xref: /dragonfly/sys/dev/drm/drm_crtc.c (revision 5d5a3633)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/export.h>
35 #include <drm/drmP.h>
36 #include <drm/drm_crtc.h>
37 #include <drm/drm_edid.h>
38 #include <uapi_drm/drm_fourcc.h>
39 #include <linux/slab.h>
40 #include <drm/drm_modeset_lock.h>
41 #include <drm/drm_atomic.h>
42 
43 #include "drm_crtc_internal.h"
44 #include "drm_internal.h"
45 
46 static struct drm_framebuffer *
47 internal_framebuffer_create(struct drm_device *dev,
48 			    struct drm_mode_fb_cmd2 *r,
49 			    struct drm_file *file_priv);
50 
51 /* Avoid boilerplate.  I'm tired of typing. */
52 #define DRM_ENUM_NAME_FN(fnname, list)				\
53 	const char *fnname(int val)				\
54 	{							\
55 		int i;						\
56 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
57 			if (list[i].type == val)		\
58 				return list[i].name;		\
59 		}						\
60 		return "(unknown)";				\
61 	}
62 
63 /*
64  * Global properties
65  */
66 static const struct drm_prop_enum_list drm_dpms_enum_list[] = {
67 	{ DRM_MODE_DPMS_ON, "On" },
68 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
69 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
70 	{ DRM_MODE_DPMS_OFF, "Off" }
71 };
72 
73 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
74 
75 static const struct drm_prop_enum_list drm_plane_type_enum_list[] = {
76 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
77 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
78 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
79 };
80 
81 /*
82  * Optional properties
83  */
84 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] = {
85 	{ DRM_MODE_SCALE_NONE, "None" },
86 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
87 	{ DRM_MODE_SCALE_CENTER, "Center" },
88 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
89 };
90 
91 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
92 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
93 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
94 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
95 };
96 
97 /*
98  * Non-global properties, but "required" for certain connectors.
99  */
100 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] = {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] = {
109 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
110 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
111 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
112 };
113 
114 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
115 		 drm_dvi_i_subconnector_enum_list)
116 
117 static const struct drm_prop_enum_list drm_tv_select_enum_list[] = {
118 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
119 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
120 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
123 };
124 
125 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
126 
127 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] = {
128 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
129 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
130 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
131 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
133 };
134 
135 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
136 		 drm_tv_subconnector_enum_list)
137 
138 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
139 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
140 	{ DRM_MODE_DIRTY_ON,       "On"       },
141 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
142 };
143 
144 struct drm_conn_prop_enum_list {
145 	int type;
146 	const char *name;
147 	int count;
148 };
149 
150 /*
151  * Connector and encoder types.
152  */
153 static struct drm_conn_prop_enum_list drm_connector_enum_list[] = {
154 	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
155 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
156 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
157 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
158 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
159 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
160 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
161 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
162 	{ DRM_MODE_CONNECTOR_Component, "Component" },
163 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
164 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
165 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
166 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
167 	{ DRM_MODE_CONNECTOR_TV, "TV" },
168 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
169 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
170 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
171 };
172 
173 static const struct drm_prop_enum_list drm_encoder_enum_list[] = {
174 	{ DRM_MODE_ENCODER_NONE, "None" },
175 	{ DRM_MODE_ENCODER_DAC, "DAC" },
176 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
177 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
178 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
179 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
180 	{ DRM_MODE_ENCODER_DSI, "DSI" },
181 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
182 };
183 
184 static const struct drm_prop_enum_list drm_subpixel_enum_list[] = {
185 	{ SubPixelUnknown, "Unknown" },
186 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
187 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
188 	{ SubPixelVerticalRGB, "Vertical RGB" },
189 	{ SubPixelVerticalBGR, "Vertical BGR" },
190 	{ SubPixelNone, "None" },
191 };
192 
193 void drm_connector_ida_init(void)
194 {
195 #if 0
196 	int i;
197 
198 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
199 		ida_init(&drm_connector_enum_list[i].ida);
200 #endif
201 }
202 
203 void drm_connector_ida_destroy(void)
204 {
205 #if 0
206 	int i;
207 
208 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
209 		ida_destroy(&drm_connector_enum_list[i].ida);
210 #endif
211 }
212 
213 /**
214  * drm_get_connector_status_name - return a string for connector status
215  * @status: connector status to compute name of
216  *
217  * In contrast to the other drm_get_*_name functions this one here returns a
218  * const pointer and hence is threadsafe.
219  */
220 const char *drm_get_connector_status_name(enum drm_connector_status status)
221 {
222 	if (status == connector_status_connected)
223 		return "connected";
224 	else if (status == connector_status_disconnected)
225 		return "disconnected";
226 	else
227 		return "unknown";
228 }
229 EXPORT_SYMBOL(drm_get_connector_status_name);
230 
231 /**
232  * drm_get_subpixel_order_name - return a string for a given subpixel enum
233  * @order: enum of subpixel_order
234  *
235  * Note you could abuse this and return something out of bounds, but that
236  * would be a caller error.  No unscrubbed user data should make it here.
237  */
238 const char *drm_get_subpixel_order_name(enum subpixel_order order)
239 {
240 	return drm_subpixel_enum_list[order].name;
241 }
242 EXPORT_SYMBOL(drm_get_subpixel_order_name);
243 
244 static char printable_char(int c)
245 {
246 	return isascii(c) && isprint(c) ? c : '?';
247 }
248 
249 /**
250  * drm_get_format_name - return a string for drm fourcc format
251  * @format: format to compute name of
252  *
253  * Note that the buffer used by this function is globally shared and owned by
254  * the function itself.
255  *
256  * FIXME: This isn't really multithreading safe.
257  */
258 const char *drm_get_format_name(uint32_t format)
259 {
260 	static char buf[32];
261 
262 	ksnprintf(buf, sizeof(buf),
263 		 "%c%c%c%c %s-endian (0x%08x)",
264 		 printable_char(format & 0xff),
265 		 printable_char((format >> 8) & 0xff),
266 		 printable_char((format >> 16) & 0xff),
267 		 printable_char((format >> 24) & 0x7f),
268 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
269 		 format);
270 
271 	return buf;
272 }
273 EXPORT_SYMBOL(drm_get_format_name);
274 
275 /*
276  * Internal function to assign a slot in the object idr and optionally
277  * register the object into the idr.
278  */
279 static int drm_mode_object_get_reg(struct drm_device *dev,
280 				   struct drm_mode_object *obj,
281 				   uint32_t obj_type,
282 				   bool register_obj)
283 {
284 	int ret;
285 
286 	mutex_lock(&dev->mode_config.idr_mutex);
287 	ret = idr_alloc(&dev->mode_config.crtc_idr, register_obj ? obj : NULL, 1, 0, GFP_KERNEL);
288 	if (ret >= 0) {
289 		/*
290 		 * Set up the object linking under the protection of the idr
291 		 * lock so that other users can't see inconsistent state.
292 		 */
293 		obj->id = ret;
294 		obj->type = obj_type;
295 	}
296 	mutex_unlock(&dev->mode_config.idr_mutex);
297 
298 	return ret < 0 ? ret : 0;
299 }
300 
301 /**
302  * drm_mode_object_get - allocate a new modeset identifier
303  * @dev: DRM device
304  * @obj: object pointer, used to generate unique ID
305  * @obj_type: object type
306  *
307  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
308  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
309  * modeset identifiers are _not_ reference counted. Hence don't use this for
310  * reference counted modeset objects like framebuffers.
311  *
312  * Returns:
313  * New unique (relative to other objects in @dev) integer identifier for the
314  * object.
315  */
316 int drm_mode_object_get(struct drm_device *dev,
317 			struct drm_mode_object *obj, uint32_t obj_type)
318 {
319 	return drm_mode_object_get_reg(dev, obj, obj_type, true);
320 }
321 
322 static void drm_mode_object_register(struct drm_device *dev,
323 				     struct drm_mode_object *obj)
324 {
325 	mutex_lock(&dev->mode_config.idr_mutex);
326 	idr_replace(&dev->mode_config.crtc_idr, obj, obj->id);
327 	mutex_unlock(&dev->mode_config.idr_mutex);
328 }
329 
330 /**
331  * drm_mode_object_put - free a modeset identifer
332  * @dev: DRM device
333  * @object: object to free
334  *
335  * Free @id from @dev's unique identifier pool. Note that despite the _get
336  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
337  * for reference counted modeset objects like framebuffers.
338  */
339 void drm_mode_object_put(struct drm_device *dev,
340 			 struct drm_mode_object *object)
341 {
342 	mutex_lock(&dev->mode_config.idr_mutex);
343 	idr_remove(&dev->mode_config.crtc_idr, object->id);
344 	mutex_unlock(&dev->mode_config.idr_mutex);
345 }
346 
347 static struct drm_mode_object *_object_find(struct drm_device *dev,
348 		uint32_t id, uint32_t type)
349 {
350 	struct drm_mode_object *obj = NULL;
351 
352 	mutex_lock(&dev->mode_config.idr_mutex);
353 	obj = idr_find(&dev->mode_config.crtc_idr, id);
354 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
355 		obj = NULL;
356 	if (obj && obj->id != id)
357 		obj = NULL;
358 	/* don't leak out unref'd fb's */
359 	if (obj && (obj->type == DRM_MODE_OBJECT_FB))
360 		obj = NULL;
361 	mutex_unlock(&dev->mode_config.idr_mutex);
362 
363 	return obj;
364 }
365 
366 /**
367  * drm_mode_object_find - look up a drm object with static lifetime
368  * @dev: drm device
369  * @id: id of the mode object
370  * @type: type of the mode object
371  *
372  * Note that framebuffers cannot be looked up with this functions - since those
373  * are reference counted, they need special treatment.  Even with
374  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
375  * rather than WARN_ON()).
376  */
377 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
378 		uint32_t id, uint32_t type)
379 {
380 	struct drm_mode_object *obj = NULL;
381 
382 	/* Framebuffers are reference counted and need their own lookup
383 	 * function.*/
384 	WARN_ON(type == DRM_MODE_OBJECT_FB);
385 	obj = _object_find(dev, id, type);
386 	return obj;
387 }
388 EXPORT_SYMBOL(drm_mode_object_find);
389 
390 /**
391  * drm_framebuffer_init - initialize a framebuffer
392  * @dev: DRM device
393  * @fb: framebuffer to be initialized
394  * @funcs: ... with these functions
395  *
396  * Allocates an ID for the framebuffer's parent mode object, sets its mode
397  * functions & device file and adds it to the master fd list.
398  *
399  * IMPORTANT:
400  * This functions publishes the fb and makes it available for concurrent access
401  * by other users. Which means by this point the fb _must_ be fully set up -
402  * since all the fb attributes are invariant over its lifetime, no further
403  * locking but only correct reference counting is required.
404  *
405  * Returns:
406  * Zero on success, error code on failure.
407  */
408 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
409 			 const struct drm_framebuffer_funcs *funcs)
410 {
411 	int ret;
412 
413 	mutex_lock(&dev->mode_config.fb_lock);
414 	kref_init(&fb->refcount);
415 	INIT_LIST_HEAD(&fb->filp_head);
416 	fb->dev = dev;
417 	fb->funcs = funcs;
418 
419 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
420 	if (ret)
421 		goto out;
422 
423 	dev->mode_config.num_fb++;
424 	list_add(&fb->head, &dev->mode_config.fb_list);
425 out:
426 	mutex_unlock(&dev->mode_config.fb_lock);
427 
428 	return 0;
429 }
430 EXPORT_SYMBOL(drm_framebuffer_init);
431 
432 /* dev->mode_config.fb_lock must be held! */
433 static void __drm_framebuffer_unregister(struct drm_device *dev,
434 					 struct drm_framebuffer *fb)
435 {
436 	mutex_lock(&dev->mode_config.idr_mutex);
437 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
438 	mutex_unlock(&dev->mode_config.idr_mutex);
439 
440 	fb->base.id = 0;
441 }
442 
443 static void drm_framebuffer_free(struct kref *kref)
444 {
445 	struct drm_framebuffer *fb =
446 			container_of(kref, struct drm_framebuffer, refcount);
447 	struct drm_device *dev = fb->dev;
448 
449 	/*
450 	 * The lookup idr holds a weak reference, which has not necessarily been
451 	 * removed at this point. Check for that.
452 	 */
453 	mutex_lock(&dev->mode_config.fb_lock);
454 	if (fb->base.id) {
455 		/* Mark fb as reaped and drop idr ref. */
456 		__drm_framebuffer_unregister(dev, fb);
457 	}
458 	mutex_unlock(&dev->mode_config.fb_lock);
459 
460 	fb->funcs->destroy(fb);
461 }
462 
463 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
464 							uint32_t id)
465 {
466 	struct drm_mode_object *obj = NULL;
467 	struct drm_framebuffer *fb;
468 
469 	mutex_lock(&dev->mode_config.idr_mutex);
470 	obj = idr_find(&dev->mode_config.crtc_idr, id);
471 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
472 		fb = NULL;
473 	else
474 		fb = obj_to_fb(obj);
475 	mutex_unlock(&dev->mode_config.idr_mutex);
476 
477 	return fb;
478 }
479 
480 /**
481  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
482  * @dev: drm device
483  * @id: id of the fb object
484  *
485  * If successful, this grabs an additional reference to the framebuffer -
486  * callers need to make sure to eventually unreference the returned framebuffer
487  * again, using @drm_framebuffer_unreference.
488  */
489 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
490 					       uint32_t id)
491 {
492 	struct drm_framebuffer *fb;
493 
494 	mutex_lock(&dev->mode_config.fb_lock);
495 	fb = __drm_framebuffer_lookup(dev, id);
496 	if (fb) {
497 		if (!kref_get_unless_zero(&fb->refcount))
498 			fb = NULL;
499 	}
500 	mutex_unlock(&dev->mode_config.fb_lock);
501 
502 	return fb;
503 }
504 EXPORT_SYMBOL(drm_framebuffer_lookup);
505 
506 /**
507  * drm_framebuffer_unreference - unref a framebuffer
508  * @fb: framebuffer to unref
509  *
510  * This functions decrements the fb's refcount and frees it if it drops to zero.
511  */
512 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
513 {
514 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
515 	kref_put(&fb->refcount, drm_framebuffer_free);
516 }
517 EXPORT_SYMBOL(drm_framebuffer_unreference);
518 
519 /**
520  * drm_framebuffer_reference - incr the fb refcnt
521  * @fb: framebuffer
522  *
523  * This functions increments the fb's refcount.
524  */
525 void drm_framebuffer_reference(struct drm_framebuffer *fb)
526 {
527 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
528 	kref_get(&fb->refcount);
529 }
530 EXPORT_SYMBOL(drm_framebuffer_reference);
531 
532 /**
533  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
534  * @fb: fb to unregister
535  *
536  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
537  * those used for fbdev. Note that the caller must hold a reference of it's own,
538  * i.e. the object may not be destroyed through this call (since it'll lead to a
539  * locking inversion).
540  */
541 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
542 {
543 	struct drm_device *dev = fb->dev;
544 
545 	mutex_lock(&dev->mode_config.fb_lock);
546 	/* Mark fb as reaped and drop idr ref. */
547 	__drm_framebuffer_unregister(dev, fb);
548 	mutex_unlock(&dev->mode_config.fb_lock);
549 }
550 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
551 
552 /**
553  * drm_framebuffer_cleanup - remove a framebuffer object
554  * @fb: framebuffer to remove
555  *
556  * Cleanup framebuffer. This function is intended to be used from the drivers
557  * ->destroy callback. It can also be used to clean up driver private
558  *  framebuffers embedded into a larger structure.
559  *
560  * Note that this function does not remove the fb from active usuage - if it is
561  * still used anywhere, hilarity can ensue since userspace could call getfb on
562  * the id and get back -EINVAL. Obviously no concern at driver unload time.
563  *
564  * Also, the framebuffer will not be removed from the lookup idr - for
565  * user-created framebuffers this will happen in in the rmfb ioctl. For
566  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
567  * drm_framebuffer_unregister_private.
568  */
569 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
570 {
571 	struct drm_device *dev = fb->dev;
572 
573 	mutex_lock(&dev->mode_config.fb_lock);
574 	list_del(&fb->head);
575 	dev->mode_config.num_fb--;
576 	mutex_unlock(&dev->mode_config.fb_lock);
577 }
578 EXPORT_SYMBOL(drm_framebuffer_cleanup);
579 
580 /**
581  * drm_framebuffer_remove - remove and unreference a framebuffer object
582  * @fb: framebuffer to remove
583  *
584  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
585  * using @fb, removes it, setting it to NULL. Then drops the reference to the
586  * passed-in framebuffer. Might take the modeset locks.
587  *
588  * Note that this function optimizes the cleanup away if the caller holds the
589  * last reference to the framebuffer. It is also guaranteed to not take the
590  * modeset locks in this case.
591  */
592 void drm_framebuffer_remove(struct drm_framebuffer *fb)
593 {
594 	struct drm_device *dev = fb->dev;
595 	struct drm_crtc *crtc;
596 	struct drm_plane *plane;
597 	struct drm_mode_set set;
598 	int ret;
599 
600 	WARN_ON(!list_empty(&fb->filp_head));
601 
602 	/*
603 	 * drm ABI mandates that we remove any deleted framebuffers from active
604 	 * useage. But since most sane clients only remove framebuffers they no
605 	 * longer need, try to optimize this away.
606 	 *
607 	 * Since we're holding a reference ourselves, observing a refcount of 1
608 	 * means that we're the last holder and can skip it. Also, the refcount
609 	 * can never increase from 1 again, so we don't need any barriers or
610 	 * locks.
611 	 *
612 	 * Note that userspace could try to race with use and instate a new
613 	 * usage _after_ we've cleared all current ones. End result will be an
614 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
615 	 * in this manner.
616 	 */
617 	if (atomic_read(&fb->refcount.refcount) > 1) {
618 		drm_modeset_lock_all(dev);
619 		/* remove from any CRTC */
620 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
621 			if (crtc->primary->fb == fb) {
622 				/* should turn off the crtc */
623 				memset(&set, 0, sizeof(struct drm_mode_set));
624 				set.crtc = crtc;
625 				set.fb = NULL;
626 				ret = drm_mode_set_config_internal(&set);
627 				if (ret)
628 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
629 			}
630 		}
631 
632 		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
633 			if (plane->fb == fb)
634 				drm_plane_force_disable(plane);
635 		}
636 		drm_modeset_unlock_all(dev);
637 	}
638 
639 	drm_framebuffer_unreference(fb);
640 }
641 EXPORT_SYMBOL(drm_framebuffer_remove);
642 
643 DEFINE_WW_CLASS(crtc_ww_class);
644 
645 /**
646  * drm_crtc_init_with_planes - Initialise a new CRTC object with
647  *    specified primary and cursor planes.
648  * @dev: DRM device
649  * @crtc: CRTC object to init
650  * @primary: Primary plane for CRTC
651  * @cursor: Cursor plane for CRTC
652  * @funcs: callbacks for the new CRTC
653  *
654  * Inits a new object created as base part of a driver crtc object.
655  *
656  * Returns:
657  * Zero on success, error code on failure.
658  */
659 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
660 			      struct drm_plane *primary,
661 			      struct drm_plane *cursor,
662 			      const struct drm_crtc_funcs *funcs)
663 {
664 	struct drm_mode_config *config = &dev->mode_config;
665 	int ret;
666 
667 	crtc->dev = dev;
668 	crtc->funcs = funcs;
669 	crtc->invert_dimensions = false;
670 
671 	drm_modeset_lock_init(&crtc->mutex);
672 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
673 	if (ret)
674 		goto out;
675 
676 	crtc->base.properties = &crtc->properties;
677 
678 	list_add_tail(&crtc->head, &config->crtc_list);
679 	config->num_crtc++;
680 
681 	crtc->primary = primary;
682 	crtc->cursor = cursor;
683 	if (primary)
684 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
685 	if (cursor)
686 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
687 
688  out:
689 
690 	return ret;
691 }
692 EXPORT_SYMBOL(drm_crtc_init_with_planes);
693 
694 /**
695  * drm_crtc_cleanup - Clean up the core crtc usage
696  * @crtc: CRTC to cleanup
697  *
698  * This function cleans up @crtc and removes it from the DRM mode setting
699  * core. Note that the function does *not* free the crtc structure itself,
700  * this is the responsibility of the caller.
701  */
702 void drm_crtc_cleanup(struct drm_crtc *crtc)
703 {
704 	struct drm_device *dev = crtc->dev;
705 
706 	kfree(crtc->gamma_store);
707 	crtc->gamma_store = NULL;
708 
709 	drm_modeset_lock_fini(&crtc->mutex);
710 
711 	drm_mode_object_put(dev, &crtc->base);
712 	list_del(&crtc->head);
713 	dev->mode_config.num_crtc--;
714 
715 	WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state);
716 	if (crtc->state && crtc->funcs->atomic_destroy_state)
717 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
718 
719 	memset(crtc, 0, sizeof(*crtc));
720 }
721 EXPORT_SYMBOL(drm_crtc_cleanup);
722 
723 /**
724  * drm_crtc_index - find the index of a registered CRTC
725  * @crtc: CRTC to find index for
726  *
727  * Given a registered CRTC, return the index of that CRTC within a DRM
728  * device's list of CRTCs.
