void drm_encoder_cleanup(struct drm_encoder *encoder)
   1154 {
   1155 	struct drm_device *dev = encoder->dev;
   1156 
   1157 	drm_modeset_lock_all(dev);
   1158 	drm_mode_object_put(dev, &encoder->base);
   1159 	kfree(encoder->name);
   1160 	list_del(&encoder->head);
   1161 	dev->mode_config.num_encoder--;
   1162 	drm_modeset_unlock_all(dev);
   1163 
   1164 	memset(encoder, 0, sizeof(*encoder));
   1165 }
   1166 EXPORT_SYMBOL(drm_encoder_cleanup);
   1167 
   1168 /**
   1169  * drm_universal_plane_init - Initialize a new universal plane object
   1170  * @dev: DRM device
   1171  * @plane: plane object to init
   1172  * @possible_crtcs: bitmask of possible CRTCs
   1173  * @funcs: callbacks for the new plane
   1174  * @formats: array of supported formats (%DRM_FORMAT_*)
   1175  * @format_count: number of elements in @formats
   1176  * @type: type of plane (overlay, primary, cursor)
   1177  *
   1178  * Initializes a plane object of type @type.
   1179  *
   1180  * Returns:
   1181  * Zero on success, error code on failure.
   1182  */
   1183 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
   1184 			     unsigned long possible_crtcs,
   1185 			     const struct drm_plane_funcs *funcs,
   1186 			     const uint32_t *formats, unsigned int format_count,
   1187 			     enum drm_plane_type type)
   1188 {
   1189 	struct drm_mode_config *config = &dev->mode_config;
   1190 	int ret;
   1191 
   1192 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
   1193 	if (ret)
   1194 		return ret;
   1195 
   1196 	drm_modeset_lock_init(&plane->mutex);
   1197 
   1198 	plane->base.properties = &plane->properties;
   1199 	plane->dev = dev;
   1200 	plane->funcs = funcs;
   1201 	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
   1202 					    GFP_KERNEL);
   1203 	if (!plane->format_types) {
   1204 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
   1205 		drm_mode_object_put(dev, &plane->base);
   1206 		return -ENOMEM;
   1207 	}
   1208 
   1209 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
   1210 	plane->format_count = format_count;
   1211 	plane->possible_crtcs = possible_crtcs;
   1212 	plane->type = type;
   1213 
   1214 	list_add_tail(&plane->head, &config->plane_list);
   1215 	config->num_total_plane++;
   1216 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
   1217 		config->num_overlay_plane++;
   1218 
   1219 	drm_object_attach_property(&plane->base,
   1220 				   config->plane_type_property,
   1221 				   plane->type);
   1222 
   1223 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
   1224 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
   1225 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
   1226 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
   1227 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
   1228 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
   1229 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
   1230 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
   1231 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
   1232 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
   1233 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
   1234 	}
   1235 
   1236 	return 0;
   1237 }
   1238 EXPORT_SYMBOL(drm_universal_plane_init);
   1239 
   1240 /**
   1241  * drm_plane_init - Initialize a legacy plane
   1242  * @dev: DRM device
   1243  * @plane: plane object to init
   1244  * @possible_crtcs: bitmask of possible CRTCs
   1245  * @funcs: callbacks for the new plane
   1246  * @formats: array of supported formats (%DRM_FORMAT_*)
   1247  * @format_count: number of elements in @formats
   1248  * @is_primary: plane type (primary vs overlay)
   1249  *
   1250  * Legacy API to initialize a DRM plane.
   1251  *
   1252  * New drivers should call drm_universal_plane_init() instead.
   1253  *
   1254  * Returns:
   1255  * Zero on success, error code on failure.
   1256  */
   1257 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
   1258 		   unsigned long possible_crtcs,
   1259 		   const struct drm_plane_funcs *funcs,
   1260 		   const uint32_t *formats, unsigned int format_count,
   1261 		   bool is_primary)
   1262 {
   1263 	enum drm_plane_type type;
   1264 
   1265 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
   1266 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
   1267 					formats, format_count, type);
   1268 }
   1269 EXPORT_SYMBOL(drm_plane_init);
   1270 
   1271 /**
   1272  * drm_plane_cleanup - Clean up the core plane usage
   1273  * @plane: plane to cleanup
   1274  *
   1275  * This function cleans up @plane and removes it from the DRM mode setting
   1276  * core. Note that the function does *not* free the plane structure itself,
   1277  * this is the responsibility of the caller.
   1278  */
   1279 void drm_plane_cleanup(struct drm_plane *plane)
   1280 {
   1281 	struct drm_device *dev = plane->dev;
   1282 
   1283 	drm_modeset_lock_all(dev);
   1284 	kfree(plane->format_types);
   1285 	drm_mode_object_put(dev, &plane->base);
   1286 
   1287 	BUG_ON(list_empty(&plane->head));
   1288 
   1289 	list_del(&plane->head);
   1290 	dev->mode_config.num_total_plane--;
   1291 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
   1292 		dev->mode_config.num_overlay_plane--;
   1293 	drm_modeset_unlock_all(dev);
   1294 
   1295 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
   1296 	if (plane->state && plane->funcs->atomic_destroy_state)
   1297 		plane->funcs->atomic_destroy_state(plane, plane->state);
   1298 	drm_modeset_lock_fini(&plane->mutex);
   1299 
   1300 	memset(plane, 0, sizeof(*plane));
   1301 }
   1302 EXPORT_SYMBOL(drm_plane_cleanup);
   1303 
   1304 /**
   1305  * drm_plane_index - find the index of a registered plane
   1306  * @plane: plane to find index for
   1307  *
   1308  * Given a registered plane, return the index of that CRTC within a DRM
   1309  * device's list of planes.
   1310  */
   1311 unsigned int drm_plane_index(struct drm_plane *plane)
   1312 {
   1313 	unsigned int index = 0;
   1314 	struct drm_plane *tmp;
   1315 
   1316 	drm_for_each_plane(tmp, plane->dev) {
   1317 		if (tmp == plane)
   1318 			return index;
   1319 
   1320 		index++;
   1321 	}
   1322 
   1323 	BUG();
   1324 }
   1325 EXPORT_SYMBOL(drm_plane_index);
   1326 
   1327 /**
   1328  * drm_plane_from_index - find the registered plane at an index
   1329  * @dev: DRM device
   1330  * @idx: index of registered plane to find for
   1331  *
   1332  * Given a plane index, return the registered plane from DRM device's
   1333  * list of planes with matching index.
   1334  */
   1335 struct drm_plane *
   1336 drm_plane_from_index(struct drm_device *dev, int idx)
   1337 {
   1338 	struct drm_plane *plane;
   1339 	unsigned int i = 0;
   1340 
   1341 	drm_for_each_plane(plane, dev) {
   1342 		if (i == idx)
   1343 			return plane;
   1344 		i++;
   1345 	}
   1346 	return NULL;
   1347 }
   1348 EXPORT_SYMBOL(drm_plane_from_index);
   1349 
   1350 /**
   1351  * drm_plane_force_disable - Forcibly disable a plane
   1352  * @plane: plane to disable
   1353  *
   1354  * Forces the plane to be disabled.
   1355  *
   1356  * Used when the plane's current framebuffer is destroyed,
   1357  * and when restoring fbdev mode.
   1358  */
   1359 void drm_plane_force_disable(struct drm_plane *plane)
   1360 {
   1361 	int ret;
   1362 
   1363 	if (!plane->fb)
   1364 		return;
   1365 
   1366 	plane->old_fb = plane->fb;
   1367 	ret = plane->funcs->disable_plane(plane);
   1368 	if (ret) {
   1369 		DRM_ERROR("failed to disable plane with busy fb\n");
   1370 		plane->old_fb = NULL;
   1371 		return;
   1372 	}
   1373 	/* disconnect the plane from the fb and crtc: */
   1374 	drm_framebuffer_unreference(plane->old_fb);
   1375 	plane->old_fb = NULL;
   1376 	plane->fb = NULL;
   1377 	plane->crtc = NULL;
   1378 }
   1379 EXPORT_SYMBOL(drm_plane_force_disable);
   1380 
   1381 static int drm_mode_create_standard_properties(struct drm_device *dev)
   1382 {
   1383 	struct drm_property *prop;
   1384 
   1385 	/*
   1386 	 * Standard properties (apply to all connectors)
   1387 	 */
   1388 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
   1389 				   DRM_MODE_PROP_IMMUTABLE,
   1390 				   "EDID", 0);
   1391 	if (!prop)
   1392 		return -ENOMEM;
   1393 	dev->mode_config.edid_property = prop;
   1394 
   1395 	prop = drm_property_create_enum(dev, 0,
   1396 				   "DPMS", drm_dpms_enum_list,
   1397 				   ARRAY_SIZE(drm_dpms_enum_list));
   1398 	if (!prop)
   1399 		return -ENOMEM;
   1400 	dev->mode_config.dpms_property = prop;
   1401 
   1402 	prop = drm_property_create(dev,
   1403 				   DRM_MODE_PROP_BLOB |
   1404 				   DRM_MODE_PROP_IMMUTABLE,
   1405 				   "PATH", 0);
   1406 	if (!prop)
   1407 		return -ENOMEM;
   1408 	dev->mode_config.path_property = prop;
   1409 
   1410 	prop = drm_property_create(dev,
   1411 				   DRM_MODE_PROP_BLOB |
   1412 				   DRM_MODE_PROP_IMMUTABLE,
   1413 				   "TILE", 0);
   1414 	if (!prop)
   1415 		return -ENOMEM;
   1416 	dev->mode_config.tile_property = prop;
   1417 
   1418 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1419 					"type", drm_plane_type_enum_list,
   1420 					ARRAY_SIZE(drm_plane_type_enum_list));
   1421 	if (!prop)
   1422 		return -ENOMEM;
   1423 	dev->mode_config.plane_type_property = prop;
   1424 
   1425 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1426 			"SRC_X", 0, UINT_MAX);
   1427 	if (!prop)
   1428 		return -ENOMEM;
   1429 	dev->mode_config.prop_src_x = prop;
   1430 
   1431 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1432 			"SRC_Y", 0, UINT_MAX);
   1433 	if (!prop)
   1434 		return -ENOMEM;
   1435 	dev->mode_config.prop_src_y = prop;
   1436 
   1437 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1438 			"SRC_W", 0, UINT_MAX);
   1439 	if (!prop)
   1440 		return -ENOMEM;
   1441 	dev->mode_config.prop_src_w = prop;
   1442 
   1443 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1444 			"SRC_H", 0, UINT_MAX);
   1445 	if (!prop)
   1446 		return -ENOMEM;
   1447 	dev->mode_config.prop_src_h = prop;
   1448 
   1449 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
   1450 			"CRTC_X", INT_MIN, INT_MAX);
   1451 	if (!prop)
   1452 		return -ENOMEM;
   1453 	dev->mode_config.prop_crtc_x = prop;
   1454 
   1455 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
   1456 			"CRTC_Y", INT_MIN, INT_MAX);
   1457 	if (!prop)
   1458 		return -ENOMEM;
   1459 	dev->mode_config.prop_crtc_y = prop;
   1460 
   1461 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1462 			"CRTC_W", 0, INT_MAX);
   1463 	if (!prop)
   1464 		return -ENOMEM;
   1465 	dev->mode_config.prop_crtc_w = prop;
   1466 
   1467 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
   1468 			"CRTC_H", 0, INT_MAX);
   1469 	if (!prop)
   1470 		return -ENOMEM;
   1471 	dev->mode_config.prop_crtc_h = prop;
   1472 
   1473 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
   1474 			"FB_ID", DRM_MODE_OBJECT_FB);
   1475 	if (!prop)
   1476 		return -ENOMEM;
   1477 	dev->mode_config.prop_fb_id = prop;
   1478 
   1479 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
   1480 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
   1481 	if (!prop)
   1482 		return -ENOMEM;
   1483 	dev->mode_config.prop_crtc_id = prop;
   1484 
   1485 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
   1486 			"ACTIVE");
   1487 	if (!prop)
   1488 		return -ENOMEM;
   1489 	dev->mode_config.prop_active = prop;
   1490 
   1491 	prop = drm_property_create(dev,
   1492 			DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
   1493 			"MODE_ID", 0);
   1494 	if (!prop)
   1495 		return -ENOMEM;
   1496 	dev->mode_config.prop_mode_id = prop;
   1497 
   1498 	return 0;
   1499 }
   1500 
   1501 /**
   1502  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
   1503  * @dev: DRM device
   1504  *
   1505  * Called by a driver the first time a DVI-I connector is made.
   1506  */
   1507 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
   1508 {
   1509 	struct drm_property *dvi_i_selector;
   1510 	struct drm_property *dvi_i_subconnector;
   1511 
   1512 	if (dev->mode_config.dvi_i_select_subconnector_property)
   1513 		return 0;
   1514 
   1515 	dvi_i_selector =
   1516 		drm_property_create_enum(dev, 0,
   1517 				    "select subconnector",
   1518 				    drm_dvi_i_select_enum_list,
   1519 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
   1520 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
   1521 
   1522 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1523 				    "subconnector",
   1524 				    drm_dvi_i_subconnector_enum_list,
   1525 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
   1526 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
   1527 
   1528 	return 0;
   1529 }
   1530 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
   1531 
   1532 /**
   1533  * drm_create_tv_properties - create TV specific connector properties
   1534  * @dev: DRM device
   1535  * @num_modes: number of different TV formats (modes) supported
   1536  * @modes: array of pointers to strings containing name of each format
   1537  *
   1538  * Called by a driver's TV initialization routine, this function creates
   1539  * the TV specific connector properties for a given device.  Caller is
   1540  * responsible for allocating a list of format names and passing them to
   1541  * this routine.
   1542  */
   1543 int drm_mode_create_tv_properties(struct drm_device *dev,
   1544 				  unsigned int num_modes,
   1545 				  const char * const modes[])
   1546 {
   1547 	struct drm_property *tv_selector;
   1548 	struct drm_property *tv_subconnector;
   1549 	unsigned int i;
   1550 
   1551 	if (dev->mode_config.tv_select_subconnector_property)
   1552 		return 0;
   1553 
   1554 	/*
   1555 	 * Basic connector properties
   1556 	 */
   1557 	tv_selector = drm_property_create_enum(dev, 0,
   1558 					  "select subconnector",
   1559 					  drm_tv_select_enum_list,
   1560 					  ARRAY_SIZE(drm_tv_select_enum_list));
   1561 	if (!tv_selector)
   1562 		goto nomem;
   1563 
   1564 	dev->mode_config.tv_select_subconnector_property = tv_selector;
   1565 
   1566 	tv_subconnector =
   1567 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1568 				    "subconnector",
   1569 				    drm_tv_subconnector_enum_list,
   1570 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
   1571 	if (!tv_subconnector)
   1572 		goto nomem;
   1573 	dev->mode_config.tv_subconnector_property = tv_subconnector;
   1574 
   1575 	/*
   1576 	 * Other, TV specific properties: margins & TV modes.
   1577 	 */
   1578 	dev->mode_config.tv_left_margin_property =
   1579 		drm_property_create_range(dev, 0, "left margin", 0, 100);
   1580 	if (!dev->mode_config.tv_left_margin_property)
   1581 		goto nomem;
   1582 
   1583 	dev->mode_config.tv_right_margin_property =
   1584 		drm_property_create_range(dev, 0, "right margin", 0, 100);
   1585 	if (!dev->mode_config.tv_right_margin_property)
   1586 		goto nomem;
   1587 
   1588 	dev->mode_config.tv_top_margin_property =
   1589 		drm_property_create_range(dev, 0, "top margin", 0, 100);
   1590 	if (!dev->mode_config.tv_top_margin_property)
   1591 		goto nomem;
   1592 
   1593 	dev->mode_config.tv_bottom_margin_property =
   1594 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
   1595 	if (!dev->mode_config.tv_bottom_margin_property)
   1596 		goto nomem;
   1597 
   1598 	dev->mode_config.tv_mode_property =
   1599 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
   1600 				    "mode", num_modes);
   1601 	if (!dev->mode_config.tv_mode_property)
   1602 		goto nomem;
   1603 
   1604 	for (i = 0; i < num_modes; i++)
   1605 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
   1606 				      i, modes[i]);
   1607 
   1608 	dev->mode_config.tv_brightness_property =
   1609 		drm_property_create_range(dev, 0, "brightness", 0, 100);
   1610 	if (!dev->mode_config.tv_brightness_property)
   1611 		goto nomem;
   1612 
   1613 	dev->mode_config.tv_contrast_property =
   1614 		drm_property_create_range(dev, 0, "contrast", 0, 100);
   1615 	if (!dev->mode_config.tv_contrast_property)
   1616 		goto nomem;
   1617 
   1618 	dev->mode_config.tv_flicker_reduction_property =
   1619 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
   1620 	if (!dev->mode_config.tv_flicker_reduction_property)
   1621 		goto nomem;
   1622 
   1623 	dev->mode_config.tv_overscan_property =
   1624 		drm_property_create_range(dev, 0, "overscan", 0, 100);
   1625 	if (!dev->mode_config.tv_overscan_property)
   1626 		goto nomem;
   1627 
   1628 	dev->mode_config.tv_saturation_property =
   1629 		drm_property_create_range(dev, 0, "saturation", 0, 100);
   1630 	if (!dev->mode_config.tv_saturation_property)
   1631 		goto nomem;
   1632 
   1633 	dev->mode_config.tv_hue_property =
   1634 		drm_property_create_range(dev, 0, "hue", 0, 100);
   1635 	if (!dev->mode_config.tv_hue_property)
   1636 		goto nomem;
   1637 
   1638 	return 0;
   1639 nomem:
   1640 	return -ENOMEM;
   1641 }
   1642 EXPORT_SYMBOL(drm_mode_create_tv_properties);
   1643 
   1644 /**
   1645  * drm_mode_create_scaling_mode_property - create scaling mode property
   1646  * @dev: DRM device
   1647  *
   1648  * Called by a driver the first time it's needed, must be attached to desired
   1649  * connectors.
   1650  */
   1651 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
   1652 {
   1653 	struct drm_property *scaling_mode;
   1654 
   1655 	if (dev->mode_config.scaling_mode_property)
   1656 		return 0;
   1657 
   1658 	scaling_mode =
   1659 		drm_property_create_enum(dev, 0, "scaling mode",
   1660 				drm_scaling_mode_enum_list,
   1661 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
   1662 
   1663 	dev->mode_config.scaling_mode_property = scaling_mode;
   1664 
   1665 	return 0;
   1666 }
   1667 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
   1668 
   1669 /**
   1670  * drm_mode_create_aspect_ratio_property - create aspect ratio property
   1671  * @dev: DRM device
   1672  *
   1673  * Called by a driver the first time it's needed, must be attached to desired
   1674  * connectors.
   1675  *
   1676  * Returns:
   1677  * Zero on success, negative errno on failure.
   1678  */
   1679 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
   1680 {
   1681 	if (dev->mode_config.aspect_ratio_property)
   1682 		return 0;
   1683 
   1684 	dev->mode_config.aspect_ratio_property =
   1685 		drm_property_create_enum(dev, 0, "aspect ratio",
   1686 				drm_aspect_ratio_enum_list,
   1687 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
   1688 
   1689 	if (dev->mode_config.aspect_ratio_property == NULL)
   1690 		return -ENOMEM;
   1691 
   1692 	return 0;
   1693 }
   1694 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
   1695 
   1696 /**
   1697  * drm_mode_create_dirty_property - create dirty property
   1698  * @dev: DRM device
   1699  *
   1700  * Called by a driver the first time it's needed, must be attached to desired
   1701  * connectors.
   1702  */
   1703 int drm_mode_create_dirty_info_property(struct drm_device *dev)
   1704 {
   1705 	struct drm_property *dirty_info;
   1706 
   1707 	if (dev->mode_config.dirty_info_property)
   1708 		return 0;
   1709 
   1710 	dirty_info =
   1711 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
   1712 				    "dirty",
   1713 				    drm_dirty_info_enum_list,
   1714 				    ARRAY_SIZE(drm_dirty_info_enum_list));
   1715 	dev->mode_config.dirty_info_property = dirty_info;
   1716 
   1717 	return 0;
   1718 }
   1719 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
   1720 
   1721 /**
   1722  * drm_mode_create_suggested_offset_properties - create suggests offset properties
   1723  * @dev: DRM device
   1724  *
   1725  * Create the the suggested x/y offset property for connectors.
   1726  */
   1727 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
   1728 {
   1729 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
   1730 		return 0;
   1731 
   1732 	dev->mode_config.suggested_x_property =
   1733 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
   1734 
   1735 	dev->mode_config.suggested_y_property =
   1736 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
   1737 
   1738 	if (dev->mode_config.suggested_x_property == NULL ||
   1739 	    dev->mode_config.suggested_y_property == NULL)
   1740 		return -ENOMEM;
   1741 	return 0;
   1742 }
   1743 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
   1744 
   1745 /**
   1746  * drm_mode_getresources - get graphics configuration
   1747  * @dev: drm device for the ioctl
   1748  * @data: data pointer for the ioctl
   1749  * @file_priv: drm file for the ioctl call
   1750  *
   1751  * Construct a set of configuration description structures and return
   1752  * them to the user, including CRTC, connector and framebuffer configuration.
   1753  *
   1754  * Called by the user via ioctl.
   1755  *
   1756  * Returns:
   1757  * Zero on success, negative errno on failure.
