xref: /dragonfly/sys/dev/drm/drm_crtc.c (revision cf37dc20)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/export.h>
35 #include <drm/drmP.h>
36 #include <drm/drm_crtc.h>
37 #include <drm/drm_edid.h>
38 #include <uapi_drm/drm_fourcc.h>
39 #include <linux/slab.h>
40 #include <drm/drm_modeset_lock.h>
41 
42 #include "drm_crtc_internal.h"
43 
44 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
45 							struct drm_mode_fb_cmd2 *r,
46 							struct drm_file *file_priv);
47 
48 /**
49  * drm_modeset_lock_all - take all modeset locks
50  * @dev: drm device
51  *
52  * This function takes all modeset locks, suitable where a more fine-grained
53  * scheme isn't (yet) implemented. Locks must be dropped with
54  * drm_modeset_unlock_all.
55  */
56 void drm_modeset_lock_all(struct drm_device *dev)
57 {
58 	struct drm_mode_config *config = &dev->mode_config;
59 	struct drm_modeset_acquire_ctx *ctx;
60 	int ret;
61 
62 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
63 	if (WARN_ON(!ctx))
64 		return;
65 
66 	mutex_lock(&config->mutex);
67 
68 	drm_modeset_acquire_init(ctx, 0);
69 
70 retry:
71 	ret = drm_modeset_lock(&config->connection_mutex, ctx);
72 	if (ret)
73 		goto fail;
74 	ret = drm_modeset_lock_all_crtcs(dev, ctx);
75 	if (ret)
76 		goto fail;
77 
78 	WARN_ON(config->acquire_ctx);
79 
80 	/* now we hold the locks, so now that it is safe, stash the
81 	 * ctx for drm_modeset_unlock_all():
82 	 */
83 	config->acquire_ctx = ctx;
84 
85 	drm_warn_on_modeset_not_all_locked(dev);
86 
87 	return;
88 
89 fail:
90 	if (ret == -EDEADLK) {
91 		drm_modeset_backoff(ctx);
92 		goto retry;
93 	}
94 }
95 EXPORT_SYMBOL(drm_modeset_lock_all);
96 
97 /**
98  * drm_modeset_unlock_all - drop all modeset locks
99  * @dev: device
100  *
101  * This function drop all modeset locks taken by drm_modeset_lock_all.
102  */
103 void drm_modeset_unlock_all(struct drm_device *dev)
104 {
105 	struct drm_mode_config *config = &dev->mode_config;
106 	struct drm_modeset_acquire_ctx *ctx = config->acquire_ctx;
107 
108 	if (WARN_ON(!ctx))
109 		return;
110 
111 	config->acquire_ctx = NULL;
112 	drm_modeset_drop_locks(ctx);
113 	drm_modeset_acquire_fini(ctx);
114 
115 	kfree(ctx);
116 
117 	mutex_unlock(&dev->mode_config.mutex);
118 }
119 EXPORT_SYMBOL(drm_modeset_unlock_all);
120 
121 /**
122  * drm_warn_on_modeset_not_all_locked - check that all modeset locks are locked
123  * @dev: device
124  *
125  * Useful as a debug assert.
126  */
127 void drm_warn_on_modeset_not_all_locked(struct drm_device *dev)
128 {
129 	struct drm_crtc *crtc;
130 
131 	/* Locking is currently fubar in the panic handler. */
132 #if 0
133 	if (oops_in_progress)
134 		return;
135 #endif
136 
137 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
138 		WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
139 
140 	WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
141 	WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
142 }
143 EXPORT_SYMBOL(drm_warn_on_modeset_not_all_locked);
144 
145 /* Avoid boilerplate.  I'm tired of typing. */
146 #define DRM_ENUM_NAME_FN(fnname, list)				\
147 	const char *fnname(int val)				\
148 	{							\
149 		int i;						\
150 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
151 			if (list[i].type == val)		\
152 				return list[i].name;		\
153 		}						\
154 		return "(unknown)";				\
155 	}
156 
157 /*
158  * Global properties
159  */
160 static const struct drm_prop_enum_list drm_dpms_enum_list[] =
161 {	{ DRM_MODE_DPMS_ON, "On" },
162 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
163 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
164 	{ DRM_MODE_DPMS_OFF, "Off" }
165 };
166 
167 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
168 
169 static const struct drm_prop_enum_list drm_plane_type_enum_list[] =
170 {
171 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
172 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
173 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
174 };
175 
176 /*
177  * Optional properties
178  */
179 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] =
180 {
181 	{ DRM_MODE_SCALE_NONE, "None" },
182 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
183 	{ DRM_MODE_SCALE_CENTER, "Center" },
184 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
185 };
186 
187 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
188 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
189 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
190 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
191 };
192 
193 /*
194  * Non-global properties, but "required" for certain connectors.
195  */
196 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] =
197 {
198 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
199 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
200 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
201 };
202 
203 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
204 
205 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] =
206 {
207 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
208 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
209 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
210 };
211 
212 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
213 		 drm_dvi_i_subconnector_enum_list)
214 
215 static const struct drm_prop_enum_list drm_tv_select_enum_list[] =
216 {
217 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
218 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
219 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
220 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
221 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
222 };
223 
224 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
225 
226 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] =
227 {
228 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
229 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
230 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
231 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
232 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
233 };
234 
235 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
236 		 drm_tv_subconnector_enum_list)
237 
238 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
239 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
240 	{ DRM_MODE_DIRTY_ON,       "On"       },
241 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
242 };
243 
244 struct drm_conn_prop_enum_list {
245 	int type;
246 	const char *name;
247 	int count;
248 };
249 
250 /*
251  * Connector and encoder types.
252  */
253 static struct drm_conn_prop_enum_list drm_connector_enum_list[] =
254 {	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
255 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
256 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
257 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
258 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
259 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
260 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
261 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
262 	{ DRM_MODE_CONNECTOR_Component, "Component" },
263 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
264 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
265 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
266 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
267 	{ DRM_MODE_CONNECTOR_TV, "TV" },
268 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
269 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
270 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
271 };
272 
273 static const struct drm_prop_enum_list drm_encoder_enum_list[] =
274 {	{ DRM_MODE_ENCODER_NONE, "None" },
275 	{ DRM_MODE_ENCODER_DAC, "DAC" },
276 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
277 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
278 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
279 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
280 	{ DRM_MODE_ENCODER_DSI, "DSI" },
281 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
282 };
283 
284 static const struct drm_prop_enum_list drm_subpixel_enum_list[] =
285 {
286 	{ SubPixelUnknown, "Unknown" },
287 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
288 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
289 	{ SubPixelVerticalRGB, "Vertical RGB" },
290 	{ SubPixelVerticalBGR, "Vertical BGR" },
291 	{ SubPixelNone, "None" },
292 };
293 
294 void drm_connector_ida_init(void)
295 {
296 #if 0
297 	int i;
298 
299 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
300 		ida_init(&drm_connector_enum_list[i].ida);
301 #endif
302 }
303 
304 void drm_connector_ida_destroy(void)
305 {
306 #if 0
307 	int i;
308 
309 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
310 		ida_destroy(&drm_connector_enum_list[i].ida);
311 #endif
312 }
313 
314 /**
315  * drm_get_connector_status_name - return a string for connector status
316  * @status: connector status to compute name of
317  *
318  * In contrast to the other drm_get_*_name functions this one here returns a
319  * const pointer and hence is threadsafe.
320  */
321 const char *drm_get_connector_status_name(enum drm_connector_status status)
322 {
323 	if (status == connector_status_connected)
324 		return "connected";
325 	else if (status == connector_status_disconnected)
326 		return "disconnected";
327 	else
328 		return "unknown";
329 }
330 EXPORT_SYMBOL(drm_get_connector_status_name);
331 
332 /**
333  * drm_get_subpixel_order_name - return a string for a given subpixel enum
334  * @order: enum of subpixel_order
335  *
336  * Note you could abuse this and return something out of bounds, but that
337  * would be a caller error.  No unscrubbed user data should make it here.
338  */
339 const char *drm_get_subpixel_order_name(enum subpixel_order order)
340 {
341 	return drm_subpixel_enum_list[order].name;
342 }
343 EXPORT_SYMBOL(drm_get_subpixel_order_name);
344 
345 static char printable_char(int c)
346 {
347 	return isascii(c) && isprint(c) ? c : '?';
348 }
349 
350 /**
351  * drm_get_format_name - return a string for drm fourcc format
352  * @format: format to compute name of
353  *
354  * Note that the buffer used by this function is globally shared and owned by
355  * the function itself.
356  *
357  * FIXME: This isn't really multithreading safe.
358  */
359 const char *drm_get_format_name(uint32_t format)
360 {
361 	static char buf[32];
362 
363 	ksnprintf(buf, sizeof(buf),
364 		 "%c%c%c%c %s-endian (0x%08x)",
365 		 printable_char(format & 0xff),
366 		 printable_char((format >> 8) & 0xff),
367 		 printable_char((format >> 16) & 0xff),
368 		 printable_char((format >> 24) & 0x7f),
369 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
370 		 format);
371 
372 	return buf;
373 }
374 EXPORT_SYMBOL(drm_get_format_name);
375 
376 /**
377  * drm_mode_object_get - allocate a new modeset identifier
378  * @dev: DRM device
379  * @obj: object pointer, used to generate unique ID
380  * @obj_type: object type
381  *
382  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
383  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
384  * modeset identifiers are _not_ reference counted. Hence don't use this for
385  * reference counted modeset objects like framebuffers.
386  *
387  * Returns:
388  * New unique (relative to other objects in @dev) integer identifier for the
389  * object.
390  */
391 int drm_mode_object_get(struct drm_device *dev,
392 			struct drm_mode_object *obj, uint32_t obj_type)
393 {
394 	int ret;
395 
396 	mutex_lock(&dev->mode_config.idr_mutex);
397 	ret = idr_alloc(&dev->mode_config.crtc_idr, obj, 1, 0, GFP_KERNEL);
398 	if (ret >= 0) {
399 		/*
400 		 * Set up the object linking under the protection of the idr
401 		 * lock so that other users can't see inconsistent state.
402 		 */
403 		obj->id = ret;
404 		obj->type = obj_type;
405 	}
406 	mutex_unlock(&dev->mode_config.idr_mutex);
407 
408 	return ret < 0 ? ret : 0;
409 }
410 
411 /**
412  * drm_mode_object_put - free a modeset identifer
413  * @dev: DRM device
414  * @object: object to free
415  *
416  * Free @id from @dev's unique identifier pool. Note that despite the _get
417  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
418  * for reference counted modeset objects like framebuffers.
419  */
420 void drm_mode_object_put(struct drm_device *dev,
421 			 struct drm_mode_object *object)
422 {
423 	mutex_lock(&dev->mode_config.idr_mutex);
424 	idr_remove(&dev->mode_config.crtc_idr, object->id);
425 	mutex_unlock(&dev->mode_config.idr_mutex);
426 }
427 
428 static struct drm_mode_object *_object_find(struct drm_device *dev,
429 		uint32_t id, uint32_t type)
430 {
431 	struct drm_mode_object *obj = NULL;
432 
433 	mutex_lock(&dev->mode_config.idr_mutex);
434 	obj = idr_find(&dev->mode_config.crtc_idr, id);
435 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
436 		obj = NULL;
437 	if (obj && obj->id != id)
438 		obj = NULL;
439 	/* don't leak out unref'd fb's */
440 	if (obj && (obj->type == DRM_MODE_OBJECT_FB))
441 		obj = NULL;
442 	mutex_unlock(&dev->mode_config.idr_mutex);
443 
444 	return obj;
445 }
446 
447 /**
448  * drm_mode_object_find - look up a drm object with static lifetime
449  * @dev: drm device
450  * @id: id of the mode object
451  * @type: type of the mode object
452  *
453  * Note that framebuffers cannot be looked up with this functions - since those
454  * are reference counted, they need special treatment.  Even with
455  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
456  * rather than WARN_ON()).
457  */
458 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
459 		uint32_t id, uint32_t type)
460 {
461 	struct drm_mode_object *obj = NULL;
462 
463 	/* Framebuffers are reference counted and need their own lookup
464 	 * function.*/
465 	WARN_ON(type == DRM_MODE_OBJECT_FB);
466 	obj = _object_find(dev, id, type);
467 	return obj;
468 }
469 EXPORT_SYMBOL(drm_mode_object_find);
470 
471 /**
472  * drm_framebuffer_init - initialize a framebuffer
473  * @dev: DRM device
474  * @fb: framebuffer to be initialized
475  * @funcs: ... with these functions
476  *
477  * Allocates an ID for the framebuffer's parent mode object, sets its mode
478  * functions & device file and adds it to the master fd list.
479  *
480  * IMPORTANT:
481  * This functions publishes the fb and makes it available for concurrent access
482  * by other users. Which means by this point the fb _must_ be fully set up -
483  * since all the fb attributes are invariant over its lifetime, no further
484  * locking but only correct reference counting is required.
485  *
486  * Returns:
487  * Zero on success, error code on failure.
488  */
489 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
490 			 const struct drm_framebuffer_funcs *funcs)
491 {
492 	int ret;
493 
494 	mutex_lock(&dev->mode_config.fb_lock);
495 	kref_init(&fb->refcount);
496 	INIT_LIST_HEAD(&fb->filp_head);
497 	fb->dev = dev;
498 	fb->funcs = funcs;
499 
500 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
501 	if (ret)
502 		goto out;
503 
504 	/* Grab the idr reference. */
505 	drm_framebuffer_reference(fb);
506 
507 	dev->mode_config.num_fb++;
508 	list_add(&fb->head, &dev->mode_config.fb_list);
509 out:
510 	mutex_unlock(&dev->mode_config.fb_lock);
511 
512 	return 0;
513 }
514 EXPORT_SYMBOL(drm_framebuffer_init);
515 
516 static void drm_framebuffer_free(struct kref *kref)
517 {
518 	struct drm_framebuffer *fb =
519 			container_of(kref, struct drm_framebuffer, refcount);
520 	fb->funcs->destroy(fb);
521 }
522 
523 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
524 							uint32_t id)
525 {
526 	struct drm_mode_object *obj = NULL;
527 	struct drm_framebuffer *fb;
528 
529 	mutex_lock(&dev->mode_config.idr_mutex);
530 	obj = idr_find(&dev->mode_config.crtc_idr, id);
531 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
532 		fb = NULL;
533 	else
534 		fb = obj_to_fb(obj);
535 	mutex_unlock(&dev->mode_config.idr_mutex);
536 
537 	return fb;
538 }
539 
540 /**
541  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
542  * @dev: drm device
543  * @id: id of the fb object
544  *
545  * If successful, this grabs an additional reference to the framebuffer -
546  * callers need to make sure to eventually unreference the returned framebuffer
547  * again, using @drm_framebuffer_unreference.
548  */
549 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
550 					       uint32_t id)
551 {
552 	struct drm_framebuffer *fb;
553 
554 	mutex_lock(&dev->mode_config.fb_lock);
555 	fb = __drm_framebuffer_lookup(dev, id);
556 	if (fb)
557 		drm_framebuffer_reference(fb);
558 	mutex_unlock(&dev->mode_config.fb_lock);
559 
560 	return fb;
561 }
562 EXPORT_SYMBOL(drm_framebuffer_lookup);
563 
564 /**
565  * drm_framebuffer_unreference - unref a framebuffer
566  * @fb: framebuffer to unref
567  *
568  * This functions decrements the fb's refcount and frees it if it drops to zero.
569  */
570 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
571 {
572 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
573 	kref_put(&fb->refcount, drm_framebuffer_free);
574 }
575 EXPORT_SYMBOL(drm_framebuffer_unreference);
576 
577 /**
578  * drm_framebuffer_reference - incr the fb refcnt
579  * @fb: framebuffer
580  *
581  * This functions increments the fb's refcount.
582  */
583 void drm_framebuffer_reference(struct drm_framebuffer *fb)
584 {
585 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
586 	kref_get(&fb->refcount);
587 }
588 EXPORT_SYMBOL(drm_framebuffer_reference);
589 
590 static void drm_framebuffer_free_bug(struct kref *kref)
591 {
592 	BUG();
593 }
594 
595 static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
596 {
597 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
598 	kref_put(&fb->refcount, drm_framebuffer_free_bug);
599 }
600 
601 /* dev->mode_config.fb_lock must be held! */
602 static void __drm_framebuffer_unregister(struct drm_device *dev,
603 					 struct drm_framebuffer *fb)
604 {
605 	mutex_lock(&dev->mode_config.idr_mutex);
606 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
607 	mutex_unlock(&dev->mode_config.idr_mutex);
608 
609 	fb->base.id = 0;
610 
611 	__drm_framebuffer_unreference(fb);
612 }
613 
614 /**
615  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
616  * @fb: fb to unregister
617  *
618  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
619  * those used for fbdev. Note that the caller must hold a reference of it's own,
620  * i.e. the object may not be destroyed through this call (since it'll lead to a
621  * locking inversion).
622  */
623 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
624 {
625 	struct drm_device *dev = fb->dev;
626 
627 	mutex_lock(&dev->mode_config.fb_lock);
628 	/* Mark fb as reaped and drop idr ref. */
629 	__drm_framebuffer_unregister(dev, fb);
630 	mutex_unlock(&dev->mode_config.fb_lock);
631 }
632 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
633 
634 /**
635  * drm_framebuffer_cleanup - remove a framebuffer object
636  * @fb: framebuffer to remove
637  *
638  * Cleanup framebuffer. This function is intended to be used from the drivers
639  * ->destroy callback. It can also be used to clean up driver private
640  *  framebuffers embedded into a larger structure.
641  *
642  * Note that this function does not remove the fb from active usuage - if it is
643  * still used anywhere, hilarity can ensue since userspace could call getfb on
644  * the id and get back -EINVAL. Obviously no concern at driver unload time.
645  *
646  * Also, the framebuffer will not be removed from the lookup idr - for
647  * user-created framebuffers this will happen in in the rmfb ioctl. For
648  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
649  * drm_framebuffer_unregister_private.
650  */
651 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
652 {
653 	struct drm_device *dev = fb->dev;
654 
655 	mutex_lock(&dev->mode_config.fb_lock);
656 	list_del(&fb->head);
657 	dev->mode_config.num_fb--;
658 	mutex_unlock(&dev->mode_config.fb_lock);
659 }
660 EXPORT_SYMBOL(drm_framebuffer_cleanup);
661 
662 /**
663  * drm_framebuffer_remove - remove and unreference a framebuffer object
664  * @fb: framebuffer to remove
665  *
666  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
667  * using @fb, removes it, setting it to NULL. Then drops the reference to the
668  * passed-in framebuffer. Might take the modeset locks.
669  *
670  * Note that this function optimizes the cleanup away if the caller holds the
671  * last reference to the framebuffer. It is also guaranteed to not take the
672  * modeset locks in this case.
673  */
674 void drm_framebuffer_remove(struct drm_framebuffer *fb)
675 {
676 	struct drm_device *dev = fb->dev;
677 	struct drm_crtc *crtc;
678 	struct drm_plane *plane;
679 	struct drm_mode_set set;
680 	int ret;
681 
682 	WARN_ON(!list_empty(&fb->filp_head));
683 
684 	/*
685 	 * drm ABI mandates that we remove any deleted framebuffers from active
686 	 * useage. But since most sane clients only remove framebuffers they no
687 	 * longer need, try to optimize this away.
688 	 *
689 	 * Since we're holding a reference ourselves, observing a refcount of 1
690 	 * means that we're the last holder and can skip it. Also, the refcount
691 	 * can never increase from 1 again, so we don't need any barriers or
692 	 * locks.
693 	 *
694 	 * Note that userspace could try to race with use and instate a new
695 	 * usage _after_ we've cleared all current ones. End result will be an
696 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
697 	 * in this manner.