729  */
730 unsigned int drm_crtc_index(struct drm_crtc *crtc)
731 {
732 	unsigned int index = 0;
733 	struct drm_crtc *tmp;
734 
735 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
736 		if (tmp == crtc)
737 			return index;
738 
739 		index++;
740 	}
741 
742 	BUG();
743 }
744 EXPORT_SYMBOL(drm_crtc_index);
745 
746 /*
747  * drm_mode_remove - remove and free a mode
748  * @connector: connector list to modify
749  * @mode: mode to remove
750  *
751  * Remove @mode from @connector's mode list, then free it.
752  */
753 static void drm_mode_remove(struct drm_connector *connector,
754 			    struct drm_display_mode *mode)
755 {
756 	list_del(&mode->head);
757 	drm_mode_destroy(connector->dev, mode);
758 }
759 
760 /**
761  * drm_display_info_set_bus_formats - set the supported bus formats
762  * @info: display info to store bus formats in
763  * @fmts: array containing the supported bus formats
764  * @nfmts: the number of entries in the fmts array
765  *
766  * Store the supported bus formats in display info structure.
767  * See MEDIA_BUS_FMT_* definitions in include/uapi/linux/media-bus-format.h for
768  * a full list of available formats.
769  */
770 int drm_display_info_set_bus_formats(struct drm_display_info *info,
771 				     const u32 *formats,
772 				     unsigned int num_formats)
773 {
774 	u32 *fmts = NULL;
775 
776 	if (!formats && num_formats)
777 		return -EINVAL;
778 
779 	if (formats && num_formats) {
780 		fmts = kmemdup(formats, sizeof(*formats) * num_formats,
781 			       GFP_KERNEL);
782 		if (!fmts)
783 			return -ENOMEM;
784 	}
785 
786 	kfree(info->bus_formats);
787 	info->bus_formats = fmts;
788 	info->num_bus_formats = num_formats;
789 
790 	return 0;
791 }
792 EXPORT_SYMBOL(drm_display_info_set_bus_formats);
793 
794 /**
795  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
796  * @connector: connector to quwery
797  *
798  * The kernel supports per-connector configration of its consoles through
799  * use of the video= parameter. This function parses that option and
800  * extracts the user's specified mode (or enable/disable status) for a
801  * particular connector. This is typically only used during the early fbdev
802  * setup.
803  */
804 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
805 {
806 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
807 	char *option = NULL;
808 
809 	if (fb_get_options(connector->name, &option))
810 		return;
811 
812 	if (!drm_mode_parse_command_line_for_connector(option,
813 						       connector,
814 						       mode))
815 		return;
816 
817 	if (mode->force) {
818 		const char *s;
819 
820 		switch (mode->force) {
821 		case DRM_FORCE_OFF:
822 			s = "OFF";
823 			break;
824 		case DRM_FORCE_ON_DIGITAL:
825 			s = "ON - dig";
826 			break;
827 		default:
828 		case DRM_FORCE_ON:
829 			s = "ON";
830 			break;
831 		}
832 
833 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
834 		connector->force = mode->force;
835 	}
836 
837 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
838 		      connector->name,
839 		      mode->xres, mode->yres,
840 		      mode->refresh_specified ? mode->refresh : 60,
841 		      mode->rb ? " reduced blanking" : "",
842 		      mode->margins ? " with margins" : "",
843 		      mode->interlace ?  " interlaced" : "");
844 }
845 
846 /**
847  * drm_connector_init - Init a preallocated connector
848  * @dev: DRM device
849  * @connector: the connector to init
850  * @funcs: callbacks for this connector
851  * @connector_type: user visible type of the connector
852  *
853  * Initialises a preallocated connector. Connectors should be
854  * subclassed as part of driver connector objects.
855  *
856  * Returns:
857  * Zero on success, error code on failure.
858  */
859 int drm_connector_init(struct drm_device *dev,
860 		       struct drm_connector *connector,
861 		       const struct drm_connector_funcs *funcs,
862 		       int connector_type)
863 {
864 	struct drm_mode_config *config = &dev->mode_config;
865 	int ret;
866 
867 	drm_modeset_lock_all(dev);
868 
869 	ret = drm_mode_object_get(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR);
870 	if (ret)
871 		goto out_unlock;
872 
873 	connector->base.properties = &connector->properties;
874 	connector->dev = dev;
875 	connector->funcs = funcs;
876 	connector->connector_type = connector_type;
877 	connector->connector_type_id =
878 		++drm_connector_enum_list[connector_type].count; /* TODO */
879 	if (connector->connector_type_id < 0) {
880 		ret = connector->connector_type_id;
881 		goto out_put;
882 	}
883 	connector->name =
884 		drm_asprintf(GFP_KERNEL, "%s-%d",
885 			  drm_connector_enum_list[connector_type].name,
886 			  connector->connector_type_id);
887 	if (!connector->name) {
888 		ret = -ENOMEM;
889 		goto out_put;
890 	}
891 
892 	INIT_LIST_HEAD(&connector->probed_modes);
893 	INIT_LIST_HEAD(&connector->modes);
894 	connector->edid_blob_ptr = NULL;
895 	connector->status = connector_status_unknown;
896 
897 	drm_connector_get_cmdline_mode(connector);
898 
899 	/* We should add connectors at the end to avoid upsetting the connector
900 	 * index too much. */
901 	list_add_tail(&connector->head, &config->connector_list);
902 	config->num_connector++;
903 
904 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
905 		drm_object_attach_property(&connector->base,
906 					      config->edid_property,
907 					      0);
908 
909 	drm_object_attach_property(&connector->base,
910 				      config->dpms_property, 0);
911 
912 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
913 		drm_object_attach_property(&connector->base, config->prop_crtc_id, 0);
914 	}
915 
916 	connector->debugfs_entry = NULL;
917 
918 out_put:
919 	if (ret)
920 		drm_mode_object_put(dev, &connector->base);
921 
922 out_unlock:
923 	drm_modeset_unlock_all(dev);
924 
925 	return ret;
926 }
927 EXPORT_SYMBOL(drm_connector_init);
928 
929 /**
930  * drm_connector_cleanup - cleans up an initialised connector
931  * @connector: connector to cleanup
932  *
933  * Cleans up the connector but doesn't free the object.
934  */
935 void drm_connector_cleanup(struct drm_connector *connector)
936 {
937 	struct drm_device *dev = connector->dev;
938 	struct drm_display_mode *mode, *t;
939 
940 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
941 		drm_mode_remove(connector, mode);
942 
943 	list_for_each_entry_safe(mode, t, &connector->modes, head)
944 		drm_mode_remove(connector, mode);
945 
946 	kfree(connector->display_info.bus_formats);
947 	drm_mode_object_put(dev, &connector->base);
948 	kfree(connector->name);
949 	connector->name = NULL;
950 	list_del(&connector->head);
951 	dev->mode_config.num_connector--;
952 
953 	WARN_ON(connector->state && !connector->funcs->atomic_destroy_state);
954 	if (connector->state && connector->funcs->atomic_destroy_state)
955 		connector->funcs->atomic_destroy_state(connector,
956 						       connector->state);
957 
958 	memset(connector, 0, sizeof(*connector));
959 }
960 EXPORT_SYMBOL(drm_connector_cleanup);
961 
962 /**
963  * drm_connector_index - find the index of a registered connector
964  * @connector: connector to find index for
965  *
966  * Given a registered connector, return the index of that connector within a DRM
967  * device's list of connectors.
968  */
969 unsigned int drm_connector_index(struct drm_connector *connector)
970 {
971 	unsigned int index = 0;
972 	struct drm_connector *tmp;
973 	struct drm_mode_config *config = &connector->dev->mode_config;
974 
975 	WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
976 
977 	list_for_each_entry(tmp, &connector->dev->mode_config.connector_list, head) {
978 		if (tmp == connector)
979 			return index;
980 
981 		index++;
982 	}
983 
984 	BUG();
985 }
986 EXPORT_SYMBOL(drm_connector_index);
987 
988 /**
989  * drm_connector_register - register a connector
990  * @connector: the connector to register
991  *
992  * Register userspace interfaces for a connector
993  *
994  * Returns:
995  * Zero on success, error code on failure.
996  */
997 int drm_connector_register(struct drm_connector *connector)
998 {
999 	int ret;
1000 
1001 	drm_mode_object_register(connector->dev, &connector->base);
1002 
1003 	ret = drm_sysfs_connector_add(connector);
1004 	if (ret)
1005 		return ret;
1006 
1007 	ret = drm_debugfs_connector_add(connector);
1008 	if (ret) {
1009 		drm_sysfs_connector_remove(connector);
1010 		return ret;
1011 	}
1012 
1013 	return 0;
1014 }
1015 EXPORT_SYMBOL(drm_connector_register);
1016 
1017 /**
1018  * drm_connector_unregister - unregister a connector
1019  * @connector: the connector to unregister
1020  *
1021  * Unregister userspace interfaces for a connector
1022  */
1023 void drm_connector_unregister(struct drm_connector *connector)
1024 {
1025 	drm_sysfs_connector_remove(connector);
1026 #if 0
1027 	drm_debugfs_connector_remove(connector);
1028 #endif
1029 }
1030 EXPORT_SYMBOL(drm_connector_unregister);
1031 
1032 
1033 /**
1034  * drm_connector_unplug_all - unregister connector userspace interfaces
1035  * @dev: drm device
1036  *
1037  * This function unregisters all connector userspace interfaces in sysfs. Should
1038  * be call when the device is disconnected, e.g. from an usb driver's
1039  * ->disconnect callback.
1040  */
1041 void drm_connector_unplug_all(struct drm_device *dev)
1042 {
1043 	struct drm_connector *connector;
1044 
1045 	/* taking the mode config mutex ends up in a clash with sysfs */
1046 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1047 		drm_connector_unregister(connector);
1048 
1049 }
1050 EXPORT_SYMBOL(drm_connector_unplug_all);
1051 
1052 /**
1053  * drm_encoder_init - Init a preallocated encoder
1054  * @dev: drm device
1055  * @encoder: the encoder to init
1056  * @funcs: callbacks for this encoder
1057  * @encoder_type: user visible type of the encoder
1058  *
1059  * Initialises a preallocated encoder. Encoder should be
1060  * subclassed as part of driver encoder objects.
1061  *
1062  * Returns:
1063  * Zero on success, error code on failure.
1064  */
1065 int drm_encoder_init(struct drm_device *dev,
1066 		      struct drm_encoder *encoder,
1067 		      const struct drm_encoder_funcs *funcs,
1068 		      int encoder_type)
1069 {
1070 	int ret;
1071 
1072 	drm_modeset_lock_all(dev);
1073 
1074 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1075 	if (ret)
1076 		goto out_unlock;
1077 
1078 	encoder->dev = dev;
1079 	encoder->encoder_type = encoder_type;
1080 	encoder->funcs = funcs;
1081 	encoder->name = drm_asprintf(GFP_KERNEL, "%s-%d",
1082 				  drm_encoder_enum_list[encoder_type].name,
1083 				  encoder->base.id);
1084 	if (!encoder->name) {
1085 		ret = -ENOMEM;
1086 		goto out_put;
1087 	}
1088 
1089 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1090 	dev->mode_config.num_encoder++;
1091 
1092 out_put:
1093 	if (ret)
1094 		drm_mode_object_put(dev, &encoder->base);
1095 
1096 out_unlock:
1097 	drm_modeset_unlock_all(dev);
1098 
1099 	return ret;
1100 }
1101 EXPORT_SYMBOL(drm_encoder_init);
1102 
1103 /**
1104  * drm_encoder_cleanup - cleans up an initialised encoder
1105  * @encoder: encoder to cleanup
1106  *
1107  * Cleans up the encoder but doesn't free the object.
1108  */
1109 void drm_encoder_cleanup(struct drm_encoder *encoder)
1110 {
1111 	struct drm_device *dev = encoder->dev;
1112 
1113 	drm_modeset_lock_all(dev);
1114 	drm_mode_object_put(dev, &encoder->base);
1115 	kfree(encoder->name);
1116 	list_del(&encoder->head);
1117 	dev->mode_config.num_encoder--;
1118 	drm_modeset_unlock_all(dev);
1119 
1120 	memset(encoder, 0, sizeof(*encoder));
1121 }
1122 EXPORT_SYMBOL(drm_encoder_cleanup);
1123 
1124 /**
1125  * drm_universal_plane_init - Initialize a new universal plane object
1126  * @dev: DRM device
1127  * @plane: plane object to init
1128  * @possible_crtcs: bitmask of possible CRTCs
1129  * @funcs: callbacks for the new plane
1130  * @formats: array of supported formats (%DRM_FORMAT_*)
1131  * @format_count: number of elements in @formats
1132  * @type: type of plane (overlay, primary, cursor)
1133  *
1134  * Initializes a plane object of type @type.
1135  *
1136  * Returns:
1137  * Zero on success, error code on failure.
1138  */
1139 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1140 			     unsigned long possible_crtcs,
1141 			     const struct drm_plane_funcs *funcs,
1142 			     const uint32_t *formats, uint32_t format_count,
1143 			     enum drm_plane_type type)
1144 {
1145 	struct drm_mode_config *config = &dev->mode_config;
1146 	int ret;
1147 
1148 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1149 	if (ret)
1150 		return ret;
1151 
1152 	drm_modeset_lock_init(&plane->mutex);
1153 
1154 	plane->base.properties = &plane->properties;
1155 	plane->dev = dev;
1156 	plane->funcs = funcs;
1157 	plane->format_types = kmalloc(sizeof(uint32_t) * format_count,
1158 				      M_DRM, M_WAITOK);
1159 	if (!plane->format_types) {
1160 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1161 		drm_mode_object_put(dev, &plane->base);
1162 		return -ENOMEM;
1163 	}
1164 
1165 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1166 	plane->format_count = format_count;
1167 	plane->possible_crtcs = possible_crtcs;
1168 	plane->type = type;
1169 
1170 	list_add_tail(&plane->head, &config->plane_list);
1171 	config->num_total_plane++;
1172 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1173 		config->num_overlay_plane++;
1174 
1175 	drm_object_attach_property(&plane->base,
1176 				   config->plane_type_property,
1177 				   plane->type);
1178 
1179 	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
1180 		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
1181 		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
1182 		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
1183 		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
1184 		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
1185 		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
1186 		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
1187 		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
1188 		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
1189 		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
1190 	}
1191 
1192 	return 0;
1193 }
1194 EXPORT_SYMBOL(drm_universal_plane_init);
1195 
1196 /**
1197  * drm_plane_init - Initialize a legacy plane
1198  * @dev: DRM device
1199  * @plane: plane object to init
1200  * @possible_crtcs: bitmask of possible CRTCs
1201  * @funcs: callbacks for the new plane
1202  * @formats: array of supported formats (%DRM_FORMAT_*)
1203  * @format_count: number of elements in @formats
1204  * @is_primary: plane type (primary vs overlay)
1205  *
1206  * Legacy API to initialize a DRM plane.
1207  *
1208  * New drivers should call drm_universal_plane_init() instead.
1209  *
1210  * Returns:
1211  * Zero on success, error code on failure.
1212  */
1213 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1214 		   unsigned long possible_crtcs,
1215 		   const struct drm_plane_funcs *funcs,
1216 		   const uint32_t *formats, uint32_t format_count,
1217 		   bool is_primary)
1218 {
1219 	enum drm_plane_type type;
1220 
1221 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1222 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1223 					formats, format_count, type);
1224 }
1225 EXPORT_SYMBOL(drm_plane_init);
1226 
1227 /**
1228  * drm_plane_cleanup - Clean up the core plane usage
1229  * @plane: plane to cleanup
1230  *
1231  * This function cleans up @plane and removes it from the DRM mode setting
1232  * core. Note that the function does *not* free the plane structure itself,
1233  * this is the responsibility of the caller.
1234  */
1235 void drm_plane_cleanup(struct drm_plane *plane)
1236 {
1237 	struct drm_device *dev = plane->dev;
1238 
1239 	drm_modeset_lock_all(dev);
1240 	kfree(plane->format_types);
1241 	drm_mode_object_put(dev, &plane->base);
1242 
1243 	BUG_ON(list_empty(&plane->head));
1244 
1245 	list_del(&plane->head);
1246 	dev->mode_config.num_total_plane--;
1247 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1248 		dev->mode_config.num_overlay_plane--;
1249 	drm_modeset_unlock_all(dev);
1250 
1251 	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
1252 	if (plane->state && plane->funcs->atomic_destroy_state)
1253 		plane->funcs->atomic_destroy_state(plane, plane->state);
1254 
1255 	memset(plane, 0, sizeof(*plane));
1256 }
1257 EXPORT_SYMBOL(drm_plane_cleanup);
1258 
1259 /**
1260  * drm_plane_index - find the index of a registered plane
1261  * @plane: plane to find index for
1262  *
1263  * Given a registered plane, return the index of that CRTC within a DRM
1264  * device's list of planes.
1265  */
1266 unsigned int drm_plane_index(struct drm_plane *plane)
1267 {
1268 	unsigned int index = 0;
1269 	struct drm_plane *tmp;
1270 
1271 	list_for_each_entry(tmp, &plane->dev->mode_config.plane_list, head) {
1272 		if (tmp == plane)
1273 			return index;
1274 
1275 		index++;
1276 	}
1277 
1278 	BUG();
1279 }
1280 EXPORT_SYMBOL(drm_plane_index);
1281 
1282 /**
1283  * drm_plane_force_disable - Forcibly disable a plane
1284  * @plane: plane to disable
1285  *
1286  * Forces the plane to be disabled.
1287  *
1288  * Used when the plane's current framebuffer is destroyed,
1289  * and when restoring fbdev mode.
1290  */
1291 void drm_plane_force_disable(struct drm_plane *plane)
1292 {
1293 	int ret;
1294 
1295 	if (!plane->fb)
1296 		return;
1297 
1298 	plane->old_fb = plane->fb;
1299 	ret = plane->funcs->disable_plane(plane);
1300 	if (ret) {
1301 		DRM_ERROR("failed to disable plane with busy fb\n");
1302 		plane->old_fb = NULL;
1303 		return;
1304 	}
1305 	/* disconnect the plane from the fb and crtc: */
1306 	drm_framebuffer_unreference(plane->old_fb);
1307 	plane->old_fb = NULL;
1308 	plane->fb = NULL;
1309 	plane->crtc = NULL;
1310 }
1311 EXPORT_SYMBOL(drm_plane_force_disable);
1312 
1313 static int drm_mode_create_standard_properties(struct drm_device *dev)
1314 {
1315 	struct drm_property *prop;
1316 
1317 	/*
1318 	 * Standard properties (apply to all connectors)
1319 	 */
1320 	prop = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1321 				   DRM_MODE_PROP_IMMUTABLE,
1322 				   "EDID", 0);
1323 	if (!prop)
1324 		return -ENOMEM;
1325 	dev->mode_config.edid_property = prop;
1326 
1327 	prop = drm_property_create_enum(dev, 0,
1328 				   "DPMS", drm_dpms_enum_list,
1329 				   ARRAY_SIZE(drm_dpms_enum_list));
1330 	if (!prop)
1331 		return -ENOMEM;
1332 	dev->mode_config.dpms_property = prop;
1333 
1334 	prop = drm_property_create(dev,
1335 				   DRM_MODE_PROP_BLOB |
1336 				   DRM_MODE_PROP_IMMUTABLE,
1337 				   "PATH", 0);
1338 	if (!prop)
1339 		return -ENOMEM;
1340 	dev->mode_config.path_property = prop;
1341 
1342 	prop = drm_property_create(dev,
1343 				   DRM_MODE_PROP_BLOB |
1344 				   DRM_MODE_PROP_IMMUTABLE,
1345 				   "TILE", 0);
1346 	if (!prop)
1347 		return -ENOMEM;
1348 	dev->mode_config.tile_property = prop;
1349 
1350 	prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1351 					"type", drm_plane_type_enum_list,
1352 					ARRAY_SIZE(drm_plane_type_enum_list));
1353 	if (!prop)
1354 		return -ENOMEM;
1355 	dev->mode_config.plane_type_property = prop;
1356 
1357 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1358 			"SRC_X", 0, UINT_MAX);
1359 	if (!prop)
1360 		return -ENOMEM;
1361 	dev->mode_config.prop_src_x = prop;
1362 
1363 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1364 			"SRC_Y", 0, UINT_MAX);
1365 	if (!prop)
1366 		return -ENOMEM;
1367 	dev->mode_config.prop_src_y = prop;
1368 
1369 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1370 			"SRC_W", 0, UINT_MAX);
1371 	if (!prop)
1372 		return -ENOMEM;
1373 	dev->mode_config.prop_src_w = prop;
1374 
1375 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1376 			"SRC_H", 0, UINT_MAX);
1377 	if (!prop)
1378 		return -ENOMEM;
1379 	dev->mode_config.prop_src_h = prop;
1380 
1381 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1382 			"CRTC_X", INT_MIN, INT_MAX);
1383 	if (!prop)
1384 		return -ENOMEM;
1385 	dev->mode_config.prop_crtc_x = prop;
1386 
1387 	prop = drm_property_create_signed_range(dev, DRM_MODE_PROP_ATOMIC,
1388 			"CRTC_Y", INT_MIN, INT_MAX);
1389 	if (!prop)
1390 		return -ENOMEM;
1391 	dev->mode_config.prop_crtc_y = prop;
1392 
1393 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1394 			"CRTC_W", 0, INT_MAX);
1395 	if (!prop)
1396 		return -ENOMEM;
1397 	dev->mode_config.prop_crtc_w = prop;
1398 
1399 	prop = drm_property_create_range(dev, DRM_MODE_PROP_ATOMIC,
1400 			"CRTC_H", 0, INT_MAX);
1401 	if (!prop)
1402 		return -ENOMEM;
1403 	dev->mode_config.prop_crtc_h = prop;
1404 
1405 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1406 			"FB_ID", DRM_MODE_OBJECT_FB);
1407 	if (!prop)
1408 		return -ENOMEM;
1409 	dev->mode_config.prop_fb_id = prop;
1410 
1411 	prop = drm_property_create_object(dev, DRM_MODE_PROP_ATOMIC,
1412 			"CRTC_ID", DRM_MODE_OBJECT_CRTC);
1413 	if (!prop)
1414 		return -ENOMEM;
1415 	dev->mode_config.prop_crtc_id = prop;
1416 
1417 	prop = drm_property_create_bool(dev, DRM_MODE_PROP_ATOMIC,
1418 			"ACTIVE");
1419 	if (!prop)
1420 		return -ENOMEM;
1421 	dev->mode_config.prop_active = prop;
1422 
1423 	return 0;
1424 }
1425 
1426 /**
1427  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1428  * @dev: DRM device
1429  *
1430  * Called by a driver the first time a DVI-I connector is made.