   1758  */
   1759 int drm_mode_getresources(struct drm_device *dev, void *data,
   1760 			  struct drm_file *file_priv)
   1761 {
   1762 	struct drm_mode_card_res *card_res = data;
   1763 	struct list_head *lh;
   1764 	struct drm_framebuffer *fb;
   1765 	struct drm_connector *connector;
   1766 	struct drm_crtc *crtc;
   1767 	struct drm_encoder *encoder;
   1768 	int ret = 0;
   1769 	int connector_count = 0;
   1770 	int crtc_count = 0;
   1771 	int fb_count = 0;
   1772 	int encoder_count = 0;
   1773 	int copied = 0;
   1774 	uint32_t __user *fb_id;
   1775 	uint32_t __user *crtc_id;
   1776 	uint32_t __user *connector_id;
   1777 	uint32_t __user *encoder_id;
   1778 
   1779 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   1780 		return -EINVAL;
   1781 
   1782 
   1783 	mutex_lock(&file_priv->fbs_lock);
   1784 	/*
   1785 	 * For the non-control nodes we need to limit the list of resources
   1786 	 * by IDs in the group list for this node
   1787 	 */
   1788 	list_for_each(lh, &file_priv->fbs)
   1789 		fb_count++;
   1790 
   1791 	/* handle this in 4 parts */
   1792 	/* FBs */
   1793 	if (card_res->count_fbs >= fb_count) {
   1794 		copied = 0;
   1795 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
   1796 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
   1797 			if (put_user(fb->base.id, fb_id + copied)) {
   1798 				mutex_unlock(&file_priv->fbs_lock);
   1799 				return -EFAULT;
   1800 			}
   1801 			copied++;
   1802 		}
   1803 	}
   1804 	card_res->count_fbs = fb_count;
   1805 	mutex_unlock(&file_priv->fbs_lock);
   1806 
   1807 	/* mode_config.mutex protects the connector list against e.g. DP MST
   1808 	 * connector hot-adding. CRTC/Plane lists are invariant. */
   1809 	mutex_lock(&dev->mode_config.mutex);
   1810 	drm_for_each_crtc(crtc, dev)
   1811 		crtc_count++;
   1812 
   1813 	drm_for_each_connector(connector, dev)
   1814 		connector_count++;
   1815 
   1816 	drm_for_each_encoder(encoder, dev)
   1817 		encoder_count++;
   1818 
   1819 	card_res->max_height = dev->mode_config.max_height;
   1820 	card_res->min_height = dev->mode_config.min_height;
   1821 	card_res->max_width = dev->mode_config.max_width;
   1822 	card_res->min_width = dev->mode_config.min_width;
   1823 
   1824 	/* CRTCs */
   1825 	if (card_res->count_crtcs >= crtc_count) {
   1826 		copied = 0;
   1827 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
   1828 		drm_for_each_crtc(crtc, dev) {
   1829 			DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
   1830 			if (put_user(crtc->base.id, crtc_id + copied)) {
   1831 				ret = -EFAULT;
   1832 				goto out;
   1833 			}
   1834 			copied++;
   1835 		}
   1836 	}
   1837 	card_res->count_crtcs = crtc_count;
   1838 
   1839 	/* Encoders */
   1840 	if (card_res->count_encoders >= encoder_count) {
   1841 		copied = 0;
   1842 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
   1843 		drm_for_each_encoder(encoder, dev) {
   1844 			DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
   1845 					encoder->name);
   1846 			if (put_user(encoder->base.id, encoder_id +
   1847 				     copied)) {
   1848 				ret = -EFAULT;
   1849 				goto out;
   1850 			}
   1851 			copied++;
   1852 		}
   1853 	}
   1854 	card_res->count_encoders = encoder_count;
   1855 
   1856 	/* Connectors */
   1857 	if (card_res->count_connectors >= connector_count) {
   1858 		copied = 0;
   1859 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
   1860 		drm_for_each_connector(connector, dev) {
   1861 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
   1862 				connector->base.id,
   1863 				connector->name);
   1864 			if (put_user(connector->base.id,
   1865 				     connector_id + copied)) {
   1866 				ret = -EFAULT;
   1867 				goto out;
   1868 			}
   1869 			copied++;
   1870 		}
   1871 	}
   1872 	card_res->count_connectors = connector_count;
   1873 
   1874 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
   1875 		  card_res->count_connectors, card_res->count_encoders);
   1876 
   1877 out:
   1878 	mutex_unlock(&dev->mode_config.mutex);
   1879 	return ret;
   1880 }
   1881 
   1882 /**
   1883  * drm_mode_getcrtc - get CRTC configuration
   1884  * @dev: drm device for the ioctl
   1885  * @data: data pointer for the ioctl
   1886  * @file_priv: drm file for the ioctl call
   1887  *
   1888  * Construct a CRTC configuration structure to return to the user.
   1889  *
   1890  * Called by the user via ioctl.
   1891  *
   1892  * Returns:
   1893  * Zero on success, negative errno on failure.
   1894  */
   1895 int drm_mode_getcrtc(struct drm_device *dev,
   1896 		     void *data, struct drm_file *file_priv)
   1897 {
   1898 	struct drm_mode_crtc *crtc_resp = data;
   1899 	struct drm_crtc *crtc;
   1900 
   1901 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   1902 		return -EINVAL;
   1903 
   1904 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
   1905 	if (!crtc)
   1906 		return -ENOENT;
   1907 
   1908 	drm_modeset_lock_crtc(crtc, crtc->primary);
   1909 	crtc_resp->gamma_size = crtc->gamma_size;
   1910 	if (crtc->primary->fb)
   1911 		crtc_resp->fb_id = crtc->primary->fb->base.id;
   1912 	else
   1913 		crtc_resp->fb_id = 0;
   1914 
   1915 	if (crtc->state) {
   1916 		crtc_resp->x = crtc->primary->state->src_x >> 16;
   1917 		crtc_resp->y = crtc->primary->state->src_y >> 16;
   1918 		if (crtc->state->enable) {
   1919 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
   1920 			crtc_resp->mode_valid = 1;
   1921 
   1922 		} else {
   1923 			crtc_resp->mode_valid = 0;
   1924 		}
   1925 	} else {
   1926 		crtc_resp->x = crtc->x;
   1927 		crtc_resp->y = crtc->y;
   1928 		if (crtc->enabled) {
   1929 			drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
   1930 			crtc_resp->mode_valid = 1;
   1931 
   1932 		} else {
   1933 			crtc_resp->mode_valid = 0;
   1934 		}
   1935 	}
   1936 	drm_modeset_unlock_crtc(crtc);
   1937 
   1938 	return 0;
   1939 }
   1940 
   1941 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
   1942 					 const struct drm_file *file_priv)
   1943 {
   1944 	/*
   1945 	 * If user-space hasn't configured the driver to expose the stereo 3D
   1946 	 * modes, don't expose them.
   1947 	 */
   1948 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
   1949 		return false;
   1950 
   1951 	return true;
   1952 }
   1953 
   1954 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
   1955 {
   1956 	/* For atomic drivers only state objects are synchronously updated and
   1957 	 * protected by modeset locks, so check those first. */
   1958 	if (connector->state)
   1959 		return connector->state->best_encoder;
   1960 	return connector->encoder;
   1961 }
   1962 
   1963 /* helper for getconnector and getproperties ioctls */
   1964 static int get_properties(struct drm_mode_object *obj, bool atomic,
   1965 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
   1966 		uint32_t *arg_count_props)
   1967 {
   1968 	int props_count;
   1969 	int i, ret, copied;
   1970 
   1971 	props_count = obj->properties->count;
   1972 	if (!atomic)
   1973 		props_count -= obj->properties->atomic_count;
   1974 
   1975 	if ((*arg_count_props >= props_count) && props_count) {
   1976 		for (i = 0, copied = 0; copied < props_count; i++) {
   1977 			struct drm_property *prop = obj->properties->properties[i];
   1978 			uint64_t val;
   1979 
   1980 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
   1981 				continue;
   1982 
   1983 			ret = drm_object_property_get_value(obj, prop, &val);
   1984 			if (ret)
   1985 				return ret;
   1986 
   1987 			if (put_user(prop->base.id, prop_ptr + copied))
   1988 				return -EFAULT;
   1989 
   1990 			if (put_user(val, prop_values + copied))
   1991 				return -EFAULT;
   1992 
   1993 			copied++;
   1994 		}
   1995 	}
   1996 	*arg_count_props = props_count;
   1997 
   1998 	return 0;
   1999 }
   2000 
   2001 /**
   2002  * drm_mode_getconnector - get connector configuration
   2003  * @dev: drm device for the ioctl
   2004  * @data: data pointer for the ioctl
   2005  * @file_priv: drm file for the ioctl call
   2006  *
   2007  * Construct a connector configuration structure to return to the user.
   2008  *
   2009  * Called by the user via ioctl.
   2010  *
   2011  * Returns:
   2012  * Zero on success, negative errno on failure.
   2013  */
   2014 int drm_mode_getconnector(struct drm_device *dev, void *data,
   2015 			  struct drm_file *file_priv)
   2016 {
   2017 	struct drm_mode_get_connector *out_resp = data;
   2018 	struct drm_connector *connector;
   2019 	struct drm_encoder *encoder;
   2020 	struct drm_display_mode *mode;
   2021 	int mode_count = 0;
   2022 	int encoders_count = 0;
   2023 	int ret = 0;
   2024 	int copied = 0;
   2025 	int i;
   2026 	struct drm_mode_modeinfo u_mode;
   2027 	struct drm_mode_modeinfo __user *mode_ptr;
   2028 	uint32_t __user *encoder_ptr;
   2029 
   2030 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2031 		return -EINVAL;
   2032 
   2033 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
   2034 
   2035 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
   2036 
   2037 	mutex_lock(&dev->mode_config.mutex);
   2038 
   2039 	connector = drm_connector_find(dev, out_resp->connector_id);
   2040 	if (!connector) {
   2041 		ret = -ENOENT;
   2042 		goto out_unlock;
   2043 	}
   2044 
   2045 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
   2046 		if (connector->encoder_ids[i] != 0)
   2047 			encoders_count++;
   2048 
   2049 	if (out_resp->count_modes == 0) {
   2050 		connector->funcs->fill_modes(connector,
   2051 					     dev->mode_config.max_width,
   2052 					     dev->mode_config.max_height);
   2053 	}
   2054 
   2055 	/* delayed so we get modes regardless of pre-fill_modes state */
   2056 	list_for_each_entry(mode, &connector->modes, head)
   2057 		if (drm_mode_expose_to_userspace(mode, file_priv))
   2058 			mode_count++;
   2059 
   2060 	out_resp->connector_id = connector->base.id;
   2061 	out_resp->connector_type = connector->connector_type;
   2062 	out_resp->connector_type_id = connector->connector_type_id;
   2063 	out_resp->mm_width = connector->display_info.width_mm;
   2064 	out_resp->mm_height = connector->display_info.height_mm;
   2065 	out_resp->subpixel = connector->display_info.subpixel_order;
   2066 	out_resp->connection = connector->status;
   2067 
   2068 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
   2069 	encoder = drm_connector_get_encoder(connector);
   2070 	if (encoder)
   2071 		out_resp->encoder_id = encoder->base.id;
   2072 	else
   2073 		out_resp->encoder_id = 0;
   2074 
   2075 	/*
   2076 	 * This ioctl is called twice, once to determine how much space is
   2077 	 * needed, and the 2nd time to fill it.
   2078 	 */
   2079 	if ((out_resp->count_modes >= mode_count) && mode_count) {
   2080 		copied = 0;
   2081 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
   2082 		list_for_each_entry(mode, &connector->modes, head) {
   2083 			if (!drm_mode_expose_to_userspace(mode, file_priv))
   2084 				continue;
   2085 
   2086 			drm_mode_convert_to_umode(&u_mode, mode);
   2087 			if (copy_to_user(mode_ptr + copied,
   2088 					 &u_mode, sizeof(u_mode))) {
   2089 				ret = -EFAULT;
   2090 				goto out;
   2091 			}
   2092 			copied++;
   2093 		}
   2094 	}
   2095 	out_resp->count_modes = mode_count;
   2096 
   2097 	ret = get_properties(&connector->base, file_priv->atomic,
   2098 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
   2099 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
   2100 			&out_resp->count_props);
   2101 	if (ret)
   2102 		goto out;
   2103 
   2104 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
   2105 		copied = 0;
   2106 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
   2107 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
   2108 			if (connector->encoder_ids[i] != 0) {
   2109 				if (put_user(connector->encoder_ids[i],
   2110 					     encoder_ptr + copied)) {
   2111 					ret = -EFAULT;
   2112 					goto out;
   2113 				}
   2114 				copied++;
   2115 			}
   2116 		}
   2117 	}
   2118 	out_resp->count_encoders = encoders_count;
   2119 
   2120 out:
   2121 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
   2122 
   2123 out_unlock:
   2124 	mutex_unlock(&dev->mode_config.mutex);
   2125 
   2126 	return ret;
   2127 }
   2128 
   2129 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
   2130 {
   2131 	struct drm_connector *connector;
   2132 	struct drm_device *dev = encoder->dev;
   2133 	bool uses_atomic = false;
   2134 
   2135 	/* For atomic drivers only state objects are synchronously updated and
   2136 	 * protected by modeset locks, so check those first. */
   2137 	drm_for_each_connector(connector, dev) {
   2138 		if (!connector->state)
   2139 			continue;
   2140 
   2141 		uses_atomic = true;
   2142 
   2143 		if (connector->state->best_encoder != encoder)
   2144 			continue;
   2145 
   2146 		return connector->state->crtc;
   2147 	}
   2148 
   2149 	/* Don't return stale data (e.g. pending async disable). */
   2150 	if (uses_atomic)
   2151 		return NULL;
   2152 
   2153 	return encoder->crtc;
   2154 }
   2155 
   2156 /**
   2157  * drm_mode_getencoder - get encoder configuration
   2158  * @dev: drm device for the ioctl
   2159  * @data: data pointer for the ioctl
   2160  * @file_priv: drm file for the ioctl call
   2161  *
   2162  * Construct a encoder configuration structure to return to the user.
   2163  *
   2164  * Called by the user via ioctl.
   2165  *
   2166  * Returns:
   2167  * Zero on success, negative errno on failure.
   2168  */
   2169 int drm_mode_getencoder(struct drm_device *dev, void *data,
   2170 			struct drm_file *file_priv)
   2171 {
   2172 	struct drm_mode_get_encoder *enc_resp = data;
   2173 	struct drm_encoder *encoder;
   2174 	struct drm_crtc *crtc;
   2175 
   2176 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2177 		return -EINVAL;
   2178 
   2179 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
   2180 	if (!encoder)
   2181 		return -ENOENT;
   2182 
   2183 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
   2184 	crtc = drm_encoder_get_crtc(encoder);
   2185 	if (crtc)
   2186 		enc_resp->crtc_id = crtc->base.id;
   2187 	else
   2188 		enc_resp->crtc_id = 0;
   2189 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
   2190 
   2191 	enc_resp->encoder_type = encoder->encoder_type;
   2192 	enc_resp->encoder_id = encoder->base.id;
   2193 	enc_resp->possible_crtcs = encoder->possible_crtcs;
   2194 	enc_resp->possible_clones = encoder->possible_clones;
   2195 
   2196 	return 0;
   2197 }
   2198 
   2199 /**
   2200  * drm_mode_getplane_res - enumerate all plane resources
   2201  * @dev: DRM device
   2202  * @data: ioctl data
   2203  * @file_priv: DRM file info
   2204  *
   2205  * Construct a list of plane ids to return to the user.
   2206  *
   2207  * Called by the user via ioctl.
   2208  *
   2209  * Returns:
   2210  * Zero on success, negative errno on failure.
   2211  */
   2212 int drm_mode_getplane_res(struct drm_device *dev, void *data,
   2213 			  struct drm_file *file_priv)
   2214 {
   2215 	struct drm_mode_get_plane_res *plane_resp = data;
   2216 	struct drm_mode_config *config;
   2217 	struct drm_plane *plane;
   2218 	uint32_t __user *plane_ptr;
   2219 	int copied = 0;
   2220 	unsigned num_planes;
   2221 
   2222 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2223 		return -EINVAL;
   2224 
   2225 	config = &dev->mode_config;
   2226 
   2227 	if (file_priv->universal_planes)
   2228 		num_planes = config->num_total_plane;
   2229 	else
   2230 		num_planes = config->num_overlay_plane;
   2231 
   2232 	/*
   2233 	 * This ioctl is called twice, once to determine how much space is
   2234 	 * needed, and the 2nd time to fill it.
   2235 	 */
   2236 	if (num_planes &&
   2237 	    (plane_resp->count_planes >= num_planes)) {
   2238 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
   2239 
   2240 		/* Plane lists are invariant, no locking needed. */
   2241 		drm_for_each_plane(plane, dev) {
   2242 			/*
   2243 			 * Unless userspace set the 'universal planes'
   2244 			 * capability bit, only advertise overlays.
   2245 			 */
   2246 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
   2247 			    !file_priv->universal_planes)
   2248 				continue;
   2249 
   2250 			if (put_user(plane->base.id, plane_ptr + copied))
   2251 				return -EFAULT;
   2252 			copied++;
   2253 		}
   2254 	}
   2255 	plane_resp->count_planes = num_planes;
   2256 
   2257 	return 0;
   2258 }
   2259 
   2260 /**
   2261  * drm_mode_getplane - get plane configuration
   2262  * @dev: DRM device
   2263  * @data: ioctl data
   2264  * @file_priv: DRM file info
   2265  *
   2266  * Construct a plane configuration structure to return to the user.
   2267  *
   2268  * Called by the user via ioctl.
   2269  *
   2270  * Returns:
   2271  * Zero on success, negative errno on failure.
   2272  */
   2273 int drm_mode_getplane(struct drm_device *dev, void *data,
   2274 		      struct drm_file *file_priv)
   2275 {
   2276 	struct drm_mode_get_plane *plane_resp = data;
   2277 	struct drm_plane *plane;
   2278 	uint32_t __user *format_ptr;
   2279 
   2280 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2281 		return -EINVAL;
   2282 
   2283 	plane = drm_plane_find(dev, plane_resp->plane_id);
   2284 	if (!plane)
   2285 		return -ENOENT;
   2286 
   2287 	drm_modeset_lock(&plane->mutex, NULL);
   2288 	if (plane->crtc)
   2289 		plane_resp->crtc_id = plane->crtc->base.id;
   2290 	else
   2291 		plane_resp->crtc_id = 0;
   2292 
   2293 	if (plane->fb)
   2294 		plane_resp->fb_id = plane->fb->base.id;
   2295 	else
   2296 		plane_resp->fb_id = 0;
   2297 	drm_modeset_unlock(&plane->mutex);
   2298 
   2299 	plane_resp->plane_id = plane->base.id;
   2300 	plane_resp->possible_crtcs = plane->possible_crtcs;
   2301 	plane_resp->gamma_size = 0;
   2302 
   2303 	/*
   2304 	 * This ioctl is called twice, once to determine how much space is
   2305 	 * needed, and the 2nd time to fill it.
   2306 	 */
   2307 	if (plane->format_count &&
   2308 	    (plane_resp->count_format_types >= plane->format_count)) {
   2309 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
   2310 		if (copy_to_user(format_ptr,
   2311 				 plane->format_types,
   2312 				 sizeof(uint32_t) * plane->format_count)) {
   2313 			return -EFAULT;
   2314 		}
   2315 	}
   2316 	plane_resp->count_format_types = plane->format_count;
   2317 
   2318 	return 0;
   2319 }
   2320 
   2321 /**
   2322  * drm_plane_check_pixel_format - Check if the plane supports the pixel format
   2323  * @plane: plane to check for format support
   2324  * @format: the pixel format
   2325  *
   2326  * Returns:
   2327  * Zero of @plane has @format in its list of supported pixel formats, -EINVAL
   2328  * otherwise.
   2329  */
   2330 int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
   2331 {
   2332 	unsigned int i;
   2333 
   2334 	for (i = 0; i < plane->format_count; i++) {
   2335 		if (format == plane->format_types[i])
   2336 			return 0;
   2337 	}
   2338 
   2339 	return -EINVAL;
   2340 }
   2341 
   2342 static int check_src_coords(uint32_t src_x, uint32_t src_y,
   2343 			    uint32_t src_w, uint32_t src_h,
   2344 			    const struct drm_framebuffer *fb)
   2345 {
   2346 	unsigned int fb_width, fb_height;
   2347 
   2348 	fb_width = fb->width << 16;
   2349 	fb_height = fb->height << 16;
   2350 
   2351 	/* Make sure source coordinates are inside the fb. */
   2352 	if (src_w > fb_width ||
   2353 	    src_x > fb_width - src_w ||
   2354 	    src_h > fb_height ||
   2355 	    src_y > fb_height - src_h) {
   2356 		DRM_DEBUG_KMS("Invalid source coordinates "
   2357 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
   2358 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
   2359 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
   2360 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
   2361 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
   2362 		return -ENOSPC;
   2363 	}
   2364 
   2365 	return 0;
   2366 }
   2367 
   2368 /*
   2369  * setplane_internal - setplane handler for internal callers
   2370  *
   2371  * Note that we assume an extra reference has already been taken on fb.  If the
   2372  * update fails, this reference will be dropped before return; if it succeeds,
   2373  * the previous framebuffer (if any) will be unreferenced instead.