698 	 */
699 	if (atomic_read(&fb->refcount.refcount) > 1) {
700 		drm_modeset_lock_all(dev);
701 		/* remove from any CRTC */
702 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
703 			if (crtc->primary->fb == fb) {
704 				/* should turn off the crtc */
705 				memset(&set, 0, sizeof(struct drm_mode_set));
706 				set.crtc = crtc;
707 				set.fb = NULL;
708 				ret = drm_mode_set_config_internal(&set);
709 				if (ret)
710 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
711 			}
712 		}
713 
714 		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
715 			if (plane->fb == fb)
716 				drm_plane_force_disable(plane);
717 		}
718 		drm_modeset_unlock_all(dev);
719 	}
720 
721 	drm_framebuffer_unreference(fb);
722 }
723 EXPORT_SYMBOL(drm_framebuffer_remove);
724 
725 DEFINE_WW_CLASS(crtc_ww_class);
726 
727 /**
728  * drm_crtc_init_with_planes - Initialise a new CRTC object with
729  *    specified primary and cursor planes.
730  * @dev: DRM device
731  * @crtc: CRTC object to init
732  * @primary: Primary plane for CRTC
733  * @cursor: Cursor plane for CRTC
734  * @funcs: callbacks for the new CRTC
735  *
736  * Inits a new object created as base part of a driver crtc object.
737  *
738  * Returns:
739  * Zero on success, error code on failure.
740  */
741 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
742 			      struct drm_plane *primary,
743 			      struct drm_plane *cursor,
744 			      const struct drm_crtc_funcs *funcs)
745 {
746 	struct drm_mode_config *config = &dev->mode_config;
747 	int ret;
748 
749 	crtc->dev = dev;
750 	crtc->funcs = funcs;
751 	crtc->invert_dimensions = false;
752 
753 	drm_modeset_lock_all(dev);
754 	drm_modeset_lock_init(&crtc->mutex);
755 	/* dropped by _unlock_all(): */
756 	drm_modeset_lock(&crtc->mutex, config->acquire_ctx);
757 
758 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
759 	if (ret)
760 		goto out;
761 
762 	crtc->base.properties = &crtc->properties;
763 
764 	list_add_tail(&crtc->head, &config->crtc_list);
765 	config->num_crtc++;
766 
767 	crtc->primary = primary;
768 	crtc->cursor = cursor;
769 	if (primary)
770 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
771 	if (cursor)
772 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
773 
774  out:
775 	drm_modeset_unlock_all(dev);
776 
777 	return ret;
778 }
779 EXPORT_SYMBOL(drm_crtc_init_with_planes);
780 
781 /**
782  * drm_crtc_cleanup - Clean up the core crtc usage
783  * @crtc: CRTC to cleanup
784  *
785  * This function cleans up @crtc and removes it from the DRM mode setting
786  * core. Note that the function does *not* free the crtc structure itself,
787  * this is the responsibility of the caller.
788  */
789 void drm_crtc_cleanup(struct drm_crtc *crtc)
790 {
791 	struct drm_device *dev = crtc->dev;
792 
793 	kfree(crtc->gamma_store);
794 	crtc->gamma_store = NULL;
795 
796 	drm_modeset_lock_fini(&crtc->mutex);
797 
798 	drm_mode_object_put(dev, &crtc->base);
799 	list_del(&crtc->head);
800 	dev->mode_config.num_crtc--;
801 }
802 EXPORT_SYMBOL(drm_crtc_cleanup);
803 
804 /**
805  * drm_crtc_index - find the index of a registered CRTC
806  * @crtc: CRTC to find index for
807  *
808  * Given a registered CRTC, return the index of that CRTC within a DRM
809  * device's list of CRTCs.
810  */
811 unsigned int drm_crtc_index(struct drm_crtc *crtc)
812 {
813 	unsigned int index = 0;
814 	struct drm_crtc *tmp;
815 
816 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
817 		if (tmp == crtc)
818 			return index;
819 
820 		index++;
821 	}
822 
823 	BUG();
824 }
825 EXPORT_SYMBOL(drm_crtc_index);
826 
827 /*
828  * drm_mode_remove - remove and free a mode
829  * @connector: connector list to modify
830  * @mode: mode to remove
831  *
832  * Remove @mode from @connector's mode list, then free it.
833  */
834 static void drm_mode_remove(struct drm_connector *connector,
835 			    struct drm_display_mode *mode)
836 {
837 	list_del(&mode->head);
838 	drm_mode_destroy(connector->dev, mode);
839 }
840 
841 /**
842  * drm_connector_init - Init a preallocated connector
843  * @dev: DRM device
844  * @connector: the connector to init
845  * @funcs: callbacks for this connector
846  * @connector_type: user visible type of the connector
847  *
848  * Initialises a preallocated connector. Connectors should be
849  * subclassed as part of driver connector objects.
850  *
851  * Returns:
852  * Zero on success, error code on failure.
853  */
854 int drm_connector_init(struct drm_device *dev,
855 		       struct drm_connector *connector,
856 		       const struct drm_connector_funcs *funcs,
857 		       int connector_type)
858 {
859 	int ret;
860 
861 	drm_modeset_lock_all(dev);
862 
863 	ret = drm_mode_object_get(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR);
864 	if (ret)
865 		goto out_unlock;
866 
867 	connector->base.properties = &connector->properties;
868 	connector->dev = dev;
869 	connector->funcs = funcs;
870 	connector->connector_type = connector_type;
871 	connector->connector_type_id =
872 		++drm_connector_enum_list[connector_type].count; /* TODO */
873 	if (connector->connector_type_id < 0) {
874 		ret = connector->connector_type_id;
875 		goto out_put;
876 	}
877 	connector->name =
878 		drm_asprintf(GFP_KERNEL, "%s-%d",
879 			  drm_connector_enum_list[connector_type].name,
880 			  connector->connector_type_id);
881 	if (!connector->name) {
882 		ret = -ENOMEM;
883 		goto out_put;
884 	}
885 
886 	INIT_LIST_HEAD(&connector->probed_modes);
887 	INIT_LIST_HEAD(&connector->modes);
888 	connector->edid_blob_ptr = NULL;
889 	connector->status = connector_status_unknown;
890 
891 	list_add_tail(&connector->head, &dev->mode_config.connector_list);
892 	dev->mode_config.num_connector++;
893 
894 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
895 		drm_object_attach_property(&connector->base,
896 					      dev->mode_config.edid_property,
897 					      0);
898 
899 	drm_object_attach_property(&connector->base,
900 				      dev->mode_config.dpms_property, 0);
901 
902 	connector->debugfs_entry = NULL;
903 
904 out_put:
905 	if (ret)
906 		drm_mode_object_put(dev, &connector->base);
907 
908 out_unlock:
909 	drm_modeset_unlock_all(dev);
910 
911 	return ret;
912 }
913 EXPORT_SYMBOL(drm_connector_init);
914 
915 /**
916  * drm_connector_cleanup - cleans up an initialised connector
917  * @connector: connector to cleanup
918  *
919  * Cleans up the connector but doesn't free the object.
920  */
921 void drm_connector_cleanup(struct drm_connector *connector)
922 {
923 	struct drm_device *dev = connector->dev;
924 	struct drm_display_mode *mode, *t;
925 
926 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
927 		drm_mode_remove(connector, mode);
928 
929 	list_for_each_entry_safe(mode, t, &connector->modes, head)
930 		drm_mode_remove(connector, mode);
931 
932 	drm_mode_object_put(dev, &connector->base);
933 	kfree(connector->name);
934 	connector->name = NULL;
935 	list_del(&connector->head);
936 	dev->mode_config.num_connector--;
937 }
938 EXPORT_SYMBOL(drm_connector_cleanup);
939 
940 /**
941  * drm_connector_register - register a connector
942  * @connector: the connector to register
943  *
944  * Register userspace interfaces for a connector
945  *
946  * Returns:
947  * Zero on success, error code on failure.
948  */
949 int drm_connector_register(struct drm_connector *connector)
950 {
951 	int ret;
952 
953 	ret = drm_sysfs_connector_add(connector);
954 	if (ret)
955 		return ret;
956 
957 #if 0
958 	ret = drm_debugfs_connector_add(connector);
959 #endif
960 	if (ret) {
961 		drm_sysfs_connector_remove(connector);
962 		return ret;
963 	}
964 
965 	return 0;
966 }
967 EXPORT_SYMBOL(drm_connector_register);
968 
969 /**
970  * drm_connector_unregister - unregister a connector
971  * @connector: the connector to unregister
972  *
973  * Unregister userspace interfaces for a connector
974  */
975 void drm_connector_unregister(struct drm_connector *connector)
976 {
977 	drm_sysfs_connector_remove(connector);
978 #if 0
979 	drm_debugfs_connector_remove(connector);
980 #endif
981 }
982 EXPORT_SYMBOL(drm_connector_unregister);
983 
984 
985 /**
986  * drm_connector_unplug_all - unregister connector userspace interfaces
987  * @dev: drm device
988  *
989  * This function unregisters all connector userspace interfaces in sysfs. Should
990  * be call when the device is disconnected, e.g. from an usb driver's
991  * ->disconnect callback.
992  */
993 void drm_connector_unplug_all(struct drm_device *dev)
994 {
995 	struct drm_connector *connector;
996 
997 	/* taking the mode config mutex ends up in a clash with sysfs */
998 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
999 		drm_connector_unregister(connector);
1000 
1001 }
1002 EXPORT_SYMBOL(drm_connector_unplug_all);
1003 
1004 /**
1005  * drm_bridge_init - initialize a drm transcoder/bridge
1006  * @dev: drm device
1007  * @bridge: transcoder/bridge to set up
1008  * @funcs: bridge function table
1009  *
1010  * Initialises a preallocated bridge. Bridges should be
1011  * subclassed as part of driver connector objects.
1012  *
1013  * Returns:
1014  * Zero on success, error code on failure.
1015  */
1016 int drm_bridge_init(struct drm_device *dev, struct drm_bridge *bridge,
1017 		const struct drm_bridge_funcs *funcs)
1018 {
1019 	int ret;
1020 
1021 	drm_modeset_lock_all(dev);
1022 
1023 	ret = drm_mode_object_get(dev, &bridge->base, DRM_MODE_OBJECT_BRIDGE);
1024 	if (ret)
1025 		goto out;
1026 
1027 	bridge->dev = dev;
1028 	bridge->funcs = funcs;
1029 
1030 	list_add_tail(&bridge->head, &dev->mode_config.bridge_list);
1031 	dev->mode_config.num_bridge++;
1032 
1033  out:
1034 	drm_modeset_unlock_all(dev);
1035 	return ret;
1036 }
1037 EXPORT_SYMBOL(drm_bridge_init);
1038 
1039 /**
1040  * drm_bridge_cleanup - cleans up an initialised bridge
1041  * @bridge: bridge to cleanup
1042  *
1043  * Cleans up the bridge but doesn't free the object.
1044  */
1045 void drm_bridge_cleanup(struct drm_bridge *bridge)
1046 {
1047 	struct drm_device *dev = bridge->dev;
1048 
1049 	drm_modeset_lock_all(dev);
1050 	drm_mode_object_put(dev, &bridge->base);
1051 	list_del(&bridge->head);
1052 	dev->mode_config.num_bridge--;
1053 	drm_modeset_unlock_all(dev);
1054 }
1055 EXPORT_SYMBOL(drm_bridge_cleanup);
1056 
1057 /**
1058  * drm_encoder_init - Init a preallocated encoder
1059  * @dev: drm device
1060  * @encoder: the encoder to init
1061  * @funcs: callbacks for this encoder
1062  * @encoder_type: user visible type of the encoder
1063  *
1064  * Initialises a preallocated encoder. Encoder should be
1065  * subclassed as part of driver encoder objects.
1066  *
1067  * Returns:
1068  * Zero on success, error code on failure.
1069  */
1070 int drm_encoder_init(struct drm_device *dev,
1071 		      struct drm_encoder *encoder,
1072 		      const struct drm_encoder_funcs *funcs,
1073 		      int encoder_type)
1074 {
1075 	int ret;
1076 
1077 	drm_modeset_lock_all(dev);
1078 
1079 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1080 	if (ret)
1081 		goto out_unlock;
1082 
1083 	encoder->dev = dev;
1084 	encoder->encoder_type = encoder_type;
1085 	encoder->funcs = funcs;
1086 	encoder->name = drm_asprintf(GFP_KERNEL, "%s-%d",
1087 				  drm_encoder_enum_list[encoder_type].name,
1088 				  encoder->base.id);
1089 	if (!encoder->name) {
1090 		ret = -ENOMEM;
1091 		goto out_put;
1092 	}
1093 
1094 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1095 	dev->mode_config.num_encoder++;
1096 
1097 out_put:
1098 	if (ret)
1099 		drm_mode_object_put(dev, &encoder->base);
1100 
1101 out_unlock:
1102 	drm_modeset_unlock_all(dev);
1103 
1104 	return ret;
1105 }
1106 EXPORT_SYMBOL(drm_encoder_init);
1107 
1108 /**
1109  * drm_encoder_cleanup - cleans up an initialised encoder
1110  * @encoder: encoder to cleanup
1111  *
1112  * Cleans up the encoder but doesn't free the object.
1113  */
1114 void drm_encoder_cleanup(struct drm_encoder *encoder)
1115 {
1116 	struct drm_device *dev = encoder->dev;
1117 	drm_modeset_lock_all(dev);
1118 	drm_mode_object_put(dev, &encoder->base);
1119 	kfree(encoder->name);
1120 	encoder->name = NULL;
1121 	list_del(&encoder->head);
1122 	dev->mode_config.num_encoder--;
1123 	drm_modeset_unlock_all(dev);
1124 }
1125 EXPORT_SYMBOL(drm_encoder_cleanup);
1126 
1127 /**
1128  * drm_universal_plane_init - Initialize a new universal plane object
1129  * @dev: DRM device
1130  * @plane: plane object to init
1131  * @possible_crtcs: bitmask of possible CRTCs
1132  * @funcs: callbacks for the new plane
1133  * @formats: array of supported formats (%DRM_FORMAT_*)
1134  * @format_count: number of elements in @formats
1135  * @type: type of plane (overlay, primary, cursor)
1136  *
1137  * Initializes a plane object of type @type.
1138  *
1139  * Returns:
1140  * Zero on success, error code on failure.
1141  */
1142 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1143 			     unsigned long possible_crtcs,
1144 			     const struct drm_plane_funcs *funcs,
1145 			     const uint32_t *formats, uint32_t format_count,
1146 			     enum drm_plane_type type)
1147 {
1148 	int ret;
1149 
1150 	drm_modeset_lock_all(dev);
1151 
1152 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1153 	if (ret)
1154 		goto out;
1155 
1156 	plane->base.properties = &plane->properties;
1157 	plane->dev = dev;
1158 	plane->funcs = funcs;
1159 	plane->format_types = kmalloc(sizeof(uint32_t) * format_count,
1160 				      M_DRM, M_WAITOK);
1161 	if (!plane->format_types) {
1162 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1163 		drm_mode_object_put(dev, &plane->base);
1164 		ret = -ENOMEM;
1165 		goto out;
1166 	}
1167 
1168 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1169 	plane->format_count = format_count;
1170 	plane->possible_crtcs = possible_crtcs;
1171 	plane->type = type;
1172 
1173 	list_add_tail(&plane->head, &dev->mode_config.plane_list);
1174 	dev->mode_config.num_total_plane++;
1175 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1176 		dev->mode_config.num_overlay_plane++;
1177 
1178 	drm_object_attach_property(&plane->base,
1179 				   dev->mode_config.plane_type_property,
1180 				   plane->type);
1181 
1182  out:
1183 	drm_modeset_unlock_all(dev);
1184 
1185 	return ret;
1186 }
1187 EXPORT_SYMBOL(drm_universal_plane_init);
1188 
1189 /**
1190  * drm_plane_init - Initialize a legacy plane
1191  * @dev: DRM device
1192  * @plane: plane object to init
1193  * @possible_crtcs: bitmask of possible CRTCs
1194  * @funcs: callbacks for the new plane
1195  * @formats: array of supported formats (%DRM_FORMAT_*)
1196  * @format_count: number of elements in @formats
1197  * @is_primary: plane type (primary vs overlay)
1198  *
1199  * Legacy API to initialize a DRM plane.
1200  *
1201  * New drivers should call drm_universal_plane_init() instead.
1202  *
1203  * Returns:
1204  * Zero on success, error code on failure.
1205  */
1206 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1207 		   unsigned long possible_crtcs,
1208 		   const struct drm_plane_funcs *funcs,
1209 		   const uint32_t *formats, uint32_t format_count,
1210 		   bool is_primary)
1211 {
1212 	enum drm_plane_type type;
1213 
1214 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1215 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1216 					formats, format_count, type);
1217 }
1218 EXPORT_SYMBOL(drm_plane_init);
1219 
1220 /**
1221  * drm_plane_cleanup - Clean up the core plane usage
1222  * @plane: plane to cleanup
1223  *
1224  * This function cleans up @plane and removes it from the DRM mode setting
1225  * core. Note that the function does *not* free the plane structure itself,
1226  * this is the responsibility of the caller.
1227  */
1228 void drm_plane_cleanup(struct drm_plane *plane)
1229 {
1230 	struct drm_device *dev = plane->dev;
1231 
1232 	drm_modeset_lock_all(dev);
1233 	kfree(plane->format_types);
1234 	drm_mode_object_put(dev, &plane->base);
1235 
1236 	BUG_ON(list_empty(&plane->head));
1237 
1238 	list_del(&plane->head);
1239 	dev->mode_config.num_total_plane--;
1240 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1241 		dev->mode_config.num_overlay_plane--;
1242 	drm_modeset_unlock_all(dev);
1243 }
1244 EXPORT_SYMBOL(drm_plane_cleanup);
1245 
1246 /**
1247  * drm_plane_force_disable - Forcibly disable a plane
1248  * @plane: plane to disable
1249  *
1250  * Forces the plane to be disabled.
1251  *
1252  * Used when the plane's current framebuffer is destroyed,
1253  * and when restoring fbdev mode.
1254  */
1255 void drm_plane_force_disable(struct drm_plane *plane)
1256 {
1257 	struct drm_framebuffer *old_fb = plane->fb;
1258 	int ret;
1259 
1260 	if (!old_fb)
1261 		return;
1262 
1263 	ret = plane->funcs->disable_plane(plane);
1264 	if (ret) {
1265 		DRM_ERROR("failed to disable plane with busy fb\n");
1266 		return;
1267 	}
1268 	/* disconnect the plane from the fb and crtc: */
1269 	__drm_framebuffer_unreference(old_fb);
1270 	plane->fb = NULL;
1271 	plane->crtc = NULL;
1272 }
1273 EXPORT_SYMBOL(drm_plane_force_disable);
1274 
1275 static int drm_mode_create_standard_connector_properties(struct drm_device *dev)
1276 {
1277 	struct drm_property *edid;
1278 	struct drm_property *dpms;
1279 	struct drm_property *dev_path;
1280 
1281 	/*
1282 	 * Standard properties (apply to all connectors)
1283 	 */
1284 	edid = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1285 				   DRM_MODE_PROP_IMMUTABLE,
1286 				   "EDID", 0);
1287 	dev->mode_config.edid_property = edid;
1288 
1289 	dpms = drm_property_create_enum(dev, 0,
1290 				   "DPMS", drm_dpms_enum_list,
1291 				   ARRAY_SIZE(drm_dpms_enum_list));
1292 	dev->mode_config.dpms_property = dpms;
1293 
1294 	dev_path = drm_property_create(dev,
1295 				       DRM_MODE_PROP_BLOB |
1296 				       DRM_MODE_PROP_IMMUTABLE,
1297 				       "PATH", 0);
1298 	dev->mode_config.path_property = dev_path;
1299 
1300 	return 0;
1301 }
1302 
1303 static int drm_mode_create_standard_plane_properties(struct drm_device *dev)
1304 {
1305 	struct drm_property *type;
1306 
1307 	/*
1308 	 * Standard properties (apply to all planes)
1309 	 */
1310 	type = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1311 					"type", drm_plane_type_enum_list,
1312 					ARRAY_SIZE(drm_plane_type_enum_list));
1313 	dev->mode_config.plane_type_property = type;
1314 
1315 	return 0;
1316 }
1317 
1318 /**
1319  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1320  * @dev: DRM device
1321  *
1322  * Called by a driver the first time a DVI-I connector is made.