1431  */
1432 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1433 {
1434 	struct drm_property *dvi_i_selector;
1435 	struct drm_property *dvi_i_subconnector;
1436 
1437 	if (dev->mode_config.dvi_i_select_subconnector_property)
1438 		return 0;
1439 
1440 	dvi_i_selector =
1441 		drm_property_create_enum(dev, 0,
1442 				    "select subconnector",
1443 				    drm_dvi_i_select_enum_list,
1444 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1445 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1446 
1447 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1448 				    "subconnector",
1449 				    drm_dvi_i_subconnector_enum_list,
1450 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1451 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1452 
1453 	return 0;
1454 }
1455 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1456 
1457 /**
1458  * drm_create_tv_properties - create TV specific connector properties
1459  * @dev: DRM device
1460  * @num_modes: number of different TV formats (modes) supported
1461  * @modes: array of pointers to strings containing name of each format
1462  *
1463  * Called by a driver's TV initialization routine, this function creates
1464  * the TV specific connector properties for a given device.  Caller is
1465  * responsible for allocating a list of format names and passing them to
1466  * this routine.
1467  */
1468 int drm_mode_create_tv_properties(struct drm_device *dev,
1469 				  unsigned int num_modes,
1470 				  char *modes[])
1471 {
1472 	struct drm_property *tv_selector;
1473 	struct drm_property *tv_subconnector;
1474 	unsigned int i;
1475 
1476 	if (dev->mode_config.tv_select_subconnector_property)
1477 		return 0;
1478 
1479 	/*
1480 	 * Basic connector properties
1481 	 */
1482 	tv_selector = drm_property_create_enum(dev, 0,
1483 					  "select subconnector",
1484 					  drm_tv_select_enum_list,
1485 					  ARRAY_SIZE(drm_tv_select_enum_list));
1486 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1487 
1488 	tv_subconnector =
1489 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1490 				    "subconnector",
1491 				    drm_tv_subconnector_enum_list,
1492 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1493 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1494 
1495 	/*
1496 	 * Other, TV specific properties: margins & TV modes.
1497 	 */
1498 	dev->mode_config.tv_left_margin_property =
1499 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1500 
1501 	dev->mode_config.tv_right_margin_property =
1502 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1503 
1504 	dev->mode_config.tv_top_margin_property =
1505 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1506 
1507 	dev->mode_config.tv_bottom_margin_property =
1508 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1509 
1510 	dev->mode_config.tv_mode_property =
1511 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1512 				    "mode", num_modes);
1513 	for (i = 0; i < num_modes; i++)
1514 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1515 				      i, modes[i]);
1516 
1517 	dev->mode_config.tv_brightness_property =
1518 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1519 
1520 	dev->mode_config.tv_contrast_property =
1521 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1522 
1523 	dev->mode_config.tv_flicker_reduction_property =
1524 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1525 
1526 	dev->mode_config.tv_overscan_property =
1527 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1528 
1529 	dev->mode_config.tv_saturation_property =
1530 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1531 
1532 	dev->mode_config.tv_hue_property =
1533 		drm_property_create_range(dev, 0, "hue", 0, 100);
1534 
1535 	return 0;
1536 }
1537 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1538 
1539 /**
1540  * drm_mode_create_scaling_mode_property - create scaling mode property
1541  * @dev: DRM device
1542  *
1543  * Called by a driver the first time it's needed, must be attached to desired
1544  * connectors.
1545  */
1546 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1547 {
1548 	struct drm_property *scaling_mode;
1549 
1550 	if (dev->mode_config.scaling_mode_property)
1551 		return 0;
1552 
1553 	scaling_mode =
1554 		drm_property_create_enum(dev, 0, "scaling mode",
1555 				drm_scaling_mode_enum_list,
1556 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1557 
1558 	dev->mode_config.scaling_mode_property = scaling_mode;
1559 
1560 	return 0;
1561 }
1562 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1563 
1564 /**
1565  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1566  * @dev: DRM device
1567  *
1568  * Called by a driver the first time it's needed, must be attached to desired
1569  * connectors.
1570  *
1571  * Returns:
1572  * Zero on success, negative errno on failure.
1573  */
1574 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1575 {
1576 	if (dev->mode_config.aspect_ratio_property)
1577 		return 0;
1578 
1579 	dev->mode_config.aspect_ratio_property =
1580 		drm_property_create_enum(dev, 0, "aspect ratio",
1581 				drm_aspect_ratio_enum_list,
1582 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1583 
1584 	if (dev->mode_config.aspect_ratio_property == NULL)
1585 		return -ENOMEM;
1586 
1587 	return 0;
1588 }
1589 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1590 
1591 /**
1592  * drm_mode_create_dirty_property - create dirty property
1593  * @dev: DRM device
1594  *
1595  * Called by a driver the first time it's needed, must be attached to desired
1596  * connectors.
1597  */
1598 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1599 {
1600 	struct drm_property *dirty_info;
1601 
1602 	if (dev->mode_config.dirty_info_property)
1603 		return 0;
1604 
1605 	dirty_info =
1606 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1607 				    "dirty",
1608 				    drm_dirty_info_enum_list,
1609 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1610 	dev->mode_config.dirty_info_property = dirty_info;
1611 
1612 	return 0;
1613 }
1614 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1615 
1616 /**
1617  * drm_mode_create_suggested_offset_properties - create suggests offset properties
1618  * @dev: DRM device
1619  *
1620  * Create the the suggested x/y offset property for connectors.
1621  */
1622 int drm_mode_create_suggested_offset_properties(struct drm_device *dev)
1623 {
1624 	if (dev->mode_config.suggested_x_property && dev->mode_config.suggested_y_property)
1625 		return 0;
1626 
1627 	dev->mode_config.suggested_x_property =
1628 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested X", 0, 0xffffffff);
1629 
1630 	dev->mode_config.suggested_y_property =
1631 		drm_property_create_range(dev, DRM_MODE_PROP_IMMUTABLE, "suggested Y", 0, 0xffffffff);
1632 
1633 	if (dev->mode_config.suggested_x_property == NULL ||
1634 	    dev->mode_config.suggested_y_property == NULL)
1635 		return -ENOMEM;
1636 	return 0;
1637 }
1638 EXPORT_SYMBOL(drm_mode_create_suggested_offset_properties);
1639 
1640 static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
1641 {
1642 	uint32_t total_objects = 0;
1643 
1644 	total_objects += dev->mode_config.num_crtc;
1645 	total_objects += dev->mode_config.num_connector;
1646 	total_objects += dev->mode_config.num_encoder;
1647 
1648 	group->id_list = kcalloc(total_objects, sizeof(uint32_t), GFP_KERNEL);
1649 	if (!group->id_list)
1650 		return -ENOMEM;
1651 
1652 	group->num_crtcs = 0;
1653 	group->num_connectors = 0;
1654 	group->num_encoders = 0;
1655 	return 0;
1656 }
1657 
1658 void drm_mode_group_destroy(struct drm_mode_group *group)
1659 {
1660 	kfree(group->id_list);
1661 	group->id_list = NULL;
1662 }
1663 
1664 /*
1665  * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
1666  * the drm core's responsibility to set up mode control groups.
1667  */
1668 int drm_mode_group_init_legacy_group(struct drm_device *dev,
1669 				     struct drm_mode_group *group)
1670 {
1671 	struct drm_crtc *crtc;
1672 	struct drm_encoder *encoder;
1673 	struct drm_connector *connector;
1674 	int ret;
1675 
1676 	ret = drm_mode_group_init(dev, group);
1677 	if (ret)
1678 		return ret;
1679 
1680 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
1681 		group->id_list[group->num_crtcs++] = crtc->base.id;
1682 
1683 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
1684 		group->id_list[group->num_crtcs + group->num_encoders++] =
1685 		encoder->base.id;
1686 
1687 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1688 		group->id_list[group->num_crtcs + group->num_encoders +
1689 			       group->num_connectors++] = connector->base.id;
1690 
1691 	return 0;
1692 }
1693 EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
1694 
1695 void drm_reinit_primary_mode_group(struct drm_device *dev)
1696 {
1697 	drm_modeset_lock_all(dev);
1698 	drm_mode_group_destroy(&dev->primary->mode_group);
1699 	drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
1700 	drm_modeset_unlock_all(dev);
1701 }
1702 EXPORT_SYMBOL(drm_reinit_primary_mode_group);
1703 
1704 /**
1705  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
1706  * @out: drm_mode_modeinfo struct to return to the user
1707  * @in: drm_display_mode to use
1708  *
1709  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
1710  * the user.
1711  */
1712 static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
1713 				      const struct drm_display_mode *in)
1714 {
1715 	WARN(in->hdisplay > USHRT_MAX || in->hsync_start > USHRT_MAX ||
1716 	     in->hsync_end > USHRT_MAX || in->htotal > USHRT_MAX ||
1717 	     in->hskew > USHRT_MAX || in->vdisplay > USHRT_MAX ||
1718 	     in->vsync_start > USHRT_MAX || in->vsync_end > USHRT_MAX ||
1719 	     in->vtotal > USHRT_MAX || in->vscan > USHRT_MAX,
1720 	     "timing values too large for mode info\n");
1721 
1722 	out->clock = in->clock;
1723 	out->hdisplay = in->hdisplay;
1724 	out->hsync_start = in->hsync_start;
1725 	out->hsync_end = in->hsync_end;
1726 	out->htotal = in->htotal;
1727 	out->hskew = in->hskew;
1728 	out->vdisplay = in->vdisplay;
1729 	out->vsync_start = in->vsync_start;
1730 	out->vsync_end = in->vsync_end;
1731 	out->vtotal = in->vtotal;
1732 	out->vscan = in->vscan;
1733 	out->vrefresh = in->vrefresh;
1734 	out->flags = in->flags;
1735 	out->type = in->type;
1736 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1737 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1738 }
1739 
1740 /**
1741  * drm_crtc_convert_umode - convert a modeinfo into a drm_display_mode
1742  * @out: drm_display_mode to return to the user
1743  * @in: drm_mode_modeinfo to use
1744  *
1745  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
1746  * the caller.
1747  *
1748  * Returns:
1749  * Zero on success, negative errno on failure.
1750  */
1751 static int drm_crtc_convert_umode(struct drm_display_mode *out,
1752 				  const struct drm_mode_modeinfo *in)
1753 {
1754 	if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
1755 		return -ERANGE;
1756 
1757 	if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
1758 		return -EINVAL;
1759 
1760 	out->clock = in->clock;
1761 	out->hdisplay = in->hdisplay;
1762 	out->hsync_start = in->hsync_start;
1763 	out->hsync_end = in->hsync_end;
1764 	out->htotal = in->htotal;
1765 	out->hskew = in->hskew;
1766 	out->vdisplay = in->vdisplay;
1767 	out->vsync_start = in->vsync_start;
1768 	out->vsync_end = in->vsync_end;
1769 	out->vtotal = in->vtotal;
1770 	out->vscan = in->vscan;
1771 	out->vrefresh = in->vrefresh;
1772 	out->flags = in->flags;
1773 	out->type = in->type;
1774 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1775 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1776 
1777 	return 0;
1778 }
1779 
1780 /**
1781  * drm_mode_getresources - get graphics configuration
1782  * @dev: drm device for the ioctl
1783  * @data: data pointer for the ioctl
1784  * @file_priv: drm file for the ioctl call
1785  *
1786  * Construct a set of configuration description structures and return
1787  * them to the user, including CRTC, connector and framebuffer configuration.
1788  *
1789  * Called by the user via ioctl.
1790  *
1791  * Returns:
1792  * Zero on success, negative errno on failure.
1793  */
1794 int drm_mode_getresources(struct drm_device *dev, void *data,
1795 			  struct drm_file *file_priv)
1796 {
1797 	struct drm_mode_card_res *card_res = data;
1798 	struct list_head *lh;
1799 	struct drm_framebuffer *fb;
1800 	struct drm_connector *connector;
1801 	struct drm_crtc *crtc;
1802 	struct drm_encoder *encoder;
1803 	int ret = 0;
1804 	int connector_count = 0;
1805 	int crtc_count = 0;
1806 	int fb_count = 0;
1807 	int encoder_count = 0;
1808 	int copied = 0, i;
1809 	uint32_t __user *fb_id;
1810 	uint32_t __user *crtc_id;
1811 	uint32_t __user *connector_id;
1812 	uint32_t __user *encoder_id;
1813 	struct drm_mode_group *mode_group;
1814 
1815 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1816 		return -EINVAL;
1817 
1818 
1819 	mutex_lock(&file_priv->fbs_lock);
1820 	/*
1821 	 * For the non-control nodes we need to limit the list of resources
1822 	 * by IDs in the group list for this node
1823 	 */
1824 	list_for_each(lh, &file_priv->fbs)
1825 		fb_count++;
1826 
1827 	/* handle this in 4 parts */
1828 	/* FBs */
1829 	if (card_res->count_fbs >= fb_count) {
1830 		copied = 0;
1831 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1832 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1833 			if (put_user(fb->base.id, fb_id + copied)) {
1834 				mutex_unlock(&file_priv->fbs_lock);
1835 				return -EFAULT;
1836 			}
1837 			copied++;
1838 		}
1839 	}
1840 	card_res->count_fbs = fb_count;
1841 	mutex_unlock(&file_priv->fbs_lock);
1842 
1843 	/* mode_config.mutex protects the connector list against e.g. DP MST
1844 	 * connector hot-adding. CRTC/Plane lists are invariant. */
1845 	mutex_lock(&dev->mode_config.mutex);
1846 	if (!drm_is_primary_client(file_priv)) {
1847 
1848 		mode_group = NULL;
1849 		list_for_each(lh, &dev->mode_config.crtc_list)
1850 			crtc_count++;
1851 
1852 		list_for_each(lh, &dev->mode_config.connector_list)
1853 			connector_count++;
1854 
1855 		list_for_each(lh, &dev->mode_config.encoder_list)
1856 			encoder_count++;
1857 #if 0
1858 	} else {
1859 
1860 		mode_group = &file_priv->master->minor->mode_group;
1861 		crtc_count = mode_group->num_crtcs;
1862 		connector_count = mode_group->num_connectors;
1863 		encoder_count = mode_group->num_encoders;
1864 #endif
1865 	}
1866 
1867 	card_res->max_height = dev->mode_config.max_height;
1868 	card_res->min_height = dev->mode_config.min_height;
1869 	card_res->max_width = dev->mode_config.max_width;
1870 	card_res->min_width = dev->mode_config.min_width;
1871 
1872 	/* CRTCs */
1873 	if (card_res->count_crtcs >= crtc_count) {
1874 		copied = 0;
1875 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1876 		if (!mode_group) {
1877 			list_for_each_entry(crtc, &dev->mode_config.crtc_list,
1878 					    head) {
1879 				DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1880 				if (put_user(crtc->base.id, crtc_id + copied)) {
1881 					ret = -EFAULT;
1882 					goto out;
1883 				}
1884 				copied++;
1885 			}
1886 		} else {
1887 			for (i = 0; i < mode_group->num_crtcs; i++) {
1888 				if (put_user(mode_group->id_list[i],
1889 					     crtc_id + copied)) {
1890 					ret = -EFAULT;
1891 					goto out;
1892 				}
1893 				copied++;
1894 			}
1895 		}
1896 	}
1897 	card_res->count_crtcs = crtc_count;
1898 
1899 	/* Encoders */
1900 	if (card_res->count_encoders >= encoder_count) {
1901 		copied = 0;
1902 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1903 		if (!mode_group) {
1904 			list_for_each_entry(encoder,
1905 					    &dev->mode_config.encoder_list,
1906 					    head) {
1907 				DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1908 						encoder->name);
1909 				if (put_user(encoder->base.id, encoder_id +
1910 					     copied)) {
1911 					ret = -EFAULT;
1912 					goto out;
1913 				}
1914 				copied++;
1915 			}
1916 		} else {
1917 			for (i = mode_group->num_crtcs; i < mode_group->num_crtcs + mode_group->num_encoders; i++) {
1918 				if (put_user(mode_group->id_list[i],
1919 					     encoder_id + copied)) {
1920 					ret = -EFAULT;
1921 					goto out;
1922 				}
1923 				copied++;
1924 			}
1925 
1926 		}
1927 	}
1928 	card_res->count_encoders = encoder_count;
1929 
1930 	/* Connectors */
1931 	if (card_res->count_connectors >= connector_count) {
1932 		copied = 0;
1933 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1934 		if (!mode_group) {
1935 			list_for_each_entry(connector,
1936 					    &dev->mode_config.connector_list,
1937 					    head) {
1938 				DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1939 					connector->base.id,
1940 					connector->name);
1941 				if (put_user(connector->base.id,
1942 					     connector_id + copied)) {
1943 					ret = -EFAULT;
1944 					goto out;
1945 				}
1946 				copied++;
1947 			}
1948 		} else {
1949 			int start = mode_group->num_crtcs +
1950 				mode_group->num_encoders;
1951 			for (i = start; i < start + mode_group->num_connectors; i++) {
1952 				if (put_user(mode_group->id_list[i],
1953 					     connector_id + copied)) {
1954 					ret = -EFAULT;
1955 					goto out;
1956 				}
1957 				copied++;
1958 			}
1959 		}
1960 	}
1961 	card_res->count_connectors = connector_count;
1962 
1963 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1964 		  card_res->count_connectors, card_res->count_encoders);
1965 
1966 out:
1967 	mutex_unlock(&dev->mode_config.mutex);
1968 	return ret;
1969 }
1970 
1971 /**
1972  * drm_mode_getcrtc - get CRTC configuration
1973  * @dev: drm device for the ioctl
1974  * @data: data pointer for the ioctl
1975  * @file_priv: drm file for the ioctl call
1976  *
1977  * Construct a CRTC configuration structure to return to the user.
1978  *
1979  * Called by the user via ioctl.
1980  *
1981  * Returns:
1982  * Zero on success, negative errno on failure.
1983  */
1984 int drm_mode_getcrtc(struct drm_device *dev,
1985 		     void *data, struct drm_file *file_priv)
1986 {
1987 	struct drm_mode_crtc *crtc_resp = data;
1988 	struct drm_crtc *crtc;
1989 
1990 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1991 		return -EINVAL;
1992 
1993 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1994 	if (!crtc)
1995 		return -ENOENT;
1996 
1997 	drm_modeset_lock_crtc(crtc, crtc->primary);
1998 	crtc_resp->x = crtc->x;
1999 	crtc_resp->y = crtc->y;
2000 	crtc_resp->gamma_size = crtc->gamma_size;
2001 	if (crtc->primary->fb)
2002 		crtc_resp->fb_id = crtc->primary->fb->base.id;
2003 	else
2004 		crtc_resp->fb_id = 0;
2005 
2006 	if (crtc->enabled) {
2007 
2008 		drm_crtc_convert_to_umode(&crtc_resp->mode, &crtc->mode);
2009 		crtc_resp->mode_valid = 1;
2010 
2011 	} else {
2012 		crtc_resp->mode_valid = 0;
2013 	}
2014 	drm_modeset_unlock_crtc(crtc);
2015 
2016 	return 0;
2017 }
2018 
2019 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
2020 					 const struct drm_file *file_priv)
2021 {
2022 	/*
2023 	 * If user-space hasn't configured the driver to expose the stereo 3D
2024 	 * modes, don't expose them.