   2374  *
   2375  * src_{x,y,w,h} are provided in 16.16 fixed point format
   2376  */
   2377 static int __setplane_internal(struct drm_plane *plane,
   2378 			       struct drm_crtc *crtc,
   2379 			       struct drm_framebuffer *fb,
   2380 			       int32_t crtc_x, int32_t crtc_y,
   2381 			       uint32_t crtc_w, uint32_t crtc_h,
   2382 			       /* src_{x,y,w,h} values are 16.16 fixed point */
   2383 			       uint32_t src_x, uint32_t src_y,
   2384 			       uint32_t src_w, uint32_t src_h)
   2385 {
   2386 	int ret = 0;
   2387 
   2388 	/* No fb means shut it down */
   2389 	if (!fb) {
   2390 		plane->old_fb = plane->fb;
   2391 		ret = plane->funcs->disable_plane(plane);
   2392 		if (!ret) {
   2393 			plane->crtc = NULL;
   2394 			plane->fb = NULL;
   2395 		} else {
   2396 			plane->old_fb = NULL;
   2397 		}
   2398 		goto out;
   2399 	}
   2400 
   2401 	/* Check whether this plane is usable on this CRTC */
   2402 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
   2403 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
   2404 		ret = -EINVAL;
   2405 		goto out;
   2406 	}
   2407 
   2408 	/* Check whether this plane supports the fb pixel format. */
   2409 	ret = drm_plane_check_pixel_format(plane, fb->pixel_format);
   2410 	if (ret) {
   2411 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
   2412 			      drm_get_format_name(fb->pixel_format));
   2413 		goto out;
   2414 	}
   2415 
   2416 	/* Give drivers some help against integer overflows */
   2417 	if (crtc_w > INT_MAX ||
   2418 	    crtc_x > INT_MAX - (int32_t) crtc_w ||
   2419 	    crtc_h > INT_MAX ||
   2420 	    crtc_y > INT_MAX - (int32_t) crtc_h) {
   2421 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
   2422 			      crtc_w, crtc_h, crtc_x, crtc_y);
   2423 		ret = -ERANGE;
   2424 		goto out;
   2425 	}
   2426 
   2427 	ret = check_src_coords(src_x, src_y, src_w, src_h, fb);
   2428 	if (ret)
   2429 		goto out;
   2430 
   2431 	plane->old_fb = plane->fb;
   2432 	ret = plane->funcs->update_plane(plane, crtc, fb,
   2433 					 crtc_x, crtc_y, crtc_w, crtc_h,
   2434 					 src_x, src_y, src_w, src_h);
   2435 	if (!ret) {
   2436 		plane->crtc = crtc;
   2437 		plane->fb = fb;
   2438 		fb = NULL;
   2439 	} else {
   2440 		plane->old_fb = NULL;
   2441 	}
   2442 
   2443 out:
   2444 	if (fb)
   2445 		drm_framebuffer_unreference(fb);
   2446 	if (plane->old_fb)
   2447 		drm_framebuffer_unreference(plane->old_fb);
   2448 	plane->old_fb = NULL;
   2449 
   2450 	return ret;
   2451 }
   2452 
   2453 static int setplane_internal(struct drm_plane *plane,
   2454 			     struct drm_crtc *crtc,
   2455 			     struct drm_framebuffer *fb,
   2456 			     int32_t crtc_x, int32_t crtc_y,
   2457 			     uint32_t crtc_w, uint32_t crtc_h,
   2458 			     /* src_{x,y,w,h} values are 16.16 fixed point */
   2459 			     uint32_t src_x, uint32_t src_y,
   2460 			     uint32_t src_w, uint32_t src_h)
   2461 {
   2462 	int ret;
   2463 
   2464 	drm_modeset_lock_all(plane->dev);
   2465 	ret = __setplane_internal(plane, crtc, fb,
   2466 				  crtc_x, crtc_y, crtc_w, crtc_h,
   2467 				  src_x, src_y, src_w, src_h);
   2468 	drm_modeset_unlock_all(plane->dev);
   2469 
   2470 	return ret;
   2471 }
   2472 
   2473 /**
   2474  * drm_mode_setplane - configure a plane's configuration
   2475  * @dev: DRM device
   2476  * @data: ioctl data*
   2477  * @file_priv: DRM file info
   2478  *
   2479  * Set plane configuration, including placement, fb, scaling, and other factors.
   2480  * Or pass a NULL fb to disable (planes may be disabled without providing a
   2481  * valid crtc).
   2482  *
   2483  * Returns:
   2484  * Zero on success, negative errno on failure.
   2485  */
   2486 int drm_mode_setplane(struct drm_device *dev, void *data,
   2487 		      struct drm_file *file_priv)
   2488 {
   2489 	struct drm_mode_set_plane *plane_req = data;
   2490 	struct drm_plane *plane;
   2491 	struct drm_crtc *crtc = NULL;
   2492 	struct drm_framebuffer *fb = NULL;
   2493 
   2494 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2495 		return -EINVAL;
   2496 
   2497 	/*
   2498 	 * First, find the plane, crtc, and fb objects.  If not available,
   2499 	 * we don't bother to call the driver.
   2500 	 */
   2501 	plane = drm_plane_find(dev, plane_req->plane_id);
   2502 	if (!plane) {
   2503 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
   2504 			      plane_req->plane_id);
   2505 		return -ENOENT;
   2506 	}
   2507 
   2508 	if (plane_req->fb_id) {
   2509 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
   2510 		if (!fb) {
   2511 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
   2512 				      plane_req->fb_id);
   2513 			return -ENOENT;
   2514 		}
   2515 
   2516 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
   2517 		if (!crtc) {
   2518 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
   2519 				      plane_req->crtc_id);
   2520 			return -ENOENT;
   2521 		}
   2522 	}
   2523 
   2524 	/*
   2525 	 * setplane_internal will take care of deref'ing either the old or new
   2526 	 * framebuffer depending on success.
   2527 	 */
   2528 	return setplane_internal(plane, crtc, fb,
   2529 				 plane_req->crtc_x, plane_req->crtc_y,
   2530 				 plane_req->crtc_w, plane_req->crtc_h,
   2531 				 plane_req->src_x, plane_req->src_y,
   2532 				 plane_req->src_w, plane_req->src_h);
   2533 }
   2534 
   2535 /**
   2536  * drm_mode_set_config_internal - helper to call ->set_config
   2537  * @set: modeset config to set
   2538  *
   2539  * This is a little helper to wrap internal calls to the ->set_config driver
   2540  * interface. The only thing it adds is correct refcounting dance.
   2541  *
   2542  * Returns:
   2543  * Zero on success, negative errno on failure.
   2544  */
   2545 int drm_mode_set_config_internal(struct drm_mode_set *set)
   2546 {
   2547 	struct drm_crtc *crtc = set->crtc;
   2548 	struct drm_framebuffer *fb;
   2549 	struct drm_crtc *tmp;
   2550 	int ret;
   2551 
   2552 	/*
   2553 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
   2554 	 * connectors from it), hence we need to refcount the fbs across all
   2555 	 * crtcs. Atomic modeset will have saner semantics ...
   2556 	 */
   2557 	drm_for_each_crtc(tmp, crtc->dev)
   2558 		tmp->primary->old_fb = tmp->primary->fb;
   2559 
   2560 	fb = set->fb;
   2561 
   2562 	ret = crtc->funcs->set_config(set);
   2563 	if (ret == 0) {
   2564 		crtc->primary->crtc = crtc;
   2565 		crtc->primary->fb = fb;
   2566 	}
   2567 
   2568 	drm_for_each_crtc(tmp, crtc->dev) {
   2569 		if (tmp->primary->fb)
   2570 			drm_framebuffer_reference(tmp->primary->fb);
   2571 		if (tmp->primary->old_fb)
   2572 			drm_framebuffer_unreference(tmp->primary->old_fb);
   2573 		tmp->primary->old_fb = NULL;
   2574 	}
   2575 
   2576 	return ret;
   2577 }
   2578 EXPORT_SYMBOL(drm_mode_set_config_internal);
   2579 
   2580 /**
   2581  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
   2582  * @mode: mode to query
   2583  * @hdisplay: hdisplay value to fill in
   2584  * @vdisplay: vdisplay value to fill in
   2585  *
   2586  * The vdisplay value will be doubled if the specified mode is a stereo mode of
   2587  * the appropriate layout.
   2588  */
   2589 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
   2590 			    int *hdisplay, int *vdisplay)
   2591 {
   2592 	struct drm_display_mode adjusted;
   2593 
   2594 	drm_mode_copy(&adjusted, mode);
   2595 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
   2596 	*hdisplay = adjusted.crtc_hdisplay;
   2597 	*vdisplay = adjusted.crtc_vdisplay;
   2598 }
   2599 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
   2600 
   2601 /**
   2602  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
   2603  *     CRTC viewport
   2604  * @crtc: CRTC that framebuffer will be displayed on
   2605  * @x: x panning
   2606  * @y: y panning
   2607  * @mode: mode that framebuffer will be displayed under
   2608  * @fb: framebuffer to check size of
   2609  */
   2610 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
   2611 			    int x, int y,
   2612 			    const struct drm_display_mode *mode,
   2613 			    const struct drm_framebuffer *fb)
   2614 
   2615 {
   2616 	int hdisplay, vdisplay;
   2617 
   2618 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
   2619 
   2620 	if (crtc->state &&
   2621 	    crtc->primary->state->rotation & (BIT(DRM_ROTATE_90) |
   2622 					      BIT(DRM_ROTATE_270)))
   2623 		swap(hdisplay, vdisplay);
   2624 
   2625 	return check_src_coords(x << 16, y << 16,
   2626 				hdisplay << 16, vdisplay << 16, fb);
   2627 }
   2628 EXPORT_SYMBOL(drm_crtc_check_viewport);
   2629 
   2630 /**
   2631  * drm_mode_setcrtc - set CRTC configuration
   2632  * @dev: drm device for the ioctl
   2633  * @data: data pointer for the ioctl
   2634  * @file_priv: drm file for the ioctl call
   2635  *
   2636  * Build a new CRTC configuration based on user request.
   2637  *
   2638  * Called by the user via ioctl.
   2639  *
   2640  * Returns:
   2641  * Zero on success, negative errno on failure.
   2642  */
   2643 int drm_mode_setcrtc(struct drm_device *dev, void *data,
   2644 		     struct drm_file *file_priv)
   2645 {
   2646 	struct drm_mode_config *config = &dev->mode_config;
   2647 	struct drm_mode_crtc *crtc_req = data;
   2648 	struct drm_crtc *crtc;
   2649 	struct drm_connector **connector_set = NULL, *connector;
   2650 	struct drm_framebuffer *fb = NULL;
   2651 	struct drm_display_mode *mode = NULL;
   2652 	struct drm_mode_set set;
   2653 	uint32_t __user *set_connectors_ptr;
   2654 	int ret;
   2655 	int i;
   2656 
   2657 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2658 		return -EINVAL;
   2659 
   2660 	/*
   2661 	 * Universal plane src offsets are only 16.16, prevent havoc for
   2662 	 * drivers using universal plane code internally.
   2663 	 */
   2664 	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
   2665 		return -ERANGE;
   2666 
   2667 	drm_modeset_lock_all(dev);
   2668 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
   2669 	if (!crtc) {
   2670 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
   2671 		ret = -ENOENT;
   2672 		goto out;
   2673 	}
   2674 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
   2675 
   2676 	if (crtc_req->mode_valid) {
   2677 		/* If we have a mode we need a framebuffer. */
   2678 		/* If we pass -1, set the mode with the currently bound fb */
   2679 		if (crtc_req->fb_id == -1) {
   2680 			if (!crtc->primary->fb) {
   2681 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
   2682 				ret = -EINVAL;
   2683 				goto out;
   2684 			}
   2685 			fb = crtc->primary->fb;
   2686 			/* Make refcounting symmetric with the lookup path. */
   2687 			drm_framebuffer_reference(fb);
   2688 		} else {
   2689 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
   2690 			if (!fb) {
   2691 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
   2692 						crtc_req->fb_id);
   2693 				ret = -ENOENT;
   2694 				goto out;
   2695 			}
   2696 		}
   2697 
   2698 		mode = drm_mode_create(dev);
   2699 		if (!mode) {
   2700 			ret = -ENOMEM;
   2701 			goto out;
   2702 		}
   2703 
   2704 		ret = drm_mode_convert_umode(mode, &crtc_req->mode);
   2705 		if (ret) {
   2706 			DRM_DEBUG_KMS("Invalid mode\n");
   2707 			goto out;
   2708 		}
   2709 
   2710 		/*
   2711 		 * Check whether the primary plane supports the fb pixel format.
   2712 		 * Drivers not implementing the universal planes API use a
   2713 		 * default formats list provided by the DRM core which doesn't
   2714 		 * match real hardware capabilities. Skip the check in that
   2715 		 * case.
   2716 		 */
   2717 		if (!crtc->primary->format_default) {
   2718 			ret = drm_plane_check_pixel_format(crtc->primary,
   2719 							   fb->pixel_format);
   2720 			if (ret) {
   2721 				DRM_DEBUG_KMS("Invalid pixel format %s\n",
   2722 					drm_get_format_name(fb->pixel_format));
   2723 				goto out;
   2724 			}
   2725 		}
   2726 
   2727 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
   2728 					      mode, fb);
   2729 		if (ret)
   2730 			goto out;
   2731 
   2732 	}
   2733 
   2734 	if (crtc_req->count_connectors == 0 && mode) {
   2735 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
   2736 		ret = -EINVAL;
   2737 		goto out;
   2738 	}
   2739 
   2740 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
   2741 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
   2742 			  crtc_req->count_connectors);
   2743 		ret = -EINVAL;
   2744 		goto out;
   2745 	}
   2746 
   2747 	if (crtc_req->count_connectors > 0) {
   2748 		u32 out_id;
   2749 
   2750 		/* Avoid unbounded kernel memory allocation */
   2751 		if (crtc_req->count_connectors > config->num_connector) {
   2752 			ret = -EINVAL;
   2753 			goto out;
   2754 		}
   2755 
   2756 		connector_set = kmalloc_array(crtc_req->count_connectors,
   2757 					      sizeof(struct drm_connector *),
   2758 					      GFP_KERNEL);
   2759 		if (!connector_set) {
   2760 			ret = -ENOMEM;
   2761 			goto out;
   2762 		}
   2763 
   2764 		for (i = 0; i < crtc_req->count_connectors; i++) {
   2765 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
   2766 			if (get_user(out_id, &set_connectors_ptr[i])) {
   2767 				ret = -EFAULT;
   2768 				goto out;
   2769 			}
   2770 
   2771 			connector = drm_connector_find(dev, out_id);
   2772 			if (!connector) {
   2773 				DRM_DEBUG_KMS("Connector id %d unknown\n",
   2774 						out_id);
   2775 				ret = -ENOENT;
   2776 				goto out;
   2777 			}
   2778 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
   2779 					connector->base.id,
   2780 					connector->name);
   2781 
   2782 			connector_set[i] = connector;
   2783 		}
   2784 	}
   2785 
   2786 	set.crtc = crtc;
   2787 	set.x = crtc_req->x;
   2788 	set.y = crtc_req->y;
   2789 	set.mode = mode;
   2790 	set.connectors = connector_set;
   2791 	set.num_connectors = crtc_req->count_connectors;
   2792 	set.fb = fb;
   2793 	ret = drm_mode_set_config_internal(&set);
   2794 
   2795 out:
   2796 	if (fb)
   2797 		drm_framebuffer_unreference(fb);
   2798 
   2799 	kfree(connector_set);
   2800 	drm_mode_destroy(dev, mode);
   2801 	drm_modeset_unlock_all(dev);
   2802 	return ret;
   2803 }
   2804 
   2805 /**
   2806  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
   2807  *     universal plane handler call
   2808  * @crtc: crtc to update cursor for
   2809  * @req: data pointer for the ioctl
   2810  * @file_priv: drm file for the ioctl call
   2811  *
   2812  * Legacy cursor ioctl's work directly with driver buffer handles.  To
   2813  * translate legacy ioctl calls into universal plane handler calls, we need to
   2814  * wrap the native buffer handle in a drm_framebuffer.
   2815  *
   2816  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
   2817  * buffer with a pitch of 4*width; the universal plane interface should be used
   2818  * directly in cases where the hardware can support other buffer settings and
   2819  * userspace wants to make use of these capabilities.
   2820  *
   2821  * Returns:
   2822  * Zero on success, negative errno on failure.
   2823  */
   2824 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
   2825 				     struct drm_mode_cursor2 *req,
   2826 				     struct drm_file *file_priv)
   2827 {
   2828 	struct drm_device *dev = crtc->dev;
   2829 	struct drm_framebuffer *fb = NULL;
   2830 	struct drm_mode_fb_cmd2 fbreq = {
   2831 		.width = req->width,
   2832 		.height = req->height,
   2833 		.pixel_format = DRM_FORMAT_ARGB8888,
   2834 		.pitches = { req->width * 4 },
   2835 		.handles = { req->handle },
   2836 	};
   2837 	int32_t crtc_x, crtc_y;
   2838 	uint32_t crtc_w = 0, crtc_h = 0;
   2839 	uint32_t src_w = 0, src_h = 0;
   2840 	int ret = 0;
   2841 
   2842 	BUG_ON(!crtc->cursor);
   2843 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
   2844 
   2845 	/*
   2846 	 * Obtain fb we'll be using (either new or existing) and take an extra
   2847 	 * reference to it if fb != null.  setplane will take care of dropping
   2848 	 * the reference if the plane update fails.
   2849 	 */
   2850 	if (req->flags & DRM_MODE_CURSOR_BO) {
   2851 		if (req->handle) {
   2852 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
   2853 			if (IS_ERR(fb)) {
   2854 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
   2855 				return PTR_ERR(fb);
   2856 			}
   2857 		} else {
   2858 			fb = NULL;
   2859 		}
   2860 	} else {
   2861 		fb = crtc->cursor->fb;
   2862 		if (fb)
   2863 			drm_framebuffer_reference(fb);
   2864 	}
   2865 
   2866 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
   2867 		crtc_x = req->x;
   2868 		crtc_y = req->y;
   2869 	} else {
   2870 		crtc_x = crtc->cursor_x;
   2871 		crtc_y = crtc->cursor_y;
   2872 	}
   2873 
   2874 	if (fb) {
   2875 		crtc_w = fb->width;
   2876 		crtc_h = fb->height;
   2877 		src_w = fb->width << 16;
   2878 		src_h = fb->height << 16;
   2879 	}
   2880 
   2881 	/*
   2882 	 * setplane_internal will take care of deref'ing either the old or new
   2883 	 * framebuffer depending on success.
   2884 	 */
   2885 	ret = __setplane_internal(crtc->cursor, crtc, fb,
   2886 				crtc_x, crtc_y, crtc_w, crtc_h,
   2887 				0, 0, src_w, src_h);
   2888 
   2889 	/* Update successful; save new cursor position, if necessary */
   2890 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
   2891 		crtc->cursor_x = req->x;
   2892 		crtc->cursor_y = req->y;
   2893 	}
   2894 
   2895 	return ret;
   2896 }
   2897 
   2898 static int drm_mode_cursor_common(struct drm_device *dev,
   2899 				  struct drm_mode_cursor2 *req,
   2900 				  struct drm_file *file_priv)
   2901 {
   2902 	struct drm_crtc *crtc;
   2903 	int ret = 0;
   2904 
   2905 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   2906 		return -EINVAL;
   2907 
   2908 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
   2909 		return -EINVAL;
   2910 
   2911 	crtc = drm_crtc_find(dev, req->crtc_id);
   2912 	if (!crtc) {
   2913 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
   2914 		return -ENOENT;
   2915 	}
   2916 
   2917 	/*
   2918 	 * If this crtc has a universal cursor plane, call that plane's update
   2919 	 * handler rather than using legacy cursor handlers.
   2920 	 */
   2921 	drm_modeset_lock_crtc(crtc, crtc->cursor);
   2922 	if (crtc->cursor) {
   2923 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
   2924 		goto out;
   2925 	}
   2926 
   2927 	if (req->flags & DRM_MODE_CURSOR_BO) {
   2928 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
   2929 			ret = -ENXIO;
   2930 			goto out;
   2931 		}
   2932 		/* Turns off the cursor if handle is 0 */
   2933 		if (crtc->funcs->cursor_set2)
   2934 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
   2935 						      req->width, req->height, req->hot_x, req->hot_y);
   2936 		else
   2937 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
   2938 						      req->width, req->height);
   2939 	}
   2940 
   2941 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
   2942 		if (crtc->funcs->cursor_move) {
   2943 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
   2944 		} else {
   2945 			ret = -EFAULT;
   2946 			goto out;
   2947 		}
   2948 	}
   2949 out:
   2950 	drm_modeset_unlock_crtc(crtc);
   2951 
   2952 	return ret;
   2953 
   2954 }
   2955 
   2956 
   2957 /**
   2958  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
   2959  * @dev: drm device for the ioctl
   2960  * @data: data pointer for the ioctl
   2961  * @file_priv: drm file for the ioctl call
   2962  *
   2963  * Set the cursor configuration based on user request.
   2964  *
   2965  * Called by the user via ioctl.
   2966  *
   2967  * Returns:
   2968  * Zero on success, negative errno on failure.