1323  */
1324 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1325 {
1326 	struct drm_property *dvi_i_selector;
1327 	struct drm_property *dvi_i_subconnector;
1328 
1329 	if (dev->mode_config.dvi_i_select_subconnector_property)
1330 		return 0;
1331 
1332 	dvi_i_selector =
1333 		drm_property_create_enum(dev, 0,
1334 				    "select subconnector",
1335 				    drm_dvi_i_select_enum_list,
1336 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1337 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1338 
1339 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1340 				    "subconnector",
1341 				    drm_dvi_i_subconnector_enum_list,
1342 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1343 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1344 
1345 	return 0;
1346 }
1347 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1348 
1349 /**
1350  * drm_create_tv_properties - create TV specific connector properties
1351  * @dev: DRM device
1352  * @num_modes: number of different TV formats (modes) supported
1353  * @modes: array of pointers to strings containing name of each format
1354  *
1355  * Called by a driver's TV initialization routine, this function creates
1356  * the TV specific connector properties for a given device.  Caller is
1357  * responsible for allocating a list of format names and passing them to
1358  * this routine.
1359  */
1360 int drm_mode_create_tv_properties(struct drm_device *dev, int num_modes,
1361 				  char *modes[])
1362 {
1363 	struct drm_property *tv_selector;
1364 	struct drm_property *tv_subconnector;
1365 	int i;
1366 
1367 	if (dev->mode_config.tv_select_subconnector_property)
1368 		return 0;
1369 
1370 	/*
1371 	 * Basic connector properties
1372 	 */
1373 	tv_selector = drm_property_create_enum(dev, 0,
1374 					  "select subconnector",
1375 					  drm_tv_select_enum_list,
1376 					  ARRAY_SIZE(drm_tv_select_enum_list));
1377 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1378 
1379 	tv_subconnector =
1380 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1381 				    "subconnector",
1382 				    drm_tv_subconnector_enum_list,
1383 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1384 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1385 
1386 	/*
1387 	 * Other, TV specific properties: margins & TV modes.
1388 	 */
1389 	dev->mode_config.tv_left_margin_property =
1390 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1391 
1392 	dev->mode_config.tv_right_margin_property =
1393 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1394 
1395 	dev->mode_config.tv_top_margin_property =
1396 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1397 
1398 	dev->mode_config.tv_bottom_margin_property =
1399 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1400 
1401 	dev->mode_config.tv_mode_property =
1402 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1403 				    "mode", num_modes);
1404 	for (i = 0; i < num_modes; i++)
1405 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1406 				      i, modes[i]);
1407 
1408 	dev->mode_config.tv_brightness_property =
1409 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1410 
1411 	dev->mode_config.tv_contrast_property =
1412 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1413 
1414 	dev->mode_config.tv_flicker_reduction_property =
1415 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1416 
1417 	dev->mode_config.tv_overscan_property =
1418 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1419 
1420 	dev->mode_config.tv_saturation_property =
1421 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1422 
1423 	dev->mode_config.tv_hue_property =
1424 		drm_property_create_range(dev, 0, "hue", 0, 100);
1425 
1426 	return 0;
1427 }
1428 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1429 
1430 /**
1431  * drm_mode_create_scaling_mode_property - create scaling mode property
1432  * @dev: DRM device
1433  *
1434  * Called by a driver the first time it's needed, must be attached to desired
1435  * connectors.
1436  */
1437 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1438 {
1439 	struct drm_property *scaling_mode;
1440 
1441 	if (dev->mode_config.scaling_mode_property)
1442 		return 0;
1443 
1444 	scaling_mode =
1445 		drm_property_create_enum(dev, 0, "scaling mode",
1446 				drm_scaling_mode_enum_list,
1447 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1448 
1449 	dev->mode_config.scaling_mode_property = scaling_mode;
1450 
1451 	return 0;
1452 }
1453 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1454 
1455 /**
1456  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1457  * @dev: DRM device
1458  *
1459  * Called by a driver the first time it's needed, must be attached to desired
1460  * connectors.
1461  *
1462  * Returns:
1463  * Zero on success, errno on failure.
1464  */
1465 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1466 {
1467 	if (dev->mode_config.aspect_ratio_property)
1468 		return 0;
1469 
1470 	dev->mode_config.aspect_ratio_property =
1471 		drm_property_create_enum(dev, 0, "aspect ratio",
1472 				drm_aspect_ratio_enum_list,
1473 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1474 
1475 	if (dev->mode_config.aspect_ratio_property == NULL)
1476 		return -ENOMEM;
1477 
1478 	return 0;
1479 }
1480 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1481 
1482 /**
1483  * drm_mode_create_dirty_property - create dirty property
1484  * @dev: DRM device
1485  *
1486  * Called by a driver the first time it's needed, must be attached to desired
1487  * connectors.
1488  */
1489 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1490 {
1491 	struct drm_property *dirty_info;
1492 
1493 	if (dev->mode_config.dirty_info_property)
1494 		return 0;
1495 
1496 	dirty_info =
1497 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1498 				    "dirty",
1499 				    drm_dirty_info_enum_list,
1500 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1501 	dev->mode_config.dirty_info_property = dirty_info;
1502 
1503 	return 0;
1504 }
1505 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1506 
1507 static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
1508 {
1509 	uint32_t total_objects = 0;
1510 
1511 	total_objects += dev->mode_config.num_crtc;
1512 	total_objects += dev->mode_config.num_connector;
1513 	total_objects += dev->mode_config.num_encoder;
1514 	total_objects += dev->mode_config.num_bridge;
1515 
1516 	group->id_list = kzalloc(total_objects * sizeof(uint32_t), GFP_KERNEL);
1517 	if (!group->id_list)
1518 		return -ENOMEM;
1519 
1520 	group->num_crtcs = 0;
1521 	group->num_connectors = 0;
1522 	group->num_encoders = 0;
1523 	group->num_bridges = 0;
1524 	return 0;
1525 }
1526 
1527 void drm_mode_group_destroy(struct drm_mode_group *group)
1528 {
1529 	kfree(group->id_list);
1530 	group->id_list = NULL;
1531 }
1532 
1533 /*
1534  * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
1535  * the drm core's responsibility to set up mode control groups.
1536  */
1537 int drm_mode_group_init_legacy_group(struct drm_device *dev,
1538 				     struct drm_mode_group *group)
1539 {
1540 	struct drm_crtc *crtc;
1541 	struct drm_encoder *encoder;
1542 	struct drm_connector *connector;
1543 	struct drm_bridge *bridge;
1544 	int ret;
1545 
1546 	if ((ret = drm_mode_group_init(dev, group)))
1547 		return ret;
1548 
1549 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
1550 		group->id_list[group->num_crtcs++] = crtc->base.id;
1551 
1552 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
1553 		group->id_list[group->num_crtcs + group->num_encoders++] =
1554 		encoder->base.id;
1555 
1556 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1557 		group->id_list[group->num_crtcs + group->num_encoders +
1558 			       group->num_connectors++] = connector->base.id;
1559 
1560 	list_for_each_entry(bridge, &dev->mode_config.bridge_list, head)
1561 		group->id_list[group->num_crtcs + group->num_encoders +
1562 			       group->num_connectors + group->num_bridges++] =
1563 					bridge->base.id;
1564 
1565 	return 0;
1566 }
1567 EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
1568 
1569 void drm_reinit_primary_mode_group(struct drm_device *dev)
1570 {
1571 	drm_modeset_lock_all(dev);
1572 	drm_mode_group_destroy(&dev->primary->mode_group);
1573 	drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
1574 	drm_modeset_unlock_all(dev);
1575 }
1576 EXPORT_SYMBOL(drm_reinit_primary_mode_group);
1577 
1578 /**
1579  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
1580  * @out: drm_mode_modeinfo struct to return to the user
1581  * @in: drm_display_mode to use
1582  *
1583  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
1584  * the user.
1585  */
1586 static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
1587 				      const struct drm_display_mode *in)
1588 {
1589 	WARN(in->hdisplay > USHRT_MAX || in->hsync_start > USHRT_MAX ||
1590 	     in->hsync_end > USHRT_MAX || in->htotal > USHRT_MAX ||
1591 	     in->hskew > USHRT_MAX || in->vdisplay > USHRT_MAX ||
1592 	     in->vsync_start > USHRT_MAX || in->vsync_end > USHRT_MAX ||
1593 	     in->vtotal > USHRT_MAX || in->vscan > USHRT_MAX,
1594 	     "timing values too large for mode info\n");
1595 
1596 	out->clock = in->clock;
1597 	out->hdisplay = in->hdisplay;
1598 	out->hsync_start = in->hsync_start;
1599 	out->hsync_end = in->hsync_end;
1600 	out->htotal = in->htotal;
1601 	out->hskew = in->hskew;
1602 	out->vdisplay = in->vdisplay;
1603 	out->vsync_start = in->vsync_start;
1604 	out->vsync_end = in->vsync_end;
1605 	out->vtotal = in->vtotal;
1606 	out->vscan = in->vscan;
1607 	out->vrefresh = in->vrefresh;
1608 	out->flags = in->flags;
1609 	out->type = in->type;
1610 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1611 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1612 }
1613 
1614 /**
1615  * drm_crtc_convert_umode - convert a modeinfo into a drm_display_mode
1616  * @out: drm_display_mode to return to the user
1617  * @in: drm_mode_modeinfo to use
1618  *
1619  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
1620  * the caller.
1621  *
1622  * Returns:
1623  * Zero on success, errno on failure.
1624  */
1625 static int drm_crtc_convert_umode(struct drm_display_mode *out,
1626 				  const struct drm_mode_modeinfo *in)
1627 {
1628 	if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
1629 		return -ERANGE;
1630 
1631 	if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
1632 		return -EINVAL;
1633 
1634 	out->clock = in->clock;
1635 	out->hdisplay = in->hdisplay;
1636 	out->hsync_start = in->hsync_start;
1637 	out->hsync_end = in->hsync_end;
1638 	out->htotal = in->htotal;
1639 	out->hskew = in->hskew;
1640 	out->vdisplay = in->vdisplay;
1641 	out->vsync_start = in->vsync_start;
1642 	out->vsync_end = in->vsync_end;
1643 	out->vtotal = in->vtotal;
1644 	out->vscan = in->vscan;
1645 	out->vrefresh = in->vrefresh;
1646 	out->flags = in->flags;
1647 	out->type = in->type;
1648 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1649 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1650 
1651 	return 0;
1652 }
1653 
1654 /**
1655  * drm_mode_getresources - get graphics configuration
1656  * @dev: drm device for the ioctl
1657  * @data: data pointer for the ioctl
1658  * @file_priv: drm file for the ioctl call
1659  *
1660  * Construct a set of configuration description structures and return
1661  * them to the user, including CRTC, connector and framebuffer configuration.
1662  *
1663  * Called by the user via ioctl.
1664  *
1665  * Returns:
1666  * Zero on success, errno on failure.
1667  */
1668 int drm_mode_getresources(struct drm_device *dev, void *data,
1669 			  struct drm_file *file_priv)
1670 {
1671 	struct drm_mode_card_res *card_res = data;
1672 	struct list_head *lh;
1673 	struct drm_framebuffer *fb;
1674 	struct drm_connector *connector;
1675 	struct drm_crtc *crtc;
1676 	struct drm_encoder *encoder;
1677 	int ret = 0;
1678 	int connector_count = 0;
1679 	int crtc_count = 0;
1680 	int fb_count = 0;
1681 	int encoder_count = 0;
1682 	int copied = 0, i;
1683 	uint32_t __user *fb_id;
1684 	uint32_t __user *crtc_id;
1685 	uint32_t __user *connector_id;
1686 	uint32_t __user *encoder_id;
1687 	struct drm_mode_group *mode_group;
1688 
1689 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1690 		return -EINVAL;
1691 
1692 
1693 	mutex_lock(&file_priv->fbs_lock);
1694 	/*
1695 	 * For the non-control nodes we need to limit the list of resources
1696 	 * by IDs in the group list for this node
1697 	 */
1698 	list_for_each(lh, &file_priv->fbs)
1699 		fb_count++;
1700 
1701 	/* handle this in 4 parts */
1702 	/* FBs */
1703 	if (card_res->count_fbs >= fb_count) {
1704 		copied = 0;
1705 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1706 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1707 			if (put_user(fb->base.id, fb_id + copied)) {
1708 				mutex_unlock(&file_priv->fbs_lock);
1709 				return -EFAULT;
1710 			}
1711 			copied++;
1712 		}
1713 	}
1714 	card_res->count_fbs = fb_count;
1715 	mutex_unlock(&file_priv->fbs_lock);
1716 
1717 	drm_modeset_lock_all(dev);
1718 	if (!drm_is_primary_client(file_priv)) {
1719 
1720 		mode_group = NULL;
1721 		list_for_each(lh, &dev->mode_config.crtc_list)
1722 			crtc_count++;
1723 
1724 		list_for_each(lh, &dev->mode_config.connector_list)
1725 			connector_count++;
1726 
1727 		list_for_each(lh, &dev->mode_config.encoder_list)
1728 			encoder_count++;
1729 	} else {
1730 
1731 		crtc_count = mode_group->num_crtcs;
1732 		connector_count = mode_group->num_connectors;
1733 		encoder_count = mode_group->num_encoders;
1734 	}
1735 
1736 	card_res->max_height = dev->mode_config.max_height;
1737 	card_res->min_height = dev->mode_config.min_height;
1738 	card_res->max_width = dev->mode_config.max_width;
1739 	card_res->min_width = dev->mode_config.min_width;
1740 
1741 	/* CRTCs */
1742 	if (card_res->count_crtcs >= crtc_count) {
1743 		copied = 0;
1744 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1745 		if (!mode_group) {
1746 			list_for_each_entry(crtc, &dev->mode_config.crtc_list,
1747 					    head) {
1748 				DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1749 				if (put_user(crtc->base.id, crtc_id + copied)) {
1750 					ret = -EFAULT;
1751 					goto out;
1752 				}
1753 				copied++;
1754 			}
1755 		} else {
1756 			for (i = 0; i < mode_group->num_crtcs; i++) {
1757 				if (put_user(mode_group->id_list[i],
1758 					     crtc_id + copied)) {
1759 					ret = -EFAULT;
1760 					goto out;
1761 				}
1762 				copied++;
1763 			}
1764 		}
1765 	}
1766 	card_res->count_crtcs = crtc_count;
1767 
1768 	/* Encoders */
1769 	if (card_res->count_encoders >= encoder_count) {
1770 		copied = 0;
1771 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1772 		if (!mode_group) {
1773 			list_for_each_entry(encoder,
1774 					    &dev->mode_config.encoder_list,
1775 					    head) {
1776 				DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1777 						encoder->name);
1778 				if (put_user(encoder->base.id, encoder_id +
1779 					     copied)) {
1780 					ret = -EFAULT;
1781 					goto out;
1782 				}
1783 				copied++;
1784 			}
1785 		} else {
1786 			for (i = mode_group->num_crtcs; i < mode_group->num_crtcs + mode_group->num_encoders; i++) {
1787 				if (put_user(mode_group->id_list[i],
1788 					     encoder_id + copied)) {
1789 					ret = -EFAULT;
1790 					goto out;
1791 				}
1792 				copied++;
1793 			}
1794 
1795 		}
1796 	}
1797 	card_res->count_encoders = encoder_count;
1798 
1799 	/* Connectors */
1800 	if (card_res->count_connectors >= connector_count) {
1801 		copied = 0;
1802 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1803 		if (!mode_group) {
1804 			list_for_each_entry(connector,
1805 					    &dev->mode_config.connector_list,
1806 					    head) {
1807 				DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1808 					connector->base.id,
1809 					connector->name);
1810 				if (put_user(connector->base.id,
1811 					     connector_id + copied)) {
1812 					ret = -EFAULT;
1813 					goto out;
1814 				}
1815 				copied++;
1816 			}
1817 		} else {
1818 			int start = mode_group->num_crtcs +
1819 				mode_group->num_encoders;
1820 			for (i = start; i < start + mode_group->num_connectors; i++) {
1821 				if (put_user(mode_group->id_list[i],
1822 					     connector_id + copied)) {
1823 					ret = -EFAULT;
1824 					goto out;
1825 				}
1826 				copied++;
1827 			}
1828 		}
1829 	}
1830 	card_res->count_connectors = connector_count;
1831 
1832 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1833 		  card_res->count_connectors, card_res->count_encoders);
1834 
1835 out:
1836 	drm_modeset_unlock_all(dev);
1837 	return ret;
1838 }
1839 
1840 /**
1841  * drm_mode_getcrtc - get CRTC configuration
1842  * @dev: drm device for the ioctl
1843  * @data: data pointer for the ioctl
1844  * @file_priv: drm file for the ioctl call
1845  *
1846  * Construct a CRTC configuration structure to return to the user.
1847  *
1848  * Called by the user via ioctl.
1849  *
1850  * Returns:
1851  * Zero on success, errno on failure.
1852  */
1853 int drm_mode_getcrtc(struct drm_device *dev,
1854 		     void *data, struct drm_file *file_priv)
1855 {
1856 	struct drm_mode_crtc *crtc_resp = data;
1857 	struct drm_crtc *crtc;
1858 	int ret = 0;
1859 
1860 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1861 		return -EINVAL;
1862 
1863 	drm_modeset_lock_all(dev);
1864 
1865 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1866 	if (!crtc) {
1867 		ret = -ENOENT;
1868 		goto out;
1869 	}
1870 
1871 	crtc_resp->x = crtc->x;
1872 	crtc_resp->y = crtc->y;
1873 	crtc_resp->gamma_size = crtc->gamma_size;
1874 	if (crtc->primary->fb)
1875 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1876 	else
1877 		crtc_resp->fb_id = 0;
1878 
1879 	if (crtc->enabled) {
1880 
1881 		drm_crtc_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1882 		crtc_resp->mode_valid = 1;
1883 
1884 	} else {
1885 		crtc_resp->mode_valid = 0;
1886 	}
1887 
1888 out:
1889 	drm_modeset_unlock_all(dev);
1890 	return ret;
1891 }
1892 
1893 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1894 					 const struct drm_file *file_priv)
1895 {
1896 	/*
1897 	 * If user-space hasn't configured the driver to expose the stereo 3D
1898 	 * modes, don't expose them.
1899 	 */
1900 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1901 		return false;
1902 
1903 	return true;
1904 }
1905 
1906 /**
1907  * drm_mode_getconnector - get connector configuration
1908  * @dev: drm device for the ioctl
1909  * @data: data pointer for the ioctl
1910  * @file_priv: drm file for the ioctl call
1911  *
1912  * Construct a connector configuration structure to return to the user.
1913  *
1914  * Called by the user via ioctl.
1915  *
1916  * Returns:
1917  * Zero on success, errno on failure.