2025 	 */
2026 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
2027 		return false;
2028 
2029 	return true;
2030 }
2031 
2032 static struct drm_encoder *drm_connector_get_encoder(struct drm_connector *connector)
2033 {
2034 	/* For atomic drivers only state objects are synchronously updated and
2035 	 * protected by modeset locks, so check those first. */
2036 	if (connector->state)
2037 		return connector->state->best_encoder;
2038 	return connector->encoder;
2039 }
2040 
2041 /* helper for getconnector and getproperties ioctls */
2042 static int get_properties(struct drm_mode_object *obj, bool atomic,
2043 		uint32_t __user *prop_ptr, uint64_t __user *prop_values,
2044 		uint32_t *arg_count_props)
2045 {
2046 	int props_count;
2047 	int i, ret, copied;
2048 
2049 	props_count = obj->properties->count;
2050 	if (!atomic)
2051 		props_count -= obj->properties->atomic_count;
2052 
2053 	if ((*arg_count_props >= props_count) && props_count) {
2054 		for (i = 0, copied = 0; copied < props_count; i++) {
2055 			struct drm_property *prop = obj->properties->properties[i];
2056 			uint64_t val;
2057 
2058 			if ((prop->flags & DRM_MODE_PROP_ATOMIC) && !atomic)
2059 				continue;
2060 
2061 			ret = drm_object_property_get_value(obj, prop, &val);
2062 			if (ret)
2063 				return ret;
2064 
2065 			if (put_user(prop->base.id, prop_ptr + copied))
2066 				return -EFAULT;
2067 
2068 			if (put_user(val, prop_values + copied))
2069 				return -EFAULT;
2070 
2071 			copied++;
2072 		}
2073 	}
2074 	*arg_count_props = props_count;
2075 
2076 	return 0;
2077 }
2078 
2079 /**
2080  * drm_mode_getconnector - get connector configuration
2081  * @dev: drm device for the ioctl
2082  * @data: data pointer for the ioctl
2083  * @file_priv: drm file for the ioctl call
2084  *
2085  * Construct a connector configuration structure to return to the user.
2086  *
2087  * Called by the user via ioctl.
2088  *
2089  * Returns:
2090  * Zero on success, negative errno on failure.
2091  */
2092 int drm_mode_getconnector(struct drm_device *dev, void *data,
2093 			  struct drm_file *file_priv)
2094 {
2095 	struct drm_mode_get_connector *out_resp = data;
2096 	struct drm_connector *connector;
2097 	struct drm_encoder *encoder;
2098 	struct drm_display_mode *mode;
2099 	int mode_count = 0;
2100 	int encoders_count = 0;
2101 	int ret = 0;
2102 	int copied = 0;
2103 	int i;
2104 	struct drm_mode_modeinfo u_mode;
2105 	struct drm_mode_modeinfo __user *mode_ptr;
2106 	uint32_t __user *encoder_ptr;
2107 
2108 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2109 		return -EINVAL;
2110 
2111 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
2112 
2113 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
2114 
2115 	mutex_lock(&dev->mode_config.mutex);
2116 
2117 	connector = drm_connector_find(dev, out_resp->connector_id);
2118 	if (!connector) {
2119 		ret = -ENOENT;
2120 		goto out_unlock;
2121 	}
2122 
2123 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
2124 		if (connector->encoder_ids[i] != 0)
2125 			encoders_count++;
2126 
2127 	if (out_resp->count_modes == 0) {
2128 		connector->funcs->fill_modes(connector,
2129 					     dev->mode_config.max_width,
2130 					     dev->mode_config.max_height);
2131 	}
2132 
2133 	/* delayed so we get modes regardless of pre-fill_modes state */
2134 	list_for_each_entry(mode, &connector->modes, head)
2135 		if (drm_mode_expose_to_userspace(mode, file_priv))
2136 			mode_count++;
2137 
2138 	out_resp->connector_id = connector->base.id;
2139 	out_resp->connector_type = connector->connector_type;
2140 	out_resp->connector_type_id = connector->connector_type_id;
2141 	out_resp->mm_width = connector->display_info.width_mm;
2142 	out_resp->mm_height = connector->display_info.height_mm;
2143 	out_resp->subpixel = connector->display_info.subpixel_order;
2144 	out_resp->connection = connector->status;
2145 
2146 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2147 	encoder = drm_connector_get_encoder(connector);
2148 	if (encoder)
2149 		out_resp->encoder_id = encoder->base.id;
2150 	else
2151 		out_resp->encoder_id = 0;
2152 
2153 	/*
2154 	 * This ioctl is called twice, once to determine how much space is
2155 	 * needed, and the 2nd time to fill it.
2156 	 */
2157 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2158 		copied = 0;
2159 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2160 		list_for_each_entry(mode, &connector->modes, head) {
2161 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2162 				continue;
2163 
2164 			drm_crtc_convert_to_umode(&u_mode, mode);
2165 			if (copy_to_user(mode_ptr + copied,
2166 					 &u_mode, sizeof(u_mode))) {
2167 				ret = -EFAULT;
2168 				goto out;
2169 			}
2170 			copied++;
2171 		}
2172 	}
2173 	out_resp->count_modes = mode_count;
2174 
2175 	ret = get_properties(&connector->base, file_priv->atomic,
2176 			(uint32_t __user *)(unsigned long)(out_resp->props_ptr),
2177 			(uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
2178 			&out_resp->count_props);
2179 	if (ret)
2180 		goto out;
2181 
2182 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2183 		copied = 0;
2184 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2185 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2186 			if (connector->encoder_ids[i] != 0) {
2187 				if (put_user(connector->encoder_ids[i],
2188 					     encoder_ptr + copied)) {
2189 					ret = -EFAULT;
2190 					goto out;
2191 				}
2192 				copied++;
2193 			}
2194 		}
2195 	}
2196 	out_resp->count_encoders = encoders_count;
2197 
2198 out:
2199 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2200 
2201 out_unlock:
2202 	mutex_unlock(&dev->mode_config.mutex);
2203 
2204 	return ret;
2205 }
2206 
2207 static struct drm_crtc *drm_encoder_get_crtc(struct drm_encoder *encoder)
2208 {
2209 	struct drm_connector *connector;
2210 	struct drm_device *dev = encoder->dev;
2211 	bool uses_atomic = false;
2212 
2213 	/* For atomic drivers only state objects are synchronously updated and
2214 	 * protected by modeset locks, so check those first. */
2215 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
2216 		if (!connector->state)
2217 			continue;
2218 
2219 		uses_atomic = true;
2220 
2221 		if (connector->state->best_encoder != encoder)
2222 			continue;
2223 
2224 		return connector->state->crtc;
2225 	}
2226 
2227 	/* Don't return stale data (e.g. pending async disable). */
2228 	if (uses_atomic)
2229 		return NULL;
2230 
2231 	return encoder->crtc;
2232 }
2233 
2234 /**
2235  * drm_mode_getencoder - get encoder configuration
2236  * @dev: drm device for the ioctl
2237  * @data: data pointer for the ioctl
2238  * @file_priv: drm file for the ioctl call
2239  *
2240  * Construct a encoder configuration structure to return to the user.
2241  *
2242  * Called by the user via ioctl.
2243  *
2244  * Returns:
2245  * Zero on success, negative errno on failure.
2246  */
2247 int drm_mode_getencoder(struct drm_device *dev, void *data,
2248 			struct drm_file *file_priv)
2249 {
2250 	struct drm_mode_get_encoder *enc_resp = data;
2251 	struct drm_encoder *encoder;
2252 	struct drm_crtc *crtc;
2253 
2254 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2255 		return -EINVAL;
2256 
2257 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2258 	if (!encoder)
2259 		return -ENOENT;
2260 
2261 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
2262 	crtc = drm_encoder_get_crtc(encoder);
2263 	if (crtc)
2264 		enc_resp->crtc_id = crtc->base.id;
2265 	else if (encoder->crtc)
2266 		enc_resp->crtc_id = encoder->crtc->base.id;
2267 	else
2268 		enc_resp->crtc_id = 0;
2269 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2270 
2271 	enc_resp->encoder_type = encoder->encoder_type;
2272 	enc_resp->encoder_id = encoder->base.id;
2273 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2274 	enc_resp->possible_clones = encoder->possible_clones;
2275 
2276 	return 0;
2277 }
2278 
2279 /**
2280  * drm_mode_getplane_res - enumerate all plane resources
2281  * @dev: DRM device
2282  * @data: ioctl data
2283  * @file_priv: DRM file info
2284  *
2285  * Construct a list of plane ids to return to the user.
2286  *
2287  * Called by the user via ioctl.
2288  *
2289  * Returns:
2290  * Zero on success, negative errno on failure.
2291  */
2292 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2293 			  struct drm_file *file_priv)
2294 {
2295 	struct drm_mode_get_plane_res *plane_resp = data;
2296 	struct drm_mode_config *config;
2297 	struct drm_plane *plane;
2298 	uint32_t __user *plane_ptr;
2299 	int copied = 0;
2300 	unsigned num_planes;
2301 
2302 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2303 		return -EINVAL;
2304 
2305 	config = &dev->mode_config;
2306 
2307 	if (file_priv->universal_planes)
2308 		num_planes = config->num_total_plane;
2309 	else
2310 		num_planes = config->num_overlay_plane;
2311 
2312 	/*
2313 	 * This ioctl is called twice, once to determine how much space is
2314 	 * needed, and the 2nd time to fill it.
2315 	 */
2316 	if (num_planes &&
2317 	    (plane_resp->count_planes >= num_planes)) {
2318 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2319 
2320 		/* Plane lists are invariant, no locking needed. */
2321 		list_for_each_entry(plane, &config->plane_list, head) {
2322 			/*
2323 			 * Unless userspace set the 'universal planes'
2324 			 * capability bit, only advertise overlays.
2325 			 */
2326 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2327 			    !file_priv->universal_planes)
2328 				continue;
2329 
2330 			if (put_user(plane->base.id, plane_ptr + copied))
2331 				return -EFAULT;
2332 			copied++;
2333 		}
2334 	}
2335 	plane_resp->count_planes = num_planes;
2336 
2337 	return 0;
2338 }
2339 
2340 /**
2341  * drm_mode_getplane - get plane configuration
2342  * @dev: DRM device
2343  * @data: ioctl data
2344  * @file_priv: DRM file info
2345  *
2346  * Construct a plane configuration structure to return to the user.
2347  *
2348  * Called by the user via ioctl.
2349  *
2350  * Returns:
2351  * Zero on success, negative errno on failure.
2352  */
2353 int drm_mode_getplane(struct drm_device *dev, void *data,
2354 		      struct drm_file *file_priv)
2355 {
2356 	struct drm_mode_get_plane *plane_resp = data;
2357 	struct drm_plane *plane;
2358 	uint32_t __user *format_ptr;
2359 
2360 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2361 		return -EINVAL;
2362 
2363 	plane = drm_plane_find(dev, plane_resp->plane_id);
2364 	if (!plane)
2365 		return -ENOENT;
2366 
2367 	drm_modeset_lock(&plane->mutex, NULL);
2368 	if (plane->crtc)
2369 		plane_resp->crtc_id = plane->crtc->base.id;
2370 	else
2371 		plane_resp->crtc_id = 0;
2372 
2373 	if (plane->fb)
2374 		plane_resp->fb_id = plane->fb->base.id;
2375 	else
2376 		plane_resp->fb_id = 0;
2377 	drm_modeset_unlock(&plane->mutex);
2378 
2379 	plane_resp->plane_id = plane->base.id;
2380 	plane_resp->possible_crtcs = plane->possible_crtcs;
2381 	plane_resp->gamma_size = 0;
2382 
2383 	/*
2384 	 * This ioctl is called twice, once to determine how much space is
2385 	 * needed, and the 2nd time to fill it.
2386 	 */
2387 	if (plane->format_count &&
2388 	    (plane_resp->count_format_types >= plane->format_count)) {
2389 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2390 		if (copy_to_user(format_ptr,
2391 				 plane->format_types,
2392 				 sizeof(uint32_t) * plane->format_count)) {
2393 			return -EFAULT;
2394 		}
2395 	}
2396 	plane_resp->count_format_types = plane->format_count;
2397 
2398 	return 0;
2399 }
2400 
2401 /*
2402  * setplane_internal - setplane handler for internal callers
2403  *
2404  * Note that we assume an extra reference has already been taken on fb.  If the
2405  * update fails, this reference will be dropped before return; if it succeeds,
2406  * the previous framebuffer (if any) will be unreferenced instead.
2407  *
2408  * src_{x,y,w,h} are provided in 16.16 fixed point format
2409  */
2410 static int __setplane_internal(struct drm_plane *plane,
2411 			       struct drm_crtc *crtc,
2412 			       struct drm_framebuffer *fb,
2413 			       int32_t crtc_x, int32_t crtc_y,
2414 			       uint32_t crtc_w, uint32_t crtc_h,
2415 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2416 			       uint32_t src_x, uint32_t src_y,
2417 			       uint32_t src_w, uint32_t src_h)
2418 {
2419 	int ret = 0;
2420 	unsigned int fb_width, fb_height;
2421 	unsigned int i;
2422 
2423 	/* No fb means shut it down */
2424 	if (!fb) {
2425 		plane->old_fb = plane->fb;
2426 		ret = plane->funcs->disable_plane(plane);
2427 		if (!ret) {
2428 			plane->crtc = NULL;
2429 			plane->fb = NULL;
2430 		} else {
2431 			plane->old_fb = NULL;
2432 		}
2433 		goto out;
2434 	}
2435 
2436 	/* Check whether this plane is usable on this CRTC */
2437 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2438 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2439 		ret = -EINVAL;
2440 		goto out;
2441 	}
2442 
2443 	/* Check whether this plane supports the fb pixel format. */
2444 	for (i = 0; i < plane->format_count; i++)
2445 		if (fb->pixel_format == plane->format_types[i])
2446 			break;
2447 	if (i == plane->format_count) {
2448 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2449 			      drm_get_format_name(fb->pixel_format));
2450 		ret = -EINVAL;
2451 		goto out;
2452 	}
2453 
2454 	fb_width = fb->width << 16;
2455 	fb_height = fb->height << 16;
2456 
2457 	/* Make sure source coordinates are inside the fb. */
2458 	if (src_w > fb_width ||
2459 	    src_x > fb_width - src_w ||
2460 	    src_h > fb_height ||
2461 	    src_y > fb_height - src_h) {
2462 		DRM_DEBUG_KMS("Invalid source coordinates "
2463 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2464 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2465 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2466 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2467 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2468 		ret = -ENOSPC;
2469 		goto out;
2470 	}
2471 
2472 	plane->old_fb = plane->fb;
2473 	ret = plane->funcs->update_plane(plane, crtc, fb,
2474 					 crtc_x, crtc_y, crtc_w, crtc_h,
2475 					 src_x, src_y, src_w, src_h);
2476 	if (!ret) {
2477 		plane->crtc = crtc;
2478 		plane->fb = fb;
2479 		fb = NULL;
2480 	} else {
2481 		plane->old_fb = NULL;
2482 	}
2483 
2484 out:
2485 	if (fb)
2486 		drm_framebuffer_unreference(fb);
2487 	if (plane->old_fb)
2488 		drm_framebuffer_unreference(plane->old_fb);
2489 	plane->old_fb = NULL;
2490 
2491 	return ret;
2492 }
2493 
2494 static int setplane_internal(struct drm_plane *plane,
2495 			     struct drm_crtc *crtc,
2496 			     struct drm_framebuffer *fb,
2497 			     int32_t crtc_x, int32_t crtc_y,
2498 			     uint32_t crtc_w, uint32_t crtc_h,
2499 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2500 			     uint32_t src_x, uint32_t src_y,
2501 			     uint32_t src_w, uint32_t src_h)
2502 {
2503 	int ret;
2504 
2505 	drm_modeset_lock_all(plane->dev);
2506 	ret = __setplane_internal(plane, crtc, fb,
2507 				  crtc_x, crtc_y, crtc_w, crtc_h,
2508 				  src_x, src_y, src_w, src_h);
2509 	drm_modeset_unlock_all(plane->dev);
2510 
2511 	return ret;
2512 }
2513 
2514 /**
2515  * drm_mode_setplane - configure a plane's configuration
2516  * @dev: DRM device
2517  * @data: ioctl data*
2518  * @file_priv: DRM file info
2519  *
2520  * Set plane configuration, including placement, fb, scaling, and other factors.
2521  * Or pass a NULL fb to disable (planes may be disabled without providing a
2522  * valid crtc).
2523  *
2524  * Returns:
2525  * Zero on success, negative errno on failure.
2526  */
2527 int drm_mode_setplane(struct drm_device *dev, void *data,
2528 		      struct drm_file *file_priv)
2529 {
2530 	struct drm_mode_set_plane *plane_req = data;
2531 	struct drm_plane *plane;
2532 	struct drm_crtc *crtc = NULL;
2533 	struct drm_framebuffer *fb = NULL;
2534 
2535 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2536 		return -EINVAL;
2537 
2538 	/* Give drivers some help against integer overflows */
2539 	if (plane_req->crtc_w > INT_MAX ||
2540 	    plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
2541 	    plane_req->crtc_h > INT_MAX ||
2542 	    plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
2543 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2544 			      plane_req->crtc_w, plane_req->crtc_h,
2545 			      plane_req->crtc_x, plane_req->crtc_y);
2546 		return -ERANGE;
2547 	}
2548 
2549 	/*
2550 	 * First, find the plane, crtc, and fb objects.  If not available,
2551 	 * we don't bother to call the driver.
2552 	 */
2553 	plane = drm_plane_find(dev, plane_req->plane_id);
2554 	if (!plane) {
2555 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2556 			      plane_req->plane_id);
2557 		return -ENOENT;
2558 	}
2559 
2560 	if (plane_req->fb_id) {
2561 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2562 		if (!fb) {
2563 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2564 				      plane_req->fb_id);
2565 			return -ENOENT;
2566 		}
2567 
2568 		crtc = drm_crtc_find(dev, plane_req->crtc_id);
2569 		if (!crtc) {
2570 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2571 				      plane_req->crtc_id);
2572 			return -ENOENT;
2573 		}
2574 	}
2575 
2576 	/*
2577 	 * setplane_internal will take care of deref'ing either the old or new
2578 	 * framebuffer depending on success.
2579 	 */
2580 	return setplane_internal(plane, crtc, fb,
2581 				 plane_req->crtc_x, plane_req->crtc_y,
2582 				 plane_req->crtc_w, plane_req->crtc_h,
2583 				 plane_req->src_x, plane_req->src_y,
2584 				 plane_req->src_w, plane_req->src_h);
2585 }
2586 
2587 /**
2588  * drm_mode_set_config_internal - helper to call ->set_config
2589  * @set: modeset config to set
2590  *
2591  * This is a little helper to wrap internal calls to the ->set_config driver
2592  * interface. The only thing it adds is correct refcounting dance.
2593  *
2594  * Returns:
2595  * Zero on success, negative errno on failure.
2596  */
2597 int drm_mode_set_config_internal(struct drm_mode_set *set)
2598 {
2599 	struct drm_crtc *crtc = set->crtc;
2600 	struct drm_framebuffer *fb;
2601 	struct drm_crtc *tmp;
2602 	int ret;
2603 
2604 	/*
2605 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2606 	 * connectors from it), hence we need to refcount the fbs across all
2607 	 * crtcs. Atomic modeset will have saner semantics ...
2608 	 */
2609 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head)
2610 		tmp->primary->old_fb = tmp->primary->fb;
2611 
2612 	fb = set->fb;
2613 
2614 	ret = crtc->funcs->set_config(set);
2615 	if (ret == 0) {
2616 		crtc->primary->crtc = crtc;
2617 		crtc->primary->fb = fb;
2618 	}
2619 
2620 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
2621 		if (tmp->primary->fb)
2622 			drm_framebuffer_reference(tmp->primary->fb);
2623 		if (tmp->primary->old_fb)
2624 			drm_framebuffer_unreference(tmp->primary->old_fb);
2625 		tmp->primary->old_fb = NULL;
2626 	}
2627 
2628 	return ret;
2629 }
2630 EXPORT_SYMBOL(drm_mode_set_config_internal);
2631 
2632 /**
2633  * drm_crtc_get_hv_timing - Fetches hdisplay/vdisplay for given mode
2634  * @mode: mode to query
2635  * @hdisplay: hdisplay value to fill in
2636  * @vdisplay: vdisplay value to fill in
2637  *
2638  * The vdisplay value will be doubled if the specified mode is a stereo mode of
2639  * the appropriate layout.
2640  */
2641 void drm_crtc_get_hv_timing(const struct drm_display_mode *mode,
2642 			    int *hdisplay, int *vdisplay)
2643 {
2644 	struct drm_display_mode adjusted;
2645 
2646 	drm_mode_copy(&adjusted, mode);
2647 	drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE_ONLY);
2648 	*hdisplay = adjusted.crtc_hdisplay;
2649 	*vdisplay = adjusted.crtc_vdisplay;
2650 }
2651 EXPORT_SYMBOL(drm_crtc_get_hv_timing);
2652 
2653 /**
2654  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2655  *     CRTC viewport
2656  * @crtc: CRTC that framebuffer will be displayed on
2657  * @x: x panning
2658  * @y: y panning
2659  * @mode: mode that framebuffer will be displayed under
2660  * @fb: framebuffer to check size of
2661  */
2662 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2663 			    int x, int y,
2664 			    const struct drm_display_mode *mode,
2665 			    const struct drm_framebuffer *fb)
2666 
2667 {
2668 	int hdisplay, vdisplay;
2669 
2670 	drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay);
2671 
2672 	if (crtc->invert_dimensions)
2673 		swap(hdisplay, vdisplay);
2674 
2675 	if (hdisplay > fb->width ||
2676 	    vdisplay > fb->height ||
2677 	    x > fb->width - hdisplay ||
2678 	    y > fb->height - vdisplay) {
2679 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2680 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2681 			      crtc->invert_dimensions ? " (inverted)" : "");
2682 		return -ENOSPC;
2683 	}
2684 
2685 	return 0;
2686 }
2687 EXPORT_SYMBOL(drm_crtc_check_viewport);
2688 
2689 /**
2690  * drm_mode_setcrtc - set CRTC configuration
2691  * @dev: drm device for the ioctl
2692  * @data: data pointer for the ioctl
2693  * @file_priv: drm file for the ioctl call
2694  *
2695  * Build a new CRTC configuration based on user request.