   2969  */
   2970 int drm_mode_cursor_ioctl(struct drm_device *dev,
   2971 			  void *data, struct drm_file *file_priv)
   2972 {
   2973 	struct drm_mode_cursor *req = data;
   2974 	struct drm_mode_cursor2 new_req;
   2975 
   2976 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
   2977 	new_req.hot_x = new_req.hot_y = 0;
   2978 
   2979 	return drm_mode_cursor_common(dev, &new_req, file_priv);
   2980 }
   2981 
   2982 /**
   2983  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
   2984  * @dev: drm device for the ioctl
   2985  * @data: data pointer for the ioctl
   2986  * @file_priv: drm file for the ioctl call
   2987  *
   2988  * Set the cursor configuration based on user request. This implements the 2nd
   2989  * version of the cursor ioctl, which allows userspace to additionally specify
   2990  * the hotspot of the pointer.
   2991  *
   2992  * Called by the user via ioctl.
   2993  *
   2994  * Returns:
   2995  * Zero on success, negative errno on failure.
   2996  */
   2997 int drm_mode_cursor2_ioctl(struct drm_device *dev,
   2998 			   void *data, struct drm_file *file_priv)
   2999 {
   3000 	struct drm_mode_cursor2 *req = data;
   3001 
   3002 	return drm_mode_cursor_common(dev, req, file_priv);
   3003 }
   3004 
   3005 /**
   3006  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
   3007  * @bpp: bits per pixels
   3008  * @depth: bit depth per pixel
   3009  *
   3010  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
   3011  * Useful in fbdev emulation code, since that deals in those values.
   3012  */
   3013 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
   3014 {
   3015 	uint32_t fmt;
   3016 
   3017 	switch (bpp) {
   3018 	case 8:
   3019 		fmt = DRM_FORMAT_C8;
   3020 		break;
   3021 	case 16:
   3022 		if (depth == 15)
   3023 			fmt = DRM_FORMAT_XRGB1555;
   3024 		else
   3025 			fmt = DRM_FORMAT_RGB565;
   3026 		break;
   3027 	case 24:
   3028 		fmt = DRM_FORMAT_RGB888;
   3029 		break;
   3030 	case 32:
   3031 		if (depth == 24)
   3032 			fmt = DRM_FORMAT_XRGB8888;
   3033 		else if (depth == 30)
   3034 			fmt = DRM_FORMAT_XRGB2101010;
   3035 		else
   3036 			fmt = DRM_FORMAT_ARGB8888;
   3037 		break;
   3038 	default:
   3039 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
   3040 		fmt = DRM_FORMAT_XRGB8888;
   3041 		break;
   3042 	}
   3043 
   3044 	return fmt;
   3045 }
   3046 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
   3047 
   3048 /**
   3049  * drm_mode_addfb - add an FB to the graphics configuration
   3050  * @dev: drm device for the ioctl
   3051  * @data: data pointer for the ioctl
   3052  * @file_priv: drm file for the ioctl call
   3053  *
   3054  * Add a new FB to the specified CRTC, given a user request. This is the
   3055  * original addfb ioctl which only supported RGB formats.
   3056  *
   3057  * Called by the user via ioctl.
   3058  *
   3059  * Returns:
   3060  * Zero on success, negative errno on failure.
   3061  */
   3062 int drm_mode_addfb(struct drm_device *dev,
   3063 		   void *data, struct drm_file *file_priv)
   3064 {
   3065 	struct drm_mode_fb_cmd *or = data;
   3066 	static const struct drm_mode_fb_cmd2 zero_fbcmd;
   3067 	struct drm_mode_fb_cmd2 r = zero_fbcmd;
   3068 	int ret;
   3069 
   3070 	/* convert to new format and call new ioctl */
   3071 	r.fb_id = or->fb_id;
   3072 	r.width = or->width;
   3073 	r.height = or->height;
   3074 	r.pitches[0] = or->pitch;
   3075 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
   3076 	r.handles[0] = or->handle;
   3077 
   3078 	ret = drm_mode_addfb2(dev, &r, file_priv);
   3079 	if (ret)
   3080 		return ret;
   3081 
   3082 	or->fb_id = r.fb_id;
   3083 
   3084 	return 0;
   3085 }
   3086 
   3087 static int format_check(const struct drm_mode_fb_cmd2 *r)
   3088 {
   3089 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
   3090 
   3091 	switch (format) {
   3092 	case DRM_FORMAT_C8:
   3093 	case DRM_FORMAT_RGB332:
   3094 	case DRM_FORMAT_BGR233:
   3095 	case DRM_FORMAT_XRGB4444:
   3096 	case DRM_FORMAT_XBGR4444:
   3097 	case DRM_FORMAT_RGBX4444:
   3098 	case DRM_FORMAT_BGRX4444:
   3099 	case DRM_FORMAT_ARGB4444:
   3100 	case DRM_FORMAT_ABGR4444:
   3101 	case DRM_FORMAT_RGBA4444:
   3102 	case DRM_FORMAT_BGRA4444:
   3103 	case DRM_FORMAT_XRGB1555:
   3104 	case DRM_FORMAT_XBGR1555:
   3105 	case DRM_FORMAT_RGBX5551:
   3106 	case DRM_FORMAT_BGRX5551:
   3107 	case DRM_FORMAT_ARGB1555:
   3108 	case DRM_FORMAT_ABGR1555:
   3109 	case DRM_FORMAT_RGBA5551:
   3110 	case DRM_FORMAT_BGRA5551:
   3111 	case DRM_FORMAT_RGB565:
   3112 	case DRM_FORMAT_BGR565:
   3113 	case DRM_FORMAT_RGB888:
   3114 	case DRM_FORMAT_BGR888:
   3115 	case DRM_FORMAT_XRGB8888:
   3116 	case DRM_FORMAT_XBGR8888:
   3117 	case DRM_FORMAT_RGBX8888:
   3118 	case DRM_FORMAT_BGRX8888:
   3119 	case DRM_FORMAT_ARGB8888:
   3120 	case DRM_FORMAT_ABGR8888:
   3121 	case DRM_FORMAT_RGBA8888:
   3122 	case DRM_FORMAT_BGRA8888:
   3123 	case DRM_FORMAT_XRGB2101010:
   3124 	case DRM_FORMAT_XBGR2101010:
   3125 	case DRM_FORMAT_RGBX1010102:
   3126 	case DRM_FORMAT_BGRX1010102:
   3127 	case DRM_FORMAT_ARGB2101010:
   3128 	case DRM_FORMAT_ABGR2101010:
   3129 	case DRM_FORMAT_RGBA1010102:
   3130 	case DRM_FORMAT_BGRA1010102:
   3131 	case DRM_FORMAT_YUYV:
   3132 	case DRM_FORMAT_YVYU:
   3133 	case DRM_FORMAT_UYVY:
   3134 	case DRM_FORMAT_VYUY:
   3135 	case DRM_FORMAT_AYUV:
   3136 	case DRM_FORMAT_NV12:
   3137 	case DRM_FORMAT_NV21:
   3138 	case DRM_FORMAT_NV16:
   3139 	case DRM_FORMAT_NV61:
   3140 	case DRM_FORMAT_NV24:
   3141 	case DRM_FORMAT_NV42:
   3142 	case DRM_FORMAT_YUV410:
   3143 	case DRM_FORMAT_YVU410:
   3144 	case DRM_FORMAT_YUV411:
   3145 	case DRM_FORMAT_YVU411:
   3146 	case DRM_FORMAT_YUV420:
   3147 	case DRM_FORMAT_YVU420:
   3148 	case DRM_FORMAT_YUV422:
   3149 	case DRM_FORMAT_YVU422:
   3150 	case DRM_FORMAT_YUV444:
   3151 	case DRM_FORMAT_YVU444:
   3152 		return 0;
   3153 	default:
   3154 		DRM_DEBUG_KMS("invalid pixel format %s\n",
   3155 			      drm_get_format_name(r->pixel_format));
   3156 		return -EINVAL;
   3157 	}
   3158 }
   3159 
   3160 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
   3161 {
   3162 	int ret, hsub, vsub, num_planes, i;
   3163 
   3164 	ret = format_check(r);
   3165 	if (ret) {
   3166 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
   3167 			      drm_get_format_name(r->pixel_format));
   3168 		return ret;
   3169 	}
   3170 
   3171 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
   3172 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
   3173 	num_planes = drm_format_num_planes(r->pixel_format);
   3174 
   3175 	if (r->width == 0 || r->width % hsub) {
   3176 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
   3177 		return -EINVAL;
   3178 	}
   3179 
   3180 	if (r->height == 0 || r->height % vsub) {
   3181 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
   3182 		return -EINVAL;
   3183 	}
   3184 
   3185 	for (i = 0; i < num_planes; i++) {
   3186 		unsigned int width = r->width / (i != 0 ? hsub : 1);
   3187 		unsigned int height = r->height / (i != 0 ? vsub : 1);
   3188 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
   3189 
   3190 		if (!r->handles[i]) {
   3191 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
   3192 			return -EINVAL;
   3193 		}
   3194 
   3195 		if ((uint64_t) width * cpp > UINT_MAX)
   3196 			return -ERANGE;
   3197 
   3198 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
   3199 			return -ERANGE;
   3200 
   3201 		if (r->pitches[i] < width * cpp) {
   3202 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
   3203 			return -EINVAL;
   3204 		}
   3205 
   3206 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
   3207 			DRM_DEBUG_KMS("bad fb modifier %"PRIu64" for plane %d\n",
   3208 				      r->modifier[i], i);
   3209 			return -EINVAL;
   3210 		}
   3211 
   3212 		/* modifier specific checks: */
   3213 		switch (r->modifier[i]) {
   3214 		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
   3215 			/* NOTE: the pitch restriction may be lifted later if it turns
   3216 			 * out that no hw has this restriction:
   3217 			 */
   3218 			if (r->pixel_format != DRM_FORMAT_NV12 ||
   3219 					width % 128 || height % 32 ||
   3220 					r->pitches[i] % 128) {
   3221 				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
   3222 				return -EINVAL;
   3223 			}
   3224 			break;
   3225 
   3226 		default:
   3227 			break;
   3228 		}
   3229 	}
   3230 
   3231 	for (i = num_planes; i < 4; i++) {
   3232 		if (r->modifier[i]) {
   3233 			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
   3234 			return -EINVAL;
   3235 		}
   3236 
   3237 		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
   3238 		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
   3239 			continue;
   3240 
   3241 		if (r->handles[i]) {
   3242 			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
   3243 			return -EINVAL;
   3244 		}
   3245 
   3246 		if (r->pitches[i]) {
   3247 			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
   3248 			return -EINVAL;
   3249 		}
   3250 
   3251 		if (r->offsets[i]) {
   3252 			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
   3253 			return -EINVAL;
   3254 		}
   3255 	}
   3256 
   3257 	return 0;
   3258 }
   3259 
   3260 static struct drm_framebuffer *
   3261 internal_framebuffer_create(struct drm_device *dev,
   3262 			    struct drm_mode_fb_cmd2 *r,
   3263 			    struct drm_file *file_priv)
   3264 {
   3265 	struct drm_mode_config *config = &dev->mode_config;
   3266 	struct drm_framebuffer *fb;
   3267 	int ret;
   3268 
   3269 	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
   3270 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
   3271 		return ERR_PTR(-EINVAL);
   3272 	}
   3273 
   3274 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
   3275 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
   3276 			  r->width, config->min_width, config->max_width);
   3277 		return ERR_PTR(-EINVAL);
   3278 	}
   3279 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
   3280 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
   3281 			  r->height, config->min_height, config->max_height);
   3282 		return ERR_PTR(-EINVAL);
   3283 	}
   3284 
   3285 	if (r->flags & DRM_MODE_FB_MODIFIERS &&
   3286 	    !dev->mode_config.allow_fb_modifiers) {
   3287 		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
   3288 		return ERR_PTR(-EINVAL);
   3289 	}
   3290 
   3291 	ret = framebuffer_check(r);
   3292 	if (ret)
   3293 		return ERR_PTR(ret);
   3294 
   3295 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
   3296 	if (IS_ERR(fb)) {
   3297 		DRM_DEBUG_KMS("could not create framebuffer\n");
   3298 		return fb;
   3299 	}
   3300 
   3301 	return fb;
   3302 }
   3303 
   3304 /**
   3305  * drm_mode_addfb2 - add an FB to the graphics configuration
   3306  * @dev: drm device for the ioctl
   3307  * @data: data pointer for the ioctl
   3308  * @file_priv: drm file for the ioctl call
   3309  *
   3310  * Add a new FB to the specified CRTC, given a user request with format. This is
   3311  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
   3312  * and uses fourcc codes as pixel format specifiers.
   3313  *
   3314  * Called by the user via ioctl.
   3315  *
   3316  * Returns:
   3317  * Zero on success, negative errno on failure.
   3318  */
   3319 int drm_mode_addfb2(struct drm_device *dev,
   3320 		    void *data, struct drm_file *file_priv)
   3321 {
   3322 	struct drm_mode_fb_cmd2 *r = data;
   3323 	struct drm_framebuffer *fb;
   3324 
   3325 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3326 		return -EINVAL;
   3327 
   3328 	fb = internal_framebuffer_create(dev, r, file_priv);
   3329 	if (IS_ERR(fb))
   3330 		return PTR_ERR(fb);
   3331 
   3332 	/* Transfer ownership to the filp for reaping on close */
   3333 
   3334 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
   3335 	mutex_lock(&file_priv->fbs_lock);
   3336 	r->fb_id = fb->base.id;
   3337 	list_add(&fb->filp_head, &file_priv->fbs);
   3338 	mutex_unlock(&file_priv->fbs_lock);
   3339 
   3340 	return 0;
   3341 }
   3342 
   3343 struct drm_mode_rmfb_work {
   3344 	struct work_struct work;
   3345 	struct list_head fbs;
   3346 };
   3347 
   3348 static void drm_mode_rmfb_work_fn(struct work_struct *w)
   3349 {
   3350 	struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work);
   3351 
   3352 	while (!list_empty(&arg->fbs)) {
   3353 		struct drm_framebuffer *fb =
   3354 			list_first_entry(&arg->fbs, typeof(*fb), filp_head);
   3355 
   3356 		list_del_init(&fb->filp_head);
   3357 		drm_framebuffer_remove(fb);
   3358 	}
   3359 }
   3360 
   3361 /**
   3362  * drm_mode_rmfb - remove an FB from the configuration
   3363  * @dev: drm device for the ioctl
   3364  * @data: data pointer for the ioctl
   3365  * @file_priv: drm file for the ioctl call
   3366  *
   3367  * Remove the FB specified by the user.
   3368  *
   3369  * Called by the user via ioctl.
   3370  *
   3371  * Returns:
   3372  * Zero on success, negative errno on failure.
   3373  */
   3374 int drm_mode_rmfb(struct drm_device *dev,
   3375 		   void *data, struct drm_file *file_priv)
   3376 {
   3377 	struct drm_framebuffer *fb = NULL;
   3378 	struct drm_framebuffer *fbl = NULL;
   3379 	uint32_t *id = data;
   3380 	int found = 0;
   3381 
   3382 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3383 		return -EINVAL;
   3384 
   3385 	mutex_lock(&file_priv->fbs_lock);
   3386 	mutex_lock(&dev->mode_config.fb_lock);
   3387 	fb = __drm_framebuffer_lookup(dev, *id);
   3388 	if (!fb)
   3389 		goto fail_lookup;
   3390 
   3391 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
   3392 		if (fb == fbl)
   3393 			found = 1;
   3394 	if (!found)
   3395 		goto fail_lookup;
   3396 
   3397 	list_del_init(&fb->filp_head);
   3398 	mutex_unlock(&dev->mode_config.fb_lock);
   3399 	mutex_unlock(&file_priv->fbs_lock);
   3400 
   3401 	/*
   3402 	 * we now own the reference that was stored in the fbs list
   3403 	 *
   3404 	 * drm_framebuffer_remove may fail with -EINTR on pending signals,
   3405 	 * so run this in a separate stack as there's no way to correctly
   3406 	 * handle this after the fb is already removed from the lookup table.
   3407 	 */
   3408 	if (!kref_exclusive_p(&fb->refcount)) {
   3409 		struct drm_mode_rmfb_work arg;
   3410 
   3411 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
   3412 		INIT_LIST_HEAD(&arg.fbs);
   3413 		list_add_tail(&fb->filp_head, &arg.fbs);
   3414 
   3415 		schedule_work(&arg.work);
   3416 		flush_work(&arg.work);
   3417 		destroy_work_on_stack(&arg.work);
   3418 	} else
   3419 		drm_framebuffer_unreference(fb);
   3420 
   3421 	return 0;
   3422 
   3423 fail_lookup:
   3424 	mutex_unlock(&dev->mode_config.fb_lock);
   3425 	mutex_unlock(&file_priv->fbs_lock);
   3426 
   3427 	return -ENOENT;
   3428 }
   3429 
   3430 /**
   3431  * drm_mode_getfb - get FB info
   3432  * @dev: drm device for the ioctl
   3433  * @data: data pointer for the ioctl
   3434  * @file_priv: drm file for the ioctl call
   3435  *
   3436  * Lookup the FB given its ID and return info about it.
   3437  *
   3438  * Called by the user via ioctl.
   3439  *
   3440  * Returns:
   3441  * Zero on success, negative errno on failure.
   3442  */
   3443 int drm_mode_getfb(struct drm_device *dev,
   3444 		   void *data, struct drm_file *file_priv)
   3445 {
   3446 	struct drm_mode_fb_cmd *r = data;
   3447 	struct drm_framebuffer *fb;
   3448 	int ret;
   3449 
   3450 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3451 		return -EINVAL;
   3452 
   3453 	fb = drm_framebuffer_lookup(dev, r->fb_id);
   3454 	if (!fb)
   3455 		return -ENOENT;
   3456 
   3457 	r->height = fb->height;
   3458 	r->width = fb->width;
   3459 	r->depth = fb->depth;
   3460 	r->bpp = fb->bits_per_pixel;
   3461 	r->pitch = fb->pitches[0];
   3462 	if (fb->funcs->create_handle) {
   3463 		if (file_priv->is_master ||
   3464 #ifdef __NetBSD__
   3465 		    DRM_SUSER() ||
   3466 #else
   3467 		    capable(CAP_SYS_ADMIN) ||
   3468 #endif
   3469 		    drm_is_control_client(file_priv)) {
   3470 			ret = fb->funcs->create_handle(fb, file_priv,
   3471 						       &r->handle);
   3472 		} else {
   3473 			/* GET_FB() is an unprivileged ioctl so we must not
   3474 			 * return a buffer-handle to non-master processes! For
   3475 			 * backwards-compatibility reasons, we cannot make
   3476 			 * GET_FB() privileged, so just return an invalid handle
   3477 			 * for non-masters. */
   3478 			r->handle = 0;
   3479 			ret = 0;
   3480 		}
   3481 	} else {
   3482 		ret = -ENODEV;
   3483 	}
   3484 
   3485 	drm_framebuffer_unreference(fb);
   3486 
   3487 	return ret;
   3488 }
   3489 
   3490 /**
   3491  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
   3492  * @dev: drm device for the ioctl
   3493  * @data: data pointer for the ioctl
   3494  * @file_priv: drm file for the ioctl call
   3495  *
   3496  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
   3497  * rectangle list. Generic userspace which does frontbuffer rendering must call
   3498  * this ioctl to flush out the changes on manual-update display outputs, e.g.
   3499  * usb display-link, mipi manual update panels or edp panel self refresh modes.
   3500  *
   3501  * Modesetting drivers which always update the frontbuffer do not need to
   3502  * implement the corresponding ->dirty framebuffer callback.
   3503  *
   3504  * Called by the user via ioctl.
   3505  *
   3506  * Returns:
   3507  * Zero on success, negative errno on failure.
   3508  */
   3509 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
   3510 			   void *data, struct drm_file *file_priv)
   3511 {
   3512 	struct drm_clip_rect __user *clips_ptr;
   3513 	struct drm_clip_rect *clips = NULL;
   3514 	struct drm_mode_fb_dirty_cmd *r = data;
   3515 	struct drm_framebuffer *fb;
   3516 	unsigned flags;
   3517 	int num_clips;
   3518 	int ret;
   3519 
   3520 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   3521 		return -EINVAL;
   3522 
   3523 	fb = drm_framebuffer_lookup(dev, r->fb_id);
   3524 	if (!fb)
   3525 		return -ENOENT;
   3526 
   3527 	num_clips = r->num_clips;
   3528 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
   3529 
   3530 	if (!num_clips != !clips_ptr) {
   3531 		ret = -EINVAL;
   3532 		goto out_err1;
   3533 	}
   3534 
   3535 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
   3536 
   3537 	/* If userspace annotates copy, clips must come in pairs */
   3538 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
   3539 		ret = -EINVAL;
   3540 		goto out_err1;
   3541 	}
   3542 
   3543 	if (num_clips && clips_ptr) {
   3544 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
   3545 			ret = -EINVAL;
   3546 			goto out_err1;
   3547 		}
   3548 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
   3549 		if (!clips) {
   3550 			ret = -ENOMEM;
   3551 			goto out_err1;
   3552 		}
   3553 
   3554 		ret = copy_from_user(clips, clips_ptr,
   3555 				     num_clips * sizeof(*clips));
   3556 		if (ret) {
   3557 			ret = -EFAULT;
   3558 			goto out_err2;
   3559 		}
   3560 	}
   3561 
   3562 	if (fb->funcs->dirty) {
   3563 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
   3564 				       clips, num_clips);
   3565 	} else {
   3566 		ret = -ENOSYS;
   3567 	}
   3568 
   3569 out_err2:
   3570 	kfree(clips);
   3571 out_err1:
   3572 	drm_framebuffer_unreference(fb);
   3573 
   3574 	return ret;
   3575 }
   3576 
   3577 /**
   3578  * drm_fb_release - remove and free the FBs on this file
   3579  * @priv: drm file for the ioctl
   3580  *
   3581  * Destroy all the FBs associated with @filp.