1918  */
1919 int drm_mode_getconnector(struct drm_device *dev, void *data,
1920 			  struct drm_file *file_priv)
1921 {
1922 	struct drm_mode_get_connector *out_resp = data;
1923 	struct drm_connector *connector;
1924 	struct drm_display_mode *mode;
1925 	int mode_count = 0;
1926 	int props_count = 0;
1927 	int encoders_count = 0;
1928 	int ret = 0;
1929 	int copied = 0;
1930 	int i;
1931 	struct drm_mode_modeinfo u_mode;
1932 	struct drm_mode_modeinfo __user *mode_ptr;
1933 	uint32_t __user *prop_ptr;
1934 	uint64_t __user *prop_values;
1935 	uint32_t __user *encoder_ptr;
1936 
1937 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1938 		return -EINVAL;
1939 
1940 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
1941 
1942 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
1943 
1944 	mutex_lock(&dev->mode_config.mutex);
1945 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
1946 
1947 	connector = drm_connector_find(dev, out_resp->connector_id);
1948 	if (!connector) {
1949 		ret = -ENOENT;
1950 		goto out;
1951 	}
1952 
1953 	props_count = connector->properties.count;
1954 
1955 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
1956 		if (connector->encoder_ids[i] != 0) {
1957 			encoders_count++;
1958 		}
1959 	}
1960 
1961 	if (out_resp->count_modes == 0) {
1962 		connector->funcs->fill_modes(connector,
1963 					     dev->mode_config.max_width,
1964 					     dev->mode_config.max_height);
1965 	}
1966 
1967 	/* delayed so we get modes regardless of pre-fill_modes state */
1968 	list_for_each_entry(mode, &connector->modes, head)
1969 		if (drm_mode_expose_to_userspace(mode, file_priv))
1970 			mode_count++;
1971 
1972 	out_resp->connector_id = connector->base.id;
1973 	out_resp->connector_type = connector->connector_type;
1974 	out_resp->connector_type_id = connector->connector_type_id;
1975 	out_resp->mm_width = connector->display_info.width_mm;
1976 	out_resp->mm_height = connector->display_info.height_mm;
1977 	out_resp->subpixel = connector->display_info.subpixel_order;
1978 	out_resp->connection = connector->status;
1979 	if (connector->encoder)
1980 		out_resp->encoder_id = connector->encoder->base.id;
1981 	else
1982 		out_resp->encoder_id = 0;
1983 
1984 	/*
1985 	 * This ioctl is called twice, once to determine how much space is
1986 	 * needed, and the 2nd time to fill it.
1987 	 */
1988 	if ((out_resp->count_modes >= mode_count) && mode_count) {
1989 		copied = 0;
1990 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
1991 		list_for_each_entry(mode, &connector->modes, head) {
1992 			if (!drm_mode_expose_to_userspace(mode, file_priv))
1993 				continue;
1994 
1995 			drm_crtc_convert_to_umode(&u_mode, mode);
1996 			if (copy_to_user(mode_ptr + copied,
1997 					 &u_mode, sizeof(u_mode))) {
1998 				ret = -EFAULT;
1999 				goto out;
2000 			}
2001 			copied++;
2002 		}
2003 	}
2004 	out_resp->count_modes = mode_count;
2005 
2006 	if ((out_resp->count_props >= props_count) && props_count) {
2007 		copied = 0;
2008 		prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
2009 		prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
2010 		for (i = 0; i < connector->properties.count; i++) {
2011 			if (put_user(connector->properties.ids[i],
2012 				     prop_ptr + copied)) {
2013 				ret = -EFAULT;
2014 				goto out;
2015 			}
2016 
2017 			if (put_user(connector->properties.values[i],
2018 				     prop_values + copied)) {
2019 				ret = -EFAULT;
2020 				goto out;
2021 			}
2022 			copied++;
2023 		}
2024 	}
2025 	out_resp->count_props = props_count;
2026 
2027 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2028 		copied = 0;
2029 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2030 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2031 			if (connector->encoder_ids[i] != 0) {
2032 				if (put_user(connector->encoder_ids[i],
2033 					     encoder_ptr + copied)) {
2034 					ret = -EFAULT;
2035 					goto out;
2036 				}
2037 				copied++;
2038 			}
2039 		}
2040 	}
2041 	out_resp->count_encoders = encoders_count;
2042 
2043 out:
2044 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2045 	mutex_unlock(&dev->mode_config.mutex);
2046 
2047 	return ret;
2048 }
2049 
2050 /**
2051  * drm_mode_getencoder - get encoder configuration
2052  * @dev: drm device for the ioctl
2053  * @data: data pointer for the ioctl
2054  * @file_priv: drm file for the ioctl call
2055  *
2056  * Construct a encoder configuration structure to return to the user.
2057  *
2058  * Called by the user via ioctl.
2059  *
2060  * Returns:
2061  * Zero on success, errno on failure.
2062  */
2063 int drm_mode_getencoder(struct drm_device *dev, void *data,
2064 			struct drm_file *file_priv)
2065 {
2066 	struct drm_mode_get_encoder *enc_resp = data;
2067 	struct drm_encoder *encoder;
2068 	int ret = 0;
2069 
2070 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2071 		return -EINVAL;
2072 
2073 	drm_modeset_lock_all(dev);
2074 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2075 	if (!encoder) {
2076 		ret = -ENOENT;
2077 		goto out;
2078 	}
2079 
2080 	if (encoder->crtc)
2081 		enc_resp->crtc_id = encoder->crtc->base.id;
2082 	else
2083 		enc_resp->crtc_id = 0;
2084 	enc_resp->encoder_type = encoder->encoder_type;
2085 	enc_resp->encoder_id = encoder->base.id;
2086 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2087 	enc_resp->possible_clones = encoder->possible_clones;
2088 
2089 out:
2090 	drm_modeset_unlock_all(dev);
2091 	return ret;
2092 }
2093 
2094 /**
2095  * drm_mode_getplane_res - enumerate all plane resources
2096  * @dev: DRM device
2097  * @data: ioctl data
2098  * @file_priv: DRM file info
2099  *
2100  * Construct a list of plane ids to return to the user.
2101  *
2102  * Called by the user via ioctl.
2103  *
2104  * Returns:
2105  * Zero on success, errno on failure.
2106  */
2107 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2108 			  struct drm_file *file_priv)
2109 {
2110 	struct drm_mode_get_plane_res *plane_resp = data;
2111 	struct drm_mode_config *config;
2112 	struct drm_plane *plane;
2113 	uint32_t __user *plane_ptr;
2114 	int copied = 0, ret = 0;
2115 	unsigned num_planes;
2116 
2117 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2118 		return -EINVAL;
2119 
2120 	drm_modeset_lock_all(dev);
2121 	config = &dev->mode_config;
2122 
2123 	if (file_priv->universal_planes)
2124 		num_planes = config->num_total_plane;
2125 	else
2126 		num_planes = config->num_overlay_plane;
2127 
2128 	/*
2129 	 * This ioctl is called twice, once to determine how much space is
2130 	 * needed, and the 2nd time to fill it.
2131 	 */
2132 	if (num_planes &&
2133 	    (plane_resp->count_planes >= num_planes)) {
2134 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2135 
2136 		list_for_each_entry(plane, &config->plane_list, head) {
2137 			/*
2138 			 * Unless userspace set the 'universal planes'
2139 			 * capability bit, only advertise overlays.
2140 			 */
2141 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2142 			    !file_priv->universal_planes)
2143 				continue;
2144 
2145 			if (put_user(plane->base.id, plane_ptr + copied)) {
2146 				ret = -EFAULT;
2147 				goto out;
2148 			}
2149 			copied++;
2150 		}
2151 	}
2152 	plane_resp->count_planes = num_planes;
2153 
2154 out:
2155 	drm_modeset_unlock_all(dev);
2156 	return ret;
2157 }
2158 
2159 /**
2160  * drm_mode_getplane - get plane configuration
2161  * @dev: DRM device
2162  * @data: ioctl data
2163  * @file_priv: DRM file info
2164  *
2165  * Construct a plane configuration structure to return to the user.
2166  *
2167  * Called by the user via ioctl.
2168  *
2169  * Returns:
2170  * Zero on success, errno on failure.
2171  */
2172 int drm_mode_getplane(struct drm_device *dev, void *data,
2173 		      struct drm_file *file_priv)
2174 {
2175 	struct drm_mode_get_plane *plane_resp = data;
2176 	struct drm_plane *plane;
2177 	uint32_t __user *format_ptr;
2178 	int ret = 0;
2179 
2180 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2181 		return -EINVAL;
2182 
2183 	drm_modeset_lock_all(dev);
2184 	plane = drm_plane_find(dev, plane_resp->plane_id);
2185 	if (!plane) {
2186 		ret = -ENOENT;
2187 		goto out;
2188 	}
2189 
2190 	if (plane->crtc)
2191 		plane_resp->crtc_id = plane->crtc->base.id;
2192 	else
2193 		plane_resp->crtc_id = 0;
2194 
2195 	if (plane->fb)
2196 		plane_resp->fb_id = plane->fb->base.id;
2197 	else
2198 		plane_resp->fb_id = 0;
2199 
2200 	plane_resp->plane_id = plane->base.id;
2201 	plane_resp->possible_crtcs = plane->possible_crtcs;
2202 	plane_resp->gamma_size = 0;
2203 
2204 	/*
2205 	 * This ioctl is called twice, once to determine how much space is
2206 	 * needed, and the 2nd time to fill it.
2207 	 */
2208 	if (plane->format_count &&
2209 	    (plane_resp->count_format_types >= plane->format_count)) {
2210 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2211 		if (copy_to_user(format_ptr,
2212 				 plane->format_types,
2213 				 sizeof(uint32_t) * plane->format_count)) {
2214 			ret = -EFAULT;
2215 			goto out;
2216 		}
2217 	}
2218 	plane_resp->count_format_types = plane->format_count;
2219 
2220 out:
2221 	drm_modeset_unlock_all(dev);
2222 	return ret;
2223 }
2224 
2225 /*
2226  * setplane_internal - setplane handler for internal callers
2227  *
2228  * Note that we assume an extra reference has already been taken on fb.  If the
2229  * update fails, this reference will be dropped before return; if it succeeds,
2230  * the previous framebuffer (if any) will be unreferenced instead.
2231  *
2232  * src_{x,y,w,h} are provided in 16.16 fixed point format
2233  */
2234 static int setplane_internal(struct drm_plane *plane,
2235 			     struct drm_crtc *crtc,
2236 			     struct drm_framebuffer *fb,
2237 			     int32_t crtc_x, int32_t crtc_y,
2238 			     uint32_t crtc_w, uint32_t crtc_h,
2239 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2240 			     uint32_t src_x, uint32_t src_y,
2241 			     uint32_t src_w, uint32_t src_h)
2242 {
2243 	struct drm_device *dev = plane->dev;
2244 	struct drm_framebuffer *old_fb = NULL;
2245 	int ret = 0;
2246 	unsigned int fb_width, fb_height;
2247 	int i;
2248 
2249 	/* No fb means shut it down */
2250 	if (!fb) {
2251 		drm_modeset_lock_all(dev);
2252 		old_fb = plane->fb;
2253 		ret = plane->funcs->disable_plane(plane);
2254 		if (!ret) {
2255 			plane->crtc = NULL;
2256 			plane->fb = NULL;
2257 		} else {
2258 			old_fb = NULL;
2259 		}
2260 		drm_modeset_unlock_all(dev);
2261 		goto out;
2262 	}
2263 
2264 	/* Check whether this plane is usable on this CRTC */
2265 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2266 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2267 		ret = -EINVAL;
2268 		goto out;
2269 	}
2270 
2271 	/* Check whether this plane supports the fb pixel format. */
2272 	for (i = 0; i < plane->format_count; i++)
2273 		if (fb->pixel_format == plane->format_types[i])
2274 			break;
2275 	if (i == plane->format_count) {
2276 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2277 			      drm_get_format_name(fb->pixel_format));
2278 		ret = -EINVAL;
2279 		goto out;
2280 	}
2281 
2282 	fb_width = fb->width << 16;
2283 	fb_height = fb->height << 16;
2284 
2285 	/* Make sure source coordinates are inside the fb. */
2286 	if (src_w > fb_width ||
2287 	    src_x > fb_width - src_w ||
2288 	    src_h > fb_height ||
2289 	    src_y > fb_height - src_h) {
2290 		DRM_DEBUG_KMS("Invalid source coordinates "
2291 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2292 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2293 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2294 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2295 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2296 		ret = -ENOSPC;
2297 		goto out;
2298 	}
2299 
2300 	drm_modeset_lock_all(dev);
2301 	old_fb = plane->fb;
2302 	ret = plane->funcs->update_plane(plane, crtc, fb,
2303 					 crtc_x, crtc_y, crtc_w, crtc_h,
2304 					 src_x, src_y, src_w, src_h);
2305 	if (!ret) {
2306 		plane->crtc = crtc;
2307 		plane->fb = fb;
2308 		fb = NULL;
2309 	} else {
2310 		old_fb = NULL;
2311 	}
2312 	drm_modeset_unlock_all(dev);
2313 
2314 out:
2315 	if (fb)
2316 		drm_framebuffer_unreference(fb);
2317 	if (old_fb)
2318 		drm_framebuffer_unreference(old_fb);
2319 
2320 	return ret;
2321 
2322 }
2323 
2324 /**
2325  * drm_mode_setplane - configure a plane's configuration
2326  * @dev: DRM device
2327  * @data: ioctl data*
2328  * @file_priv: DRM file info
2329  *
2330  * Set plane configuration, including placement, fb, scaling, and other factors.
2331  * Or pass a NULL fb to disable (planes may be disabled without providing a
2332  * valid crtc).
2333  *
2334  * Returns:
2335  * Zero on success, errno on failure.
2336  */
2337 int drm_mode_setplane(struct drm_device *dev, void *data,
2338 		      struct drm_file *file_priv)
2339 {
2340 	struct drm_mode_set_plane *plane_req = data;
2341 	struct drm_mode_object *obj;
2342 	struct drm_plane *plane;
2343 	struct drm_crtc *crtc = NULL;
2344 	struct drm_framebuffer *fb = NULL;
2345 
2346 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2347 		return -EINVAL;
2348 
2349 	/* Give drivers some help against integer overflows */
2350 	if (plane_req->crtc_w > INT_MAX ||
2351 	    plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
2352 	    plane_req->crtc_h > INT_MAX ||
2353 	    plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
2354 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2355 			      plane_req->crtc_w, plane_req->crtc_h,
2356 			      plane_req->crtc_x, plane_req->crtc_y);
2357 		return -ERANGE;
2358 	}
2359 
2360 	/*
2361 	 * First, find the plane, crtc, and fb objects.  If not available,
2362 	 * we don't bother to call the driver.
2363 	 */
2364 	obj = drm_mode_object_find(dev, plane_req->plane_id,
2365 				   DRM_MODE_OBJECT_PLANE);
2366 	if (!obj) {
2367 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2368 			      plane_req->plane_id);
2369 		return -ENOENT;
2370 	}
2371 	plane = obj_to_plane(obj);
2372 
2373 	if (plane_req->fb_id) {
2374 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2375 		if (!fb) {
2376 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2377 				      plane_req->fb_id);
2378 			return -ENOENT;
2379 		}
2380 
2381 		obj = drm_mode_object_find(dev, plane_req->crtc_id,
2382 					   DRM_MODE_OBJECT_CRTC);
2383 		if (!obj) {
2384 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2385 				      plane_req->crtc_id);
2386 			return -ENOENT;
2387 		}
2388 		crtc = obj_to_crtc(obj);
2389 	}
2390 
2391 	/*
2392 	 * setplane_internal will take care of deref'ing either the old or new
2393 	 * framebuffer depending on success.
2394 	 */
2395 	return setplane_internal(plane, crtc, fb,
2396 				 plane_req->crtc_x, plane_req->crtc_y,
2397 				 plane_req->crtc_w, plane_req->crtc_h,
2398 				 plane_req->src_x, plane_req->src_y,
2399 				 plane_req->src_w, plane_req->src_h);
2400 }
2401 
2402 /**
2403  * drm_mode_set_config_internal - helper to call ->set_config
2404  * @set: modeset config to set
2405  *
2406  * This is a little helper to wrap internal calls to the ->set_config driver
2407  * interface. The only thing it adds is correct refcounting dance.
2408  *
2409  * Returns:
2410  * Zero on success, errno on failure.
2411  */
2412 int drm_mode_set_config_internal(struct drm_mode_set *set)
2413 {
2414 	struct drm_crtc *crtc = set->crtc;
2415 	struct drm_framebuffer *fb;
2416 	struct drm_crtc *tmp;
2417 	int ret;
2418 
2419 	/*
2420 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2421 	 * connectors from it), hence we need to refcount the fbs across all
2422 	 * crtcs. Atomic modeset will have saner semantics ...
2423 	 */
2424 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head)
2425 		tmp->old_fb = tmp->primary->fb;
2426 
2427 	fb = set->fb;
2428 
2429 	ret = crtc->funcs->set_config(set);
2430 	if (ret == 0) {
2431 		crtc->primary->crtc = crtc;
2432 		crtc->primary->fb = fb;
2433 	}
2434 
2435 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
2436 		if (tmp->primary->fb)
2437 			drm_framebuffer_reference(tmp->primary->fb);
2438 		if (tmp->old_fb)
2439 			drm_framebuffer_unreference(tmp->old_fb);
2440 	}
2441 
2442 	return ret;
2443 }
2444 EXPORT_SYMBOL(drm_mode_set_config_internal);
2445 
2446 /**
2447  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2448  *     CRTC viewport
2449  * @crtc: CRTC that framebuffer will be displayed on
2450  * @x: x panning
2451  * @y: y panning
2452  * @mode: mode that framebuffer will be displayed under
2453  * @fb: framebuffer to check size of
2454  */
2455 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2456 			    int x, int y,
2457 			    const struct drm_display_mode *mode,
2458 			    const struct drm_framebuffer *fb)
2459 
2460 {
2461 	int hdisplay, vdisplay;
2462 
2463 	hdisplay = mode->hdisplay;
2464 	vdisplay = mode->vdisplay;
2465 
2466 	if (drm_mode_is_stereo(mode)) {
2467 		struct drm_display_mode adjusted = *mode;
2468 
2469 		drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE);
2470 		hdisplay = adjusted.crtc_hdisplay;
2471 		vdisplay = adjusted.crtc_vdisplay;
2472 	}
2473 
2474 	if (crtc->invert_dimensions)
2475 		swap(hdisplay, vdisplay);
2476 
2477 	if (hdisplay > fb->width ||
2478 	    vdisplay > fb->height ||
2479 	    x > fb->width - hdisplay ||
2480 	    y > fb->height - vdisplay) {
2481 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2482 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2483 			      crtc->invert_dimensions ? " (inverted)" : "");
2484 		return -ENOSPC;
2485 	}
2486 
2487 	return 0;
2488 }
2489 EXPORT_SYMBOL(drm_crtc_check_viewport);
2490 
2491 /**
2492  * drm_mode_setcrtc - set CRTC configuration
2493  * @dev: drm device for the ioctl
2494  * @data: data pointer for the ioctl
2495  * @file_priv: drm file for the ioctl call
2496  *
2497  * Build a new CRTC configuration based on user request.
2498  *
2499  * Called by the user via ioctl.
2500  *
2501  * Returns:
2502  * Zero on success, errno on failure.