2696  *
2697  * Called by the user via ioctl.
2698  *
2699  * Returns:
2700  * Zero on success, negative errno on failure.
2701  */
2702 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2703 		     struct drm_file *file_priv)
2704 {
2705 	struct drm_mode_config *config = &dev->mode_config;
2706 	struct drm_mode_crtc *crtc_req = data;
2707 	struct drm_crtc *crtc;
2708 	struct drm_connector **connector_set = NULL, *connector;
2709 	struct drm_framebuffer *fb = NULL;
2710 	struct drm_display_mode *mode = NULL;
2711 	struct drm_mode_set set;
2712 	uint32_t __user *set_connectors_ptr;
2713 	int ret;
2714 	int i;
2715 
2716 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2717 		return -EINVAL;
2718 
2719 	/* For some reason crtc x/y offsets are signed internally. */
2720 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
2721 		return -ERANGE;
2722 
2723 	drm_modeset_lock_all(dev);
2724 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2725 	if (!crtc) {
2726 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2727 		ret = -ENOENT;
2728 		goto out;
2729 	}
2730 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2731 
2732 	if (crtc_req->mode_valid) {
2733 		/* If we have a mode we need a framebuffer. */
2734 		/* If we pass -1, set the mode with the currently bound fb */
2735 		if (crtc_req->fb_id == -1) {
2736 			if (!crtc->primary->fb) {
2737 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2738 				ret = -EINVAL;
2739 				goto out;
2740 			}
2741 			fb = crtc->primary->fb;
2742 			/* Make refcounting symmetric with the lookup path. */
2743 			drm_framebuffer_reference(fb);
2744 		} else {
2745 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2746 			if (!fb) {
2747 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2748 						crtc_req->fb_id);
2749 				ret = -ENOENT;
2750 				goto out;
2751 			}
2752 		}
2753 
2754 		mode = drm_mode_create(dev);
2755 		if (!mode) {
2756 			ret = -ENOMEM;
2757 			goto out;
2758 		}
2759 
2760 		ret = drm_crtc_convert_umode(mode, &crtc_req->mode);
2761 		if (ret) {
2762 			DRM_DEBUG_KMS("Invalid mode\n");
2763 			goto out;
2764 		}
2765 
2766 		mode->status = drm_mode_validate_basic(mode);
2767 		if (mode->status != MODE_OK) {
2768 			ret = -EINVAL;
2769 			goto out;
2770 		}
2771 
2772 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2773 
2774 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2775 					      mode, fb);
2776 		if (ret)
2777 			goto out;
2778 
2779 	}
2780 
2781 	if (crtc_req->count_connectors == 0 && mode) {
2782 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2783 		ret = -EINVAL;
2784 		goto out;
2785 	}
2786 
2787 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2788 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2789 			  crtc_req->count_connectors);
2790 		ret = -EINVAL;
2791 		goto out;
2792 	}
2793 
2794 	if (crtc_req->count_connectors > 0) {
2795 		u32 out_id;
2796 
2797 		/* Avoid unbounded kernel memory allocation */
2798 		if (crtc_req->count_connectors > config->num_connector) {
2799 			ret = -EINVAL;
2800 			goto out;
2801 		}
2802 
2803 		connector_set = kmalloc(crtc_req->count_connectors *
2804 					sizeof(struct drm_connector *),
2805 					M_DRM, M_WAITOK);
2806 		if (!connector_set) {
2807 			ret = -ENOMEM;
2808 			goto out;
2809 		}
2810 
2811 		for (i = 0; i < crtc_req->count_connectors; i++) {
2812 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2813 			if (get_user(out_id, &set_connectors_ptr[i])) {
2814 				ret = -EFAULT;
2815 				goto out;
2816 			}
2817 
2818 			connector = drm_connector_find(dev, out_id);
2819 			if (!connector) {
2820 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2821 						out_id);
2822 				ret = -ENOENT;
2823 				goto out;
2824 			}
2825 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2826 					connector->base.id,
2827 					connector->name);
2828 
2829 			connector_set[i] = connector;
2830 		}
2831 	}
2832 
2833 	set.crtc = crtc;
2834 	set.x = crtc_req->x;
2835 	set.y = crtc_req->y;
2836 	set.mode = mode;
2837 	set.connectors = connector_set;
2838 	set.num_connectors = crtc_req->count_connectors;
2839 	set.fb = fb;
2840 	ret = drm_mode_set_config_internal(&set);
2841 
2842 out:
2843 	if (fb)
2844 		drm_framebuffer_unreference(fb);
2845 
2846 	kfree(connector_set);
2847 	drm_mode_destroy(dev, mode);
2848 	drm_modeset_unlock_all(dev);
2849 	return ret;
2850 }
2851 
2852 /**
2853  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2854  *     universal plane handler call
2855  * @crtc: crtc to update cursor for
2856  * @req: data pointer for the ioctl
2857  * @file_priv: drm file for the ioctl call
2858  *
2859  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2860  * translate legacy ioctl calls into universal plane handler calls, we need to
2861  * wrap the native buffer handle in a drm_framebuffer.
2862  *
2863  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2864  * buffer with a pitch of 4*width; the universal plane interface should be used
2865  * directly in cases where the hardware can support other buffer settings and
2866  * userspace wants to make use of these capabilities.
2867  *
2868  * Returns:
2869  * Zero on success, negative errno on failure.
2870  */
2871 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2872 				     struct drm_mode_cursor2 *req,
2873 				     struct drm_file *file_priv)
2874 {
2875 	struct drm_device *dev = crtc->dev;
2876 	struct drm_framebuffer *fb = NULL;
2877 	struct drm_mode_fb_cmd2 fbreq = {
2878 		.width = req->width,
2879 		.height = req->height,
2880 		.pixel_format = DRM_FORMAT_ARGB8888,
2881 		.pitches = { req->width * 4 },
2882 		.handles = { req->handle },
2883 	};
2884 	int32_t crtc_x, crtc_y;
2885 	uint32_t crtc_w = 0, crtc_h = 0;
2886 	uint32_t src_w = 0, src_h = 0;
2887 	int ret = 0;
2888 
2889 	BUG_ON(!crtc->cursor);
2890 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2891 
2892 	/*
2893 	 * Obtain fb we'll be using (either new or existing) and take an extra
2894 	 * reference to it if fb != null.  setplane will take care of dropping
2895 	 * the reference if the plane update fails.
2896 	 */
2897 	if (req->flags & DRM_MODE_CURSOR_BO) {
2898 		if (req->handle) {
2899 			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
2900 			if (IS_ERR(fb)) {
2901 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2902 				return PTR_ERR(fb);
2903 			}
2904 		} else {
2905 			fb = NULL;
2906 		}
2907 	} else {
2908 		fb = crtc->cursor->fb;
2909 		if (fb)
2910 			drm_framebuffer_reference(fb);
2911 	}
2912 
2913 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2914 		crtc_x = req->x;
2915 		crtc_y = req->y;
2916 	} else {
2917 		crtc_x = crtc->cursor_x;
2918 		crtc_y = crtc->cursor_y;
2919 	}
2920 
2921 	if (fb) {
2922 		crtc_w = fb->width;
2923 		crtc_h = fb->height;
2924 		src_w = fb->width << 16;
2925 		src_h = fb->height << 16;
2926 	}
2927 
2928 	/*
2929 	 * setplane_internal will take care of deref'ing either the old or new
2930 	 * framebuffer depending on success.
2931 	 */
2932 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2933 				crtc_x, crtc_y, crtc_w, crtc_h,
2934 				0, 0, src_w, src_h);
2935 
2936 	/* Update successful; save new cursor position, if necessary */
2937 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2938 		crtc->cursor_x = req->x;
2939 		crtc->cursor_y = req->y;
2940 	}
2941 
2942 	return ret;
2943 }
2944 
2945 static int drm_mode_cursor_common(struct drm_device *dev,
2946 				  struct drm_mode_cursor2 *req,
2947 				  struct drm_file *file_priv)
2948 {
2949 	struct drm_crtc *crtc;
2950 	int ret = 0;
2951 
2952 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2953 		return -EINVAL;
2954 
2955 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2956 		return -EINVAL;
2957 
2958 	crtc = drm_crtc_find(dev, req->crtc_id);
2959 	if (!crtc) {
2960 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2961 		return -ENOENT;
2962 	}
2963 
2964 	/*
2965 	 * If this crtc has a universal cursor plane, call that plane's update
2966 	 * handler rather than using legacy cursor handlers.
2967 	 */
2968 	drm_modeset_lock_crtc(crtc, crtc->cursor);
2969 	if (crtc->cursor) {
2970 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2971 		goto out;
2972 	}
2973 
2974 	if (req->flags & DRM_MODE_CURSOR_BO) {
2975 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2976 			ret = -ENXIO;
2977 			goto out;
2978 		}
2979 		/* Turns off the cursor if handle is 0 */
2980 		if (crtc->funcs->cursor_set2)
2981 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2982 						      req->width, req->height, req->hot_x, req->hot_y);
2983 		else
2984 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2985 						      req->width, req->height);
2986 	}
2987 
2988 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2989 		if (crtc->funcs->cursor_move) {
2990 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2991 		} else {
2992 			ret = -EFAULT;
2993 			goto out;
2994 		}
2995 	}
2996 out:
2997 	drm_modeset_unlock_crtc(crtc);
2998 
2999 	return ret;
3000 
3001 }
3002 
3003 
3004 /**
3005  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
3006  * @dev: drm device for the ioctl
3007  * @data: data pointer for the ioctl
3008  * @file_priv: drm file for the ioctl call
3009  *
3010  * Set the cursor configuration based on user request.
3011  *
3012  * Called by the user via ioctl.
3013  *
3014  * Returns:
3015  * Zero on success, negative errno on failure.
3016  */
3017 int drm_mode_cursor_ioctl(struct drm_device *dev,
3018 			  void *data, struct drm_file *file_priv)
3019 {
3020 	struct drm_mode_cursor *req = data;
3021 	struct drm_mode_cursor2 new_req;
3022 
3023 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
3024 	new_req.hot_x = new_req.hot_y = 0;
3025 
3026 	return drm_mode_cursor_common(dev, &new_req, file_priv);
3027 }
3028 
3029 /**
3030  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
3031  * @dev: drm device for the ioctl
3032  * @data: data pointer for the ioctl
3033  * @file_priv: drm file for the ioctl call
3034  *
3035  * Set the cursor configuration based on user request. This implements the 2nd
3036  * version of the cursor ioctl, which allows userspace to additionally specify
3037  * the hotspot of the pointer.
3038  *
3039  * Called by the user via ioctl.
3040  *
3041  * Returns:
3042  * Zero on success, negative errno on failure.
3043  */
3044 int drm_mode_cursor2_ioctl(struct drm_device *dev,
3045 			   void *data, struct drm_file *file_priv)
3046 {
3047 	struct drm_mode_cursor2 *req = data;
3048 
3049 	return drm_mode_cursor_common(dev, req, file_priv);
3050 }
3051 
3052 /**
3053  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
3054  * @bpp: bits per pixels
3055  * @depth: bit depth per pixel
3056  *
3057  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
3058  * Useful in fbdev emulation code, since that deals in those values.
3059  */
3060 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
3061 {
3062 	uint32_t fmt;
3063 
3064 	switch (bpp) {
3065 	case 8:
3066 		fmt = DRM_FORMAT_C8;
3067 		break;
3068 	case 16:
3069 		if (depth == 15)
3070 			fmt = DRM_FORMAT_XRGB1555;
3071 		else
3072 			fmt = DRM_FORMAT_RGB565;
3073 		break;
3074 	case 24:
3075 		fmt = DRM_FORMAT_RGB888;
3076 		break;
3077 	case 32:
3078 		if (depth == 24)
3079 			fmt = DRM_FORMAT_XRGB8888;
3080 		else if (depth == 30)
3081 			fmt = DRM_FORMAT_XRGB2101010;
3082 		else
3083 			fmt = DRM_FORMAT_ARGB8888;
3084 		break;
3085 	default:
3086 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
3087 		fmt = DRM_FORMAT_XRGB8888;
3088 		break;
3089 	}
3090 
3091 	return fmt;
3092 }
3093 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
3094 
3095 /**
3096  * drm_mode_addfb - add an FB to the graphics configuration
3097  * @dev: drm device for the ioctl
3098  * @data: data pointer for the ioctl
3099  * @file_priv: drm file for the ioctl call
3100  *
3101  * Add a new FB to the specified CRTC, given a user request. This is the
3102  * original addfb ioctl which only supported RGB formats.
3103  *
3104  * Called by the user via ioctl.
3105  *
3106  * Returns:
3107  * Zero on success, negative errno on failure.
3108  */
3109 int drm_mode_addfb(struct drm_device *dev,
3110 		   void *data, struct drm_file *file_priv)
3111 {
3112 	struct drm_mode_fb_cmd *or = data;
3113 	struct drm_mode_fb_cmd2 r = {};
3114 	int ret;
3115 
3116 	/* convert to new format and call new ioctl */
3117 	r.fb_id = or->fb_id;
3118 	r.width = or->width;
3119 	r.height = or->height;
3120 	r.pitches[0] = or->pitch;
3121 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
3122 	r.handles[0] = or->handle;
3123 
3124 	ret = drm_mode_addfb2(dev, &r, file_priv);
3125 	if (ret)
3126 		return ret;
3127 
3128 	or->fb_id = r.fb_id;
3129 
3130 	return ret;
3131 }
3132 
3133 static int format_check(const struct drm_mode_fb_cmd2 *r)
3134 {
3135 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
3136 
3137 	switch (format) {
3138 	case DRM_FORMAT_C8:
3139 	case DRM_FORMAT_RGB332:
3140 	case DRM_FORMAT_BGR233:
3141 	case DRM_FORMAT_XRGB4444:
3142 	case DRM_FORMAT_XBGR4444:
3143 	case DRM_FORMAT_RGBX4444:
3144 	case DRM_FORMAT_BGRX4444:
3145 	case DRM_FORMAT_ARGB4444:
3146 	case DRM_FORMAT_ABGR4444:
3147 	case DRM_FORMAT_RGBA4444:
3148 	case DRM_FORMAT_BGRA4444:
3149 	case DRM_FORMAT_XRGB1555:
3150 	case DRM_FORMAT_XBGR1555:
3151 	case DRM_FORMAT_RGBX5551:
3152 	case DRM_FORMAT_BGRX5551:
3153 	case DRM_FORMAT_ARGB1555:
3154 	case DRM_FORMAT_ABGR1555:
3155 	case DRM_FORMAT_RGBA5551:
3156 	case DRM_FORMAT_BGRA5551:
3157 	case DRM_FORMAT_RGB565:
3158 	case DRM_FORMAT_BGR565:
3159 	case DRM_FORMAT_RGB888:
3160 	case DRM_FORMAT_BGR888:
3161 	case DRM_FORMAT_XRGB8888:
3162 	case DRM_FORMAT_XBGR8888:
3163 	case DRM_FORMAT_RGBX8888:
3164 	case DRM_FORMAT_BGRX8888:
3165 	case DRM_FORMAT_ARGB8888:
3166 	case DRM_FORMAT_ABGR8888:
3167 	case DRM_FORMAT_RGBA8888:
3168 	case DRM_FORMAT_BGRA8888:
3169 	case DRM_FORMAT_XRGB2101010:
3170 	case DRM_FORMAT_XBGR2101010:
3171 	case DRM_FORMAT_RGBX1010102:
3172 	case DRM_FORMAT_BGRX1010102:
3173 	case DRM_FORMAT_ARGB2101010:
3174 	case DRM_FORMAT_ABGR2101010:
3175 	case DRM_FORMAT_RGBA1010102:
3176 	case DRM_FORMAT_BGRA1010102:
3177 	case DRM_FORMAT_YUYV:
3178 	case DRM_FORMAT_YVYU:
3179 	case DRM_FORMAT_UYVY:
3180 	case DRM_FORMAT_VYUY:
3181 	case DRM_FORMAT_AYUV:
3182 	case DRM_FORMAT_NV12:
3183 	case DRM_FORMAT_NV21:
3184 	case DRM_FORMAT_NV16:
3185 	case DRM_FORMAT_NV61:
3186 	case DRM_FORMAT_NV24:
3187 	case DRM_FORMAT_NV42:
3188 	case DRM_FORMAT_YUV410:
3189 	case DRM_FORMAT_YVU410:
3190 	case DRM_FORMAT_YUV411:
3191 	case DRM_FORMAT_YVU411:
3192 	case DRM_FORMAT_YUV420:
3193 	case DRM_FORMAT_YVU420:
3194 	case DRM_FORMAT_YUV422:
3195 	case DRM_FORMAT_YVU422:
3196 	case DRM_FORMAT_YUV444:
3197 	case DRM_FORMAT_YVU444:
3198 		return 0;
3199 	default:
3200 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3201 			      drm_get_format_name(r->pixel_format));
3202 		return -EINVAL;
3203 	}
3204 }
3205 
3206 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3207 {
3208 	int ret, hsub, vsub, num_planes, i;
3209 
3210 	ret = format_check(r);
3211 	if (ret) {
3212 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3213 			      drm_get_format_name(r->pixel_format));
3214 		return ret;
3215 	}
3216 
3217 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3218 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3219 	num_planes = drm_format_num_planes(r->pixel_format);
3220 
3221 	if (r->width == 0 || r->width % hsub) {
3222 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
3223 		return -EINVAL;
3224 	}
3225 
3226 	if (r->height == 0 || r->height % vsub) {
3227 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3228 		return -EINVAL;
3229 	}
3230 
3231 	for (i = 0; i < num_planes; i++) {
3232 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3233 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3234 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3235 
3236 		if (!r->handles[i]) {
3237 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3238 			return -EINVAL;
3239 		}
3240 
3241 		if ((uint64_t) width * cpp > UINT_MAX)
3242 			return -ERANGE;
3243 
3244 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3245 			return -ERANGE;
3246 
3247 		if (r->pitches[i] < width * cpp) {
3248 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3249 			return -EINVAL;
3250 		}
3251 	}
3252 
3253 	return 0;
3254 }
3255 
3256 static struct drm_framebuffer *
3257 internal_framebuffer_create(struct drm_device *dev,
3258 			    struct drm_mode_fb_cmd2 *r,
3259 			    struct drm_file *file_priv)
3260 {
3261 	struct drm_mode_config *config = &dev->mode_config;
3262 	struct drm_framebuffer *fb;
3263 	int ret;
3264 
3265 	if (r->flags & ~DRM_MODE_FB_INTERLACED) {
3266 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3267 		return ERR_PTR(-EINVAL);
3268 	}
3269 
3270 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3271 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3272 			  r->width, config->min_width, config->max_width);
3273 		return ERR_PTR(-EINVAL);
3274 	}
3275 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3276 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3277 			  r->height, config->min_height, config->max_height);
3278 		return ERR_PTR(-EINVAL);
3279 	}
3280 
3281 	ret = framebuffer_check(r);
3282 	if (ret)
3283 		return ERR_PTR(ret);
3284 
3285 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3286 	if (IS_ERR(fb)) {
3287 		DRM_DEBUG_KMS("could not create framebuffer\n");
3288 		return fb;
3289 	}
3290 
3291 	return fb;
3292 }
3293 
3294 /**
3295  * drm_mode_addfb2 - add an FB to the graphics configuration
3296  * @dev: drm device for the ioctl
3297  * @data: data pointer for the ioctl
3298  * @file_priv: drm file for the ioctl call
3299  *
3300  * Add a new FB to the specified CRTC, given a user request with format. This is
3301  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3302  * and uses fourcc codes as pixel format specifiers.
3303  *
3304  * Called by the user via ioctl.
3305  *
3306  * Returns:
3307  * Zero on success, negative errno on failure.
3308  */
3309 int drm_mode_addfb2(struct drm_device *dev,
3310 		    void *data, struct drm_file *file_priv)
3311 {
3312 	struct drm_mode_fb_cmd2 *r = data;
3313 	struct drm_framebuffer *fb;
3314 
3315 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3316 		return -EINVAL;
3317 
3318 	fb = internal_framebuffer_create(dev, r, file_priv);
3319 	if (IS_ERR(fb))
3320 		return PTR_ERR(fb);
3321 
3322 	/* Transfer ownership to the filp for reaping on close */
3323 
3324 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3325 	mutex_lock(&file_priv->fbs_lock);
3326 	r->fb_id = fb->base.id;
3327 	list_add(&fb->filp_head, &file_priv->fbs);
3328 	mutex_unlock(&file_priv->fbs_lock);
3329 
3330 	return 0;
3331 }
3332 
3333 /**
3334  * drm_mode_rmfb - remove an FB from the configuration
3335  * @dev: drm device for the ioctl
3336  * @data: data pointer for the ioctl
3337  * @file_priv: drm file for the ioctl call
3338  *
3339  * Remove the FB specified by the user.
3340  *
3341  * Called by the user via ioctl.
3342  *
3343  * Returns:
3344  * Zero on success, negative errno on failure.