   3582  *
   3583  * Called by the user via ioctl.
   3584  *
   3585  * Returns:
   3586  * Zero on success, negative errno on failure.
   3587  */
   3588 void drm_fb_release(struct drm_file *priv)
   3589 {
   3590 	struct drm_framebuffer *fb, *tfb;
   3591 	struct drm_mode_rmfb_work arg;
   3592 
   3593 	INIT_LIST_HEAD(&arg.fbs);
   3594 
   3595 	/*
   3596 	 * When the file gets released that means no one else can access the fb
   3597 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
   3598 	 * avoid upsetting lockdep since the universal cursor code adds a
   3599 	 * framebuffer while holding mutex locks.
   3600 	 *
   3601 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
   3602 	 * locks is impossible here since no one else but this function can get
   3603 	 * at it any more.
   3604 	 */
   3605 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
   3606 		if (!kref_exclusive_p(&fb->refcount)) {
   3607 			list_move_tail(&fb->filp_head, &arg.fbs);
   3608 		} else {
   3609 			list_del_init(&fb->filp_head);
   3610 
   3611 			/* This drops the fpriv->fbs reference. */
   3612 			drm_framebuffer_unreference(fb);
   3613 		}
   3614 	}
   3615 
   3616 	if (!list_empty(&arg.fbs)) {
   3617 		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
   3618 
   3619 		schedule_work(&arg.work);
   3620 		flush_work(&arg.work);
   3621 		destroy_work_on_stack(&arg.work);
   3622 	}
   3623 }
   3624 
   3625 /**
   3626  * drm_property_create - create a new property type
   3627  * @dev: drm device
   3628  * @flags: flags specifying the property type
   3629  * @name: name of the property
   3630  * @num_values: number of pre-defined values
   3631  *
   3632  * This creates a new generic drm property which can then be attached to a drm
   3633  * object with drm_object_attach_property. The returned property object must be
   3634  * freed with drm_property_destroy.
   3635  *
   3636  * Note that the DRM core keeps a per-device list of properties and that, if
   3637  * drm_mode_config_cleanup() is called, it will destroy all properties created
   3638  * by the driver.
   3639  *
   3640  * Returns:
   3641  * A pointer to the newly created property on success, NULL on failure.
   3642  */
   3643 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
   3644 					 const char *name, int num_values)
   3645 {
   3646 	struct drm_property *property = NULL;
   3647 	int ret;
   3648 
   3649 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
   3650 	if (!property)
   3651 		return NULL;
   3652 
   3653 	property->dev = dev;
   3654 
   3655 	if (num_values) {
   3656 		property->values = kcalloc(num_values, sizeof(uint64_t),
   3657 					   GFP_KERNEL);
   3658 		if (!property->values)
   3659 			goto fail;
   3660 	}
   3661 
   3662 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
   3663 	if (ret)
   3664 		goto fail;
   3665 
   3666 	property->flags = flags;
   3667 	property->num_values = num_values;
   3668 	INIT_LIST_HEAD(&property->enum_list);
   3669 
   3670 	if (name) {
   3671 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
   3672 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
   3673 	}
   3674 
   3675 	list_add_tail(&property->head, &dev->mode_config.property_list);
   3676 
   3677 	WARN_ON(!drm_property_type_valid(property));
   3678 
   3679 	return property;
   3680 fail:
   3681 	kfree(property->values);
   3682 	kfree(property);
   3683 	return NULL;
   3684 }
   3685 EXPORT_SYMBOL(drm_property_create);
   3686 
   3687 /**
   3688  * drm_property_create_enum - create a new enumeration property type
   3689  * @dev: drm device
   3690  * @flags: flags specifying the property type
   3691  * @name: name of the property
   3692  * @props: enumeration lists with property values
   3693  * @num_values: number of pre-defined values
   3694  *
   3695  * This creates a new generic drm property which can then be attached to a drm
   3696  * object with drm_object_attach_property. The returned property object must be
   3697  * freed with drm_property_destroy.
   3698  *
   3699  * Userspace is only allowed to set one of the predefined values for enumeration
   3700  * properties.
   3701  *
   3702  * Returns:
   3703  * A pointer to the newly created property on success, NULL on failure.
   3704  */
   3705 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
   3706 					 const char *name,
   3707 					 const struct drm_prop_enum_list *props,
   3708 					 int num_values)
   3709 {
   3710 	struct drm_property *property;
   3711 	int i, ret;
   3712 
   3713 	flags |= DRM_MODE_PROP_ENUM;
   3714 
   3715 	property = drm_property_create(dev, flags, name, num_values);
   3716 	if (!property)
   3717 		return NULL;
   3718 
   3719 	for (i = 0; i < num_values; i++) {
   3720 		ret = drm_property_add_enum(property, i,
   3721 				      props[i].type,
   3722 				      props[i].name);
   3723 		if (ret) {
   3724 			drm_property_destroy(dev, property);
   3725 			return NULL;
   3726 		}
   3727 	}
   3728 
   3729 	return property;
   3730 }
   3731 EXPORT_SYMBOL(drm_property_create_enum);
   3732 
   3733 /**
   3734  * drm_property_create_bitmask - create a new bitmask property type
   3735  * @dev: drm device
   3736  * @flags: flags specifying the property type
   3737  * @name: name of the property
   3738  * @props: enumeration lists with property bitflags
   3739  * @num_props: size of the @props array
   3740  * @supported_bits: bitmask of all supported enumeration values
   3741  *
   3742  * This creates a new bitmask drm property which can then be attached to a drm
   3743  * object with drm_object_attach_property. The returned property object must be
   3744  * freed with drm_property_destroy.
   3745  *
   3746  * Compared to plain enumeration properties userspace is allowed to set any
   3747  * or'ed together combination of the predefined property bitflag values
   3748  *
   3749  * Returns:
   3750  * A pointer to the newly created property on success, NULL on failure.
   3751  */
   3752 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
   3753 					 int flags, const char *name,
   3754 					 const struct drm_prop_enum_list *props,
   3755 					 int num_props,
   3756 					 uint64_t supported_bits)
   3757 {
   3758 	struct drm_property *property;
   3759 	int i, ret, index = 0;
   3760 	int num_values = hweight64(supported_bits);
   3761 
   3762 	flags |= DRM_MODE_PROP_BITMASK;
   3763 
   3764 	property = drm_property_create(dev, flags, name, num_values);
   3765 	if (!property)
   3766 		return NULL;
   3767 	for (i = 0; i < num_props; i++) {
   3768 		if (!(supported_bits & (1ULL << props[i].type)))
   3769 			continue;
   3770 
   3771 		if (WARN_ON(index >= num_values)) {
   3772 			drm_property_destroy(dev, property);
   3773 			return NULL;
   3774 		}
   3775 
   3776 		ret = drm_property_add_enum(property, index++,
   3777 				      props[i].type,
   3778 				      props[i].name);
   3779 		if (ret) {
   3780 			drm_property_destroy(dev, property);
   3781 			return NULL;
   3782 		}
   3783 	}
   3784 
   3785 	return property;
   3786 }
   3787 EXPORT_SYMBOL(drm_property_create_bitmask);
   3788 
   3789 static struct drm_property *property_create_range(struct drm_device *dev,
   3790 					 int flags, const char *name,
   3791 					 uint64_t min, uint64_t max)
   3792 {
   3793 	struct drm_property *property;
   3794 
   3795 	property = drm_property_create(dev, flags, name, 2);
   3796 	if (!property)
   3797 		return NULL;
   3798 
   3799 	property->values[0] = min;
   3800 	property->values[1] = max;
   3801 
   3802 	return property;
   3803 }
   3804 
   3805 /**
   3806  * drm_property_create_range - create a new unsigned ranged property type
   3807  * @dev: drm device
   3808  * @flags: flags specifying the property type
   3809  * @name: name of the property
   3810  * @min: minimum value of the property
   3811  * @max: maximum value of the property
   3812  *
   3813  * This creates a new generic drm property which can then be attached to a drm
   3814  * object with drm_object_attach_property. The returned property object must be
   3815  * freed with drm_property_destroy.
   3816  *
   3817  * Userspace is allowed to set any unsigned integer value in the (min, max)
   3818  * range inclusive.
   3819  *
   3820  * Returns:
   3821  * A pointer to the newly created property on success, NULL on failure.
   3822  */
   3823 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
   3824 					 const char *name,
   3825 					 uint64_t min, uint64_t max)
   3826 {
   3827 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
   3828 			name, min, max);
   3829 }
   3830 EXPORT_SYMBOL(drm_property_create_range);
   3831 
   3832 /**
   3833  * drm_property_create_signed_range - create a new signed ranged property type
   3834  * @dev: drm device
   3835  * @flags: flags specifying the property type
   3836  * @name: name of the property
   3837  * @min: minimum value of the property
   3838  * @max: maximum value of the property
   3839  *
   3840  * This creates a new generic drm property which can then be attached to a drm
   3841  * object with drm_object_attach_property. The returned property object must be
   3842  * freed with drm_property_destroy.
   3843  *
   3844  * Userspace is allowed to set any signed integer value in the (min, max)
   3845  * range inclusive.
   3846  *
   3847  * Returns:
   3848  * A pointer to the newly created property on success, NULL on failure.
   3849  */
   3850 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
   3851 					 int flags, const char *name,
   3852 					 int64_t min, int64_t max)
   3853 {
   3854 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
   3855 			name, I642U64(min), I642U64(max));
   3856 }
   3857 EXPORT_SYMBOL(drm_property_create_signed_range);
   3858 
   3859 /**
   3860  * drm_property_create_object - create a new object property type
   3861  * @dev: drm device
   3862  * @flags: flags specifying the property type
   3863  * @name: name of the property
   3864  * @type: object type from DRM_MODE_OBJECT_* defines
   3865  *
   3866  * This creates a new generic drm property which can then be attached to a drm
   3867  * object with drm_object_attach_property. The returned property object must be
   3868  * freed with drm_property_destroy.
   3869  *
   3870  * Userspace is only allowed to set this to any property value of the given
   3871  * @type. Only useful for atomic properties, which is enforced.
   3872  *
   3873  * Returns:
   3874  * A pointer to the newly created property on success, NULL on failure.
   3875  */
   3876 struct drm_property *drm_property_create_object(struct drm_device *dev,
   3877 					 int flags, const char *name, uint32_t type)
   3878 {
   3879 	struct drm_property *property;
   3880 
   3881 	flags |= DRM_MODE_PROP_OBJECT;
   3882 
   3883 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
   3884 		return NULL;
   3885 
   3886 	property = drm_property_create(dev, flags, name, 1);
   3887 	if (!property)
   3888 		return NULL;
   3889 
   3890 	property->values[0] = type;
   3891 
   3892 	return property;
   3893 }
   3894 EXPORT_SYMBOL(drm_property_create_object);
   3895 
   3896 /**
   3897  * drm_property_create_bool - create a new boolean property type
   3898  * @dev: drm device
   3899  * @flags: flags specifying the property type
   3900  * @name: name of the property
   3901  *
   3902  * This creates a new generic drm property which can then be attached to a drm
   3903  * object with drm_object_attach_property. The returned property object must be
   3904  * freed with drm_property_destroy.
   3905  *
   3906  * This is implemented as a ranged property with only {0, 1} as valid values.
   3907  *
   3908  * Returns:
   3909  * A pointer to the newly created property on success, NULL on failure.
   3910  */
   3911 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
   3912 					 const char *name)
   3913 {
   3914 	return drm_property_create_range(dev, flags, name, 0, 1);
   3915 }
   3916 EXPORT_SYMBOL(drm_property_create_bool);
   3917 
   3918 /**
   3919  * drm_property_add_enum - add a possible value to an enumeration property
   3920  * @property: enumeration property to change
   3921  * @index: index of the new enumeration
   3922  * @value: value of the new enumeration
   3923  * @name: symbolic name of the new enumeration
   3924  *
   3925  * This functions adds enumerations to a property.
   3926  *
   3927  * It's use is deprecated, drivers should use one of the more specific helpers
   3928  * to directly create the property with all enumerations already attached.
   3929  *
   3930  * Returns:
   3931  * Zero on success, error code on failure.
   3932  */
   3933 int drm_property_add_enum(struct drm_property *property, int index,
   3934 			  uint64_t value, const char *name)
   3935 {
   3936 	struct drm_property_enum *prop_enum;
   3937 
   3938 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   3939 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
   3940 		return -EINVAL;
   3941 
   3942 	/*
   3943 	 * Bitmask enum properties have the additional constraint of values
   3944 	 * from 0 to 63
   3945 	 */
   3946 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
   3947 			(value > 63))
   3948 		return -EINVAL;
   3949 
   3950 	if (!list_empty(&property->enum_list)) {
   3951 		list_for_each_entry(prop_enum, &property->enum_list, head) {
   3952 			if (prop_enum->value == value) {
   3953 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
   3954 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
   3955 				return 0;
   3956 			}
   3957 		}
   3958 	}
   3959 
   3960 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
   3961 	if (!prop_enum)
   3962 		return -ENOMEM;
   3963 
   3964 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
   3965 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
   3966 	prop_enum->value = value;
   3967 
   3968 	property->values[index] = value;
   3969 	list_add_tail(&prop_enum->head, &property->enum_list);
   3970 	return 0;
   3971 }
   3972 EXPORT_SYMBOL(drm_property_add_enum);
   3973 
   3974 /**
   3975  * drm_property_destroy - destroy a drm property
   3976  * @dev: drm device
   3977  * @property: property to destry
   3978  *
   3979  * This function frees a property including any attached resources like
   3980  * enumeration values.
   3981  */
   3982 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
   3983 {
   3984 	struct drm_property_enum *prop_enum, *pt;
   3985 
   3986 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
   3987 		list_del(&prop_enum->head);
   3988 		kfree(prop_enum);
   3989 	}
   3990 
   3991 	if (property->num_values)
   3992 		kfree(property->values);
   3993 	drm_mode_object_put(dev, &property->base);
   3994 	list_del(&property->head);
   3995 	kfree(property);
   3996 }
   3997 EXPORT_SYMBOL(drm_property_destroy);
   3998 
   3999 /**
   4000  * drm_object_attach_property - attach a property to a modeset object
   4001  * @obj: drm modeset object
   4002  * @property: property to attach
   4003  * @init_val: initial value of the property
   4004  *
   4005  * This attaches the given property to the modeset object with the given initial
   4006  * value. Currently this function cannot fail since the properties are stored in
   4007  * a statically sized array.
   4008  */
   4009 void drm_object_attach_property(struct drm_mode_object *obj,
   4010 				struct drm_property *property,
   4011 				uint64_t init_val)
   4012 {
   4013 	int count = obj->properties->count;
   4014 
   4015 	if (count == DRM_OBJECT_MAX_PROPERTY) {
   4016 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
   4017 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
   4018 			"you see this message on the same object type.\n",
   4019 			obj->type);
   4020 		return;
   4021 	}
   4022 
   4023 	obj->properties->properties[count] = property;
   4024 	obj->properties->values[count] = init_val;
   4025 	obj->properties->count++;
   4026 	if (property->flags & DRM_MODE_PROP_ATOMIC)
   4027 		obj->properties->atomic_count++;
   4028 }
   4029 EXPORT_SYMBOL(drm_object_attach_property);
   4030 
   4031 /**
   4032  * drm_object_property_set_value - set the value of a property
   4033  * @obj: drm mode object to set property value for
   4034  * @property: property to set
   4035  * @val: value the property should be set to
   4036  *
   4037  * This functions sets a given property on a given object. This function only
   4038  * changes the software state of the property, it does not call into the
   4039  * driver's ->set_property callback.
   4040  *
   4041  * Returns:
   4042  * Zero on success, error code on failure.
   4043  */
   4044 int drm_object_property_set_value(struct drm_mode_object *obj,
   4045 				  struct drm_property *property, uint64_t val)
   4046 {
   4047 	int i;
   4048 
   4049 	for (i = 0; i < obj->properties->count; i++) {
   4050 		if (obj->properties->properties[i] == property) {
   4051 			obj->properties->values[i] = val;
   4052 			return 0;
   4053 		}
   4054 	}
   4055 
   4056 	return -EINVAL;
   4057 }
   4058 EXPORT_SYMBOL(drm_object_property_set_value);
   4059 
   4060 /**
   4061  * drm_object_property_get_value - retrieve the value of a property
   4062  * @obj: drm mode object to get property value from
   4063  * @property: property to retrieve
   4064  * @val: storage for the property value
   4065  *
   4066  * This function retrieves the softare state of the given property for the given
   4067  * property. Since there is no driver callback to retrieve the current property
   4068  * value this might be out of sync with the hardware, depending upon the driver
   4069  * and property.
   4070  *
   4071  * Returns:
   4072  * Zero on success, error code on failure.
   4073  */
   4074 int drm_object_property_get_value(struct drm_mode_object *obj,
   4075 				  struct drm_property *property, uint64_t *val)
   4076 {
   4077 	int i;
   4078 
   4079 	/* read-only properties bypass atomic mechanism and still store
   4080 	 * their value in obj->properties->values[].. mostly to avoid
   4081 	 * having to deal w/ EDID and similar props in atomic paths:
   4082 	 */
   4083 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
   4084 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
   4085 		return drm_atomic_get_property(obj, property, val);
   4086 
   4087 	for (i = 0; i < obj->properties->count; i++) {
   4088 		if (obj->properties->properties[i] == property) {
   4089 			*val = obj->properties->values[i];
   4090 			return 0;
   4091 		}
   4092 	}
   4093 
   4094 	return -EINVAL;
   4095 }
   4096 EXPORT_SYMBOL(drm_object_property_get_value);
   4097 
   4098 /**
   4099  * drm_mode_getproperty_ioctl - get the property metadata
   4100  * @dev: DRM device
   4101  * @data: ioctl data
   4102  * @file_priv: DRM file info
   4103  *
   4104  * This function retrieves the metadata for a given property, like the different
   4105  * possible values for an enum property or the limits for a range property.
   4106  *
   4107  * Blob properties are special
   4108  *
   4109  * Called by the user via ioctl.
   4110  *
   4111  * Returns:
   4112  * Zero on success, negative errno on failure.
   4113  */
   4114 int drm_mode_getproperty_ioctl(struct drm_device *dev,
   4115 			       void *data, struct drm_file *file_priv)
   4116 {
   4117 	struct drm_mode_get_property *out_resp = data;
   4118 	struct drm_property *property;
   4119 	int enum_count = 0;
   4120 	int value_count = 0;
   4121 	int ret = 0, i;
   4122 	int copied;
   4123 	struct drm_property_enum *prop_enum;
   4124 	struct drm_mode_property_enum __user *enum_ptr;
   4125 	uint64_t __user *values_ptr;
   4126 
   4127 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4128 		return -EINVAL;
   4129 
   4130 	drm_modeset_lock_all(dev);
   4131 	property = drm_property_find(dev, out_resp->prop_id);
   4132 	if (!property) {
   4133 		ret = -ENOENT;
   4134 		goto done;
   4135 	}
   4136 
   4137 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   4138 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4139 		list_for_each_entry(prop_enum, &property->enum_list, head)
   4140 			enum_count++;
   4141 	}
   4142 
   4143 	value_count = property->num_values;
   4144 
   4145 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
   4146 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
   4147 	out_resp->flags = property->flags;
   4148 
   4149 	if ((out_resp->count_values >= value_count) && value_count) {
   4150 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
   4151 		for (i = 0; i < value_count; i++) {
   4152 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
   4153 				ret = -EFAULT;
   4154 				goto done;
   4155 			}
   4156 		}
   4157 	}
   4158 	out_resp->count_values = value_count;
   4159 
   4160 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
   4161 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4162 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
   4163 			copied = 0;
   4164 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
   4165 			list_for_each_entry(prop_enum, &property->enum_list, head) {
   4166 
   4167 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
   4168 					ret = -EFAULT;
   4169 					goto done;
   4170 				}
   4171 
   4172 				if (copy_to_user(&enum_ptr[copied].name,
   4173 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
   4174 					ret = -EFAULT;
   4175 					goto done;
   4176 				}
   4177 				copied++;
   4178 			}
   4179 		}
   4180 		out_resp->count_enum_blobs = enum_count;
   4181 	}
   4182 
   4183 	/*
   4184 	 * NOTE: The idea seems to have been to use this to read all the blob
   4185 	 * property values. But nothing ever added them to the corresponding
   4186 	 * list, userspace always used the special-purpose get_blob ioctl to
   4187 	 * read the value for a blob property. It also doesn't make a lot of
   4188 	 * sense to return values here when everything else is just metadata for
   4189 	 * the property itself.
   4190 	 */
   4191 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
   4192 		out_resp->count_enum_blobs = 0;
   4193 done:
   4194 	drm_modeset_unlock_all(dev);
   4195 	return ret;
   4196 }
   4197 
   4198 /**
   4199  * drm_property_create_blob - Create new blob property
   4200  *
   4201  * Creates a new blob property for a specified DRM device, optionally
   4202  * copying data.
   4203  *
   4204  * @dev: DRM device to create property for
   4205  * @length: Length to allocate for blob data
   4206  * @data: If specified, copies data into blob
   4207  *
   4208  * Returns:
   4209  * New blob property with a single reference on success, or an ERR_PTR
   4210  * value on failure.