2503  */
2504 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2505 		     struct drm_file *file_priv)
2506 {
2507 	struct drm_mode_config *config = &dev->mode_config;
2508 	struct drm_mode_crtc *crtc_req = data;
2509 	struct drm_crtc *crtc;
2510 	struct drm_connector **connector_set = NULL, *connector;
2511 	struct drm_framebuffer *fb = NULL;
2512 	struct drm_display_mode *mode = NULL;
2513 	struct drm_mode_set set;
2514 	uint32_t __user *set_connectors_ptr;
2515 	int ret;
2516 	int i;
2517 
2518 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2519 		return -EINVAL;
2520 
2521 	/* For some reason crtc x/y offsets are signed internally. */
2522 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
2523 		return -ERANGE;
2524 
2525 	drm_modeset_lock_all(dev);
2526 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2527 	if (!crtc) {
2528 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2529 		ret = -ENOENT;
2530 		goto out;
2531 	}
2532 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2533 
2534 	if (crtc_req->mode_valid) {
2535 		/* If we have a mode we need a framebuffer. */
2536 		/* If we pass -1, set the mode with the currently bound fb */
2537 		if (crtc_req->fb_id == -1) {
2538 			if (!crtc->primary->fb) {
2539 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2540 				ret = -EINVAL;
2541 				goto out;
2542 			}
2543 			fb = crtc->primary->fb;
2544 			/* Make refcounting symmetric with the lookup path. */
2545 			drm_framebuffer_reference(fb);
2546 		} else {
2547 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2548 			if (!fb) {
2549 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2550 						crtc_req->fb_id);
2551 				ret = -ENOENT;
2552 				goto out;
2553 			}
2554 		}
2555 
2556 		mode = drm_mode_create(dev);
2557 		if (!mode) {
2558 			ret = -ENOMEM;
2559 			goto out;
2560 		}
2561 
2562 		ret = drm_crtc_convert_umode(mode, &crtc_req->mode);
2563 		if (ret) {
2564 			DRM_DEBUG_KMS("Invalid mode\n");
2565 			goto out;
2566 		}
2567 
2568 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2569 
2570 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2571 					      mode, fb);
2572 		if (ret)
2573 			goto out;
2574 
2575 	}
2576 
2577 	if (crtc_req->count_connectors == 0 && mode) {
2578 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2579 		ret = -EINVAL;
2580 		goto out;
2581 	}
2582 
2583 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2584 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2585 			  crtc_req->count_connectors);
2586 		ret = -EINVAL;
2587 		goto out;
2588 	}
2589 
2590 	if (crtc_req->count_connectors > 0) {
2591 		u32 out_id;
2592 
2593 		/* Avoid unbounded kernel memory allocation */
2594 		if (crtc_req->count_connectors > config->num_connector) {
2595 			ret = -EINVAL;
2596 			goto out;
2597 		}
2598 
2599 		connector_set = kmalloc(crtc_req->count_connectors *
2600 					sizeof(struct drm_connector *),
2601 					M_DRM, M_WAITOK);
2602 		if (!connector_set) {
2603 			ret = -ENOMEM;
2604 			goto out;
2605 		}
2606 
2607 		for (i = 0; i < crtc_req->count_connectors; i++) {
2608 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2609 			if (get_user(out_id, &set_connectors_ptr[i])) {
2610 				ret = -EFAULT;
2611 				goto out;
2612 			}
2613 
2614 			connector = drm_connector_find(dev, out_id);
2615 			if (!connector) {
2616 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2617 						out_id);
2618 				ret = -ENOENT;
2619 				goto out;
2620 			}
2621 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2622 					connector->base.id,
2623 					connector->name);
2624 
2625 			connector_set[i] = connector;
2626 		}
2627 	}
2628 
2629 	set.crtc = crtc;
2630 	set.x = crtc_req->x;
2631 	set.y = crtc_req->y;
2632 	set.mode = mode;
2633 	set.connectors = connector_set;
2634 	set.num_connectors = crtc_req->count_connectors;
2635 	set.fb = fb;
2636 	ret = drm_mode_set_config_internal(&set);
2637 
2638 out:
2639 	if (fb)
2640 		drm_framebuffer_unreference(fb);
2641 
2642 	kfree(connector_set);
2643 	drm_mode_destroy(dev, mode);
2644 	drm_modeset_unlock_all(dev);
2645 	return ret;
2646 }
2647 
2648 /**
2649  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2650  *     universal plane handler call
2651  * @crtc: crtc to update cursor for
2652  * @req: data pointer for the ioctl
2653  * @file_priv: drm file for the ioctl call
2654  *
2655  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2656  * translate legacy ioctl calls into universal plane handler calls, we need to
2657  * wrap the native buffer handle in a drm_framebuffer.
2658  *
2659  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2660  * buffer with a pitch of 4*width; the universal plane interface should be used
2661  * directly in cases where the hardware can support other buffer settings and
2662  * userspace wants to make use of these capabilities.
2663  *
2664  * Returns:
2665  * Zero on success, errno on failure.
2666  */
2667 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2668 				     struct drm_mode_cursor2 *req,
2669 				     struct drm_file *file_priv)
2670 {
2671 	struct drm_device *dev = crtc->dev;
2672 	struct drm_framebuffer *fb = NULL;
2673 	struct drm_mode_fb_cmd2 fbreq = {
2674 		.width = req->width,
2675 		.height = req->height,
2676 		.pixel_format = DRM_FORMAT_ARGB8888,
2677 		.pitches = { req->width * 4 },
2678 		.handles = { req->handle },
2679 	};
2680 	int32_t crtc_x, crtc_y;
2681 	uint32_t crtc_w = 0, crtc_h = 0;
2682 	uint32_t src_w = 0, src_h = 0;
2683 	int ret = 0;
2684 
2685 	BUG_ON(!crtc->cursor);
2686 
2687 	/*
2688 	 * Obtain fb we'll be using (either new or existing) and take an extra
2689 	 * reference to it if fb != null.  setplane will take care of dropping
2690 	 * the reference if the plane update fails.
2691 	 */
2692 	if (req->flags & DRM_MODE_CURSOR_BO) {
2693 		if (req->handle) {
2694 			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
2695 			if (IS_ERR(fb)) {
2696 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2697 				return PTR_ERR(fb);
2698 			}
2699 
2700 			drm_framebuffer_reference(fb);
2701 		} else {
2702 			fb = NULL;
2703 		}
2704 	} else {
2705 		mutex_lock(&dev->mode_config.mutex);
2706 		fb = crtc->cursor->fb;
2707 		if (fb)
2708 			drm_framebuffer_reference(fb);
2709 		mutex_unlock(&dev->mode_config.mutex);
2710 	}
2711 
2712 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2713 		crtc_x = req->x;
2714 		crtc_y = req->y;
2715 	} else {
2716 		crtc_x = crtc->cursor_x;
2717 		crtc_y = crtc->cursor_y;
2718 	}
2719 
2720 	if (fb) {
2721 		crtc_w = fb->width;
2722 		crtc_h = fb->height;
2723 		src_w = fb->width << 16;
2724 		src_h = fb->height << 16;
2725 	}
2726 
2727 	/*
2728 	 * setplane_internal will take care of deref'ing either the old or new
2729 	 * framebuffer depending on success.
2730 	 */
2731 	ret = setplane_internal(crtc->cursor, crtc, fb,
2732 				crtc_x, crtc_y, crtc_w, crtc_h,
2733 				0, 0, src_w, src_h);
2734 
2735 	/* Update successful; save new cursor position, if necessary */
2736 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2737 		crtc->cursor_x = req->x;
2738 		crtc->cursor_y = req->y;
2739 	}
2740 
2741 	return ret;
2742 }
2743 
2744 static int drm_mode_cursor_common(struct drm_device *dev,
2745 				  struct drm_mode_cursor2 *req,
2746 				  struct drm_file *file_priv)
2747 {
2748 	struct drm_crtc *crtc;
2749 	int ret = 0;
2750 
2751 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2752 		return -EINVAL;
2753 
2754 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2755 		return -EINVAL;
2756 
2757 	crtc = drm_crtc_find(dev, req->crtc_id);
2758 	if (!crtc) {
2759 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2760 		return -ENOENT;
2761 	}
2762 
2763 	/*
2764 	 * If this crtc has a universal cursor plane, call that plane's update
2765 	 * handler rather than using legacy cursor handlers.
2766 	 */
2767 	if (crtc->cursor)
2768 		return drm_mode_cursor_universal(crtc, req, file_priv);
2769 
2770 	drm_modeset_lock(&crtc->mutex, NULL);
2771 	if (req->flags & DRM_MODE_CURSOR_BO) {
2772 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2773 			ret = -ENXIO;
2774 			goto out;
2775 		}
2776 		/* Turns off the cursor if handle is 0 */
2777 		if (crtc->funcs->cursor_set2)
2778 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2779 						      req->width, req->height, req->hot_x, req->hot_y);
2780 		else
2781 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2782 						      req->width, req->height);
2783 	}
2784 
2785 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2786 		if (crtc->funcs->cursor_move) {
2787 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2788 		} else {
2789 			ret = -EFAULT;
2790 			goto out;
2791 		}
2792 	}
2793 out:
2794 	drm_modeset_unlock(&crtc->mutex);
2795 
2796 	return ret;
2797 
2798 }
2799 
2800 
2801 /**
2802  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2803  * @dev: drm device for the ioctl
2804  * @data: data pointer for the ioctl
2805  * @file_priv: drm file for the ioctl call
2806  *
2807  * Set the cursor configuration based on user request.
2808  *
2809  * Called by the user via ioctl.
2810  *
2811  * Returns:
2812  * Zero on success, errno on failure.
2813  */
2814 int drm_mode_cursor_ioctl(struct drm_device *dev,
2815 			  void *data, struct drm_file *file_priv)
2816 {
2817 	struct drm_mode_cursor *req = data;
2818 	struct drm_mode_cursor2 new_req;
2819 
2820 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2821 	new_req.hot_x = new_req.hot_y = 0;
2822 
2823 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2824 }
2825 
2826 /**
2827  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2828  * @dev: drm device for the ioctl
2829  * @data: data pointer for the ioctl
2830  * @file_priv: drm file for the ioctl call
2831  *
2832  * Set the cursor configuration based on user request. This implements the 2nd
2833  * version of the cursor ioctl, which allows userspace to additionally specify
2834  * the hotspot of the pointer.
2835  *
2836  * Called by the user via ioctl.
2837  *
2838  * Returns:
2839  * Zero on success, errno on failure.
2840  */
2841 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2842 			   void *data, struct drm_file *file_priv)
2843 {
2844 	struct drm_mode_cursor2 *req = data;
2845 	return drm_mode_cursor_common(dev, req, file_priv);
2846 }
2847 
2848 /**
2849  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
2850  * @bpp: bits per pixels
2851  * @depth: bit depth per pixel
2852  *
2853  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
2854  * Useful in fbdev emulation code, since that deals in those values.
2855  */
2856 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
2857 {
2858 	uint32_t fmt;
2859 
2860 	switch (bpp) {
2861 	case 8:
2862 		fmt = DRM_FORMAT_C8;
2863 		break;
2864 	case 16:
2865 		if (depth == 15)
2866 			fmt = DRM_FORMAT_XRGB1555;
2867 		else
2868 			fmt = DRM_FORMAT_RGB565;
2869 		break;
2870 	case 24:
2871 		fmt = DRM_FORMAT_RGB888;
2872 		break;
2873 	case 32:
2874 		if (depth == 24)
2875 			fmt = DRM_FORMAT_XRGB8888;
2876 		else if (depth == 30)
2877 			fmt = DRM_FORMAT_XRGB2101010;
2878 		else
2879 			fmt = DRM_FORMAT_ARGB8888;
2880 		break;
2881 	default:
2882 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
2883 		fmt = DRM_FORMAT_XRGB8888;
2884 		break;
2885 	}
2886 
2887 	return fmt;
2888 }
2889 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
2890 
2891 /**
2892  * drm_mode_addfb - add an FB to the graphics configuration
2893  * @dev: drm device for the ioctl
2894  * @data: data pointer for the ioctl
2895  * @file_priv: drm file for the ioctl call
2896  *
2897  * Add a new FB to the specified CRTC, given a user request. This is the
2898  * original addfb ioclt which only supported RGB formats.
2899  *
2900  * Called by the user via ioctl.
2901  *
2902  * Returns:
2903  * Zero on success, errno on failure.
2904  */
2905 int drm_mode_addfb(struct drm_device *dev,
2906 		   void *data, struct drm_file *file_priv)
2907 {
2908 	struct drm_mode_fb_cmd *or = data;
2909 	struct drm_mode_fb_cmd2 r = {};
2910 	struct drm_mode_config *config = &dev->mode_config;
2911 	struct drm_framebuffer *fb;
2912 	int ret = 0;
2913 
2914 	/* Use new struct with format internally */
2915 	r.fb_id = or->fb_id;
2916 	r.width = or->width;
2917 	r.height = or->height;
2918 	r.pitches[0] = or->pitch;
2919 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
2920 	r.handles[0] = or->handle;
2921 
2922 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2923 		return -EINVAL;
2924 
2925 	if ((config->min_width > r.width) || (r.width > config->max_width))
2926 		return -EINVAL;
2927 
2928 	if ((config->min_height > r.height) || (r.height > config->max_height))
2929 		return -EINVAL;
2930 
2931 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, &r);
2932 	if (IS_ERR(fb)) {
2933 		DRM_DEBUG_KMS("could not create framebuffer\n");
2934 		return PTR_ERR(fb);
2935 	}
2936 
2937 	mutex_lock(&file_priv->fbs_lock);
2938 	or->fb_id = fb->base.id;
2939 	list_add(&fb->filp_head, &file_priv->fbs);
2940 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
2941 	mutex_unlock(&file_priv->fbs_lock);
2942 
2943 	return ret;
2944 }
2945 
2946 static int format_check(const struct drm_mode_fb_cmd2 *r)
2947 {
2948 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
2949 
2950 	switch (format) {
2951 	case DRM_FORMAT_C8:
2952 	case DRM_FORMAT_RGB332:
2953 	case DRM_FORMAT_BGR233:
2954 	case DRM_FORMAT_XRGB4444:
2955 	case DRM_FORMAT_XBGR4444:
2956 	case DRM_FORMAT_RGBX4444:
2957 	case DRM_FORMAT_BGRX4444:
2958 	case DRM_FORMAT_ARGB4444:
2959 	case DRM_FORMAT_ABGR4444:
2960 	case DRM_FORMAT_RGBA4444:
2961 	case DRM_FORMAT_BGRA4444:
2962 	case DRM_FORMAT_XRGB1555:
2963 	case DRM_FORMAT_XBGR1555:
2964 	case DRM_FORMAT_RGBX5551:
2965 	case DRM_FORMAT_BGRX5551:
2966 	case DRM_FORMAT_ARGB1555:
2967 	case DRM_FORMAT_ABGR1555:
2968 	case DRM_FORMAT_RGBA5551:
2969 	case DRM_FORMAT_BGRA5551:
2970 	case DRM_FORMAT_RGB565:
2971 	case DRM_FORMAT_BGR565:
2972 	case DRM_FORMAT_RGB888:
2973 	case DRM_FORMAT_BGR888:
2974 	case DRM_FORMAT_XRGB8888:
2975 	case DRM_FORMAT_XBGR8888:
2976 	case DRM_FORMAT_RGBX8888:
2977 	case DRM_FORMAT_BGRX8888:
2978 	case DRM_FORMAT_ARGB8888:
2979 	case DRM_FORMAT_ABGR8888:
2980 	case DRM_FORMAT_RGBA8888:
2981 	case DRM_FORMAT_BGRA8888:
2982 	case DRM_FORMAT_XRGB2101010:
2983 	case DRM_FORMAT_XBGR2101010:
2984 	case DRM_FORMAT_RGBX1010102:
2985 	case DRM_FORMAT_BGRX1010102:
2986 	case DRM_FORMAT_ARGB2101010:
2987 	case DRM_FORMAT_ABGR2101010:
2988 	case DRM_FORMAT_RGBA1010102:
2989 	case DRM_FORMAT_BGRA1010102:
2990 	case DRM_FORMAT_YUYV:
2991 	case DRM_FORMAT_YVYU:
2992 	case DRM_FORMAT_UYVY:
2993 	case DRM_FORMAT_VYUY:
2994 	case DRM_FORMAT_AYUV:
2995 	case DRM_FORMAT_NV12:
2996 	case DRM_FORMAT_NV21:
2997 	case DRM_FORMAT_NV16:
2998 	case DRM_FORMAT_NV61:
2999 	case DRM_FORMAT_NV24:
3000 	case DRM_FORMAT_NV42:
3001 	case DRM_FORMAT_YUV410:
3002 	case DRM_FORMAT_YVU410:
3003 	case DRM_FORMAT_YUV411:
3004 	case DRM_FORMAT_YVU411:
3005 	case DRM_FORMAT_YUV420:
3006 	case DRM_FORMAT_YVU420:
3007 	case DRM_FORMAT_YUV422:
3008 	case DRM_FORMAT_YVU422:
3009 	case DRM_FORMAT_YUV444:
3010 	case DRM_FORMAT_YVU444:
3011 		return 0;
3012 	default:
3013 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3014 			      drm_get_format_name(r->pixel_format));
3015 		return -EINVAL;
3016 	}
3017 }
3018 
3019 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3020 {
3021 	int ret, hsub, vsub, num_planes, i;
3022 
3023 	ret = format_check(r);
3024 	if (ret) {
3025 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3026 			      drm_get_format_name(r->pixel_format));
3027 		return ret;
3028 	}
3029 
3030 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3031 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3032 	num_planes = drm_format_num_planes(r->pixel_format);
3033 
3034 	if (r->width == 0 || r->width % hsub) {
3035 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->height);
3036 		return -EINVAL;
3037 	}
3038 
3039 	if (r->height == 0 || r->height % vsub) {
3040 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3041 		return -EINVAL;
3042 	}
3043 
3044 	for (i = 0; i < num_planes; i++) {
3045 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3046 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3047 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3048 
3049 		if (!r->handles[i]) {
3050 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3051 			return -EINVAL;
3052 		}
3053 
3054 		if ((uint64_t) width * cpp > UINT_MAX)
3055 			return -ERANGE;
3056 
3057 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3058 			return -ERANGE;
3059 
3060 		if (r->pitches[i] < width * cpp) {
3061 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3062 			return -EINVAL;
3063 		}
3064 	}
3065 
3066 	return 0;
3067 }
3068 
3069 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
3070 							struct drm_mode_fb_cmd2 *r,
3071 							struct drm_file *file_priv)
3072 {
3073 	struct drm_mode_config *config = &dev->mode_config;
3074 	struct drm_framebuffer *fb;
3075 	int ret;
3076 
3077 	if (r->flags & ~DRM_MODE_FB_INTERLACED) {
3078 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3079 		return ERR_PTR(-EINVAL);
3080 	}
3081 
3082 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3083 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3084 			  r->width, config->min_width, config->max_width);
3085 		return ERR_PTR(-EINVAL);
3086 	}
3087 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3088 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3089 			  r->height, config->min_height, config->max_height);
3090 		return ERR_PTR(-EINVAL);
3091 	}
3092 
3093 	ret = framebuffer_check(r);
3094 	if (ret)
3095 		return ERR_PTR(ret);
3096 
3097 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3098 	if (IS_ERR(fb)) {
3099 		DRM_DEBUG_KMS("could not create framebuffer\n");
3100 		return fb;
3101 	}
3102 
3103 	mutex_lock(&file_priv->fbs_lock);
3104 	r->fb_id = fb->base.id;
3105 	list_add(&fb->filp_head, &file_priv->fbs);
3106 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3107 	mutex_unlock(&file_priv->fbs_lock);
3108 
3109 	return fb;
3110 }
3111 
3112 /**
3113  * drm_mode_addfb2 - add an FB to the graphics configuration
3114  * @dev: drm device for the ioctl
3115  * @data: data pointer for the ioctl
3116  * @file_priv: drm file for the ioctl call
3117  *
3118  * Add a new FB to the specified CRTC, given a user request with format. This is
3119  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3120  * and uses fourcc codes as pixel format specifiers.
3121  *
3122  * Called by the user via ioctl.
3123  *
3124  * Returns:
3125  * Zero on success, errno on failure.
3126  */
3127 int drm_mode_addfb2(struct drm_device *dev,
3128 		    void *data, struct drm_file *file_priv)
3129 {
3130 	struct drm_framebuffer *fb;
3131 
3132 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3133 		return -EINVAL;
3134 
3135 	fb = add_framebuffer_internal(dev, data, file_priv);
3136 	if (IS_ERR(fb))
3137 		return PTR_ERR(fb);
3138 
3139 	return 0;
3140 }
3141 
3142 /**
3143  * drm_mode_rmfb - remove an FB from the configuration
3144  * @dev: drm device for the ioctl
3145  * @data: data pointer for the ioctl
3146  * @file_priv: drm file for the ioctl call
3147  *
3148  * Remove the FB specified by the user.
3149  *
3150  * Called by the user via ioctl.
3151  *
3152  * Returns:
3153  * Zero on success, errno on failure.