3345  */
3346 int drm_mode_rmfb(struct drm_device *dev,
3347 		   void *data, struct drm_file *file_priv)
3348 {
3349 	struct drm_framebuffer *fb = NULL;
3350 	struct drm_framebuffer *fbl = NULL;
3351 	uint32_t *id = data;
3352 	int found = 0;
3353 
3354 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3355 		return -EINVAL;
3356 
3357 	mutex_lock(&file_priv->fbs_lock);
3358 	mutex_lock(&dev->mode_config.fb_lock);
3359 	fb = __drm_framebuffer_lookup(dev, *id);
3360 	if (!fb)
3361 		goto fail_lookup;
3362 
3363 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3364 		if (fb == fbl)
3365 			found = 1;
3366 	if (!found)
3367 		goto fail_lookup;
3368 
3369 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3370 	__drm_framebuffer_unregister(dev, fb);
3371 
3372 	list_del_init(&fb->filp_head);
3373 	mutex_unlock(&dev->mode_config.fb_lock);
3374 	mutex_unlock(&file_priv->fbs_lock);
3375 
3376 	drm_framebuffer_remove(fb);
3377 
3378 	return 0;
3379 
3380 fail_lookup:
3381 	mutex_unlock(&dev->mode_config.fb_lock);
3382 	mutex_unlock(&file_priv->fbs_lock);
3383 
3384 	return -ENOENT;
3385 }
3386 
3387 /**
3388  * drm_mode_getfb - get FB info
3389  * @dev: drm device for the ioctl
3390  * @data: data pointer for the ioctl
3391  * @file_priv: drm file for the ioctl call
3392  *
3393  * Lookup the FB given its ID and return info about it.
3394  *
3395  * Called by the user via ioctl.
3396  *
3397  * Returns:
3398  * Zero on success, negative errno on failure.
3399  */
3400 int drm_mode_getfb(struct drm_device *dev,
3401 		   void *data, struct drm_file *file_priv)
3402 {
3403 	struct drm_mode_fb_cmd *r = data;
3404 	struct drm_framebuffer *fb;
3405 	int ret;
3406 
3407 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3408 		return -EINVAL;
3409 
3410 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3411 	if (!fb)
3412 		return -ENOENT;
3413 
3414 	r->height = fb->height;
3415 	r->width = fb->width;
3416 	r->depth = fb->depth;
3417 	r->bpp = fb->bits_per_pixel;
3418 	r->pitch = fb->pitches[0];
3419 	if (fb->funcs->create_handle) {
3420 		ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
3421 	} else {
3422 		ret = -ENODEV;
3423 	}
3424 
3425 	drm_framebuffer_unreference(fb);
3426 
3427 	return ret;
3428 }
3429 
3430 /**
3431  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3432  * @dev: drm device for the ioctl
3433  * @data: data pointer for the ioctl
3434  * @file_priv: drm file for the ioctl call
3435  *
3436  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3437  * rectangle list. Generic userspace which does frontbuffer rendering must call
3438  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3439  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3440  *
3441  * Modesetting drivers which always update the frontbuffer do not need to
3442  * implement the corresponding ->dirty framebuffer callback.
3443  *
3444  * Called by the user via ioctl.
3445  *
3446  * Returns:
3447  * Zero on success, negative errno on failure.
3448  */
3449 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3450 			   void *data, struct drm_file *file_priv)
3451 {
3452 	struct drm_clip_rect __user *clips_ptr;
3453 	struct drm_clip_rect *clips = NULL;
3454 	struct drm_mode_fb_dirty_cmd *r = data;
3455 	struct drm_framebuffer *fb;
3456 	unsigned flags;
3457 	int num_clips;
3458 	int ret;
3459 
3460 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3461 		return -EINVAL;
3462 
3463 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3464 	if (!fb)
3465 		return -ENOENT;
3466 
3467 	num_clips = r->num_clips;
3468 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3469 
3470 	if (!num_clips != !clips_ptr) {
3471 		ret = -EINVAL;
3472 		goto out_err1;
3473 	}
3474 
3475 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3476 
3477 	/* If userspace annotates copy, clips must come in pairs */
3478 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3479 		ret = -EINVAL;
3480 		goto out_err1;
3481 	}
3482 
3483 	if (num_clips && clips_ptr) {
3484 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3485 			ret = -EINVAL;
3486 			goto out_err1;
3487 		}
3488 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
3489 		if (!clips) {
3490 			ret = -ENOMEM;
3491 			goto out_err1;
3492 		}
3493 
3494 		ret = copy_from_user(clips, clips_ptr,
3495 				     num_clips * sizeof(*clips));
3496 		if (ret) {
3497 			ret = -EFAULT;
3498 			goto out_err2;
3499 		}
3500 	}
3501 
3502 	if (fb->funcs->dirty) {
3503 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3504 				       clips, num_clips);
3505 	} else {
3506 		ret = -ENOSYS;
3507 	}
3508 
3509 out_err2:
3510 	kfree(clips);
3511 out_err1:
3512 	drm_framebuffer_unreference(fb);
3513 
3514 	return ret;
3515 }
3516 
3517 
3518 /**
3519  * drm_fb_release - remove and free the FBs on this file
3520  * @priv: drm file for the ioctl
3521  *
3522  * Destroy all the FBs associated with @filp.
3523  *
3524  * Called by the user via ioctl.
3525  *
3526  * Returns:
3527  * Zero on success, negative errno on failure.
3528  */
3529 void drm_fb_release(struct drm_file *priv)
3530 {
3531 	struct drm_device *dev = priv->dev;
3532 	struct drm_framebuffer *fb, *tfb;
3533 
3534 	/*
3535 	 * When the file gets released that means no one else can access the fb
3536 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
3537 	 * avoid upsetting lockdep since the universal cursor code adds a
3538 	 * framebuffer while holding mutex locks.
3539 	 *
3540 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3541 	 * locks is impossible here since no one else but this function can get
3542 	 * at it any more.
3543 	 */
3544 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3545 
3546 		mutex_lock(&dev->mode_config.fb_lock);
3547 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3548 		__drm_framebuffer_unregister(dev, fb);
3549 		mutex_unlock(&dev->mode_config.fb_lock);
3550 
3551 		list_del_init(&fb->filp_head);
3552 
3553 		/* This will also drop the fpriv->fbs reference. */
3554 		drm_framebuffer_remove(fb);
3555 	}
3556 }
3557 
3558 /**
3559  * drm_property_create - create a new property type
3560  * @dev: drm device
3561  * @flags: flags specifying the property type
3562  * @name: name of the property
3563  * @num_values: number of pre-defined values
3564  *
3565  * This creates a new generic drm property which can then be attached to a drm
3566  * object with drm_object_attach_property. The returned property object must be
3567  * freed with drm_property_destroy.
3568  *
3569  * Note that the DRM core keeps a per-device list of properties and that, if
3570  * drm_mode_config_cleanup() is called, it will destroy all properties created
3571  * by the driver.
3572  *
3573  * Returns:
3574  * A pointer to the newly created property on success, NULL on failure.
3575  */
3576 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3577 					 const char *name, int num_values)
3578 {
3579 	struct drm_property *property = NULL;
3580 	int ret;
3581 
3582 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3583 	if (!property)
3584 		return NULL;
3585 
3586 	property->dev = dev;
3587 
3588 	if (num_values) {
3589 		property->values = kcalloc(num_values, sizeof(uint64_t),
3590 					   GFP_KERNEL);
3591 		if (!property->values)
3592 			goto fail;
3593 	}
3594 
3595 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3596 	if (ret)
3597 		goto fail;
3598 
3599 	property->flags = flags;
3600 	property->num_values = num_values;
3601 	INIT_LIST_HEAD(&property->enum_list);
3602 
3603 	if (name) {
3604 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3605 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3606 	}
3607 
3608 	list_add_tail(&property->head, &dev->mode_config.property_list);
3609 
3610 	WARN_ON(!drm_property_type_valid(property));
3611 
3612 	return property;
3613 fail:
3614 	kfree(property->values);
3615 	kfree(property);
3616 	return NULL;
3617 }
3618 EXPORT_SYMBOL(drm_property_create);
3619 
3620 /**
3621  * drm_property_create_enum - create a new enumeration property type
3622  * @dev: drm device
3623  * @flags: flags specifying the property type
3624  * @name: name of the property
3625  * @props: enumeration lists with property values
3626  * @num_values: number of pre-defined values
3627  *
3628  * This creates a new generic drm property which can then be attached to a drm
3629  * object with drm_object_attach_property. The returned property object must be
3630  * freed with drm_property_destroy.
3631  *
3632  * Userspace is only allowed to set one of the predefined values for enumeration
3633  * properties.
3634  *
3635  * Returns:
3636  * A pointer to the newly created property on success, NULL on failure.
3637  */
3638 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3639 					 const char *name,
3640 					 const struct drm_prop_enum_list *props,
3641 					 int num_values)
3642 {
3643 	struct drm_property *property;
3644 	int i, ret;
3645 
3646 	flags |= DRM_MODE_PROP_ENUM;
3647 
3648 	property = drm_property_create(dev, flags, name, num_values);
3649 	if (!property)
3650 		return NULL;
3651 
3652 	for (i = 0; i < num_values; i++) {
3653 		ret = drm_property_add_enum(property, i,
3654 				      props[i].type,
3655 				      props[i].name);
3656 		if (ret) {
3657 			drm_property_destroy(dev, property);
3658 			return NULL;
3659 		}
3660 	}
3661 
3662 	return property;
3663 }
3664 EXPORT_SYMBOL(drm_property_create_enum);
3665 
3666 /**
3667  * drm_property_create_bitmask - create a new bitmask property type
3668  * @dev: drm device
3669  * @flags: flags specifying the property type
3670  * @name: name of the property
3671  * @props: enumeration lists with property bitflags
3672  * @num_props: size of the @props array
3673  * @supported_bits: bitmask of all supported enumeration values
3674  *
3675  * This creates a new bitmask drm property which can then be attached to a drm
3676  * object with drm_object_attach_property. The returned property object must be
3677  * freed with drm_property_destroy.
3678  *
3679  * Compared to plain enumeration properties userspace is allowed to set any
3680  * or'ed together combination of the predefined property bitflag values
3681  *
3682  * Returns:
3683  * A pointer to the newly created property on success, NULL on failure.
3684  */
3685 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3686 					 int flags, const char *name,
3687 					 const struct drm_prop_enum_list *props,
3688 					 int num_props,
3689 					 uint64_t supported_bits)
3690 {
3691 	struct drm_property *property;
3692 	int i, ret, index = 0;
3693 	int num_values = hweight64(supported_bits);
3694 
3695 	flags |= DRM_MODE_PROP_BITMASK;
3696 
3697 	property = drm_property_create(dev, flags, name, num_values);
3698 	if (!property)
3699 		return NULL;
3700 	for (i = 0; i < num_props; i++) {
3701 		if (!(supported_bits & (1ULL << props[i].type)))
3702 			continue;
3703 
3704 		if (WARN_ON(index >= num_values)) {
3705 			drm_property_destroy(dev, property);
3706 			return NULL;
3707 		}
3708 
3709 		ret = drm_property_add_enum(property, index++,
3710 				      props[i].type,
3711 				      props[i].name);
3712 		if (ret) {
3713 			drm_property_destroy(dev, property);
3714 			return NULL;
3715 		}
3716 	}
3717 
3718 	return property;
3719 }
3720 EXPORT_SYMBOL(drm_property_create_bitmask);
3721 
3722 static struct drm_property *property_create_range(struct drm_device *dev,
3723 					 int flags, const char *name,
3724 					 uint64_t min, uint64_t max)
3725 {
3726 	struct drm_property *property;
3727 
3728 	property = drm_property_create(dev, flags, name, 2);
3729 	if (!property)
3730 		return NULL;
3731 
3732 	property->values[0] = min;
3733 	property->values[1] = max;
3734 
3735 	return property;
3736 }
3737 
3738 /**
3739  * drm_property_create_range - create a new unsigned ranged property type
3740  * @dev: drm device
3741  * @flags: flags specifying the property type
3742  * @name: name of the property
3743  * @min: minimum value of the property
3744  * @max: maximum value of the property
3745  *
3746  * This creates a new generic drm property which can then be attached to a drm
3747  * object with drm_object_attach_property. The returned property object must be
3748  * freed with drm_property_destroy.
3749  *
3750  * Userspace is allowed to set any unsigned integer value in the (min, max)
3751  * range inclusive.
3752  *
3753  * Returns:
3754  * A pointer to the newly created property on success, NULL on failure.
3755  */
3756 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3757 					 const char *name,
3758 					 uint64_t min, uint64_t max)
3759 {
3760 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3761 			name, min, max);
3762 }
3763 EXPORT_SYMBOL(drm_property_create_range);
3764 
3765 /**
3766  * drm_property_create_signed_range - create a new signed ranged property type
3767  * @dev: drm device
3768  * @flags: flags specifying the property type
3769  * @name: name of the property
3770  * @min: minimum value of the property
3771  * @max: maximum value of the property
3772  *
3773  * This creates a new generic drm property which can then be attached to a drm
3774  * object with drm_object_attach_property. The returned property object must be
3775  * freed with drm_property_destroy.
3776  *
3777  * Userspace is allowed to set any signed integer value in the (min, max)
3778  * range inclusive.
3779  *
3780  * Returns:
3781  * A pointer to the newly created property on success, NULL on failure.
3782  */
3783 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3784 					 int flags, const char *name,
3785 					 int64_t min, int64_t max)
3786 {
3787 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3788 			name, I642U64(min), I642U64(max));
3789 }
3790 EXPORT_SYMBOL(drm_property_create_signed_range);
3791 
3792 /**
3793  * drm_property_create_object - create a new object property type
3794  * @dev: drm device
3795  * @flags: flags specifying the property type
3796  * @name: name of the property
3797  * @type: object type from DRM_MODE_OBJECT_* defines
3798  *
3799  * This creates a new generic drm property which can then be attached to a drm
3800  * object with drm_object_attach_property. The returned property object must be
3801  * freed with drm_property_destroy.
3802  *
3803  * Userspace is only allowed to set this to any property value of the given
3804  * @type. Only useful for atomic properties, which is enforced.
3805  *
3806  * Returns:
3807  * A pointer to the newly created property on success, NULL on failure.
3808  */
3809 struct drm_property *drm_property_create_object(struct drm_device *dev,
3810 					 int flags, const char *name, uint32_t type)
3811 {
3812 	struct drm_property *property;
3813 
3814 	flags |= DRM_MODE_PROP_OBJECT;
3815 
3816 	if (WARN_ON(!(flags & DRM_MODE_PROP_ATOMIC)))
3817 		return NULL;
3818 
3819 	property = drm_property_create(dev, flags, name, 1);
3820 	if (!property)
3821 		return NULL;
3822 
3823 	property->values[0] = type;
3824 
3825 	return property;
3826 }
3827 EXPORT_SYMBOL(drm_property_create_object);
3828 
3829 /**
3830  * drm_property_create_bool - create a new boolean property type
3831  * @dev: drm device
3832  * @flags: flags specifying the property type
3833  * @name: name of the property
3834  *
3835  * This creates a new generic drm property which can then be attached to a drm
3836  * object with drm_object_attach_property. The returned property object must be
3837  * freed with drm_property_destroy.
3838  *
3839  * This is implemented as a ranged property with only {0, 1} as valid values.
3840  *
3841  * Returns:
3842  * A pointer to the newly created property on success, NULL on failure.
3843  */
3844 struct drm_property *drm_property_create_bool(struct drm_device *dev, int flags,
3845 					 const char *name)
3846 {
3847 	return drm_property_create_range(dev, flags, name, 0, 1);
3848 }
3849 EXPORT_SYMBOL(drm_property_create_bool);
3850 
3851 /**
3852  * drm_property_add_enum - add a possible value to an enumeration property
3853  * @property: enumeration property to change
3854  * @index: index of the new enumeration
3855  * @value: value of the new enumeration
3856  * @name: symbolic name of the new enumeration
3857  *
3858  * This functions adds enumerations to a property.
3859  *
3860  * It's use is deprecated, drivers should use one of the more specific helpers
3861  * to directly create the property with all enumerations already attached.
3862  *
3863  * Returns:
3864  * Zero on success, error code on failure.
3865  */
3866 int drm_property_add_enum(struct drm_property *property, int index,
3867 			  uint64_t value, const char *name)
3868 {
3869 	struct drm_property_enum *prop_enum;
3870 
3871 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3872 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3873 		return -EINVAL;
3874 
3875 	/*
3876 	 * Bitmask enum properties have the additional constraint of values
3877 	 * from 0 to 63
3878 	 */
3879 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3880 			(value > 63))
3881 		return -EINVAL;
3882 
3883 	if (!list_empty(&property->enum_list)) {
3884 		list_for_each_entry(prop_enum, &property->enum_list, head) {
3885 			if (prop_enum->value == value) {
3886 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3887 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3888 				return 0;
3889 			}
3890 		}
3891 	}
3892 
3893 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3894 	if (!prop_enum)
3895 		return -ENOMEM;
3896 
3897 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3898 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3899 	prop_enum->value = value;
3900 
3901 	property->values[index] = value;
3902 	list_add_tail(&prop_enum->head, &property->enum_list);
3903 	return 0;
3904 }
3905 EXPORT_SYMBOL(drm_property_add_enum);
3906 
3907 /**
3908  * drm_property_destroy - destroy a drm property
3909  * @dev: drm device
3910  * @property: property to destry
3911  *
3912  * This function frees a property including any attached resources like
3913  * enumeration values.
3914  */
3915 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3916 {
3917 	struct drm_property_enum *prop_enum, *pt;
3918 
3919 	list_for_each_entry_safe(prop_enum, pt, &property->enum_list, head) {
3920 		list_del(&prop_enum->head);
3921 		kfree(prop_enum);
3922 	}
3923 
3924 	if (property->num_values)
3925 		kfree(property->values);
3926 	drm_mode_object_put(dev, &property->base);
3927 	list_del(&property->head);
3928 	kfree(property);
3929 }
3930 EXPORT_SYMBOL(drm_property_destroy);
3931 
3932 /**
3933  * drm_object_attach_property - attach a property to a modeset object
3934  * @obj: drm modeset object
3935  * @property: property to attach
3936  * @init_val: initial value of the property
3937  *
3938  * This attaches the given property to the modeset object with the given initial
3939  * value. Currently this function cannot fail since the properties are stored in
3940  * a statically sized array.
3941  */
3942 void drm_object_attach_property(struct drm_mode_object *obj,
3943 				struct drm_property *property,
3944 				uint64_t init_val)
3945 {
3946 	int count = obj->properties->count;
3947 
3948 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3949 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3950 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3951 			"you see this message on the same object type.\n",
3952 			obj->type);
3953 		return;
3954 	}
3955 
3956 	obj->properties->properties[count] = property;
3957 	obj->properties->values[count] = init_val;
3958 	obj->properties->count++;
3959 	if (property->flags & DRM_MODE_PROP_ATOMIC)
3960 		obj->properties->atomic_count++;
3961 }
3962 EXPORT_SYMBOL(drm_object_attach_property);
3963 
3964 /**
3965  * drm_object_property_set_value - set the value of a property
3966  * @obj: drm mode object to set property value for
3967  * @property: property to set
3968  * @val: value the property should be set to
3969  *
3970  * This functions sets a given property on a given object. This function only
3971  * changes the software state of the property, it does not call into the
3972  * driver's ->set_property callback.
3973  *
3974  * Returns:
3975  * Zero on success, error code on failure.
3976  */
3977 int drm_object_property_set_value(struct drm_mode_object *obj,
3978 				  struct drm_property *property, uint64_t val)
3979 {
3980 	int i;
3981 
3982 	for (i = 0; i < obj->properties->count; i++) {
3983 		if (obj->properties->properties[i] == property) {
3984 			obj->properties->values[i] = val;
3985 			return 0;
3986 		}
3987 	}
3988 
3989 	return -EINVAL;
3990 }
3991 EXPORT_SYMBOL(drm_object_property_set_value);
3992 
3993 /**
3994  * drm_object_property_get_value - retrieve the value of a property
3995  * @obj: drm mode object to get property value from
3996  * @property: property to retrieve
3997  * @val: storage for the property value
3998  *
3999  * This function retrieves the softare state of the given property for the given
4000  * property. Since there is no driver callback to retrieve the current property
4001  * value this might be out of sync with the hardware, depending upon the driver
4002  * and property.
4003  *
4004  * Returns:
4005  * Zero on success, error code on failure.
4006  */
4007 int drm_object_property_get_value(struct drm_mode_object *obj,
4008 				  struct drm_property *property, uint64_t *val)
4009 {
4010 	int i;
4011 
4012 	/* read-only properties bypass atomic mechanism and still store
4013 	 * their value in obj->properties->values[].. mostly to avoid
4014 	 * having to deal w/ EDID and similar props in atomic paths:
4015 	 */
4016 	if (drm_core_check_feature(property->dev, DRIVER_ATOMIC) &&
4017 			!(property->flags & DRM_MODE_PROP_IMMUTABLE))
4018 		return drm_atomic_get_property(obj, property, val);
4019 
4020 	for (i = 0; i < obj->properties->count; i++) {
4021 		if (obj->properties->properties[i] == property) {
4022 			*val = obj->properties->values[i];
4023 			return 0;
4024 		}
4025 	}
4026 
4027 	return -EINVAL;
4028 }
4029 EXPORT_SYMBOL(drm_object_property_get_value);
4030 
4031 /**
4032  * drm_mode_getproperty_ioctl - get the property metadata
4033  * @dev: DRM device
4034  * @data: ioctl data
4035  * @file_priv: DRM file info
4036  *
4037  * This function retrieves the metadata for a given property, like the different
4038  * possible values for an enum property or the limits for a range property.