   4211  */
   4212 struct drm_property_blob *
   4213 drm_property_create_blob(struct drm_device *dev, size_t length,
   4214 			 const void *data)
   4215 {
   4216 	struct drm_property_blob *blob;
   4217 	int ret;
   4218 
   4219 	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
   4220 		return ERR_PTR(-EINVAL);
   4221 
   4222 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
   4223 	if (!blob)
   4224 		return ERR_PTR(-ENOMEM);
   4225 
   4226 	/* This must be explicitly initialised, so we can safely call list_del
   4227 	 * on it in the removal handler, even if it isn't in a file list. */
   4228 	INIT_LIST_HEAD(&blob->head_file);
   4229 	blob->length = length;
   4230 	blob->dev = dev;
   4231 
   4232 	if (data)
   4233 		memcpy(blob->data, data, length);
   4234 
   4235 	mutex_lock(&dev->mode_config.blob_lock);
   4236 
   4237 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
   4238 	if (ret) {
   4239 		kfree(blob);
   4240 		mutex_unlock(&dev->mode_config.blob_lock);
   4241 		return ERR_PTR(-EINVAL);
   4242 	}
   4243 
   4244 	kref_init(&blob->refcount);
   4245 
   4246 	list_add_tail(&blob->head_global,
   4247 	              &dev->mode_config.property_blob_list);
   4248 
   4249 	mutex_unlock(&dev->mode_config.blob_lock);
   4250 
   4251 	return blob;
   4252 }
   4253 EXPORT_SYMBOL(drm_property_create_blob);
   4254 
   4255 /**
   4256  * drm_property_free_blob - Blob property destructor
   4257  *
   4258  * Internal free function for blob properties; must not be used directly.
   4259  *
   4260  * @kref: Reference
   4261  */
   4262 static void drm_property_free_blob(struct kref *kref)
   4263 {
   4264 	struct drm_property_blob *blob =
   4265 		container_of(kref, struct drm_property_blob, refcount);
   4266 
   4267 	WARN_ON(!mutex_is_locked(&blob->dev->mode_config.blob_lock));
   4268 
   4269 	list_del(&blob->head_global);
   4270 	list_del(&blob->head_file);
   4271 	drm_mode_object_put(blob->dev, &blob->base);
   4272 
   4273 	kfree(blob);
   4274 }
   4275 
   4276 /**
   4277  * drm_property_unreference_blob - Unreference a blob property
   4278  *
   4279  * Drop a reference on a blob property. May free the object.
   4280  *
   4281  * @blob: Pointer to blob property
   4282  */
   4283 void drm_property_unreference_blob(struct drm_property_blob *blob)
   4284 {
   4285 	struct drm_device *dev;
   4286 
   4287 	if (!blob)
   4288 		return;
   4289 
   4290 	dev = blob->dev;
   4291 
   4292 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
   4293 
   4294 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
   4295 			   &dev->mode_config.blob_lock))
   4296 		mutex_unlock(&dev->mode_config.blob_lock);
   4297 	else
   4298 		might_lock(&dev->mode_config.blob_lock);
   4299 }
   4300 EXPORT_SYMBOL(drm_property_unreference_blob);
   4301 
   4302 /**
   4303  * drm_property_unreference_blob_locked - Unreference a blob property with blob_lock held
   4304  *
   4305  * Drop a reference on a blob property. May free the object. This must be
   4306  * called with blob_lock held.
   4307  *
   4308  * @blob: Pointer to blob property
   4309  */
   4310 static void drm_property_unreference_blob_locked(struct drm_property_blob *blob)
   4311 {
   4312 	if (!blob)
   4313 		return;
   4314 
   4315 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
   4316 
   4317 	kref_put(&blob->refcount, drm_property_free_blob);
   4318 }
   4319 
   4320 /**
   4321  * drm_property_destroy_user_blobs - destroy all blobs created by this client
   4322  * @dev:       DRM device
   4323  * @file_priv: destroy all blobs owned by this file handle
   4324  */
   4325 void drm_property_destroy_user_blobs(struct drm_device *dev,
   4326 				     struct drm_file *file_priv)
   4327 {
   4328 	struct drm_property_blob *blob, *bt;
   4329 
   4330 	mutex_lock(&dev->mode_config.blob_lock);
   4331 
   4332 	list_for_each_entry_safe(blob, bt, &file_priv->blobs, head_file) {
   4333 		list_del_init(&blob->head_file);
   4334 		drm_property_unreference_blob_locked(blob);
   4335 	}
   4336 
   4337 	mutex_unlock(&dev->mode_config.blob_lock);
   4338 }
   4339 
   4340 /**
   4341  * drm_property_reference_blob - Take a reference on an existing property
   4342  *
   4343  * Take a new reference on an existing blob property.
   4344  *
   4345  * @blob: Pointer to blob property
   4346  */
   4347 struct drm_property_blob *drm_property_reference_blob(struct drm_property_blob *blob)
   4348 {
   4349 	DRM_DEBUG("%p: blob ID: %d (%d)\n", blob, blob->base.id, blob->refcount.kr_count);
   4350 	kref_get(&blob->refcount);
   4351 	return blob;
   4352 }
   4353 EXPORT_SYMBOL(drm_property_reference_blob);
   4354 
   4355 /*
   4356  * Like drm_property_lookup_blob, but does not return an additional reference.
   4357  * Must be called with blob_lock held.
   4358  */
   4359 static struct drm_property_blob *__drm_property_lookup_blob(struct drm_device *dev,
   4360 							    uint32_t id)
   4361 {
   4362 	struct drm_mode_object *obj = NULL;
   4363 	struct drm_property_blob *blob;
   4364 
   4365 	WARN_ON(!mutex_is_locked(&dev->mode_config.blob_lock));
   4366 
   4367 	mutex_lock(&dev->mode_config.idr_mutex);
   4368 	obj = idr_find(&dev->mode_config.crtc_idr, id);
   4369 	if (!obj || (obj->type != DRM_MODE_OBJECT_BLOB) || (obj->id != id))
   4370 		blob = NULL;
   4371 	else
   4372 		blob = obj_to_blob(obj);
   4373 	mutex_unlock(&dev->mode_config.idr_mutex);
   4374 
   4375 	return blob;
   4376 }
   4377 
   4378 /**
   4379  * drm_property_lookup_blob - look up a blob property and take a reference
   4380  * @dev: drm device
   4381  * @id: id of the blob property
   4382  *
   4383  * If successful, this takes an additional reference to the blob property.
   4384  * callers need to make sure to eventually unreference the returned property
   4385  * again, using @drm_property_unreference_blob.
   4386  */
   4387 struct drm_property_blob *drm_property_lookup_blob(struct drm_device *dev,
   4388 					           uint32_t id)
   4389 {
   4390 	struct drm_property_blob *blob;
   4391 
   4392 	mutex_lock(&dev->mode_config.blob_lock);
   4393 	blob = __drm_property_lookup_blob(dev, id);
   4394 	if (blob) {
   4395 		if (!kref_get_unless_zero(&blob->refcount))
   4396 			blob = NULL;
   4397 	}
   4398 	mutex_unlock(&dev->mode_config.blob_lock);
   4399 
   4400 	return blob;
   4401 }
   4402 EXPORT_SYMBOL(drm_property_lookup_blob);
   4403 
   4404 /**
   4405  * drm_property_replace_global_blob - atomically replace existing blob property
   4406  * @dev: drm device
   4407  * @replace: location of blob property pointer to be replaced
   4408  * @length: length of data for new blob, or 0 for no data
   4409  * @data: content for new blob, or NULL for no data
   4410  * @obj_holds_id: optional object for property holding blob ID
   4411  * @prop_holds_id: optional property holding blob ID
   4412  * @return 0 on success or error on failure
   4413  *
   4414  * This function will atomically replace a global property in the blob list,
   4415  * optionally updating a property which holds the ID of that property. It is
   4416  * guaranteed to be atomic: no caller will be allowed to see intermediate
   4417  * results, and either the entire operation will succeed and clean up the
   4418  * previous property, or it will fail and the state will be unchanged.
   4419  *
   4420  * If length is 0 or data is NULL, no new blob will be created, and the holding
   4421  * property, if specified, will be set to 0.
   4422  *
   4423  * Access to the replace pointer is assumed to be protected by the caller, e.g.
   4424  * by holding the relevant modesetting object lock for its parent.
   4425  *
   4426  * For example, a drm_connector has a 'PATH' property, which contains the ID
   4427  * of a blob property with the value of the MST path information. Calling this
   4428  * function with replace pointing to the connector's path_blob_ptr, length and
   4429  * data set for the new path information, obj_holds_id set to the connector's
   4430  * base object, and prop_holds_id set to the path property name, will perform
   4431  * a completely atomic update. The access to path_blob_ptr is protected by the
   4432  * caller holding a lock on the connector.
   4433  */
   4434 static int drm_property_replace_global_blob(struct drm_device *dev,
   4435                                             struct drm_property_blob **replace,
   4436                                             size_t length,
   4437                                             const void *data,
   4438                                             struct drm_mode_object *obj_holds_id,
   4439                                             struct drm_property *prop_holds_id)
   4440 {
   4441 	struct drm_property_blob *new_blob = NULL;
   4442 	struct drm_property_blob *old_blob = NULL;
   4443 	int ret;
   4444 
   4445 	WARN_ON(replace == NULL);
   4446 
   4447 	old_blob = *replace;
   4448 
   4449 	if (length && data) {
   4450 		new_blob = drm_property_create_blob(dev, length, data);
   4451 		if (IS_ERR(new_blob))
   4452 			return PTR_ERR(new_blob);
   4453 	}
   4454 
   4455 	/* This does not need to be synchronised with blob_lock, as the
   4456 	 * get_properties ioctl locks all modesetting objects, and
   4457 	 * obj_holds_id must be locked before calling here, so we cannot
   4458 	 * have its value out of sync with the list membership modified
   4459 	 * below under blob_lock. */
   4460 	if (obj_holds_id) {
   4461 		ret = drm_object_property_set_value(obj_holds_id,
   4462 						    prop_holds_id,
   4463 						    new_blob ?
   4464 						        new_blob->base.id : 0);
   4465 		if (ret != 0)
   4466 			goto err_created;
   4467 	}
   4468 
   4469 	drm_property_unreference_blob(old_blob);
   4470 	*replace = new_blob;
   4471 
   4472 	return 0;
   4473 
   4474 err_created:
   4475 	drm_property_unreference_blob(new_blob);
   4476 	return ret;
   4477 }
   4478 
   4479 /**
   4480  * drm_mode_getblob_ioctl - get the contents of a blob property value
   4481  * @dev: DRM device
   4482  * @data: ioctl data
   4483  * @file_priv: DRM file info
   4484  *
   4485  * This function retrieves the contents of a blob property. The value stored in
   4486  * an object's blob property is just a normal modeset object id.
   4487  *
   4488  * Called by the user via ioctl.
   4489  *
   4490  * Returns:
   4491  * Zero on success, negative errno on failure.
   4492  */
   4493 int drm_mode_getblob_ioctl(struct drm_device *dev,
   4494 			   void *data, struct drm_file *file_priv)
   4495 {
   4496 	struct drm_mode_get_blob *out_resp = data;
   4497 	struct drm_property_blob *blob;
   4498 	int ret = 0;
   4499 	void __user *blob_ptr;
   4500 
   4501 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4502 		return -EINVAL;
   4503 
   4504 	drm_modeset_lock_all(dev);
   4505 	mutex_lock(&dev->mode_config.blob_lock);
   4506 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
   4507 	if (!blob) {
   4508 		ret = -ENOENT;
   4509 		goto done;
   4510 	}
   4511 
   4512 	if (out_resp->length == blob->length) {
   4513 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
   4514 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
   4515 			ret = -EFAULT;
   4516 			goto done;
   4517 		}
   4518 	}
   4519 	out_resp->length = blob->length;
   4520 
   4521 done:
   4522 	mutex_unlock(&dev->mode_config.blob_lock);
   4523 	drm_modeset_unlock_all(dev);
   4524 	return ret;
   4525 }
   4526 
   4527 /**
   4528  * drm_mode_createblob_ioctl - create a new blob property
   4529  * @dev: DRM device
   4530  * @data: ioctl data
   4531  * @file_priv: DRM file info
   4532  *
   4533  * This function creates a new blob property with user-defined values. In order
   4534  * to give us sensible validation and checking when creating, rather than at
   4535  * every potential use, we also require a type to be provided upfront.
   4536  *
   4537  * Called by the user via ioctl.
   4538  *
   4539  * Returns:
   4540  * Zero on success, negative errno on failure.
   4541  */
   4542 int drm_mode_createblob_ioctl(struct drm_device *dev,
   4543 			      void *data, struct drm_file *file_priv)
   4544 {
   4545 	struct drm_mode_create_blob *out_resp = data;
   4546 	struct drm_property_blob *blob;
   4547 	void __user *blob_ptr;
   4548 	int ret = 0;
   4549 
   4550 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4551 		return -EINVAL;
   4552 
   4553 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
   4554 	if (IS_ERR(blob))
   4555 		return PTR_ERR(blob);
   4556 
   4557 	blob_ptr = (void __user *)(unsigned long)out_resp->data;
   4558 	if (copy_from_user(blob->data, blob_ptr, out_resp->length)) {
   4559 		ret = -EFAULT;
   4560 		goto out_blob;
   4561 	}
   4562 
   4563 	/* Dropping the lock between create_blob and our access here is safe
   4564 	 * as only the same file_priv can remove the blob; at this point, it is
   4565 	 * not associated with any file_priv. */
   4566 	mutex_lock(&dev->mode_config.blob_lock);
   4567 	out_resp->blob_id = blob->base.id;
   4568 	list_add_tail(&blob->head_file, &file_priv->blobs);
   4569 	mutex_unlock(&dev->mode_config.blob_lock);
   4570 
   4571 	return 0;
   4572 
   4573 out_blob:
   4574 	drm_property_unreference_blob(blob);
   4575 	return ret;
   4576 }
   4577 
   4578 /**
   4579  * drm_mode_destroyblob_ioctl - destroy a user blob property
   4580  * @dev: DRM device
   4581  * @data: ioctl data
   4582  * @file_priv: DRM file info
   4583  *
   4584  * Destroy an existing user-defined blob property.
   4585  *
   4586  * Called by the user via ioctl.
   4587  *
   4588  * Returns:
   4589  * Zero on success, negative errno on failure.
   4590  */
   4591 int drm_mode_destroyblob_ioctl(struct drm_device *dev,
   4592 			       void *data, struct drm_file *file_priv)
   4593 {
   4594 	struct drm_mode_destroy_blob *out_resp = data;
   4595 	struct drm_property_blob *blob = NULL, *bt;
   4596 	bool found = false;
   4597 	int ret = 0;
   4598 
   4599 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4600 		return -EINVAL;
   4601 
   4602 	mutex_lock(&dev->mode_config.blob_lock);
   4603 	blob = __drm_property_lookup_blob(dev, out_resp->blob_id);
   4604 	if (!blob) {
   4605 		ret = -ENOENT;
   4606 		goto err;
   4607 	}
   4608 
   4609 	/* Ensure the property was actually created by this user. */
   4610 	list_for_each_entry(bt, &file_priv->blobs, head_file) {
   4611 		if (bt == blob) {
   4612 			found = true;
   4613 			break;
   4614 		}
   4615 	}
   4616 
   4617 	if (!found) {
   4618 		ret = -EPERM;
   4619 		goto err;
   4620 	}
   4621 
   4622 	/* We must drop head_file here, because we may not be the last
   4623 	 * reference on the blob. */
   4624 	list_del_init(&blob->head_file);
   4625 	drm_property_unreference_blob_locked(blob);
   4626 	mutex_unlock(&dev->mode_config.blob_lock);
   4627 
   4628 	return 0;
   4629 
   4630 err:
   4631 	mutex_unlock(&dev->mode_config.blob_lock);
   4632 	return ret;
   4633 }
   4634 
   4635 /**
   4636  * drm_mode_connector_set_path_property - set tile property on connector
   4637  * @connector: connector to set property on.
   4638  * @path: path to use for property; must not be NULL.
   4639  *
   4640  * This creates a property to expose to userspace to specify a
   4641  * connector path. This is mainly used for DisplayPort MST where
   4642  * connectors have a topology and we want to allow userspace to give
   4643  * them more meaningful names.
   4644  *
   4645  * Returns:
   4646  * Zero on success, negative errno on failure.
   4647  */
   4648 int drm_mode_connector_set_path_property(struct drm_connector *connector,
   4649 					 const char *path)
   4650 {
   4651 	struct drm_device *dev = connector->dev;
   4652 	int ret;
   4653 
   4654 	ret = drm_property_replace_global_blob(dev,
   4655 	                                       &connector->path_blob_ptr,
   4656 	                                       strlen(path) + 1,
   4657 	                                       path,
   4658 	                                       &connector->base,
   4659 	                                       dev->mode_config.path_property);
   4660 	return ret;
   4661 }
   4662 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
   4663 
   4664 /**
   4665  * drm_mode_connector_set_tile_property - set tile property on connector
   4666  * @connector: connector to set property on.
   4667  *
   4668  * This looks up the tile information for a connector, and creates a
   4669  * property for userspace to parse if it exists. The property is of
   4670  * the form of 8 integers using ':' as a separator.
   4671  *
   4672  * Returns:
   4673  * Zero on success, errno on failure.
   4674  */
   4675 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
   4676 {
   4677 	struct drm_device *dev = connector->dev;
   4678 	char tile[256];
   4679 	int ret;
   4680 
   4681 	if (!connector->has_tile) {
   4682 		ret  = drm_property_replace_global_blob(dev,
   4683 		                                        &connector->tile_blob_ptr,
   4684 		                                        0,
   4685 		                                        NULL,
   4686 		                                        &connector->base,
   4687 		                                        dev->mode_config.tile_property);
   4688 		return ret;
   4689 	}
   4690 
   4691 	snprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
   4692 		 connector->tile_group->id, connector->tile_is_single_monitor,
   4693 		 connector->num_h_tile, connector->num_v_tile,
   4694 		 connector->tile_h_loc, connector->tile_v_loc,
   4695 		 connector->tile_h_size, connector->tile_v_size);
   4696 
   4697 	ret = drm_property_replace_global_blob(dev,
   4698 	                                       &connector->tile_blob_ptr,
   4699 	                                       strlen(tile) + 1,
   4700 	                                       tile,
   4701 	                                       &connector->base,
   4702 	                                       dev->mode_config.tile_property);
   4703 	return ret;
   4704 }
   4705 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
   4706 
   4707 /**
   4708  * drm_mode_connector_update_edid_property - update the edid property of a connector
   4709  * @connector: drm connector
   4710  * @edid: new value of the edid property
   4711  *
   4712  * This function creates a new blob modeset object and assigns its id to the
   4713  * connector's edid property.
   4714  *
   4715  * Returns:
   4716  * Zero on success, negative errno on failure.
   4717  */
   4718 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
   4719 					    const struct edid *edid)
   4720 {
   4721 	struct drm_device *dev = connector->dev;
   4722 	size_t size = 0;
   4723 	int ret;
   4724 
   4725 	/* ignore requests to set edid when overridden */
   4726 	if (connector->override_edid)
   4727 		return 0;
   4728 
   4729 	if (edid)
   4730 		size = EDID_LENGTH * (1 + edid->extensions);
   4731 
   4732 	ret = drm_property_replace_global_blob(dev,
   4733 					       &connector->edid_blob_ptr,
   4734 	                                       size,
   4735 	                                       edid,
   4736 	                                       &connector->base,
   4737 	                                       dev->mode_config.edid_property);
   4738 	return ret;
   4739 }
   4740 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
   4741 
   4742 /* Some properties could refer to dynamic refcnt'd objects, or things that
   4743  * need special locking to handle lifetime issues (ie. to ensure the prop
   4744  * value doesn't become invalid part way through the property update due to
   4745  * race).  The value returned by reference via 'obj' should be passed back
   4746  * to drm_property_change_valid_put() after the property is set (and the
   4747  * object to which the property is attached has a chance to take it's own
   4748  * reference).
   4749  */
   4750 bool drm_property_change_valid_get(struct drm_property *property,
   4751 					 uint64_t value, struct drm_mode_object **ref)
   4752 {
   4753 	int i;
   4754 
   4755 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
   4756 		return false;
   4757 
   4758 	*ref = NULL;
   4759 
   4760 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
   4761 		if (value < property->values[0] || value > property->values[1])
   4762 			return false;
   4763 		return true;
   4764 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
   4765 		int64_t svalue = U642I64(value);
   4766 
   4767 		if (svalue < U642I64(property->values[0]) ||
   4768 				svalue > U642I64(property->values[1]))
   4769 			return false;
   4770 		return true;
   4771 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
   4772 		uint64_t valid_mask = 0;
   4773 
   4774 		for (i = 0; i < property->num_values; i++)
   4775 			valid_mask |= (1ULL << property->values[i]);
   4776 		return !(value & ~valid_mask);
   4777 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
   4778 		struct drm_property_blob *blob;
   4779 
   4780 		if (value == 0)
   4781 			return true;
   4782 
   4783 		blob = drm_property_lookup_blob(property->dev, value);
   4784 		if (blob) {
   4785 			*ref = &blob->base;
   4786 			return true;
   4787 		} else {
   4788 			return false;
   4789 		}
   4790 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
   4791 		/* a zero value for an object property translates to null: */
   4792 		if (value == 0)
   4793 			return true;
   4794 
   4795 		/* handle refcnt'd objects specially: */
   4796 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
   4797 			struct drm_framebuffer *fb;
   4798 			fb = drm_framebuffer_lookup(property->dev, value);
   4799 			if (fb) {
   4800 				*ref = &fb->base;
   4801 				return true;
   4802 			} else {
   4803 				return false;
   4804 			}
   4805 		} else {
   4806 			return _object_find(property->dev, value, property->values[0]) != NULL;
   4807 		}
   4808 	}
   4809 
   4810 	for (i = 0; i < property->num_values; i++)
   4811 		if (property->values[i] == value)
   4812 			return true;
   4813 	return false;
   4814 }
   4815 
   4816 void drm_property_change_valid_put(struct drm_property *property,
   4817 		struct drm_mode_object *ref)
   4818 {
   4819 	if (!ref)
   4820 		return;
   4821 
   4822 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
   4823 		if (property->values[0] == DRM_MODE_OBJECT_FB)
   4824 			drm_framebuffer_unreference(obj_to_fb(ref));
   4825 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
   4826 		drm_property_unreference_blob(obj_to_blob(ref));
   4827 }
   4828 
   4829 /**
   4830  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
   4831  * @dev: DRM device
   4832  * @data: ioctl data
   4833  * @file_priv: DRM file info
   4834  *
   4835  * This function sets the current value for a connectors's property. It also
   4836  * calls into a driver's ->set_property callback to update the hardware state
   4837  *
   4838  * Called by the user via ioctl.