3154  */
3155 int drm_mode_rmfb(struct drm_device *dev,
3156 		   void *data, struct drm_file *file_priv)
3157 {
3158 	struct drm_framebuffer *fb = NULL;
3159 	struct drm_framebuffer *fbl = NULL;
3160 	uint32_t *id = data;
3161 	int found = 0;
3162 
3163 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3164 		return -EINVAL;
3165 
3166 	mutex_lock(&file_priv->fbs_lock);
3167 	mutex_lock(&dev->mode_config.fb_lock);
3168 	fb = __drm_framebuffer_lookup(dev, *id);
3169 	if (!fb)
3170 		goto fail_lookup;
3171 
3172 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3173 		if (fb == fbl)
3174 			found = 1;
3175 	if (!found)
3176 		goto fail_lookup;
3177 
3178 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3179 	__drm_framebuffer_unregister(dev, fb);
3180 
3181 	list_del_init(&fb->filp_head);
3182 	mutex_unlock(&dev->mode_config.fb_lock);
3183 	mutex_unlock(&file_priv->fbs_lock);
3184 
3185 	drm_framebuffer_remove(fb);
3186 
3187 	return 0;
3188 
3189 fail_lookup:
3190 	mutex_unlock(&dev->mode_config.fb_lock);
3191 	mutex_unlock(&file_priv->fbs_lock);
3192 
3193 	return -ENOENT;
3194 }
3195 
3196 /**
3197  * drm_mode_getfb - get FB info
3198  * @dev: drm device for the ioctl
3199  * @data: data pointer for the ioctl
3200  * @file_priv: drm file for the ioctl call
3201  *
3202  * Lookup the FB given its ID and return info about it.
3203  *
3204  * Called by the user via ioctl.
3205  *
3206  * Returns:
3207  * Zero on success, errno on failure.
3208  */
3209 int drm_mode_getfb(struct drm_device *dev,
3210 		   void *data, struct drm_file *file_priv)
3211 {
3212 	struct drm_mode_fb_cmd *r = data;
3213 	struct drm_framebuffer *fb;
3214 	int ret;
3215 
3216 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3217 		return -EINVAL;
3218 
3219 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3220 	if (!fb)
3221 		return -ENOENT;
3222 
3223 	r->height = fb->height;
3224 	r->width = fb->width;
3225 	r->depth = fb->depth;
3226 	r->bpp = fb->bits_per_pixel;
3227 	r->pitch = fb->pitches[0];
3228 	if (fb->funcs->create_handle) {
3229 		ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
3230 	} else {
3231 		ret = -ENODEV;
3232 	}
3233 
3234 	drm_framebuffer_unreference(fb);
3235 
3236 	return ret;
3237 }
3238 
3239 /**
3240  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3241  * @dev: drm device for the ioctl
3242  * @data: data pointer for the ioctl
3243  * @file_priv: drm file for the ioctl call
3244  *
3245  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3246  * rectangle list. Generic userspace which does frontbuffer rendering must call
3247  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3248  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3249  *
3250  * Modesetting drivers which always update the frontbuffer do not need to
3251  * implement the corresponding ->dirty framebuffer callback.
3252  *
3253  * Called by the user via ioctl.
3254  *
3255  * Returns:
3256  * Zero on success, errno on failure.
3257  */
3258 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3259 			   void *data, struct drm_file *file_priv)
3260 {
3261 	struct drm_clip_rect __user *clips_ptr;
3262 	struct drm_clip_rect *clips = NULL;
3263 	struct drm_mode_fb_dirty_cmd *r = data;
3264 	struct drm_framebuffer *fb;
3265 	unsigned flags;
3266 	int num_clips;
3267 	int ret;
3268 
3269 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3270 		return -EINVAL;
3271 
3272 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3273 	if (!fb)
3274 		return -ENOENT;
3275 
3276 	num_clips = r->num_clips;
3277 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3278 
3279 	if (!num_clips != !clips_ptr) {
3280 		ret = -EINVAL;
3281 		goto out_err1;
3282 	}
3283 
3284 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3285 
3286 	/* If userspace annotates copy, clips must come in pairs */
3287 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3288 		ret = -EINVAL;
3289 		goto out_err1;
3290 	}
3291 
3292 	if (num_clips && clips_ptr) {
3293 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3294 			ret = -EINVAL;
3295 			goto out_err1;
3296 		}
3297 		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
3298 		if (!clips) {
3299 			ret = -ENOMEM;
3300 			goto out_err1;
3301 		}
3302 
3303 		ret = copy_from_user(clips, clips_ptr,
3304 				     num_clips * sizeof(*clips));
3305 		if (ret) {
3306 			ret = -EFAULT;
3307 			goto out_err2;
3308 		}
3309 	}
3310 
3311 	if (fb->funcs->dirty) {
3312 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3313 				       clips, num_clips);
3314 	} else {
3315 		ret = -ENOSYS;
3316 	}
3317 
3318 out_err2:
3319 	kfree(clips);
3320 out_err1:
3321 	drm_framebuffer_unreference(fb);
3322 
3323 	return ret;
3324 }
3325 
3326 
3327 /**
3328  * drm_fb_release - remove and free the FBs on this file
3329  * @priv: drm file for the ioctl
3330  *
3331  * Destroy all the FBs associated with @filp.
3332  *
3333  * Called by the user via ioctl.
3334  *
3335  * Returns:
3336  * Zero on success, errno on failure.
3337  */
3338 void drm_fb_release(struct drm_file *priv)
3339 {
3340 	struct drm_device *dev = priv->dev;
3341 	struct drm_framebuffer *fb, *tfb;
3342 
3343 	mutex_lock(&priv->fbs_lock);
3344 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3345 
3346 		mutex_lock(&dev->mode_config.fb_lock);
3347 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3348 		__drm_framebuffer_unregister(dev, fb);
3349 		mutex_unlock(&dev->mode_config.fb_lock);
3350 
3351 		list_del_init(&fb->filp_head);
3352 
3353 		/* This will also drop the fpriv->fbs reference. */
3354 		drm_framebuffer_remove(fb);
3355 	}
3356 	mutex_unlock(&priv->fbs_lock);
3357 }
3358 
3359 /**
3360  * drm_property_create - create a new property type
3361  * @dev: drm device
3362  * @flags: flags specifying the property type
3363  * @name: name of the property
3364  * @num_values: number of pre-defined values
3365  *
3366  * This creates a new generic drm property which can then be attached to a drm
3367  * object with drm_object_attach_property. The returned property object must be
3368  * freed with drm_property_destroy.
3369  *
3370  * Returns:
3371  * A pointer to the newly created property on success, NULL on failure.
3372  */
3373 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3374 					 const char *name, int num_values)
3375 {
3376 	struct drm_property *property = NULL;
3377 	int ret;
3378 
3379 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3380 	if (!property)
3381 		return NULL;
3382 
3383 	property->dev = dev;
3384 
3385 	if (num_values) {
3386 		property->values = kzalloc(sizeof(uint64_t)*num_values, GFP_KERNEL);
3387 		if (!property->values)
3388 			goto fail;
3389 	}
3390 
3391 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3392 	if (ret)
3393 		goto fail;
3394 
3395 	property->flags = flags;
3396 	property->num_values = num_values;
3397 	INIT_LIST_HEAD(&property->enum_blob_list);
3398 
3399 	if (name) {
3400 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3401 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3402 	}
3403 
3404 	list_add_tail(&property->head, &dev->mode_config.property_list);
3405 
3406 	WARN_ON(!drm_property_type_valid(property));
3407 
3408 	return property;
3409 fail:
3410 	kfree(property->values);
3411 	kfree(property);
3412 	return NULL;
3413 }
3414 EXPORT_SYMBOL(drm_property_create);
3415 
3416 /**
3417  * drm_property_create_enum - create a new enumeration property type
3418  * @dev: drm device
3419  * @flags: flags specifying the property type
3420  * @name: name of the property
3421  * @props: enumeration lists with property values
3422  * @num_values: number of pre-defined values
3423  *
3424  * This creates a new generic drm property which can then be attached to a drm
3425  * object with drm_object_attach_property. The returned property object must be
3426  * freed with drm_property_destroy.
3427  *
3428  * Userspace is only allowed to set one of the predefined values for enumeration
3429  * properties.
3430  *
3431  * Returns:
3432  * A pointer to the newly created property on success, NULL on failure.
3433  */
3434 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3435 					 const char *name,
3436 					 const struct drm_prop_enum_list *props,
3437 					 int num_values)
3438 {
3439 	struct drm_property *property;
3440 	int i, ret;
3441 
3442 	flags |= DRM_MODE_PROP_ENUM;
3443 
3444 	property = drm_property_create(dev, flags, name, num_values);
3445 	if (!property)
3446 		return NULL;
3447 
3448 	for (i = 0; i < num_values; i++) {
3449 		ret = drm_property_add_enum(property, i,
3450 				      props[i].type,
3451 				      props[i].name);
3452 		if (ret) {
3453 			drm_property_destroy(dev, property);
3454 			return NULL;
3455 		}
3456 	}
3457 
3458 	return property;
3459 }
3460 EXPORT_SYMBOL(drm_property_create_enum);
3461 
3462 /**
3463  * drm_property_create_bitmask - create a new bitmask property type
3464  * @dev: drm device
3465  * @flags: flags specifying the property type
3466  * @name: name of the property
3467  * @props: enumeration lists with property bitflags
3468  * @num_values: number of pre-defined values
3469  *
3470  * This creates a new generic drm property which can then be attached to a drm
3471  * object with drm_object_attach_property. The returned property object must be
3472  * freed with drm_property_destroy.
3473  *
3474  * Compared to plain enumeration properties userspace is allowed to set any
3475  * or'ed together combination of the predefined property bitflag values
3476  *
3477  * Returns:
3478  * A pointer to the newly created property on success, NULL on failure.
3479  */
3480 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3481 					 int flags, const char *name,
3482 					 const struct drm_prop_enum_list *props,
3483 					 int num_values)
3484 {
3485 	struct drm_property *property;
3486 	int i, ret;
3487 
3488 	flags |= DRM_MODE_PROP_BITMASK;
3489 
3490 	property = drm_property_create(dev, flags, name, num_values);
3491 	if (!property)
3492 		return NULL;
3493 
3494 	for (i = 0; i < num_values; i++) {
3495 		ret = drm_property_add_enum(property, i,
3496 				      props[i].type,
3497 				      props[i].name);
3498 		if (ret) {
3499 			drm_property_destroy(dev, property);
3500 			return NULL;
3501 		}
3502 	}
3503 
3504 	return property;
3505 }
3506 EXPORT_SYMBOL(drm_property_create_bitmask);
3507 
3508 static struct drm_property *property_create_range(struct drm_device *dev,
3509 					 int flags, const char *name,
3510 					 uint64_t min, uint64_t max)
3511 {
3512 	struct drm_property *property;
3513 
3514 	property = drm_property_create(dev, flags, name, 2);
3515 	if (!property)
3516 		return NULL;
3517 
3518 	property->values[0] = min;
3519 	property->values[1] = max;
3520 
3521 	return property;
3522 }
3523 
3524 /**
3525  * drm_property_create_range - create a new ranged property type
3526  * @dev: drm device
3527  * @flags: flags specifying the property type
3528  * @name: name of the property
3529  * @min: minimum value of the property
3530  * @max: maximum value of the property
3531  *
3532  * This creates a new generic drm property which can then be attached to a drm
3533  * object with drm_object_attach_property. The returned property object must be
3534  * freed with drm_property_destroy.
3535  *
3536  * Userspace is allowed to set any interger value in the (min, max) range
3537  * inclusive.
3538  *
3539  * Returns:
3540  * A pointer to the newly created property on success, NULL on failure.
3541  */
3542 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3543 					 const char *name,
3544 					 uint64_t min, uint64_t max)
3545 {
3546 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3547 			name, min, max);
3548 }
3549 EXPORT_SYMBOL(drm_property_create_range);
3550 
3551 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3552 					 int flags, const char *name,
3553 					 int64_t min, int64_t max)
3554 {
3555 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3556 			name, I642U64(min), I642U64(max));
3557 }
3558 EXPORT_SYMBOL(drm_property_create_signed_range);
3559 
3560 struct drm_property *drm_property_create_object(struct drm_device *dev,
3561 					 int flags, const char *name, uint32_t type)
3562 {
3563 	struct drm_property *property;
3564 
3565 	flags |= DRM_MODE_PROP_OBJECT;
3566 
3567 	property = drm_property_create(dev, flags, name, 1);
3568 	if (!property)
3569 		return NULL;
3570 
3571 	property->values[0] = type;
3572 
3573 	return property;
3574 }
3575 EXPORT_SYMBOL(drm_property_create_object);
3576 
3577 /**
3578  * drm_property_add_enum - add a possible value to an enumeration property
3579  * @property: enumeration property to change
3580  * @index: index of the new enumeration
3581  * @value: value of the new enumeration
3582  * @name: symbolic name of the new enumeration
3583  *
3584  * This functions adds enumerations to a property.
3585  *
3586  * It's use is deprecated, drivers should use one of the more specific helpers
3587  * to directly create the property with all enumerations already attached.
3588  *
3589  * Returns:
3590  * Zero on success, error code on failure.
3591  */
3592 int drm_property_add_enum(struct drm_property *property, int index,
3593 			  uint64_t value, const char *name)
3594 {
3595 	struct drm_property_enum *prop_enum;
3596 
3597 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3598 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3599 		return -EINVAL;
3600 
3601 	/*
3602 	 * Bitmask enum properties have the additional constraint of values
3603 	 * from 0 to 63
3604 	 */
3605 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3606 			(value > 63))
3607 		return -EINVAL;
3608 
3609 	if (!list_empty(&property->enum_blob_list)) {
3610 		list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
3611 			if (prop_enum->value == value) {
3612 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3613 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3614 				return 0;
3615 			}
3616 		}
3617 	}
3618 
3619 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3620 	if (!prop_enum)
3621 		return -ENOMEM;
3622 
3623 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3624 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3625 	prop_enum->value = value;
3626 
3627 	property->values[index] = value;
3628 	list_add_tail(&prop_enum->head, &property->enum_blob_list);
3629 	return 0;
3630 }
3631 EXPORT_SYMBOL(drm_property_add_enum);
3632 
3633 /**
3634  * drm_property_destroy - destroy a drm property
3635  * @dev: drm device
3636  * @property: property to destry
3637  *
3638  * This function frees a property including any attached resources like
3639  * enumeration values.
3640  */
3641 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3642 {
3643 	struct drm_property_enum *prop_enum, *pt;
3644 
3645 	list_for_each_entry_safe(prop_enum, pt, &property->enum_blob_list, head) {
3646 		list_del(&prop_enum->head);
3647 		kfree(prop_enum);
3648 	}
3649 
3650 	if (property->num_values)
3651 		kfree(property->values);
3652 	drm_mode_object_put(dev, &property->base);
3653 	list_del(&property->head);
3654 	kfree(property);
3655 }
3656 EXPORT_SYMBOL(drm_property_destroy);
3657 
3658 /**
3659  * drm_object_attach_property - attach a property to a modeset object
3660  * @obj: drm modeset object
3661  * @property: property to attach
3662  * @init_val: initial value of the property
3663  *
3664  * This attaches the given property to the modeset object with the given initial
3665  * value. Currently this function cannot fail since the properties are stored in
3666  * a statically sized array.
3667  */
3668 void drm_object_attach_property(struct drm_mode_object *obj,
3669 				struct drm_property *property,
3670 				uint64_t init_val)
3671 {
3672 	int count = obj->properties->count;
3673 
3674 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3675 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3676 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3677 			"you see this message on the same object type.\n",
3678 			obj->type);
3679 		return;
3680 	}
3681 
3682 	obj->properties->ids[count] = property->base.id;
3683 	obj->properties->values[count] = init_val;
3684 	obj->properties->count++;
3685 }
3686 EXPORT_SYMBOL(drm_object_attach_property);
3687 
3688 /**
3689  * drm_object_property_set_value - set the value of a property
3690  * @obj: drm mode object to set property value for
3691  * @property: property to set
3692  * @val: value the property should be set to
3693  *
3694  * This functions sets a given property on a given object. This function only
3695  * changes the software state of the property, it does not call into the
3696  * driver's ->set_property callback.
3697  *
3698  * Returns:
3699  * Zero on success, error code on failure.
3700  */
3701 int drm_object_property_set_value(struct drm_mode_object *obj,
3702 				  struct drm_property *property, uint64_t val)
3703 {
3704 	int i;
3705 
3706 	for (i = 0; i < obj->properties->count; i++) {
3707 		if (obj->properties->ids[i] == property->base.id) {
3708 			obj->properties->values[i] = val;
3709 			return 0;
3710 		}
3711 	}
3712 
3713 	return -EINVAL;
3714 }
3715 EXPORT_SYMBOL(drm_object_property_set_value);
3716 
3717 /**
3718  * drm_object_property_get_value - retrieve the value of a property
3719  * @obj: drm mode object to get property value from
3720  * @property: property to retrieve
3721  * @val: storage for the property value
3722  *
3723  * This function retrieves the softare state of the given property for the given
3724  * property. Since there is no driver callback to retrieve the current property
3725  * value this might be out of sync with the hardware, depending upon the driver
3726  * and property.
3727  *
3728  * Returns:
3729  * Zero on success, error code on failure.
3730  */
3731 int drm_object_property_get_value(struct drm_mode_object *obj,
3732 				  struct drm_property *property, uint64_t *val)
3733 {
3734 	int i;
3735 
3736 	for (i = 0; i < obj->properties->count; i++) {
3737 		if (obj->properties->ids[i] == property->base.id) {
3738 			*val = obj->properties->values[i];
3739 			return 0;
3740 		}
3741 	}
3742 
3743 	return -EINVAL;
3744 }
3745 EXPORT_SYMBOL(drm_object_property_get_value);
3746 
3747 /**
3748  * drm_mode_getproperty_ioctl - get the current value of a connector's property
3749  * @dev: DRM device
3750  * @data: ioctl data
3751  * @file_priv: DRM file info
3752  *
3753  * This function retrieves the current value for an connectors's property.
3754  *
3755  * Called by the user via ioctl.
3756  *
3757  * Returns:
3758  * Zero on success, errno on failure.
3759  */
3760 int drm_mode_getproperty_ioctl(struct drm_device *dev,
3761 			       void *data, struct drm_file *file_priv)
3762 {
3763 	struct drm_mode_get_property *out_resp = data;
3764 	struct drm_property *property;
3765 	int enum_count = 0;
3766 	int blob_count = 0;
3767 	int value_count = 0;
3768 	int ret = 0, i;
3769 	int copied;
3770 	struct drm_property_enum *prop_enum;
3771 	struct drm_mode_property_enum __user *enum_ptr;
3772 	struct drm_property_blob *prop_blob;
3773 	uint32_t __user *blob_id_ptr;
3774 	uint64_t __user *values_ptr;
3775 	uint32_t __user *blob_length_ptr;
3776 
3777 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3778 		return -EINVAL;
3779 
3780 	drm_modeset_lock_all(dev);
3781 	property = drm_property_find(dev, out_resp->prop_id);
3782 	if (!property) {
3783 		ret = -ENOENT;
3784 		goto done;
3785 	}
3786 
3787 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3788 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3789 		list_for_each_entry(prop_enum, &property->enum_blob_list, head)
3790 			enum_count++;
3791 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
3792 		list_for_each_entry(prop_blob, &property->enum_blob_list, head)
3793 			blob_count++;
3794 	}
3795 
3796 	value_count = property->num_values;
3797 
3798 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
3799 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
3800 	out_resp->flags = property->flags;
3801 
3802 	if ((out_resp->count_values >= value_count) && value_count) {
3803 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
3804 		for (i = 0; i < value_count; i++) {
3805 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
3806 				ret = -EFAULT;
3807 				goto done;
3808 			}
3809 		}
3810 	}
3811 	out_resp->count_values = value_count;
3812 
3813 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3814 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3815 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
3816 			copied = 0;
3817 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
3818 			list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
3819 
3820 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
3821 					ret = -EFAULT;
3822 					goto done;
3823 				}
3824 
3825 				if (copy_to_user(&enum_ptr[copied].name,
3826 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
3827 					ret = -EFAULT;
3828 					goto done;
3829 				}
3830 				copied++;
3831 			}
3832 		}
3833 		out_resp->count_enum_blobs = enum_count;
3834 	}
3835 
3836 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
3837 		if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
3838 			copied = 0;
3839 			blob_id_ptr = (uint32_t __user *)(unsigned long)out_resp->enum_blob_ptr;
3840 			blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
3841 
3842 			list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
3843 				if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
3844 					ret = -EFAULT;
3845 					goto done;
3846 				}
3847 
3848 				if (put_user(prop_blob->length, blob_length_ptr + copied)) {
3849 					ret = -EFAULT;
3850 					goto done;
3851 				}
3852 
3853 				copied++;
3854 			}
3855 		}
3856 		out_resp->count_enum_blobs = blob_count;
3857 	}
3858 done:
3859 	drm_modeset_unlock_all(dev);
3860 	return ret;
3861 }
3862 
3863 static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev, int length,
3864 							  void *data)
3865 {
3866 	struct drm_property_blob *blob;
3867 	int ret;
3868 
3869 	if (!length || !data)
3870 		return NULL;
3871 
3872 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
3873 	if (!blob)
3874 		return NULL;
3875 
3876 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
3877 	if (ret) {
3878 		kfree(blob);
3879 		return NULL;
3880 	}
3881 
3882 	blob->length = length;
3883 
3884 	memcpy(blob->data, data, length);
3885 
3886 	list_add_tail(&blob->head, &dev->mode_config.property_blob_list);
3887 	return blob;
3888 }
3889 
3890 static void drm_property_destroy_blob(struct drm_device *dev,
3891 			       struct drm_property_blob *blob)
3892 {
3893 	drm_mode_object_put(dev, &blob->base);
3894 	list_del(&blob->head);
3895 	kfree(blob);
3896 }
3897 
3898 /**
3899  * drm_mode_getblob_ioctl - get the contents of a blob property value
3900  * @dev: DRM device
3901  * @data: ioctl data
3902  * @file_priv: DRM file info
3903  *
3904  * This function retrieves the contents of a blob property. The value stored in
3905  * an object's blob property is just a normal modeset object id.