4039  *
4040  * Blob properties are special
4041  *
4042  * Called by the user via ioctl.
4043  *
4044  * Returns:
4045  * Zero on success, negative errno on failure.
4046  */
4047 int drm_mode_getproperty_ioctl(struct drm_device *dev,
4048 			       void *data, struct drm_file *file_priv)
4049 {
4050 	struct drm_mode_get_property *out_resp = data;
4051 	struct drm_property *property;
4052 	int enum_count = 0;
4053 	int value_count = 0;
4054 	int ret = 0, i;
4055 	int copied;
4056 	struct drm_property_enum *prop_enum;
4057 	struct drm_mode_property_enum __user *enum_ptr;
4058 	uint64_t __user *values_ptr;
4059 
4060 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4061 		return -EINVAL;
4062 
4063 	drm_modeset_lock_all(dev);
4064 	property = drm_property_find(dev, out_resp->prop_id);
4065 	if (!property) {
4066 		ret = -ENOENT;
4067 		goto done;
4068 	}
4069 
4070 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4071 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4072 		list_for_each_entry(prop_enum, &property->enum_list, head)
4073 			enum_count++;
4074 	}
4075 
4076 	value_count = property->num_values;
4077 
4078 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
4079 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
4080 	out_resp->flags = property->flags;
4081 
4082 	if ((out_resp->count_values >= value_count) && value_count) {
4083 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
4084 		for (i = 0; i < value_count; i++) {
4085 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
4086 				ret = -EFAULT;
4087 				goto done;
4088 			}
4089 		}
4090 	}
4091 	out_resp->count_values = value_count;
4092 
4093 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
4094 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4095 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
4096 			copied = 0;
4097 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
4098 			list_for_each_entry(prop_enum, &property->enum_list, head) {
4099 
4100 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
4101 					ret = -EFAULT;
4102 					goto done;
4103 				}
4104 
4105 				if (copy_to_user(&enum_ptr[copied].name,
4106 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
4107 					ret = -EFAULT;
4108 					goto done;
4109 				}
4110 				copied++;
4111 			}
4112 		}
4113 		out_resp->count_enum_blobs = enum_count;
4114 	}
4115 
4116 	/*
4117 	 * NOTE: The idea seems to have been to use this to read all the blob
4118 	 * property values. But nothing ever added them to the corresponding
4119 	 * list, userspace always used the special-purpose get_blob ioctl to
4120 	 * read the value for a blob property. It also doesn't make a lot of
4121 	 * sense to return values here when everything else is just metadata for
4122 	 * the property itself.
4123 	 */
4124 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
4125 		out_resp->count_enum_blobs = 0;
4126 done:
4127 	drm_modeset_unlock_all(dev);
4128 	return ret;
4129 }
4130 
4131 static struct drm_property_blob *
4132 drm_property_create_blob(struct drm_device *dev, size_t length,
4133 			 const void *data)
4134 {
4135 	struct drm_property_blob *blob;
4136 	int ret;
4137 
4138 	if (!length || !data)
4139 		return NULL;
4140 
4141 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
4142 	if (!blob)
4143 		return NULL;
4144 
4145 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
4146 	if (ret) {
4147 		kfree(blob);
4148 		return NULL;
4149 	}
4150 
4151 	blob->length = length;
4152 
4153 	memcpy(blob->data, data, length);
4154 
4155 	list_add_tail(&blob->head, &dev->mode_config.property_blob_list);
4156 	return blob;
4157 }
4158 
4159 static void drm_property_destroy_blob(struct drm_device *dev,
4160 			       struct drm_property_blob *blob)
4161 {
4162 	drm_mode_object_put(dev, &blob->base);
4163 	list_del(&blob->head);
4164 	kfree(blob);
4165 }
4166 
4167 /**
4168  * drm_mode_getblob_ioctl - get the contents of a blob property value
4169  * @dev: DRM device
4170  * @data: ioctl data
4171  * @file_priv: DRM file info
4172  *
4173  * This function retrieves the contents of a blob property. The value stored in
4174  * an object's blob property is just a normal modeset object id.
4175  *
4176  * Called by the user via ioctl.
4177  *
4178  * Returns:
4179  * Zero on success, negative errno on failure.
4180  */
4181 int drm_mode_getblob_ioctl(struct drm_device *dev,
4182 			   void *data, struct drm_file *file_priv)
4183 {
4184 	struct drm_mode_get_blob *out_resp = data;
4185 	struct drm_property_blob *blob;
4186 	int ret = 0;
4187 	void __user *blob_ptr;
4188 
4189 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4190 		return -EINVAL;
4191 
4192 	drm_modeset_lock_all(dev);
4193 	blob = drm_property_blob_find(dev, out_resp->blob_id);
4194 	if (!blob) {
4195 		ret = -ENOENT;
4196 		goto done;
4197 	}
4198 
4199 	if (out_resp->length == blob->length) {
4200 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
4201 		if (copy_to_user(blob_ptr, blob->data, blob->length)) {
4202 			ret = -EFAULT;
4203 			goto done;
4204 		}
4205 	}
4206 	out_resp->length = blob->length;
4207 
4208 done:
4209 	drm_modeset_unlock_all(dev);
4210 	return ret;
4211 }
4212 
4213 /**
4214  * drm_mode_connector_set_path_property - set tile property on connector
4215  * @connector: connector to set property on.
4216  * @path: path to use for property.
4217  *
4218  * This creates a property to expose to userspace to specify a
4219  * connector path. This is mainly used for DisplayPort MST where
4220  * connectors have a topology and we want to allow userspace to give
4221  * them more meaningful names.
4222  *
4223  * Returns:
4224  * Zero on success, negative errno on failure.
4225  */
4226 int drm_mode_connector_set_path_property(struct drm_connector *connector,
4227 					 const char *path)
4228 {
4229 	struct drm_device *dev = connector->dev;
4230 	size_t size = strlen(path) + 1;
4231 	int ret;
4232 
4233 	connector->path_blob_ptr = drm_property_create_blob(connector->dev,
4234 							    size, path);
4235 	if (!connector->path_blob_ptr)
4236 		return -EINVAL;
4237 
4238 	ret = drm_object_property_set_value(&connector->base,
4239 					    dev->mode_config.path_property,
4240 					    connector->path_blob_ptr->base.id);
4241 	return ret;
4242 }
4243 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4244 
4245 /**
4246  * drm_mode_connector_set_tile_property - set tile property on connector
4247  * @connector: connector to set property on.
4248  *
4249  * This looks up the tile information for a connector, and creates a
4250  * property for userspace to parse if it exists. The property is of
4251  * the form of 8 integers using ':' as a separator.
4252  *
4253  * Returns:
4254  * Zero on success, errno on failure.
4255  */
4256 int drm_mode_connector_set_tile_property(struct drm_connector *connector)
4257 {
4258 	struct drm_device *dev = connector->dev;
4259 	int ret, size;
4260 	char tile[256];
4261 
4262 	if (connector->tile_blob_ptr)
4263 		drm_property_destroy_blob(dev, connector->tile_blob_ptr);
4264 
4265 	if (!connector->has_tile) {
4266 		connector->tile_blob_ptr = NULL;
4267 		ret = drm_object_property_set_value(&connector->base,
4268 						    dev->mode_config.tile_property, 0);
4269 		return ret;
4270 	}
4271 
4272 	ksnprintf(tile, 256, "%d:%d:%d:%d:%d:%d:%d:%d",
4273 		 connector->tile_group->id, connector->tile_is_single_monitor,
4274 		 connector->num_h_tile, connector->num_v_tile,
4275 		 connector->tile_h_loc, connector->tile_v_loc,
4276 		 connector->tile_h_size, connector->tile_v_size);
4277 	size = strlen(tile) + 1;
4278 
4279 	connector->tile_blob_ptr = drm_property_create_blob(connector->dev,
4280 							    size, tile);
4281 	if (!connector->tile_blob_ptr)
4282 		return -EINVAL;
4283 
4284 	ret = drm_object_property_set_value(&connector->base,
4285 					    dev->mode_config.tile_property,
4286 					    connector->tile_blob_ptr->base.id);
4287 	return ret;
4288 }
4289 EXPORT_SYMBOL(drm_mode_connector_set_tile_property);
4290 
4291 /**
4292  * drm_mode_connector_update_edid_property - update the edid property of a connector
4293  * @connector: drm connector
4294  * @edid: new value of the edid property
4295  *
4296  * This function creates a new blob modeset object and assigns its id to the
4297  * connector's edid property.
4298  *
4299  * Returns:
4300  * Zero on success, negative errno on failure.
4301  */
4302 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4303 					    const struct edid *edid)
4304 {
4305 	struct drm_device *dev = connector->dev;
4306 	size_t size;
4307 	int ret;
4308 
4309 	/* ignore requests to set edid when overridden */
4310 	if (connector->override_edid)
4311 		return 0;
4312 
4313 	if (connector->edid_blob_ptr)
4314 		drm_property_destroy_blob(dev, connector->edid_blob_ptr);
4315 
4316 	/* Delete edid, when there is none. */
4317 	if (!edid) {
4318 		connector->edid_blob_ptr = NULL;
4319 		ret = drm_object_property_set_value(&connector->base, dev->mode_config.edid_property, 0);
4320 		return ret;
4321 	}
4322 
4323 	size = EDID_LENGTH * (1 + edid->extensions);
4324 	connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
4325 							    size, edid);
4326 	if (!connector->edid_blob_ptr)
4327 		return -EINVAL;
4328 
4329 	ret = drm_object_property_set_value(&connector->base,
4330 					       dev->mode_config.edid_property,
4331 					       connector->edid_blob_ptr->base.id);
4332 
4333 	return ret;
4334 }
4335 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4336 
4337 /* Some properties could refer to dynamic refcnt'd objects, or things that
4338  * need special locking to handle lifetime issues (ie. to ensure the prop
4339  * value doesn't become invalid part way through the property update due to
4340  * race).  The value returned by reference via 'obj' should be passed back
4341  * to drm_property_change_valid_put() after the property is set (and the
4342  * object to which the property is attached has a chance to take it's own
4343  * reference).
4344  */
4345 bool drm_property_change_valid_get(struct drm_property *property,
4346 					 uint64_t value, struct drm_mode_object **ref)
4347 {
4348 	int i;
4349 
4350 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4351 		return false;
4352 
4353 	*ref = NULL;
4354 
4355 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4356 		if (value < property->values[0] || value > property->values[1])
4357 			return false;
4358 		return true;
4359 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4360 		int64_t svalue = U642I64(value);
4361 
4362 		if (svalue < U642I64(property->values[0]) ||
4363 				svalue > U642I64(property->values[1]))
4364 			return false;
4365 		return true;
4366 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4367 		uint64_t valid_mask = 0;
4368 
4369 		for (i = 0; i < property->num_values; i++)
4370 			valid_mask |= (1ULL << property->values[i]);
4371 		return !(value & ~valid_mask);
4372 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4373 		/* Only the driver knows */
4374 		return true;
4375 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4376 		/* a zero value for an object property translates to null: */
4377 		if (value == 0)
4378 			return true;
4379 
4380 		/* handle refcnt'd objects specially: */
4381 		if (property->values[0] == DRM_MODE_OBJECT_FB) {
4382 			struct drm_framebuffer *fb;
4383 			fb = drm_framebuffer_lookup(property->dev, value);
4384 			if (fb) {
4385 				*ref = &fb->base;
4386 				return true;
4387 			} else {
4388 				return false;
4389 			}
4390 		} else {
4391 			return _object_find(property->dev, value, property->values[0]) != NULL;
4392 		}
4393 	}
4394 
4395 	for (i = 0; i < property->num_values; i++)
4396 		if (property->values[i] == value)
4397 			return true;
4398 	return false;
4399 }
4400 
4401 void drm_property_change_valid_put(struct drm_property *property,
4402 		struct drm_mode_object *ref)
4403 {
4404 	if (!ref)
4405 		return;
4406 
4407 	if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4408 		if (property->values[0] == DRM_MODE_OBJECT_FB)
4409 			drm_framebuffer_unreference(obj_to_fb(ref));
4410 	}
4411 }
4412 
4413 /**
4414  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4415  * @dev: DRM device
4416  * @data: ioctl data
4417  * @file_priv: DRM file info
4418  *
4419  * This function sets the current value for a connectors's property. It also
4420  * calls into a driver's ->set_property callback to update the hardware state
4421  *
4422  * Called by the user via ioctl.
4423  *
4424  * Returns:
4425  * Zero on success, negative errno on failure.
4426  */
4427 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4428 				       void *data, struct drm_file *file_priv)
4429 {
4430 	struct drm_mode_connector_set_property *conn_set_prop = data;
4431 	struct drm_mode_obj_set_property obj_set_prop = {
4432 		.value = conn_set_prop->value,
4433 		.prop_id = conn_set_prop->prop_id,
4434 		.obj_id = conn_set_prop->connector_id,
4435 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4436 	};
4437 
4438 	/* It does all the locking and checking we need */
4439 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4440 }
4441 
4442 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4443 					   struct drm_property *property,
4444 					   uint64_t value)
4445 {
4446 	int ret = -EINVAL;
4447 	struct drm_connector *connector = obj_to_connector(obj);
4448 
4449 	/* Do DPMS ourselves */
4450 	if (property == connector->dev->mode_config.dpms_property) {
4451 		if (connector->funcs->dpms)
4452 			(*connector->funcs->dpms)(connector, (int)value);
4453 		ret = 0;
4454 	} else if (connector->funcs->set_property)
4455 		ret = connector->funcs->set_property(connector, property, value);
4456 
4457 	/* store the property value if successful */
4458 	if (!ret)
4459 		drm_object_property_set_value(&connector->base, property, value);
4460 	return ret;
4461 }
4462 
4463 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4464 				      struct drm_property *property,
4465 				      uint64_t value)
4466 {
4467 	int ret = -EINVAL;
4468 	struct drm_crtc *crtc = obj_to_crtc(obj);
4469 
4470 	if (crtc->funcs->set_property)
4471 		ret = crtc->funcs->set_property(crtc, property, value);
4472 	if (!ret)
4473 		drm_object_property_set_value(obj, property, value);
4474 
4475 	return ret;
4476 }
4477 
4478 /**
4479  * drm_mode_plane_set_obj_prop - set the value of a property
4480  * @plane: drm plane object to set property value for
4481  * @property: property to set
4482  * @value: value the property should be set to
4483  *
4484  * This functions sets a given property on a given plane object. This function
4485  * calls the driver's ->set_property callback and changes the software state of
4486  * the property if the callback succeeds.
4487  *
4488  * Returns:
4489  * Zero on success, error code on failure.
4490  */
4491 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4492 				struct drm_property *property,
4493 				uint64_t value)
4494 {
4495 	int ret = -EINVAL;
4496 	struct drm_mode_object *obj = &plane->base;
4497 
4498 	if (plane->funcs->set_property)
4499 		ret = plane->funcs->set_property(plane, property, value);
4500 	if (!ret)
4501 		drm_object_property_set_value(obj, property, value);
4502 
4503 	return ret;
4504 }
4505 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4506 
4507 /**
4508  * drm_mode_obj_get_properties_ioctl - get the current value of a object's property
4509  * @dev: DRM device
4510  * @data: ioctl data
4511  * @file_priv: DRM file info
4512  *
4513  * This function retrieves the current value for an object's property. Compared
4514  * to the connector specific ioctl this one is extended to also work on crtc and
4515  * plane objects.
4516  *
4517  * Called by the user via ioctl.
4518  *
4519  * Returns:
4520  * Zero on success, negative errno on failure.
4521  */
4522 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4523 				      struct drm_file *file_priv)
4524 {
4525 	struct drm_mode_obj_get_properties *arg = data;
4526 	struct drm_mode_object *obj;
4527 	int ret = 0;
4528 
4529 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4530 		return -EINVAL;
4531 
4532 	drm_modeset_lock_all(dev);
4533 
4534 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4535 	if (!obj) {
4536 		ret = -ENOENT;
4537 		goto out;
4538 	}
4539 	if (!obj->properties) {
4540 		ret = -EINVAL;
4541 		goto out;
4542 	}
4543 
4544 	ret = get_properties(obj, file_priv->atomic,
4545 			(uint32_t __user *)(unsigned long)(arg->props_ptr),
4546 			(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
4547 			&arg->count_props);
4548 
4549 out:
4550 	drm_modeset_unlock_all(dev);
4551 	return ret;
4552 }
4553 
4554 /**
4555  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4556  * @dev: DRM device
4557  * @data: ioctl data
4558  * @file_priv: DRM file info
4559  *
4560  * This function sets the current value for an object's property. It also calls
4561  * into a driver's ->set_property callback to update the hardware state.
4562  * Compared to the connector specific ioctl this one is extended to also work on
4563  * crtc and plane objects.
4564  *
4565  * Called by the user via ioctl.
4566  *
4567  * Returns:
4568  * Zero on success, negative errno on failure.
4569  */
4570 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4571 				    struct drm_file *file_priv)
4572 {
4573 	struct drm_mode_obj_set_property *arg = data;
4574 	struct drm_mode_object *arg_obj;
4575 	struct drm_mode_object *prop_obj;
4576 	struct drm_property *property;
4577 	int i, ret = -EINVAL;
4578 	struct drm_mode_object *ref;
4579 
4580 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4581 		return -EINVAL;
4582 
4583 	drm_modeset_lock_all(dev);
4584 
4585 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4586 	if (!arg_obj) {
4587 		ret = -ENOENT;
4588 		goto out;
4589 	}
4590 	if (!arg_obj->properties)
4591 		goto out;
4592 
4593 	for (i = 0; i < arg_obj->properties->count; i++)
4594 		if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
4595 			break;
4596 
4597 	if (i == arg_obj->properties->count)
4598 		goto out;
4599 
4600 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4601 					DRM_MODE_OBJECT_PROPERTY);
4602 	if (!prop_obj) {
4603 		ret = -ENOENT;
4604 		goto out;
4605 	}
4606 	property = obj_to_property(prop_obj);
4607 
4608 	if (!drm_property_change_valid_get(property, arg->value, &ref))
4609 		goto out;
4610 
4611 	switch (arg_obj->type) {
4612 	case DRM_MODE_OBJECT_CONNECTOR:
4613 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4614 						      arg->value);
4615 		break;
4616 	case DRM_MODE_OBJECT_CRTC:
4617 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4618 		break;
4619 	case DRM_MODE_OBJECT_PLANE:
4620 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4621 						  property, arg->value);
4622 		break;
4623 	}
4624 
4625 	drm_property_change_valid_put(property, ref);
4626 
4627 out:
4628 	drm_modeset_unlock_all(dev);
4629 	return ret;
4630 }
4631 
4632 /**
4633  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4634  * @connector: connector to attach
4635  * @encoder: encoder to attach @connector to
4636  *
4637  * This function links up a connector to an encoder. Note that the routing
4638  * restrictions between encoders and crtcs are exposed to userspace through the
4639  * possible_clones and possible_crtcs bitmasks.
4640  *
4641  * Returns:
4642  * Zero on success, negative errno on failure.
4643  */
4644 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4645 				      struct drm_encoder *encoder)
4646 {
4647 	int i;
4648 
4649 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4650 		if (connector->encoder_ids[i] == 0) {
4651 			connector->encoder_ids[i] = encoder->base.id;
4652 			return 0;
4653 		}
4654 	}
4655 	return -ENOMEM;
4656 }
4657 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4658 
4659 /**
4660  * drm_mode_crtc_set_gamma_size - set the gamma table size
4661  * @crtc: CRTC to set the gamma table size for
4662  * @gamma_size: size of the gamma table
4663  *
4664  * Drivers which support gamma tables should set this to the supported gamma
4665  * table size when initializing the CRTC. Currently the drm core only supports a
4666  * fixed gamma table size.
4667  *
4668  * Returns:
4669  * Zero on success, negative errno on failure.
4670  */
4671 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4672 				 int gamma_size)
4673 {
4674 	crtc->gamma_size = gamma_size;
4675 
4676 	crtc->gamma_store = kcalloc(gamma_size, sizeof(uint16_t) * 3,
4677 				    GFP_KERNEL);
4678 	if (!crtc->gamma_store) {
4679 		crtc->gamma_size = 0;
4680 		return -ENOMEM;
4681 	}
4682 
4683 	return 0;
4684 }
4685 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4686 
4687 /**
4688  * drm_mode_gamma_set_ioctl - set the gamma table
4689  * @dev: DRM device
4690  * @data: ioctl data
4691  * @file_priv: DRM file info
4692  *
4693  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4694  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
4695  *
4696  * Called by the user via ioctl.
4697  *
4698  * Returns:
4699  * Zero on success, negative errno on failure.