   4839  *
   4840  * Returns:
   4841  * Zero on success, negative errno on failure.
   4842  */
   4843 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
   4844 				       void *data, struct drm_file *file_priv)
   4845 {
   4846 	struct drm_mode_connector_set_property *conn_set_prop = data;
   4847 	struct drm_mode_obj_set_property obj_set_prop = {
   4848 		.value = conn_set_prop->value,
   4849 		.prop_id = conn_set_prop->prop_id,
   4850 		.obj_id = conn_set_prop->connector_id,
   4851 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
   4852 	};
   4853 
   4854 	/* It does all the locking and checking we need */
   4855 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
   4856 }
   4857 
   4858 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
   4859 					   struct drm_property *property,
   4860 					   uint64_t value)
   4861 {
   4862 	int ret = -EINVAL;
   4863 	struct drm_connector *connector = obj_to_connector(obj);
   4864 
   4865 	/* Do DPMS ourselves */
   4866 	if (property == connector->dev->mode_config.dpms_property) {
   4867 		ret = 0;
   4868 		if (connector->funcs->dpms)
   4869 			ret = (*connector->funcs->dpms)(connector, (int)value);
   4870 	} else if (connector->funcs->set_property)
   4871 		ret = connector->funcs->set_property(connector, property, value);
   4872 
   4873 	/* store the property value if successful */
   4874 	if (!ret)
   4875 		drm_object_property_set_value(&connector->base, property, value);
   4876 	return ret;
   4877 }
   4878 
   4879 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
   4880 				      struct drm_property *property,
   4881 				      uint64_t value)
   4882 {
   4883 	int ret = -EINVAL;
   4884 	struct drm_crtc *crtc = obj_to_crtc(obj);
   4885 
   4886 	if (crtc->funcs->set_property)
   4887 		ret = crtc->funcs->set_property(crtc, property, value);
   4888 	if (!ret)
   4889 		drm_object_property_set_value(obj, property, value);
   4890 
   4891 	return ret;
   4892 }
   4893 
   4894 /**
   4895  * drm_mode_plane_set_obj_prop - set the value of a property
   4896  * @plane: drm plane object to set property value for
   4897  * @property: property to set
   4898  * @value: value the property should be set to
   4899  *
   4900  * This functions sets a given property on a given plane object. This function
   4901  * calls the driver's ->set_property callback and changes the software state of
   4902  * the property if the callback succeeds.
   4903  *
   4904  * Returns:
   4905  * Zero on success, error code on failure.
   4906  */
   4907 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
   4908 				struct drm_property *property,
   4909 				uint64_t value)
   4910 {
   4911 	int ret = -EINVAL;
   4912 	struct drm_mode_object *obj = &plane->base;
   4913 
   4914 	if (plane->funcs->set_property)
   4915 		ret = plane->funcs->set_property(plane, property, value);
   4916 	if (!ret)
   4917 		drm_object_property_set_value(obj, property, value);
   4918 
   4919 	return ret;
   4920 }
   4921 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
   4922 
   4923 /**
   4924  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
   4925  * @dev: DRM device
   4926  * @data: ioctl data
   4927  * @file_priv: DRM file info
   4928  *
   4929  * This function retrieves the current value for an object's property. Compared
   4930  * to the connector specific ioctl this one is extended to also work on crtc and
   4931  * plane objects.
   4932  *
   4933  * Called by the user via ioctl.
   4934  *
   4935  * Returns:
   4936  * Zero on success, negative errno on failure.
   4937  */
   4938 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
   4939 				      struct drm_file *file_priv)
   4940 {
   4941 	struct drm_mode_obj_get_properties *arg = data;
   4942 	struct drm_mode_object *obj;
   4943 	int ret = 0;
   4944 
   4945 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4946 		return -EINVAL;
   4947 
   4948 	drm_modeset_lock_all(dev);
   4949 
   4950 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
   4951 	if (!obj) {
   4952 		ret = -ENOENT;
   4953 		goto out;
   4954 	}
   4955 	if (!obj->properties) {
   4956 		ret = -EINVAL;
   4957 		goto out;
   4958 	}
   4959 
   4960 	ret = get_properties(obj, file_priv->atomic,
   4961 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
   4962 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
   4963 			&arg->count_props);
   4964 
   4965 out:
   4966 	drm_modeset_unlock_all(dev);
   4967 	return ret;
   4968 }
   4969 
   4970 /**
   4971  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
   4972  * @dev: DRM device
   4973  * @data: ioctl data
   4974  * @file_priv: DRM file info
   4975  *
   4976  * This function sets the current value for an object's property. It also calls
   4977  * into a driver's ->set_property callback to update the hardware state.
   4978  * Compared to the connector specific ioctl this one is extended to also work on
   4979  * crtc and plane objects.
   4980  *
   4981  * Called by the user via ioctl.
   4982  *
   4983  * Returns:
   4984  * Zero on success, negative errno on failure.
   4985  */
   4986 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
   4987 				    struct drm_file *file_priv)
   4988 {
   4989 	struct drm_mode_obj_set_property *arg = data;
   4990 	struct drm_mode_object *arg_obj;
   4991 	struct drm_mode_object *prop_obj;
   4992 	struct drm_property *property;
   4993 	int i, ret = -EINVAL;
   4994 	struct drm_mode_object *ref;
   4995 
   4996 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   4997 		return -EINVAL;
   4998 
   4999 	drm_modeset_lock_all(dev);
   5000 
   5001 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
   5002 	if (!arg_obj) {
   5003 		ret = -ENOENT;
   5004 		goto out;
   5005 	}
   5006 	if (!arg_obj->properties)
   5007 		goto out;
   5008 
   5009 	for (i = 0; i < arg_obj->properties->count; i++)
   5010 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
   5011 			break;
   5012 
   5013 	if (i == arg_obj->properties->count)
   5014 		goto out;
   5015 
   5016 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
   5017 					DRM_MODE_OBJECT_PROPERTY);
   5018 	if (!prop_obj) {
   5019 		ret = -ENOENT;
   5020 		goto out;
   5021 	}
   5022 	property = obj_to_property(prop_obj);
   5023 
   5024 	if (!drm_property_change_valid_get(property, arg->value, &ref))
   5025 		goto out;
   5026 
   5027 	switch (arg_obj->type) {
   5028 	case DRM_MODE_OBJECT_CONNECTOR:
   5029 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
   5030 						      arg->value);
   5031 		break;
   5032 	case DRM_MODE_OBJECT_CRTC:
   5033 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
   5034 		break;
   5035 	case DRM_MODE_OBJECT_PLANE:
   5036 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
   5037 						  property, arg->value);
   5038 		break;
   5039 	}
   5040 
   5041 	drm_property_change_valid_put(property, ref);
   5042 
   5043 out:
   5044 	drm_modeset_unlock_all(dev);
   5045 	return ret;
   5046 }
   5047 
   5048 /**
   5049  * drm_mode_connector_attach_encoder - attach a connector to an encoder
   5050  * @connector: connector to attach
   5051  * @encoder: encoder to attach @connector to
   5052  *
   5053  * This function links up a connector to an encoder. Note that the routing
   5054  * restrictions between encoders and crtcs are exposed to userspace through the
   5055  * possible_clones and possible_crtcs bitmasks.
   5056  *
   5057  * Returns:
   5058  * Zero on success, negative errno on failure.
   5059  */
   5060 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
   5061 				      struct drm_encoder *encoder)
   5062 {
   5063 	int i;
   5064 
   5065 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
   5066 		if (connector->encoder_ids[i] == 0) {
   5067 			connector->encoder_ids[i] = encoder->base.id;
   5068 			return 0;
   5069 		}
   5070 	}
   5071 	return -ENOMEM;
   5072 }
   5073 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
   5074 
   5075 /**
   5076  * drm_mode_crtc_set_gamma_size - set the gamma table size
   5077  * @crtc: CRTC to set the gamma table size for
   5078  * @gamma_size: size of the gamma table
   5079  *
   5080  * Drivers which support gamma tables should set this to the supported gamma
   5081  * table size when initializing the CRTC. Currently the drm core only supports a
   5082  * fixed gamma table size.
   5083  *
   5084  * Returns:
   5085  * Zero on success, negative errno on failure.
   5086  */
   5087 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
   5088 				 int gamma_size)
   5089 {
   5090 	crtc->gamma_size = gamma_size;
   5091 
   5092 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
   5093 				    GFP_KERNEL);
   5094 	if (!crtc->gamma_store) {
   5095 		crtc->gamma_size = 0;
   5096 		return -ENOMEM;
   5097 	}
   5098 
   5099 	return 0;
   5100 }
   5101 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
   5102 
   5103 /**
   5104  * drm_mode_gamma_set_ioctl - set the gamma table
   5105  * @dev: DRM device
   5106  * @data: ioctl data
   5107  * @file_priv: DRM file info
   5108  *
   5109  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
   5110  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
   5111  *
   5112  * Called by the user via ioctl.
   5113  *
   5114  * Returns:
   5115  * Zero on success, negative errno on failure.
   5116  */
   5117 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
   5118 			     void *data, struct drm_file *file_priv)
   5119 {
   5120 	struct drm_mode_crtc_lut *crtc_lut = data;
   5121 	struct drm_crtc *crtc;
   5122 	void *r_base, *g_base, *b_base;
   5123 	int size;
   5124 	int ret = 0;
   5125 
   5126 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5127 		return -EINVAL;
   5128 
   5129 	drm_modeset_lock_all(dev);
   5130 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
   5131 	if (!crtc) {
   5132 		ret = -ENOENT;
   5133 		goto out;
   5134 	}
   5135 
   5136 	if (crtc->funcs->gamma_set == NULL) {
   5137 		ret = -ENOSYS;
   5138 		goto out;
   5139 	}
   5140 
   5141 	/* memcpy into gamma store */
   5142 	if (crtc_lut->gamma_size != crtc->gamma_size) {
   5143 		ret = -EINVAL;
   5144 		goto out;
   5145 	}
   5146 
   5147 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
   5148 	r_base = crtc->gamma_store;
   5149 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
   5150 		ret = -EFAULT;
   5151 		goto out;
   5152 	}
   5153 
   5154 	g_base = r_base + size;
   5155 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
   5156 		ret = -EFAULT;
   5157 		goto out;
   5158 	}
   5159 
   5160 	b_base = g_base + size;
   5161 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
   5162 		ret = -EFAULT;
   5163 		goto out;
   5164 	}
   5165 
   5166 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
   5167 
   5168 out:
   5169 	drm_modeset_unlock_all(dev);
   5170 	return ret;
   5171 
   5172 }
   5173 
   5174 /**
   5175  * drm_mode_gamma_get_ioctl - get the gamma table
   5176  * @dev: DRM device
   5177  * @data: ioctl data
   5178  * @file_priv: DRM file info
   5179  *
   5180  * Copy the current gamma table into the storage provided. This also provides
   5181  * the gamma table size the driver expects, which can be used to size the
   5182  * allocated storage.
   5183  *
   5184  * Called by the user via ioctl.
   5185  *
   5186  * Returns:
   5187  * Zero on success, negative errno on failure.
   5188  */
   5189 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
   5190 			     void *data, struct drm_file *file_priv)
   5191 {
   5192 	struct drm_mode_crtc_lut *crtc_lut = data;
   5193 	struct drm_crtc *crtc;
   5194 	void *r_base, *g_base, *b_base;
   5195 	int size;
   5196 	int ret = 0;
   5197 
   5198 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5199 		return -EINVAL;
   5200 
   5201 	drm_modeset_lock_all(dev);
   5202 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
   5203 	if (!crtc) {
   5204 		ret = -ENOENT;
   5205 		goto out;
   5206 	}
   5207 
   5208 	/* memcpy into gamma store */
   5209 	if (crtc_lut->gamma_size != crtc->gamma_size) {
   5210 		ret = -EINVAL;
   5211 		goto out;
   5212 	}
   5213 
   5214 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
   5215 	r_base = crtc->gamma_store;
   5216 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
   5217 		ret = -EFAULT;
   5218 		goto out;
   5219 	}
   5220 
   5221 	g_base = r_base + size;
   5222 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
   5223 		ret = -EFAULT;
   5224 		goto out;
   5225 	}
   5226 
   5227 	b_base = g_base + size;
   5228 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
   5229 		ret = -EFAULT;
   5230 		goto out;
   5231 	}
   5232 out:
   5233 	drm_modeset_unlock_all(dev);
   5234 	return ret;
   5235 }
   5236 
   5237 /**
   5238  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
   5239  * @dev: DRM device
   5240  * @data: ioctl data
   5241  * @file_priv: DRM file info
   5242  *
   5243  * This schedules an asynchronous update on a given CRTC, called page flip.
   5244  * Optionally a drm event is generated to signal the completion of the event.
   5245  * Generic drivers cannot assume that a pageflip with changed framebuffer
   5246  * properties (including driver specific metadata like tiling layout) will work,
   5247  * but some drivers support e.g. pixel format changes through the pageflip
   5248  * ioctl.
   5249  *
   5250  * Called by the user via ioctl.
   5251  *
   5252  * Returns:
   5253  * Zero on success, negative errno on failure.
   5254  */
   5255 int drm_mode_page_flip_ioctl(struct drm_device *dev,
   5256 			     void *data, struct drm_file *file_priv)
   5257 {
   5258 	struct drm_mode_crtc_page_flip *page_flip = data;
   5259 	struct drm_crtc *crtc;
   5260 	struct drm_framebuffer *fb = NULL;
   5261 	struct drm_pending_vblank_event *e = NULL;
   5262 	unsigned long flags;
   5263 	int ret = -EINVAL;
   5264 
   5265 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
   5266 		return -EINVAL;
   5267 
   5268 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
   5269 	    page_flip->reserved != 0)
   5270 		return -EINVAL;
   5271 
   5272 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
   5273 		return -EINVAL;
   5274 
   5275 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
   5276 	if (!crtc)
   5277 		return -ENOENT;
   5278 
   5279 	drm_modeset_lock_crtc(crtc, crtc->primary);
   5280 	if (crtc->primary->fb == NULL) {
   5281 		/* The framebuffer is currently unbound, presumably
   5282 		 * due to a hotplug event, that userspace has not
   5283 		 * yet discovered.
   5284 		 */
   5285 		ret = -EBUSY;
   5286 		goto out;
   5287 	}
   5288 
   5289 	if (crtc->funcs->page_flip == NULL)
   5290 		goto out;
   5291 
   5292 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
   5293 	if (!fb) {
   5294 		ret = -ENOENT;
   5295 		goto out;
   5296 	}
   5297 
   5298 	if (crtc->state) {
   5299 		const struct drm_plane_state *state = crtc->primary->state;
   5300 
   5301 		ret = check_src_coords(state->src_x, state->src_y,
   5302 				       state->src_w, state->src_h, fb);
   5303 	} else {
   5304 		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
   5305 	}
   5306 	if (ret)
   5307 		goto out;
   5308 
   5309 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
   5310 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
   5311 		ret = -EINVAL;
   5312 		goto out;
   5313 	}
   5314 
   5315 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
   5316 		ret = -ENOMEM;
   5317 		spin_lock_irqsave(&dev->event_lock, flags);
   5318 		if (file_priv->event_space < sizeof(e->event)) {
   5319 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5320 			goto out;
   5321 		}
   5322 		file_priv->event_space -= sizeof(e->event);
   5323 		spin_unlock_irqrestore(&dev->event_lock, flags);
   5324 
   5325 		e = kzalloc(sizeof(*e), GFP_KERNEL);
   5326 		if (e == NULL) {
   5327 			spin_lock_irqsave(&dev->event_lock, flags);
   5328 			file_priv->event_space += sizeof(e->event);
   5329 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5330 			goto out;
   5331 		}
   5332 
   5333 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
   5334 		e->event.base.length = sizeof(e->event);
   5335 		e->event.user_data = page_flip->user_data;
   5336 		e->base.event = &e->event.base;
   5337 		e->base.file_priv = file_priv;
   5338 		e->base.destroy =
   5339 			(void (*) (struct drm_pending_event *)) kfree;
   5340 	}
   5341 
   5342 	crtc->primary->old_fb = crtc->primary->fb;
   5343 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
   5344 	if (ret) {
   5345 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
   5346 			spin_lock_irqsave(&dev->event_lock, flags);
   5347 			file_priv->event_space += sizeof(e->event);
   5348 			spin_unlock_irqrestore(&dev->event_lock, flags);
   5349 			kfree(e);
   5350 		}
   5351 		/* Keep the old fb, don't unref it. */
   5352 		crtc->primary->old_fb = NULL;
   5353 	} else {
   5354 		crtc->primary->fb = fb;
   5355 		/* Unref only the old framebuffer. */
   5356 		fb = NULL;
   5357 	}
   5358 
   5359 out:
   5360 	if (fb)
   5361 		drm_framebuffer_unreference(fb);
   5362 	if (crtc->primary->old_fb)
   5363 		drm_framebuffer_unreference(crtc->primary->old_fb);
   5364 	crtc->primary->old_fb = NULL;
   5365 	drm_modeset_unlock_crtc(crtc);
   5366 
   5367 	return ret;
   5368 }
   5369 
   5370 /**
   5371  * drm_mode_config_reset - call ->reset callbacks
   5372  * @dev: drm device
   5373  *
   5374  * This functions calls all the crtc's, encoder's and connector's ->reset
   5375  * callback. Drivers can use this in e.g. their driver load or resume code to
   5376  * reset hardware and software state.
   5377  */
   5378 void drm_mode_config_reset(struct drm_device *dev)
   5379 {
   5380 	struct drm_crtc *crtc;
   5381 	struct drm_plane *plane;
   5382 	struct drm_encoder *encoder;
   5383 	struct drm_connector *connector;
   5384 
   5385 	drm_for_each_plane(plane, dev)
   5386 		if (plane->funcs->reset)
   5387 			plane->funcs->reset(plane);
   5388 
   5389 	drm_for_each_crtc(crtc, dev)
   5390 		if (crtc->funcs->reset)
   5391 			crtc->funcs->reset(crtc);
   5392 
   5393 	drm_for_each_encoder(encoder, dev)
   5394 		if (encoder->funcs->reset)
   5395 			encoder->funcs->reset(encoder);
   5396 
   5397 	mutex_lock(&dev->mode_config.mutex);
   5398 	drm_for_each_connector(connector, dev)
   5399 		if (connector->funcs->reset)
   5400 			connector->funcs->reset(connector);
   5401 	mutex_unlock(&dev->mode_config.mutex);
   5402 }
   5403 EXPORT_SYMBOL(drm_mode_config_reset);
   5404 
   5405 /**
   5406  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
   5407  * @dev: DRM device
   5408  * @data: ioctl data
   5409  * @file_priv: DRM file info
   5410  *
   5411  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
   5412  * TTM or something else entirely) and returns the resulting buffer handle. This
   5413  * handle can then be wrapped up into a framebuffer modeset object.
   5414  *
   5415  * Note that userspace is not allowed to use such objects for render
   5416  * acceleration - drivers must create their own private ioctls for such a use
   5417  * case.
   5418  *
   5419  * Called by the user via ioctl.
   5420  *
   5421  * Returns:
   5422  * Zero on success, negative errno on failure.
   5423  */
   5424 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
   5425 			       void *data, struct drm_file *file_priv)
   5426 {
   5427 	struct drm_mode_create_dumb *args = data;
   5428 	u32 cpp, stride, size;
   5429 
   5430 	if (!dev->driver->dumb_create)
   5431 		return -ENOSYS;
   5432 	if (!args->width || !args->height || !args->bpp)
   5433 		return -EINVAL;
   5434 
   5435 	/* overflow checks for 32bit size calculations */
   5436 	/* NOTE: DIV_ROUND_UP() can overflow */
   5437 	cpp = DIV_ROUND_UP(args->bpp, 8);
   5438 	if (!cpp || cpp > 0xffffffffU / args->width)
   5439 		return -EINVAL;
   5440 	stride = cpp * args->width;
   5441 	if (args->height > 0xffffffffU / stride)
   5442 		return -EINVAL;
   5443 
   5444 	/* test for wrap-around */
   5445 	size = args->height * stride;
   5446 	if (PAGE_ALIGN(size) == 0)
   5447 		return -EINVAL;
   5448 
   5449 	/*
   5450 	 * handle, pitch and size are output parameters. Zero them out to
   5451 	 * prevent drivers from accidentally using uninitialized data. Since
   5452 	 * not all existing userspace is clearing these fields properly we
   5453 	 * cannot reject IOCTL with garbage in them.