3906  *
3907  * Called by the user via ioctl.
3908  *
3909  * Returns:
3910  * Zero on success, errno on failure.
3911  */
3912 int drm_mode_getblob_ioctl(struct drm_device *dev,
3913 			   void *data, struct drm_file *file_priv)
3914 {
3915 	struct drm_mode_get_blob *out_resp = data;
3916 	struct drm_property_blob *blob;
3917 	int ret = 0;
3918 	void __user *blob_ptr;
3919 
3920 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3921 		return -EINVAL;
3922 
3923 	drm_modeset_lock_all(dev);
3924 	blob = drm_property_blob_find(dev, out_resp->blob_id);
3925 	if (!blob) {
3926 		ret = -ENOENT;
3927 		goto done;
3928 	}
3929 
3930 	if (out_resp->length == blob->length) {
3931 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
3932 		if (copy_to_user(blob_ptr, blob->data, blob->length)){
3933 			ret = -EFAULT;
3934 			goto done;
3935 		}
3936 	}
3937 	out_resp->length = blob->length;
3938 
3939 done:
3940 	drm_modeset_unlock_all(dev);
3941 	return ret;
3942 }
3943 
3944 int drm_mode_connector_set_path_property(struct drm_connector *connector,
3945 					 char *path)
3946 {
3947 	struct drm_device *dev = connector->dev;
3948 	int ret, size;
3949 	size = strlen(path) + 1;
3950 
3951 	connector->path_blob_ptr = drm_property_create_blob(connector->dev,
3952 							    size, path);
3953 	if (!connector->path_blob_ptr)
3954 		return -EINVAL;
3955 
3956 	ret = drm_object_property_set_value(&connector->base,
3957 					    dev->mode_config.path_property,
3958 					    connector->path_blob_ptr->base.id);
3959 	return ret;
3960 }
3961 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
3962 
3963 /**
3964  * drm_mode_connector_update_edid_property - update the edid property of a connector
3965  * @connector: drm connector
3966  * @edid: new value of the edid property
3967  *
3968  * This function creates a new blob modeset object and assigns its id to the
3969  * connector's edid property.
3970  *
3971  * Returns:
3972  * Zero on success, errno on failure.
3973  */
3974 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
3975 					    struct edid *edid)
3976 {
3977 	struct drm_device *dev = connector->dev;
3978 	int ret, size;
3979 
3980 	/* ignore requests to set edid when overridden */
3981 	if (connector->override_edid)
3982 		return 0;
3983 
3984 	if (connector->edid_blob_ptr)
3985 		drm_property_destroy_blob(dev, connector->edid_blob_ptr);
3986 
3987 	/* Delete edid, when there is none. */
3988 	if (!edid) {
3989 		connector->edid_blob_ptr = NULL;
3990 		ret = drm_object_property_set_value(&connector->base, dev->mode_config.edid_property, 0);
3991 		return ret;
3992 	}
3993 
3994 	size = EDID_LENGTH * (1 + edid->extensions);
3995 	connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
3996 							    size, edid);
3997 	if (!connector->edid_blob_ptr)
3998 		return -EINVAL;
3999 
4000 	ret = drm_object_property_set_value(&connector->base,
4001 					       dev->mode_config.edid_property,
4002 					       connector->edid_blob_ptr->base.id);
4003 
4004 	return ret;
4005 }
4006 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4007 
4008 static bool drm_property_change_is_valid(struct drm_property *property,
4009 					 uint64_t value)
4010 {
4011 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4012 		return false;
4013 
4014 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4015 		if (value < property->values[0] || value > property->values[1])
4016 			return false;
4017 		return true;
4018 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4019 		int64_t svalue = U642I64(value);
4020 		if (svalue < U642I64(property->values[0]) ||
4021 				svalue > U642I64(property->values[1]))
4022 			return false;
4023 		return true;
4024 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4025 		int i;
4026 		uint64_t valid_mask = 0;
4027 		for (i = 0; i < property->num_values; i++)
4028 			valid_mask |= (1ULL << property->values[i]);
4029 		return !(value & ~valid_mask);
4030 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4031 		/* Only the driver knows */
4032 		return true;
4033 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4034 		struct drm_mode_object *obj;
4035 		/* a zero value for an object property translates to null: */
4036 		if (value == 0)
4037 			return true;
4038 		/*
4039 		 * NOTE: use _object_find() directly to bypass restriction on
4040 		 * looking up refcnt'd objects (ie. fb's).  For a refcnt'd
4041 		 * object this could race against object finalization, so it
4042 		 * simply tells us that the object *was* valid.  Which is good
4043 		 * enough.
4044 		 */
4045 		obj = _object_find(property->dev, value, property->values[0]);
4046 		return obj != NULL;
4047 	} else {
4048 		int i;
4049 		for (i = 0; i < property->num_values; i++)
4050 			if (property->values[i] == value)
4051 				return true;
4052 		return false;
4053 	}
4054 }
4055 
4056 /**
4057  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4058  * @dev: DRM device
4059  * @data: ioctl data
4060  * @file_priv: DRM file info
4061  *
4062  * This function sets the current value for a connectors's property. It also
4063  * calls into a driver's ->set_property callback to update the hardware state
4064  *
4065  * Called by the user via ioctl.
4066  *
4067  * Returns:
4068  * Zero on success, errno on failure.
4069  */
4070 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4071 				       void *data, struct drm_file *file_priv)
4072 {
4073 	struct drm_mode_connector_set_property *conn_set_prop = data;
4074 	struct drm_mode_obj_set_property obj_set_prop = {
4075 		.value = conn_set_prop->value,
4076 		.prop_id = conn_set_prop->prop_id,
4077 		.obj_id = conn_set_prop->connector_id,
4078 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4079 	};
4080 
4081 	/* It does all the locking and checking we need */
4082 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4083 }
4084 
4085 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4086 					   struct drm_property *property,
4087 					   uint64_t value)
4088 {
4089 	int ret = -EINVAL;
4090 	struct drm_connector *connector = obj_to_connector(obj);
4091 
4092 	/* Do DPMS ourselves */
4093 	if (property == connector->dev->mode_config.dpms_property) {
4094 		if (connector->funcs->dpms)
4095 			(*connector->funcs->dpms)(connector, (int)value);
4096 		ret = 0;
4097 	} else if (connector->funcs->set_property)
4098 		ret = connector->funcs->set_property(connector, property, value);
4099 
4100 	/* store the property value if successful */
4101 	if (!ret)
4102 		drm_object_property_set_value(&connector->base, property, value);
4103 	return ret;
4104 }
4105 
4106 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4107 				      struct drm_property *property,
4108 				      uint64_t value)
4109 {
4110 	int ret = -EINVAL;
4111 	struct drm_crtc *crtc = obj_to_crtc(obj);
4112 
4113 	if (crtc->funcs->set_property)
4114 		ret = crtc->funcs->set_property(crtc, property, value);
4115 	if (!ret)
4116 		drm_object_property_set_value(obj, property, value);
4117 
4118 	return ret;
4119 }
4120 
4121 static int drm_mode_plane_set_obj_prop(struct drm_mode_object *obj,
4122 				      struct drm_property *property,
4123 				      uint64_t value)
4124 {
4125 	int ret = -EINVAL;
4126 	struct drm_plane *plane = obj_to_plane(obj);
4127 
4128 	if (plane->funcs->set_property)
4129 		ret = plane->funcs->set_property(plane, property, value);
4130 	if (!ret)
4131 		drm_object_property_set_value(obj, property, value);
4132 
4133 	return ret;
4134 }
4135 
4136 /**
4137  * drm_mode_getproperty_ioctl - get the current value of a object's property
4138  * @dev: DRM device
4139  * @data: ioctl data
4140  * @file_priv: DRM file info
4141  *
4142  * This function retrieves the current value for an object's property. Compared
4143  * to the connector specific ioctl this one is extended to also work on crtc and
4144  * plane objects.
4145  *
4146  * Called by the user via ioctl.
4147  *
4148  * Returns:
4149  * Zero on success, errno on failure.
4150  */
4151 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4152 				      struct drm_file *file_priv)
4153 {
4154 	struct drm_mode_obj_get_properties *arg = data;
4155 	struct drm_mode_object *obj;
4156 	int ret = 0;
4157 	int i;
4158 	int copied = 0;
4159 	int props_count = 0;
4160 	uint32_t __user *props_ptr;
4161 	uint64_t __user *prop_values_ptr;
4162 
4163 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4164 		return -EINVAL;
4165 
4166 	drm_modeset_lock_all(dev);
4167 
4168 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4169 	if (!obj) {
4170 		ret = -ENOENT;
4171 		goto out;
4172 	}
4173 	if (!obj->properties) {
4174 		ret = -EINVAL;
4175 		goto out;
4176 	}
4177 
4178 	props_count = obj->properties->count;
4179 
4180 	/* This ioctl is called twice, once to determine how much space is
4181 	 * needed, and the 2nd time to fill it. */
4182 	if ((arg->count_props >= props_count) && props_count) {
4183 		copied = 0;
4184 		props_ptr = (uint32_t __user *)(unsigned long)(arg->props_ptr);
4185 		prop_values_ptr = (uint64_t __user *)(unsigned long)
4186 				  (arg->prop_values_ptr);
4187 		for (i = 0; i < props_count; i++) {
4188 			if (put_user(obj->properties->ids[i],
4189 				     props_ptr + copied)) {
4190 				ret = -EFAULT;
4191 				goto out;
4192 			}
4193 			if (put_user(obj->properties->values[i],
4194 				     prop_values_ptr + copied)) {
4195 				ret = -EFAULT;
4196 				goto out;
4197 			}
4198 			copied++;
4199 		}
4200 	}
4201 	arg->count_props = props_count;
4202 out:
4203 	drm_modeset_unlock_all(dev);
4204 	return ret;
4205 }
4206 
4207 /**
4208  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4209  * @dev: DRM device
4210  * @data: ioctl data
4211  * @file_priv: DRM file info
4212  *
4213  * This function sets the current value for an object's property. It also calls
4214  * into a driver's ->set_property callback to update the hardware state.
4215  * Compared to the connector specific ioctl this one is extended to also work on
4216  * crtc and plane objects.
4217  *
4218  * Called by the user via ioctl.
4219  *
4220  * Returns:
4221  * Zero on success, errno on failure.
4222  */
4223 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4224 				    struct drm_file *file_priv)
4225 {
4226 	struct drm_mode_obj_set_property *arg = data;
4227 	struct drm_mode_object *arg_obj;
4228 	struct drm_mode_object *prop_obj;
4229 	struct drm_property *property;
4230 	int ret = -EINVAL;
4231 	int i;
4232 
4233 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4234 		return -EINVAL;
4235 
4236 	drm_modeset_lock_all(dev);
4237 
4238 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4239 	if (!arg_obj) {
4240 		ret = -ENOENT;
4241 		goto out;
4242 	}
4243 	if (!arg_obj->properties)
4244 		goto out;
4245 
4246 	for (i = 0; i < arg_obj->properties->count; i++)
4247 		if (arg_obj->properties->ids[i] == arg->prop_id)
4248 			break;
4249 
4250 	if (i == arg_obj->properties->count)
4251 		goto out;
4252 
4253 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4254 					DRM_MODE_OBJECT_PROPERTY);
4255 	if (!prop_obj) {
4256 		ret = -ENOENT;
4257 		goto out;
4258 	}
4259 	property = obj_to_property(prop_obj);
4260 
4261 	if (!drm_property_change_is_valid(property, arg->value))
4262 		goto out;
4263 
4264 	switch (arg_obj->type) {
4265 	case DRM_MODE_OBJECT_CONNECTOR:
4266 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4267 						      arg->value);
4268 		break;
4269 	case DRM_MODE_OBJECT_CRTC:
4270 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4271 		break;
4272 	case DRM_MODE_OBJECT_PLANE:
4273 		ret = drm_mode_plane_set_obj_prop(arg_obj, property, arg->value);
4274 		break;
4275 	}
4276 
4277 out:
4278 	drm_modeset_unlock_all(dev);
4279 	return ret;
4280 }
4281 
4282 /**
4283  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4284  * @connector: connector to attach
4285  * @encoder: encoder to attach @connector to
4286  *
4287  * This function links up a connector to an encoder. Note that the routing
4288  * restrictions between encoders and crtcs are exposed to userspace through the
4289  * possible_clones and possible_crtcs bitmasks.
4290  *
4291  * Returns:
4292  * Zero on success, errno on failure.
4293  */
4294 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4295 				      struct drm_encoder *encoder)
4296 {
4297 	int i;
4298 
4299 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4300 		if (connector->encoder_ids[i] == 0) {
4301 			connector->encoder_ids[i] = encoder->base.id;
4302 			return 0;
4303 		}
4304 	}
4305 	return -ENOMEM;
4306 }
4307 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4308 
4309 /**
4310  * drm_mode_crtc_set_gamma_size - set the gamma table size
4311  * @crtc: CRTC to set the gamma table size for
4312  * @gamma_size: size of the gamma table
4313  *
4314  * Drivers which support gamma tables should set this to the supported gamma
4315  * table size when initializing the CRTC. Currently the drm core only supports a
4316  * fixed gamma table size.
4317  *
4318  * Returns:
4319  * Zero on success, errno on failure.
4320  */
4321 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4322 				 int gamma_size)
4323 {
4324 	crtc->gamma_size = gamma_size;
4325 
4326 	crtc->gamma_store = kzalloc(gamma_size * sizeof(uint16_t) * 3, GFP_KERNEL);
4327 	if (!crtc->gamma_store) {
4328 		crtc->gamma_size = 0;
4329 		return -ENOMEM;
4330 	}
4331 
4332 	return 0;
4333 }
4334 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4335 
4336 /**
4337  * drm_mode_gamma_set_ioctl - set the gamma table
4338  * @dev: DRM device
4339  * @data: ioctl data
4340  * @file_priv: DRM file info
4341  *
4342  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4343  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
4344  *
4345  * Called by the user via ioctl.
4346  *
4347  * Returns:
4348  * Zero on success, errno on failure.
4349  */
4350 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
4351 			     void *data, struct drm_file *file_priv)
4352 {
4353 	struct drm_mode_crtc_lut *crtc_lut = data;
4354 	struct drm_crtc *crtc;
4355 	void *r_base, *g_base, *b_base;
4356 	int size;
4357 	int ret = 0;
4358 
4359 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4360 		return -EINVAL;
4361 
4362 	drm_modeset_lock_all(dev);
4363 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4364 	if (!crtc) {
4365 		ret = -ENOENT;
4366 		goto out;
4367 	}
4368 
4369 	if (crtc->funcs->gamma_set == NULL) {
4370 		ret = -ENOSYS;
4371 		goto out;
4372 	}
4373 
4374 	/* memcpy into gamma store */
4375 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4376 		ret = -EINVAL;
4377 		goto out;
4378 	}
4379 
4380 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4381 	r_base = crtc->gamma_store;
4382 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
4383 		ret = -EFAULT;
4384 		goto out;
4385 	}
4386 
4387 	g_base = (char *)r_base + size;
4388 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
4389 		ret = -EFAULT;
4390 		goto out;
4391 	}
4392 
4393 	b_base = (char *)g_base + size;
4394 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
4395 		ret = -EFAULT;
4396 		goto out;
4397 	}
4398 
4399 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
4400 
4401 out:
4402 	drm_modeset_unlock_all(dev);
4403 	return ret;
4404 
4405 }
4406 
4407 /**
4408  * drm_mode_gamma_get_ioctl - get the gamma table
4409  * @dev: DRM device
4410  * @data: ioctl data
4411  * @file_priv: DRM file info
4412  *
4413  * Copy the current gamma table into the storage provided. This also provides
4414  * the gamma table size the driver expects, which can be used to size the
4415  * allocated storage.
4416  *
4417  * Called by the user via ioctl.
4418  *
4419  * Returns:
4420  * Zero on success, errno on failure.
4421  */
4422 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
4423 			     void *data, struct drm_file *file_priv)
4424 {
4425 	struct drm_mode_crtc_lut *crtc_lut = data;
4426 	struct drm_crtc *crtc;
4427 	void *r_base, *g_base, *b_base;
4428 	int size;
4429 	int ret = 0;
4430 
4431 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4432 		return -EINVAL;
4433 
4434 	drm_modeset_lock_all(dev);
4435 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4436 	if (!crtc) {
4437 		ret = -ENOENT;
4438 		goto out;
4439 	}
4440 
4441 	/* memcpy into gamma store */
4442 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4443 		ret = -EINVAL;
4444 		goto out;
4445 	}
4446 
4447 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4448 	r_base = crtc->gamma_store;
4449 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
4450 		ret = -EFAULT;
4451 		goto out;
4452 	}
4453 
4454 	g_base = (char *)r_base + size;
4455 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
4456 		ret = -EFAULT;
4457 		goto out;
4458 	}
4459 
4460 	b_base = (char *)g_base + size;
4461 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
4462 		ret = -EFAULT;
4463 		goto out;
4464 	}
4465 out:
4466 	drm_modeset_unlock_all(dev);
4467 	return ret;
4468 }
4469 
4470 /*
4471  * The Linux version of kfree() is a macro and can't be called
4472  * directly via a function pointer
4473  */
4474 static void drm_kms_free(void *arg)
4475 {
4476 	kfree(arg);
4477 }
4478 
4479 /**
4480  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
4481  * @dev: DRM device
4482  * @data: ioctl data
4483  * @file_priv: DRM file info
4484  *
4485  * This schedules an asynchronous update on a given CRTC, called page flip.
4486  * Optionally a drm event is generated to signal the completion of the event.
4487  * Generic drivers cannot assume that a pageflip with changed framebuffer
4488  * properties (including driver specific metadata like tiling layout) will work,
4489  * but some drivers support e.g. pixel format changes through the pageflip
4490  * ioctl.
4491  *
4492  * Called by the user via ioctl.
4493  *
4494  * Returns:
4495  * Zero on success, errno on failure.
4496  */
4497 int drm_mode_page_flip_ioctl(struct drm_device *dev,
4498 			     void *data, struct drm_file *file_priv)
4499 {
4500 	struct drm_mode_crtc_page_flip *page_flip = data;
4501 	struct drm_crtc *crtc;
4502 	struct drm_framebuffer *fb = NULL, *old_fb = NULL;
4503 	struct drm_pending_vblank_event *e = NULL;
4504 	int ret = -EINVAL;
4505 
4506 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
4507 	    page_flip->reserved != 0)
4508 		return -EINVAL;
4509 
4510 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
4511 		return -EINVAL;
4512 
4513 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
4514 	if (!crtc)
4515 		return -ENOENT;
4516 
4517 	drm_modeset_lock(&crtc->mutex, NULL);
4518 	if (crtc->primary->fb == NULL) {
4519 		/* The framebuffer is currently unbound, presumably
4520 		 * due to a hotplug event, that userspace has not
4521 		 * yet discovered.
4522 		 */
4523 		ret = -EBUSY;
4524 		goto out;
4525 	}
4526 
4527 	if (crtc->funcs->page_flip == NULL)
4528 		goto out;
4529 
4530 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
4531 	if (!fb) {
4532 		ret = -ENOENT;
4533 		goto out;
4534 	}
4535 
4536 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
4537 	if (ret)
4538 		goto out;
4539 
4540 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
4541 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
4542 		ret = -EINVAL;
4543 		goto out;
4544 	}
4545 
4546 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4547 		ret = -ENOMEM;
4548 		lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4549 		if (file_priv->event_space < sizeof e->event) {
4550 			lockmgr(&dev->event_lock, LK_RELEASE);
4551 			goto out;
4552 		}
4553 		file_priv->event_space -= sizeof e->event;
4554 		lockmgr(&dev->event_lock, LK_RELEASE);
4555 
4556 		e = kzalloc(sizeof *e, GFP_KERNEL);
4557 		if (e == NULL) {
4558 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4559 			file_priv->event_space += sizeof e->event;
4560 			lockmgr(&dev->event_lock, LK_RELEASE);
4561 			goto out;
4562 		}
4563 
4564 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
4565 		e->event.base.length = sizeof e->event;
4566 		e->event.user_data = page_flip->user_data;
4567 		e->base.event = &e->event.base;
4568 		e->base.file_priv = file_priv;
4569 		/* XXX: DragonFly-specific */
4570 		e->base.destroy =
4571 			(void (*) (struct drm_pending_event *)) drm_kms_free;
4572 	}
4573 
4574 	old_fb = crtc->primary->fb;
4575 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
4576 	if (ret) {
4577 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4578 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4579 			file_priv->event_space += sizeof e->event;
4580 			lockmgr(&dev->event_lock, LK_RELEASE);
4581 			kfree(e);
4582 		}
4583 		/* Keep the old fb, don't unref it. */
4584 		old_fb = NULL;
4585 	} else {
4586 		/*
4587 		 * Warn if the driver hasn't properly updated the crtc->fb
4588 		 * field to reflect that the new framebuffer is now used.
4589 		 * Failing to do so will screw with the reference counting
4590 		 * on framebuffers.
4591 		 */
4592 		WARN_ON(crtc->primary->fb != fb);
4593 		/* Unref only the old framebuffer. */
4594 		fb = NULL;
4595 	}
4596 
4597 out:
4598 	if (fb)
4599 		drm_framebuffer_unreference(fb);
4600 	if (old_fb)
4601 		drm_framebuffer_unreference(old_fb);
4602 	drm_modeset_unlock(&crtc->mutex);
4603 
4604 	return ret;
4605 }
4606 
4607 /**
4608  * drm_mode_config_reset - call ->reset callbacks
4609  * @dev: drm device
4610  *
4611  * This functions calls all the crtc's, encoder's and connector's ->reset
4612  * callback. Drivers can use this in e.g. their driver load or resume code to
4613  * reset hardware and software state.
4614  */
4615 void drm_mode_config_reset(struct drm_device *dev)
4616 {
4617 	struct drm_crtc *crtc;
4618 	struct drm_encoder *encoder;
4619 	struct drm_connector *connector;
4620 
4621 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
4622 		if (crtc->funcs->reset)
4623 			crtc->funcs->reset(crtc);
4624 
4625 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
4626 		if (encoder->funcs->reset)
4627 			encoder->funcs->reset(encoder);
4628 
4629 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
4630 		connector->status = connector_status_unknown;
4631 
4632 		if (connector->funcs->reset)
4633 			connector->funcs->reset(connector);
4634 	}
4635 }
4636 EXPORT_SYMBOL(drm_mode_config_reset);
4637 
4638 /**
4639  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
4640  * @dev: DRM device
4641  * @data: ioctl data
4642  * @file_priv: DRM file info
4643  *
4644  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
4645  * TTM or something else entirely) and returns the resulting buffer handle. This
4646  * handle can then be wrapped up into a framebuffer modeset object.
4647  *
4648  * Note that userspace is not allowed to use such objects for render
4649  * acceleration - drivers must create their own private ioctls for such a use
4650  * case.
4651  *
4652  * Called by the user via ioctl.
4653  *
4654  * Returns:
4655  * Zero on success, errno on failure.
4656  */
4657 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
4658 			       void *data, struct drm_file *file_priv)
4659 {
4660 	struct drm_mode_create_dumb *args = data;
4661 	u32 cpp, stride, size;
4662 
4663 	if (!dev->driver->dumb_create)
4664 		return -ENOSYS;
4665 	if (!args->width || !args->height || !args->bpp)
4666 		return -EINVAL;
4667 
4668 	/* overflow checks for 32bit size calculations */
4669 	/* NOTE: DIV_ROUND_UP() can overflow */
4670 	cpp = DIV_ROUND_UP(args->bpp, 8);
4671 	if (!cpp || cpp > 0xffffffffU / args->width)
4672 		return -EINVAL;
4673 	stride = cpp * args->width;
4674 	if (args->height > 0xffffffffU / stride)
4675 		return -EINVAL;
4676 
4677 	/* test for wrap-around */
4678 	size = args->height * stride;
4679 	if (PAGE_ALIGN(size) == 0)
4680 		return -EINVAL;
4681 
4682 	return dev->driver->dumb_create(file_priv, dev, args);
4683 }
4684 
4685 /**
4686  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
4687  * @dev: DRM device
4688  * @data: ioctl data
4689  * @file_priv: DRM file info
4690  *
4691  * Allocate an offset in the drm device node's address space to be able to
4692  * memory map a dumb buffer.
4693  *
4694  * Called by the user via ioctl.
4695  *
4696  * Returns:
4697  * Zero on success, errno on failure.
4698  */
4699 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
4700 			     void *data, struct drm_file *file_priv)
4701 {
4702 	struct drm_mode_map_dumb *args = data;
4703 
4704 	/* call driver ioctl to get mmap offset */
4705 	if (!dev->driver->dumb_map_offset)
4706 		return -ENOSYS;
4707 
4708 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
4709 }
4710 
4711 /**
4712  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
4713  * @dev: DRM device
4714  * @data: ioctl data
4715  * @file_priv: DRM file info
4716  *
4717  * This destroys the userspace handle for the given dumb backing storage buffer.
4718  * Since buffer objects must be reference counted in the kernel a buffer object
4719  * won't be immediately freed if a framebuffer modeset object still uses it.
4720  *
4721  * Called by the user via ioctl.
4722  *
4723  * Returns:
4724  * Zero on success, errno on failure.
4725  */
4726 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
4727 				void *data, struct drm_file *file_priv)
4728 {
4729 	struct drm_mode_destroy_dumb *args = data;
4730 
4731 	if (!dev->driver->dumb_destroy)
4732 		return -ENOSYS;
4733 
4734 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
4735 }
4736 
4737 /**
4738  * drm_fb_get_bpp_depth - get the bpp/depth values for format
4739  * @format: pixel format (DRM_FORMAT_*)
4740  * @depth: storage for the depth value
4741  * @bpp: storage for the bpp value
4742  *
4743  * This only supports RGB formats here for compat with code that doesn't use
4744  * pixel formats directly yet.
4745  */
4746 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
4747 			  int *bpp)
4748 {
4749 	switch (format) {
4750 	case DRM_FORMAT_C8:
4751 	case DRM_FORMAT_RGB332:
4752 	case DRM_FORMAT_BGR233:
4753 		*depth = 8;
4754 		*bpp = 8;
4755 		break;
4756 	case DRM_FORMAT_XRGB1555:
4757 	case DRM_FORMAT_XBGR1555:
4758 	case DRM_FORMAT_RGBX5551:
4759 	case DRM_FORMAT_BGRX5551:
4760 	case DRM_FORMAT_ARGB1555:
4761 	case DRM_FORMAT_ABGR1555:
4762 	case DRM_FORMAT_RGBA5551:
4763 	case DRM_FORMAT_BGRA5551:
4764 		*depth = 15;
4765 		*bpp = 16;
4766 		break;
4767 	case DRM_FORMAT_RGB565:
4768 	case DRM_FORMAT_BGR565:
4769 		*depth = 16;
4770 		*bpp = 16;
4771 		break;
4772 	case DRM_FORMAT_RGB888:
4773 	case DRM_FORMAT_BGR888:
4774 		*depth = 24;
4775 		*bpp = 24;
4776 		break;
4777 	case DRM_FORMAT_XRGB8888:
4778 	case DRM_FORMAT_XBGR8888:
4779 	case DRM_FORMAT_RGBX8888:
4780 	case DRM_FORMAT_BGRX8888:
4781 		*depth = 24;
4782 		*bpp = 32;
4783 		break;
4784 	case DRM_FORMAT_XRGB2101010:
4785 	case DRM_FORMAT_XBGR2101010:
4786 	case DRM_FORMAT_RGBX1010102:
4787 	case DRM_FORMAT_BGRX1010102:
4788 	case DRM_FORMAT_ARGB2101010:
4789 	case DRM_FORMAT_ABGR2101010:
4790 	case DRM_FORMAT_RGBA1010102:
4791 	case DRM_FORMAT_BGRA1010102:
4792 		*depth = 30;
4793 		*bpp = 32;
4794 		break;
4795 	case DRM_FORMAT_ARGB8888:
4796 	case DRM_FORMAT_ABGR8888:
4797 	case DRM_FORMAT_RGBA8888:
4798 	case DRM_FORMAT_BGRA8888:
4799 		*depth = 32;
4800 		*bpp = 32;
4801 		break;
4802 	default:
4803 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
4804 			      drm_get_format_name(format));
4805 		*depth = 0;
4806 		*bpp = 0;
4807 		break;
4808 	}
4809 }
4810 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
4811 
4812 /**
4813  * drm_format_num_planes - get the number of planes for format
4814  * @format: pixel format (DRM_FORMAT_*)
4815  *
4816  * Returns:
4817  * The number of planes used by the specified pixel format.
4818  */
4819 int drm_format_num_planes(uint32_t format)
4820 {
4821 	switch (format) {
4822 	case DRM_FORMAT_YUV410:
4823 	case DRM_FORMAT_YVU410:
4824 	case DRM_FORMAT_YUV411:
4825 	case DRM_FORMAT_YVU411:
4826 	case DRM_FORMAT_YUV420:
4827 	case DRM_FORMAT_YVU420:
4828 	case DRM_FORMAT_YUV422:
4829 	case DRM_FORMAT_YVU422:
4830 	case DRM_FORMAT_YUV444:
4831 	case DRM_FORMAT_YVU444:
4832 		return 3;
4833 	case DRM_FORMAT_NV12:
4834 	case DRM_FORMAT_NV21:
4835 	case DRM_FORMAT_NV16:
4836 	case DRM_FORMAT_NV61:
4837 	case DRM_FORMAT_NV24:
4838 	case DRM_FORMAT_NV42:
4839 		return 2;
4840 	default:
4841 		return 1;
4842 	}
4843 }
4844 EXPORT_SYMBOL(drm_format_num_planes);
4845 
4846 /**
4847  * drm_format_plane_cpp - determine the bytes per pixel value
4848  * @format: pixel format (DRM_FORMAT_*)
4849  * @plane: plane index
4850  *
4851  * Returns:
4852  * The bytes per pixel value for the specified plane.
4853  */
4854 int drm_format_plane_cpp(uint32_t format, int plane)
4855 {
4856 	unsigned int depth;
4857 	int bpp;
4858 
4859 	if (plane >= drm_format_num_planes(format))
4860 		return 0;
4861 
4862 	switch (format) {
4863 	case DRM_FORMAT_YUYV:
4864 	case DRM_FORMAT_YVYU:
4865 	case DRM_FORMAT_UYVY:
4866 	case DRM_FORMAT_VYUY:
4867 		return 2;
4868 	case DRM_FORMAT_NV12:
4869 	case DRM_FORMAT_NV21:
4870 	case DRM_FORMAT_NV16:
4871 	case DRM_FORMAT_NV61:
4872 	case DRM_FORMAT_NV24:
4873 	case DRM_FORMAT_NV42:
4874 		return plane ? 2 : 1;
4875 	case DRM_FORMAT_YUV410:
4876 	case DRM_FORMAT_YVU410:
4877 	case DRM_FORMAT_YUV411:
4878 	case DRM_FORMAT_YVU411:
4879 	case DRM_FORMAT_YUV420:
4880 	case DRM_FORMAT_YVU420:
4881 	case DRM_FORMAT_YUV422:
4882 	case DRM_FORMAT_YVU422:
4883 	case DRM_FORMAT_YUV444:
4884 	case DRM_FORMAT_YVU444:
4885 		return 1;
4886 	default:
4887 		drm_fb_get_bpp_depth(format, &depth, &bpp);
4888 		return bpp >> 3;
4889 	}
4890 }
4891 EXPORT_SYMBOL(drm_format_plane_cpp);
4892 
4893 /**
4894  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
4895  * @format: pixel format (DRM_FORMAT_*)
4896  *
4897  * Returns:
4898  * The horizontal chroma subsampling factor for the
4899  * specified pixel format.
4900  */
4901 int drm_format_horz_chroma_subsampling(uint32_t format)
4902 {
4903 	switch (format) {
4904 	case DRM_FORMAT_YUV411:
4905 	case DRM_FORMAT_YVU411:
4906 	case DRM_FORMAT_YUV410:
4907 	case DRM_FORMAT_YVU410:
4908 		return 4;
4909 	case DRM_FORMAT_YUYV:
4910 	case DRM_FORMAT_YVYU:
4911 	case DRM_FORMAT_UYVY:
4912 	case DRM_FORMAT_VYUY:
4913 	case DRM_FORMAT_NV12:
4914 	case DRM_FORMAT_NV21:
4915 	case DRM_FORMAT_NV16:
4916 	case DRM_FORMAT_NV61:
4917 	case DRM_FORMAT_YUV422:
4918 	case DRM_FORMAT_YVU422:
4919 	case DRM_FORMAT_YUV420:
4920 	case DRM_FORMAT_YVU420:
4921 		return 2;
4922 	default:
4923 		return 1;
4924 	}
4925 }
4926 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
4927 
4928 /**
4929  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
4930  * @format: pixel format (DRM_FORMAT_*)
4931  *
4932  * Returns:
4933  * The vertical chroma subsampling factor for the
4934  * specified pixel format.
4935  */
4936 int drm_format_vert_chroma_subsampling(uint32_t format)
4937 {
4938 	switch (format) {
4939 	case DRM_FORMAT_YUV410:
4940 	case DRM_FORMAT_YVU410:
4941 		return 4;
4942 	case DRM_FORMAT_YUV420:
4943 	case DRM_FORMAT_YVU420:
4944 	case DRM_FORMAT_NV12:
4945 	case DRM_FORMAT_NV21:
4946 		return 2;
4947 	default:
4948 		return 1;
4949 	}
4950 }
4951 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
4952 
4953 /**
4954  * drm_mode_config_init - initialize DRM mode_configuration structure
4955  * @dev: DRM device
4956  *
4957  * Initialize @dev's mode_config structure, used for tracking the graphics
4958  * configuration of @dev.
4959  *
4960  * Since this initializes the modeset locks, no locking is possible. Which is no
4961  * problem, since this should happen single threaded at init time. It is the
4962  * driver's problem to ensure this guarantee.
4963  *
4964  */
4965 void drm_mode_config_init(struct drm_device *dev)
4966 {
4967 	lockinit(&dev->mode_config.mutex, "drmmcm", 0, LK_CANRECURSE);
4968 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
4969 	lockinit(&dev->mode_config.idr_mutex, "mcfgidr", 0, LK_CANRECURSE);
4970 	lockinit(&dev->mode_config.fb_lock, "drmfbl", 0, LK_CANRECURSE);
4971 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
4972 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
4973 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
4974 	INIT_LIST_HEAD(&dev->mode_config.bridge_list);
4975 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
4976 	INIT_LIST_HEAD(&dev->mode_config.property_list);
4977 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
4978 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
4979 	idr_init(&dev->mode_config.crtc_idr);
4980 
4981 	drm_modeset_lock_all(dev);
4982 	drm_mode_create_standard_connector_properties(dev);
4983 	drm_mode_create_standard_plane_properties(dev);
4984 	drm_modeset_unlock_all(dev);
4985 
4986 	/* Just to be sure */
4987 	dev->mode_config.num_fb = 0;
4988 	dev->mode_config.num_connector = 0;
4989 	dev->mode_config.num_crtc = 0;
4990 	dev->mode_config.num_encoder = 0;
4991 	dev->mode_config.num_overlay_plane = 0;
4992 	dev->mode_config.num_total_plane = 0;
4993 }
4994 EXPORT_SYMBOL(drm_mode_config_init);
4995 
4996 /**
4997  * drm_mode_config_cleanup - free up DRM mode_config info
4998  * @dev: DRM device
4999  *
5000  * Free up all the connectors and CRTCs associated with this DRM device, then
5001  * free up the framebuffers and associated buffer objects.
5002  *
5003  * Note that since this /should/ happen single-threaded at driver/device
5004  * teardown time, no locking is required. It's the driver's job to ensure that
5005  * this guarantee actually holds true.
5006  *
5007  * FIXME: cleanup any dangling user buffer objects too
5008  */
5009 void drm_mode_config_cleanup(struct drm_device *dev)
5010 {
5011 	struct drm_connector *connector, *ot;
5012 	struct drm_crtc *crtc, *ct;
5013 	struct drm_encoder *encoder, *enct;
5014 	struct drm_bridge *bridge, *brt;
5015 	struct drm_framebuffer *fb, *fbt;
5016 	struct drm_property *property, *pt;
5017 	struct drm_property_blob *blob, *bt;
5018 	struct drm_plane *plane, *plt;
5019 
5020 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5021 				 head) {
5022 		encoder->funcs->destroy(encoder);
5023 	}
5024 
5025 	list_for_each_entry_safe(bridge, brt,
5026 				 &dev->mode_config.bridge_list, head) {
5027 		bridge->funcs->destroy(bridge);
5028 	}
5029 
5030 	list_for_each_entry_safe(connector, ot,
5031 				 &dev->mode_config.connector_list, head) {
5032 		connector->funcs->destroy(connector);
5033 	}
5034 
5035 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5036 				 head) {
5037 		drm_property_destroy(dev, property);
5038 	}
5039 
5040 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5041 				 head) {
5042 		drm_property_destroy_blob(dev, blob);
5043 	}
5044 
5045 	/*
5046 	 * Single-threaded teardown context, so it's not required to grab the
5047 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5048 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5049 	 *
5050 	 * Also, if there are any framebuffers left, that's a driver leak now,
5051 	 * so politely WARN about this.
5052 	 */
5053 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5054 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5055 		drm_framebuffer_remove(fb);
5056 	}
5057 
5058 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5059 				 head) {
5060 		plane->funcs->destroy(plane);
5061 	}
5062 
5063 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5064 		crtc->funcs->destroy(crtc);
5065 	}
5066 
5067 	idr_destroy(&dev->mode_config.crtc_idr);
5068 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5069 }
5070 EXPORT_SYMBOL(drm_mode_config_cleanup);
5071