   5454 	 */
   5455 	args->handle = 0;
   5456 	args->pitch = 0;
   5457 	args->size = 0;
   5458 
   5459 	return dev->driver->dumb_create(file_priv, dev, args);
   5460 }
   5461 
   5462 /**
   5463  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
   5464  * @dev: DRM device
   5465  * @data: ioctl data
   5466  * @file_priv: DRM file info
   5467  *
   5468  * Allocate an offset in the drm device node's address space to be able to
   5469  * memory map a dumb buffer.
   5470  *
   5471  * Called by the user via ioctl.
   5472  *
   5473  * Returns:
   5474  * Zero on success, negative errno on failure.
   5475  */
   5476 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
   5477 			     void *data, struct drm_file *file_priv)
   5478 {
   5479 	struct drm_mode_map_dumb *args = data;
   5480 
   5481 	/* call driver ioctl to get mmap offset */
   5482 	if (!dev->driver->dumb_map_offset)
   5483 		return -ENOSYS;
   5484 
   5485 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
   5486 }
   5487 
   5488 /**
   5489  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
   5490  * @dev: DRM device
   5491  * @data: ioctl data
   5492  * @file_priv: DRM file info
   5493  *
   5494  * This destroys the userspace handle for the given dumb backing storage buffer.
   5495  * Since buffer objects must be reference counted in the kernel a buffer object
   5496  * won't be immediately freed if a framebuffer modeset object still uses it.
   5497  *
   5498  * Called by the user via ioctl.
   5499  *
   5500  * Returns:
   5501  * Zero on success, negative errno on failure.
   5502  */
   5503 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
   5504 				void *data, struct drm_file *file_priv)
   5505 {
   5506 	struct drm_mode_destroy_dumb *args = data;
   5507 
   5508 	if (!dev->driver->dumb_destroy)
   5509 		return -ENOSYS;
   5510 
   5511 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
   5512 }
   5513 
   5514 /**
   5515  * drm_fb_get_bpp_depth - get the bpp/depth values for format
   5516  * @format: pixel format (DRM_FORMAT_*)
   5517  * @depth: storage for the depth value
   5518  * @bpp: storage for the bpp value
   5519  *
   5520  * This only supports RGB formats here for compat with code that doesn't use
   5521  * pixel formats directly yet.
   5522  */
   5523 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
   5524 			  int *bpp)
   5525 {
   5526 	switch (format) {
   5527 	case DRM_FORMAT_C8:
   5528 	case DRM_FORMAT_RGB332:
   5529 	case DRM_FORMAT_BGR233:
   5530 		*depth = 8;
   5531 		*bpp = 8;
   5532 		break;
   5533 	case DRM_FORMAT_XRGB1555:
   5534 	case DRM_FORMAT_XBGR1555:
   5535 	case DRM_FORMAT_RGBX5551:
   5536 	case DRM_FORMAT_BGRX5551:
   5537 	case DRM_FORMAT_ARGB1555:
   5538 	case DRM_FORMAT_ABGR1555:
   5539 	case DRM_FORMAT_RGBA5551:
   5540 	case DRM_FORMAT_BGRA5551:
   5541 		*depth = 15;
   5542 		*bpp = 16;
   5543 		break;
   5544 	case DRM_FORMAT_RGB565:
   5545 	case DRM_FORMAT_BGR565:
   5546 		*depth = 16;
   5547 		*bpp = 16;
   5548 		break;
   5549 	case DRM_FORMAT_RGB888:
   5550 	case DRM_FORMAT_BGR888:
   5551 		*depth = 24;
   5552 		*bpp = 24;
   5553 		break;
   5554 	case DRM_FORMAT_XRGB8888:
   5555 	case DRM_FORMAT_XBGR8888:
   5556 	case DRM_FORMAT_RGBX8888:
   5557 	case DRM_FORMAT_BGRX8888:
   5558 		*depth = 24;
   5559 		*bpp = 32;
   5560 		break;
   5561 	case DRM_FORMAT_XRGB2101010:
   5562 	case DRM_FORMAT_XBGR2101010:
   5563 	case DRM_FORMAT_RGBX1010102:
   5564 	case DRM_FORMAT_BGRX1010102:
   5565 	case DRM_FORMAT_ARGB2101010:
   5566 	case DRM_FORMAT_ABGR2101010:
   5567 	case DRM_FORMAT_RGBA1010102:
   5568 	case DRM_FORMAT_BGRA1010102:
   5569 		*depth = 30;
   5570 		*bpp = 32;
   5571 		break;
   5572 	case DRM_FORMAT_ARGB8888:
   5573 	case DRM_FORMAT_ABGR8888:
   5574 	case DRM_FORMAT_RGBA8888:
   5575 	case DRM_FORMAT_BGRA8888:
   5576 		*depth = 32;
   5577 		*bpp = 32;
   5578 		break;
   5579 	default:
   5580 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
   5581 			      drm_get_format_name(format));
   5582 		*depth = 0;
   5583 		*bpp = 0;
   5584 		break;
   5585 	}
   5586 }
   5587 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
   5588 
   5589 /**
   5590  * drm_format_num_planes - get the number of planes for format
   5591  * @format: pixel format (DRM_FORMAT_*)
   5592  *
   5593  * Returns:
   5594  * The number of planes used by the specified pixel format.
   5595  */
   5596 int drm_format_num_planes(uint32_t format)
   5597 {
   5598 	switch (format) {
   5599 	case DRM_FORMAT_YUV410:
   5600 	case DRM_FORMAT_YVU410:
   5601 	case DRM_FORMAT_YUV411:
   5602 	case DRM_FORMAT_YVU411:
   5603 	case DRM_FORMAT_YUV420:
   5604 	case DRM_FORMAT_YVU420:
   5605 	case DRM_FORMAT_YUV422:
   5606 	case DRM_FORMAT_YVU422:
   5607 	case DRM_FORMAT_YUV444:
   5608 	case DRM_FORMAT_YVU444:
   5609 		return 3;
   5610 	case DRM_FORMAT_NV12:
   5611 	case DRM_FORMAT_NV21:
   5612 	case DRM_FORMAT_NV16:
   5613 	case DRM_FORMAT_NV61:
   5614 	case DRM_FORMAT_NV24:
   5615 	case DRM_FORMAT_NV42:
   5616 		return 2;
   5617 	default:
   5618 		return 1;
   5619 	}
   5620 }
   5621 EXPORT_SYMBOL(drm_format_num_planes);
   5622 
   5623 /**
   5624  * drm_format_plane_cpp - determine the bytes per pixel value
   5625  * @format: pixel format (DRM_FORMAT_*)
   5626  * @plane: plane index
   5627  *
   5628  * Returns:
   5629  * The bytes per pixel value for the specified plane.
   5630  */
   5631 int drm_format_plane_cpp(uint32_t format, int plane)
   5632 {
   5633 	unsigned int depth;
   5634 	int bpp;
   5635 
   5636 	if (plane >= drm_format_num_planes(format))
   5637 		return 0;
   5638 
   5639 	switch (format) {
   5640 	case DRM_FORMAT_YUYV:
   5641 	case DRM_FORMAT_YVYU:
   5642 	case DRM_FORMAT_UYVY:
   5643 	case DRM_FORMAT_VYUY:
   5644 		return 2;
   5645 	case DRM_FORMAT_NV12:
   5646 	case DRM_FORMAT_NV21:
   5647 	case DRM_FORMAT_NV16:
   5648 	case DRM_FORMAT_NV61:
   5649 	case DRM_FORMAT_NV24:
   5650 	case DRM_FORMAT_NV42:
   5651 		return plane ? 2 : 1;
   5652 	case DRM_FORMAT_YUV410:
   5653 	case DRM_FORMAT_YVU410:
   5654 	case DRM_FORMAT_YUV411:
   5655 	case DRM_FORMAT_YVU411:
   5656 	case DRM_FORMAT_YUV420:
   5657 	case DRM_FORMAT_YVU420:
   5658 	case DRM_FORMAT_YUV422:
   5659 	case DRM_FORMAT_YVU422:
   5660 	case DRM_FORMAT_YUV444:
   5661 	case DRM_FORMAT_YVU444:
   5662 		return 1;
   5663 	default:
   5664 		drm_fb_get_bpp_depth(format, &depth, &bpp);
   5665 		return bpp >> 3;
   5666 	}
   5667 }
   5668 EXPORT_SYMBOL(drm_format_plane_cpp);
   5669 
   5670 /**
   5671  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
   5672  * @format: pixel format (DRM_FORMAT_*)
   5673  *
   5674  * Returns:
   5675  * The horizontal chroma subsampling factor for the
   5676  * specified pixel format.
   5677  */
   5678 int drm_format_horz_chroma_subsampling(uint32_t format)
   5679 {
   5680 	switch (format) {
   5681 	case DRM_FORMAT_YUV411:
   5682 	case DRM_FORMAT_YVU411:
   5683 	case DRM_FORMAT_YUV410:
   5684 	case DRM_FORMAT_YVU410:
   5685 		return 4;
   5686 	case DRM_FORMAT_YUYV:
   5687 	case DRM_FORMAT_YVYU:
   5688 	case DRM_FORMAT_UYVY:
   5689 	case DRM_FORMAT_VYUY:
   5690 	case DRM_FORMAT_NV12:
   5691 	case DRM_FORMAT_NV21:
   5692 	case DRM_FORMAT_NV16:
   5693 	case DRM_FORMAT_NV61:
   5694 	case DRM_FORMAT_YUV422:
   5695 	case DRM_FORMAT_YVU422:
   5696 	case DRM_FORMAT_YUV420:
   5697 	case DRM_FORMAT_YVU420:
   5698 		return 2;
   5699 	default:
   5700 		return 1;
   5701 	}
   5702 }
   5703 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
   5704 
   5705 /**
   5706  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
   5707  * @format: pixel format (DRM_FORMAT_*)
   5708  *
   5709  * Returns:
   5710  * The vertical chroma subsampling factor for the
   5711  * specified pixel format.
   5712  */
   5713 int drm_format_vert_chroma_subsampling(uint32_t format)
   5714 {
   5715 	switch (format) {
   5716 	case DRM_FORMAT_YUV410:
   5717 	case DRM_FORMAT_YVU410:
   5718 		return 4;
   5719 	case DRM_FORMAT_YUV420:
   5720 	case DRM_FORMAT_YVU420:
   5721 	case DRM_FORMAT_NV12:
   5722 	case DRM_FORMAT_NV21:
   5723 		return 2;
   5724 	default:
   5725 		return 1;
   5726 	}
   5727 }
   5728 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
   5729 
   5730 /**
   5731  * drm_rotation_simplify() - Try to simplify the rotation
   5732  * @rotation: Rotation to be simplified
   5733  * @supported_rotations: Supported rotations
   5734  *
   5735  * Attempt to simplify the rotation to a form that is supported.
   5736  * Eg. if the hardware supports everything except DRM_REFLECT_X
   5737  * one could call this function like this:
   5738  *
   5739  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
   5740  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
   5741  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
   5742  *
   5743  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
   5744  * transforms the hardware supports, this function may not
   5745  * be able to produce a supported transform, so the caller should
   5746  * check the result afterwards.
   5747  */
   5748 unsigned int drm_rotation_simplify(unsigned int rotation,
   5749 				   unsigned int supported_rotations)
   5750 {
   5751 	if (rotation & ~supported_rotations) {
   5752 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
   5753 		rotation = (rotation & DRM_REFLECT_MASK) |
   5754 		           BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4);
   5755 	}
   5756 
   5757 	return rotation;
   5758 }
   5759 EXPORT_SYMBOL(drm_rotation_simplify);
   5760 
   5761 /**
   5762  * drm_mode_config_init - initialize DRM mode_configuration structure
   5763  * @dev: DRM device
   5764  *
   5765  * Initialize @dev's mode_config structure, used for tracking the graphics
   5766  * configuration of @dev.
   5767  *
   5768  * Since this initializes the modeset locks, no locking is possible. Which is no
   5769  * problem, since this should happen single threaded at init time. It is the
   5770  * driver's problem to ensure this guarantee.
   5771  *
   5772  */
   5773 void drm_mode_config_init(struct drm_device *dev)
   5774 {
   5775 #ifdef __NetBSD__
   5776 	linux_mutex_init(&dev->mode_config.mutex);
   5777 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
   5778 	linux_mutex_init(&dev->mode_config.idr_mutex);
   5779 	linux_mutex_init(&dev->mode_config.fb_lock);
   5780 	linux_mutex_init(&dev->mode_config.blob_lock);
   5781 #else
   5782 	mutex_init(&dev->mode_config.mutex);
   5783 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
   5784 	mutex_init(&dev->mode_config.idr_mutex);
   5785 	mutex_init(&dev->mode_config.fb_lock);
   5786 	mutex_init(&dev->mode_config.blob_lock);
   5787 #endif
   5788 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
   5789 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
   5790 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
   5791 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
   5792 	INIT_LIST_HEAD(&dev->mode_config.property_list);
   5793 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
   5794 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
   5795 	idr_init(&dev->mode_config.crtc_idr);
   5796 	idr_init(&dev->mode_config.tile_idr);
   5797 
   5798 	drm_modeset_lock_all(dev);
   5799 	drm_mode_create_standard_properties(dev);
   5800 	drm_modeset_unlock_all(dev);
   5801 
   5802 	/* Just to be sure */
   5803 	dev->mode_config.num_fb = 0;
   5804 	dev->mode_config.num_connector = 0;
   5805 	dev->mode_config.num_crtc = 0;
   5806 	dev->mode_config.num_encoder = 0;
   5807 	dev->mode_config.num_overlay_plane = 0;
   5808 	dev->mode_config.num_total_plane = 0;
   5809 }
   5810 EXPORT_SYMBOL(drm_mode_config_init);
   5811 
   5812 /**
   5813  * drm_mode_config_cleanup - free up DRM mode_config info
   5814  * @dev: DRM device
   5815  *
   5816  * Free up all the connectors and CRTCs associated with this DRM device, then
   5817  * free up the framebuffers and associated buffer objects.
   5818  *
   5819  * Note that since this /should/ happen single-threaded at driver/device
   5820  * teardown time, no locking is required. It's the driver's job to ensure that
   5821  * this guarantee actually holds true.
   5822  *
   5823  * FIXME: cleanup any dangling user buffer objects too
   5824  */
   5825 void drm_mode_config_cleanup(struct drm_device *dev)
   5826 {
   5827 	struct drm_connector *connector, *ot;
   5828 	struct drm_crtc *crtc, *ct;
   5829 	struct drm_encoder *encoder, *enct;
   5830 	struct drm_framebuffer *fb, *fbt;
   5831 	struct drm_property *property, *pt;
   5832 	struct drm_property_blob *blob, *bt;
   5833 	struct drm_plane *plane, *plt;
   5834 
   5835 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
   5836 				 head) {
   5837 		encoder->funcs->destroy(encoder);
   5838 	}
   5839 
   5840 	list_for_each_entry_safe(connector, ot,
   5841 				 &dev->mode_config.connector_list, head) {
   5842 		connector->funcs->destroy(connector);
   5843 	}
   5844 
   5845 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
   5846 				 head) {
   5847 		drm_property_destroy(dev, property);
   5848 	}
   5849 
   5850 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
   5851 				 head_global) {
   5852 		drm_property_unreference_blob(blob);
   5853 	}
   5854 
   5855 	/*
   5856 	 * Single-threaded teardown context, so it's not required to grab the
   5857 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
   5858 	 * would actually deadlock with the drm_framebuffer_cleanup function.
   5859 	 *
   5860 	 * Also, if there are any framebuffers left, that's a driver leak now,
   5861 	 * so politely WARN about this.
   5862 	 */
   5863 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
   5864 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
   5865 		drm_framebuffer_free(&fb->refcount);
   5866 	}
   5867 
   5868 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
   5869 				 head) {
   5870 		plane->funcs->destroy(plane);
   5871 	}
   5872 
   5873 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
   5874 		crtc->funcs->destroy(crtc);
   5875 	}
   5876 
   5877 	idr_destroy(&dev->mode_config.tile_idr);
   5878 	idr_destroy(&dev->mode_config.crtc_idr);
   5879 #ifdef __NetBSD__
   5880 	linux_mutex_destroy(&dev->mode_config.blob_lock);
   5881 	linux_mutex_destroy(&dev->mode_config.fb_lock);
   5882 	linux_mutex_destroy(&dev->mode_config.idr_mutex);
   5883 	linux_mutex_destroy(&dev->mode_config.mutex);
   5884 #endif
   5885 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
   5886 }
   5887 EXPORT_SYMBOL(drm_mode_config_cleanup);
   5888 
   5889 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
   5890 						       unsigned int supported_rotations)
   5891 {
   5892 	static const struct drm_prop_enum_list props[] = {
   5893 		{ DRM_ROTATE_0,   "rotate-0" },
   5894 		{ DRM_ROTATE_90,  "rotate-90" },
   5895 		{ DRM_ROTATE_180, "rotate-180" },
   5896 		{ DRM_ROTATE_270, "rotate-270" },
   5897 		{ DRM_REFLECT_X,  "reflect-x" },
   5898 		{ DRM_REFLECT_Y,  "reflect-y" },
   5899 	};
   5900 
   5901 	return drm_property_create_bitmask(dev, 0, "rotation",
   5902 					   props, ARRAY_SIZE(props),
   5903 					   supported_rotations);
   5904 }
   5905 EXPORT_SYMBOL(drm_mode_create_rotation_property);
   5906 
   5907 /**
   5908  * DOC: Tile group
   5909  *
   5910  * Tile groups are used to represent tiled monitors with a unique
   5911  * integer identifier. Tiled monitors using DisplayID v1.3 have
   5912  * a unique 8-byte handle, we store this in a tile group, so we
   5913  * have a common identifier for all tiles in a monitor group.
   5914  */
   5915 static void drm_tile_group_free(struct kref *kref)
   5916 {
   5917 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
   5918 	struct drm_device *dev = tg->dev;
   5919 	mutex_lock(&dev->mode_config.idr_mutex);
   5920 	idr_remove(&dev->mode_config.tile_idr, tg->id);
   5921 	mutex_unlock(&dev->mode_config.idr_mutex);
   5922 	kfree(tg);
   5923 }
   5924 
   5925 /**
   5926  * drm_mode_put_tile_group - drop a reference to a tile group.
   5927  * @dev: DRM device
   5928  * @tg: tile group to drop reference to.
   5929  *
   5930  * drop reference to tile group and free if 0.
   5931  */
   5932 void drm_mode_put_tile_group(struct drm_device *dev,
   5933 			     struct drm_tile_group *tg)
   5934 {
   5935 	kref_put(&tg->refcount, drm_tile_group_free);
   5936 }
   5937 
   5938 /**
   5939  * drm_mode_get_tile_group - get a reference to an existing tile group
   5940  * @dev: DRM device
   5941  * @topology: 8-bytes unique per monitor.
   5942  *
   5943  * Use the unique bytes to get a reference to an existing tile group.
   5944  *
   5945  * RETURNS:
   5946  * tile group or NULL if not found.
   5947  */
   5948 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
   5949 					       char topology[8])
   5950 {
   5951 	struct drm_tile_group *tg;
   5952 	int id;
   5953 	mutex_lock(&dev->mode_config.idr_mutex);
   5954 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
   5955 		if (!memcmp(tg->group_data, topology, 8)) {
   5956 			if (!kref_get_unless_zero(&tg->refcount))
   5957 				tg = NULL;
   5958 			mutex_unlock(&dev->mode_config.idr_mutex);
   5959 			return tg;
   5960 		}
   5961 	}
   5962 	mutex_unlock(&dev->mode_config.idr_mutex);
   5963 	return NULL;
   5964 }
   5965 EXPORT_SYMBOL(drm_mode_get_tile_group);
   5966 
   5967 /**
   5968  * drm_mode_create_tile_group - create a tile group from a displayid description
   5969  * @dev: DRM device
   5970  * @topology: 8-bytes unique per monitor.
   5971  *
   5972  * Create a tile group for the unique monitor, and get a unique
   5973  * identifier for the tile group.
   5974  *
   5975  * RETURNS:
   5976  * new tile group or error.
   5977  */
   5978 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
   5979 						  char topology[8])
   5980 {
   5981 	struct drm_tile_group *tg;
   5982 	int ret;
   5983 
   5984 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
   5985 	if (!tg)
   5986 		return ERR_PTR(-ENOMEM);
   5987 
   5988 	kref_init(&tg->refcount);
   5989 	memcpy(tg->group_data, topology, 8);
   5990 	tg->dev = dev;
   5991 
   5992 	idr_preload(GFP_KERNEL);
   5993 	mutex_lock(&dev->mode_config.idr_mutex);
   5994 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
   5995 	if (ret >= 0) {
   5996 		tg->id = ret;
   5997 	} else {
   5998 		kfree(tg);
   5999 		tg = ERR_PTR(ret);
   6000 	}
   6001 
   6002 	mutex_unlock(&dev->mode_config.idr_mutex);
   6003 	idr_preload_end();
   6004 	return tg;
   6005 }
   6006 EXPORT_SYMBOL(drm_mode_create_tile_group);
   6007