4700  */
4701 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
4702 			     void *data, struct drm_file *file_priv)
4703 {
4704 	struct drm_mode_crtc_lut *crtc_lut = data;
4705 	struct drm_crtc *crtc;
4706 	void *r_base, *g_base, *b_base;
4707 	int size;
4708 	int ret = 0;
4709 
4710 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4711 		return -EINVAL;
4712 
4713 	drm_modeset_lock_all(dev);
4714 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4715 	if (!crtc) {
4716 		ret = -ENOENT;
4717 		goto out;
4718 	}
4719 
4720 	if (crtc->funcs->gamma_set == NULL) {
4721 		ret = -ENOSYS;
4722 		goto out;
4723 	}
4724 
4725 	/* memcpy into gamma store */
4726 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4727 		ret = -EINVAL;
4728 		goto out;
4729 	}
4730 
4731 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4732 	r_base = crtc->gamma_store;
4733 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
4734 		ret = -EFAULT;
4735 		goto out;
4736 	}
4737 
4738 	g_base = (char *)r_base + size;
4739 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
4740 		ret = -EFAULT;
4741 		goto out;
4742 	}
4743 
4744 	b_base = (char *)g_base + size;
4745 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
4746 		ret = -EFAULT;
4747 		goto out;
4748 	}
4749 
4750 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
4751 
4752 out:
4753 	drm_modeset_unlock_all(dev);
4754 	return ret;
4755 
4756 }
4757 
4758 /**
4759  * drm_mode_gamma_get_ioctl - get the gamma table
4760  * @dev: DRM device
4761  * @data: ioctl data
4762  * @file_priv: DRM file info
4763  *
4764  * Copy the current gamma table into the storage provided. This also provides
4765  * the gamma table size the driver expects, which can be used to size the
4766  * allocated storage.
4767  *
4768  * Called by the user via ioctl.
4769  *
4770  * Returns:
4771  * Zero on success, negative errno on failure.
4772  */
4773 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
4774 			     void *data, struct drm_file *file_priv)
4775 {
4776 	struct drm_mode_crtc_lut *crtc_lut = data;
4777 	struct drm_crtc *crtc;
4778 	void *r_base, *g_base, *b_base;
4779 	int size;
4780 	int ret = 0;
4781 
4782 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4783 		return -EINVAL;
4784 
4785 	drm_modeset_lock_all(dev);
4786 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4787 	if (!crtc) {
4788 		ret = -ENOENT;
4789 		goto out;
4790 	}
4791 
4792 	/* memcpy into gamma store */
4793 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4794 		ret = -EINVAL;
4795 		goto out;
4796 	}
4797 
4798 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4799 	r_base = crtc->gamma_store;
4800 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
4801 		ret = -EFAULT;
4802 		goto out;
4803 	}
4804 
4805 	g_base = (char *)r_base + size;
4806 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
4807 		ret = -EFAULT;
4808 		goto out;
4809 	}
4810 
4811 	b_base = (char *)g_base + size;
4812 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
4813 		ret = -EFAULT;
4814 		goto out;
4815 	}
4816 out:
4817 	drm_modeset_unlock_all(dev);
4818 	return ret;
4819 }
4820 
4821 /*
4822  * The Linux version of kfree() is a macro and can't be called
4823  * directly via a function pointer
4824  */
4825 static void drm_kms_free(void *arg)
4826 {
4827 	kfree(arg);
4828 }
4829 
4830 /**
4831  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
4832  * @dev: DRM device
4833  * @data: ioctl data
4834  * @file_priv: DRM file info
4835  *
4836  * This schedules an asynchronous update on a given CRTC, called page flip.
4837  * Optionally a drm event is generated to signal the completion of the event.
4838  * Generic drivers cannot assume that a pageflip with changed framebuffer
4839  * properties (including driver specific metadata like tiling layout) will work,
4840  * but some drivers support e.g. pixel format changes through the pageflip
4841  * ioctl.
4842  *
4843  * Called by the user via ioctl.
4844  *
4845  * Returns:
4846  * Zero on success, negative errno on failure.
4847  */
4848 int drm_mode_page_flip_ioctl(struct drm_device *dev,
4849 			     void *data, struct drm_file *file_priv)
4850 {
4851 	struct drm_mode_crtc_page_flip *page_flip = data;
4852 	struct drm_crtc *crtc;
4853 	struct drm_framebuffer *fb = NULL;
4854 	struct drm_pending_vblank_event *e = NULL;
4855 	int ret = -EINVAL;
4856 
4857 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
4858 	    page_flip->reserved != 0)
4859 		return -EINVAL;
4860 
4861 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
4862 		return -EINVAL;
4863 
4864 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
4865 	if (!crtc)
4866 		return -ENOENT;
4867 
4868 	drm_modeset_lock_crtc(crtc, crtc->primary);
4869 	if (crtc->primary->fb == NULL) {
4870 		/* The framebuffer is currently unbound, presumably
4871 		 * due to a hotplug event, that userspace has not
4872 		 * yet discovered.
4873 		 */
4874 		ret = -EBUSY;
4875 		goto out;
4876 	}
4877 
4878 	if (crtc->funcs->page_flip == NULL)
4879 		goto out;
4880 
4881 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
4882 	if (!fb) {
4883 		ret = -ENOENT;
4884 		goto out;
4885 	}
4886 
4887 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
4888 	if (ret)
4889 		goto out;
4890 
4891 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
4892 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
4893 		ret = -EINVAL;
4894 		goto out;
4895 	}
4896 
4897 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4898 		ret = -ENOMEM;
4899 		lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4900 		if (file_priv->event_space < sizeof(e->event)) {
4901 			lockmgr(&dev->event_lock, LK_RELEASE);
4902 			goto out;
4903 		}
4904 		file_priv->event_space -= sizeof(e->event);
4905 		lockmgr(&dev->event_lock, LK_RELEASE);
4906 
4907 		e = kzalloc(sizeof(*e), GFP_KERNEL);
4908 		if (e == NULL) {
4909 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4910 			file_priv->event_space += sizeof(e->event);
4911 			lockmgr(&dev->event_lock, LK_RELEASE);
4912 			goto out;
4913 		}
4914 
4915 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
4916 		e->event.base.length = sizeof(e->event);
4917 		e->event.user_data = page_flip->user_data;
4918 		e->base.event = &e->event.base;
4919 		e->base.file_priv = file_priv;
4920 #ifdef __DragonFly__
4921 		e->base.destroy =
4922 			(void (*) (struct drm_pending_event *)) drm_kms_free;
4923 #else
4924 		e->base.destroy =
4925 			(void (*) (struct drm_pending_event *)) kfree;
4926 #endif
4927 	}
4928 
4929 	crtc->primary->old_fb = crtc->primary->fb;
4930 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
4931 	if (ret) {
4932 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4933 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4934 			file_priv->event_space += sizeof(e->event);
4935 			lockmgr(&dev->event_lock, LK_RELEASE);
4936 			kfree(e);
4937 		}
4938 		/* Keep the old fb, don't unref it. */
4939 		crtc->primary->old_fb = NULL;
4940 	} else {
4941 		/*
4942 		 * Warn if the driver hasn't properly updated the crtc->fb
4943 		 * field to reflect that the new framebuffer is now used.
4944 		 * Failing to do so will screw with the reference counting
4945 		 * on framebuffers.
4946 		 */
4947 		WARN_ON(crtc->primary->fb != fb);
4948 		/* Unref only the old framebuffer. */
4949 		fb = NULL;
4950 	}
4951 
4952 out:
4953 	if (fb)
4954 		drm_framebuffer_unreference(fb);
4955 	if (crtc->primary->old_fb)
4956 		drm_framebuffer_unreference(crtc->primary->old_fb);
4957 	crtc->primary->old_fb = NULL;
4958 	drm_modeset_unlock_crtc(crtc);
4959 
4960 	return ret;
4961 }
4962 
4963 /**
4964  * drm_mode_config_reset - call ->reset callbacks
4965  * @dev: drm device
4966  *
4967  * This functions calls all the crtc's, encoder's and connector's ->reset
4968  * callback. Drivers can use this in e.g. their driver load or resume code to
4969  * reset hardware and software state.
4970  */
4971 void drm_mode_config_reset(struct drm_device *dev)
4972 {
4973 	struct drm_crtc *crtc;
4974 	struct drm_plane *plane;
4975 	struct drm_encoder *encoder;
4976 	struct drm_connector *connector;
4977 
4978 	list_for_each_entry(plane, &dev->mode_config.plane_list, head)
4979 		if (plane->funcs->reset)
4980 			plane->funcs->reset(plane);
4981 
4982 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
4983 		if (crtc->funcs->reset)
4984 			crtc->funcs->reset(crtc);
4985 
4986 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
4987 		if (encoder->funcs->reset)
4988 			encoder->funcs->reset(encoder);
4989 
4990 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
4991 		connector->status = connector_status_unknown;
4992 
4993 		if (connector->funcs->reset)
4994 			connector->funcs->reset(connector);
4995 	}
4996 }
4997 EXPORT_SYMBOL(drm_mode_config_reset);
4998 
4999 /**
5000  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
5001  * @dev: DRM device
5002  * @data: ioctl data
5003  * @file_priv: DRM file info
5004  *
5005  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
5006  * TTM or something else entirely) and returns the resulting buffer handle. This
5007  * handle can then be wrapped up into a framebuffer modeset object.
5008  *
5009  * Note that userspace is not allowed to use such objects for render
5010  * acceleration - drivers must create their own private ioctls for such a use
5011  * case.
5012  *
5013  * Called by the user via ioctl.
5014  *
5015  * Returns:
5016  * Zero on success, negative errno on failure.
5017  */
5018 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
5019 			       void *data, struct drm_file *file_priv)
5020 {
5021 	struct drm_mode_create_dumb *args = data;
5022 	u32 cpp, stride, size;
5023 
5024 	if (!dev->driver->dumb_create)
5025 		return -ENOSYS;
5026 	if (!args->width || !args->height || !args->bpp)
5027 		return -EINVAL;
5028 
5029 	/* overflow checks for 32bit size calculations */
5030 	/* NOTE: DIV_ROUND_UP() can overflow */
5031 	cpp = DIV_ROUND_UP(args->bpp, 8);
5032 	if (!cpp || cpp > 0xffffffffU / args->width)
5033 		return -EINVAL;
5034 	stride = cpp * args->width;
5035 	if (args->height > 0xffffffffU / stride)
5036 		return -EINVAL;
5037 
5038 	/* test for wrap-around */
5039 	size = args->height * stride;
5040 	if (PAGE_ALIGN(size) == 0)
5041 		return -EINVAL;
5042 
5043 	/*
5044 	 * handle, pitch and size are output parameters. Zero them out to
5045 	 * prevent drivers from accidentally using uninitialized data. Since
5046 	 * not all existing userspace is clearing these fields properly we
5047 	 * cannot reject IOCTL with garbage in them.
5048 	 */
5049 	args->handle = 0;
5050 	args->pitch = 0;
5051 	args->size = 0;
5052 
5053 	return dev->driver->dumb_create(file_priv, dev, args);
5054 }
5055 
5056 /**
5057  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
5058  * @dev: DRM device
5059  * @data: ioctl data
5060  * @file_priv: DRM file info
5061  *
5062  * Allocate an offset in the drm device node's address space to be able to
5063  * memory map a dumb buffer.
5064  *
5065  * Called by the user via ioctl.
5066  *
5067  * Returns:
5068  * Zero on success, negative errno on failure.
5069  */
5070 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
5071 			     void *data, struct drm_file *file_priv)
5072 {
5073 	struct drm_mode_map_dumb *args = data;
5074 
5075 	/* call driver ioctl to get mmap offset */
5076 	if (!dev->driver->dumb_map_offset)
5077 		return -ENOSYS;
5078 
5079 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
5080 }
5081 
5082 /**
5083  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
5084  * @dev: DRM device
5085  * @data: ioctl data
5086  * @file_priv: DRM file info
5087  *
5088  * This destroys the userspace handle for the given dumb backing storage buffer.
5089  * Since buffer objects must be reference counted in the kernel a buffer object
5090  * won't be immediately freed if a framebuffer modeset object still uses it.
5091  *
5092  * Called by the user via ioctl.
5093  *
5094  * Returns:
5095  * Zero on success, negative errno on failure.
5096  */
5097 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
5098 				void *data, struct drm_file *file_priv)
5099 {
5100 	struct drm_mode_destroy_dumb *args = data;
5101 
5102 	if (!dev->driver->dumb_destroy)
5103 		return -ENOSYS;
5104 
5105 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
5106 }
5107 
5108 /**
5109  * drm_fb_get_bpp_depth - get the bpp/depth values for format
5110  * @format: pixel format (DRM_FORMAT_*)
5111  * @depth: storage for the depth value
5112  * @bpp: storage for the bpp value
5113  *
5114  * This only supports RGB formats here for compat with code that doesn't use
5115  * pixel formats directly yet.
5116  */
5117 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
5118 			  int *bpp)
5119 {
5120 	switch (format) {
5121 	case DRM_FORMAT_C8:
5122 	case DRM_FORMAT_RGB332:
5123 	case DRM_FORMAT_BGR233:
5124 		*depth = 8;
5125 		*bpp = 8;
5126 		break;
5127 	case DRM_FORMAT_XRGB1555:
5128 	case DRM_FORMAT_XBGR1555:
5129 	case DRM_FORMAT_RGBX5551:
5130 	case DRM_FORMAT_BGRX5551:
5131 	case DRM_FORMAT_ARGB1555:
5132 	case DRM_FORMAT_ABGR1555:
5133 	case DRM_FORMAT_RGBA5551:
5134 	case DRM_FORMAT_BGRA5551:
5135 		*depth = 15;
5136 		*bpp = 16;
5137 		break;
5138 	case DRM_FORMAT_RGB565:
5139 	case DRM_FORMAT_BGR565:
5140 		*depth = 16;
5141 		*bpp = 16;
5142 		break;
5143 	case DRM_FORMAT_RGB888:
5144 	case DRM_FORMAT_BGR888:
5145 		*depth = 24;
5146 		*bpp = 24;
5147 		break;
5148 	case DRM_FORMAT_XRGB8888:
5149 	case DRM_FORMAT_XBGR8888:
5150 	case DRM_FORMAT_RGBX8888:
5151 	case DRM_FORMAT_BGRX8888:
5152 		*depth = 24;
5153 		*bpp = 32;
5154 		break;
5155 	case DRM_FORMAT_XRGB2101010:
5156 	case DRM_FORMAT_XBGR2101010:
5157 	case DRM_FORMAT_RGBX1010102:
5158 	case DRM_FORMAT_BGRX1010102:
5159 	case DRM_FORMAT_ARGB2101010:
5160 	case DRM_FORMAT_ABGR2101010:
5161 	case DRM_FORMAT_RGBA1010102:
5162 	case DRM_FORMAT_BGRA1010102:
5163 		*depth = 30;
5164 		*bpp = 32;
5165 		break;
5166 	case DRM_FORMAT_ARGB8888:
5167 	case DRM_FORMAT_ABGR8888:
5168 	case DRM_FORMAT_RGBA8888:
5169 	case DRM_FORMAT_BGRA8888:
5170 		*depth = 32;
5171 		*bpp = 32;
5172 		break;
5173 	default:
5174 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
5175 			      drm_get_format_name(format));
5176 		*depth = 0;
5177 		*bpp = 0;
5178 		break;
5179 	}
5180 }
5181 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
5182 
5183 /**
5184  * drm_format_num_planes - get the number of planes for format
5185  * @format: pixel format (DRM_FORMAT_*)
5186  *
5187  * Returns:
5188  * The number of planes used by the specified pixel format.
5189  */
5190 int drm_format_num_planes(uint32_t format)
5191 {
5192 	switch (format) {
5193 	case DRM_FORMAT_YUV410:
5194 	case DRM_FORMAT_YVU410:
5195 	case DRM_FORMAT_YUV411:
5196 	case DRM_FORMAT_YVU411:
5197 	case DRM_FORMAT_YUV420:
5198 	case DRM_FORMAT_YVU420:
5199 	case DRM_FORMAT_YUV422:
5200 	case DRM_FORMAT_YVU422:
5201 	case DRM_FORMAT_YUV444:
5202 	case DRM_FORMAT_YVU444:
5203 		return 3;
5204 	case DRM_FORMAT_NV12:
5205 	case DRM_FORMAT_NV21:
5206 	case DRM_FORMAT_NV16:
5207 	case DRM_FORMAT_NV61:
5208 	case DRM_FORMAT_NV24:
5209 	case DRM_FORMAT_NV42:
5210 		return 2;
5211 	default:
5212 		return 1;
5213 	}
5214 }
5215 EXPORT_SYMBOL(drm_format_num_planes);
5216 
5217 /**
5218  * drm_format_plane_cpp - determine the bytes per pixel value
5219  * @format: pixel format (DRM_FORMAT_*)
5220  * @plane: plane index
5221  *
5222  * Returns:
5223  * The bytes per pixel value for the specified plane.
5224  */
5225 int drm_format_plane_cpp(uint32_t format, int plane)
5226 {
5227 	unsigned int depth;
5228 	int bpp;
5229 
5230 	if (plane >= drm_format_num_planes(format))
5231 		return 0;
5232 
5233 	switch (format) {
5234 	case DRM_FORMAT_YUYV:
5235 	case DRM_FORMAT_YVYU:
5236 	case DRM_FORMAT_UYVY:
5237 	case DRM_FORMAT_VYUY:
5238 		return 2;
5239 	case DRM_FORMAT_NV12:
5240 	case DRM_FORMAT_NV21:
5241 	case DRM_FORMAT_NV16:
5242 	case DRM_FORMAT_NV61:
5243 	case DRM_FORMAT_NV24:
5244 	case DRM_FORMAT_NV42:
5245 		return plane ? 2 : 1;
5246 	case DRM_FORMAT_YUV410:
5247 	case DRM_FORMAT_YVU410:
5248 	case DRM_FORMAT_YUV411:
5249 	case DRM_FORMAT_YVU411:
5250 	case DRM_FORMAT_YUV420:
5251 	case DRM_FORMAT_YVU420:
5252 	case DRM_FORMAT_YUV422:
5253 	case DRM_FORMAT_YVU422:
5254 	case DRM_FORMAT_YUV444:
5255 	case DRM_FORMAT_YVU444:
5256 		return 1;
5257 	default:
5258 		drm_fb_get_bpp_depth(format, &depth, &bpp);
5259 		return bpp >> 3;
5260 	}
5261 }
5262 EXPORT_SYMBOL(drm_format_plane_cpp);
5263 
5264 /**
5265  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
5266  * @format: pixel format (DRM_FORMAT_*)
5267  *
5268  * Returns:
5269  * The horizontal chroma subsampling factor for the
5270  * specified pixel format.
5271  */
5272 int drm_format_horz_chroma_subsampling(uint32_t format)
5273 {
5274 	switch (format) {
5275 	case DRM_FORMAT_YUV411:
5276 	case DRM_FORMAT_YVU411:
5277 	case DRM_FORMAT_YUV410:
5278 	case DRM_FORMAT_YVU410:
5279 		return 4;
5280 	case DRM_FORMAT_YUYV:
5281 	case DRM_FORMAT_YVYU:
5282 	case DRM_FORMAT_UYVY:
5283 	case DRM_FORMAT_VYUY:
5284 	case DRM_FORMAT_NV12:
5285 	case DRM_FORMAT_NV21:
5286 	case DRM_FORMAT_NV16:
5287 	case DRM_FORMAT_NV61:
5288 	case DRM_FORMAT_YUV422:
5289 	case DRM_FORMAT_YVU422:
5290 	case DRM_FORMAT_YUV420:
5291 	case DRM_FORMAT_YVU420:
5292 		return 2;
5293 	default:
5294 		return 1;
5295 	}
5296 }
5297 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
5298 
5299 /**
5300  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5301  * @format: pixel format (DRM_FORMAT_*)
5302  *
5303  * Returns:
5304  * The vertical chroma subsampling factor for the
5305  * specified pixel format.
5306  */
5307 int drm_format_vert_chroma_subsampling(uint32_t format)
5308 {
5309 	switch (format) {
5310 	case DRM_FORMAT_YUV410:
5311 	case DRM_FORMAT_YVU410:
5312 		return 4;
5313 	case DRM_FORMAT_YUV420:
5314 	case DRM_FORMAT_YVU420:
5315 	case DRM_FORMAT_NV12:
5316 	case DRM_FORMAT_NV21:
5317 		return 2;
5318 	default:
5319 		return 1;
5320 	}
5321 }
5322 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5323 
5324 /**
5325  * drm_rotation_simplify() - Try to simplify the rotation
5326  * @rotation: Rotation to be simplified
5327  * @supported_rotations: Supported rotations
5328  *
5329  * Attempt to simplify the rotation to a form that is supported.
5330  * Eg. if the hardware supports everything except DRM_REFLECT_X
5331  * one could call this function like this:
5332  *
5333  * drm_rotation_simplify(rotation, BIT(DRM_ROTATE_0) |
5334  *                       BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_180) |
5335  *                       BIT(DRM_ROTATE_270) | BIT(DRM_REFLECT_Y));
5336  *
5337  * to eliminate the DRM_ROTATE_X flag. Depending on what kind of
5338  * transforms the hardware supports, this function may not
5339  * be able to produce a supported transform, so the caller should
5340  * check the result afterwards.
5341  */
5342 unsigned int drm_rotation_simplify(unsigned int rotation,
5343 				   unsigned int supported_rotations)
5344 {
5345 	if (rotation & ~supported_rotations) {
5346 		rotation ^= BIT(DRM_REFLECT_X) | BIT(DRM_REFLECT_Y);
5347 		rotation = (rotation & ~0xf) | BIT((ffs(rotation & 0xf) + 1) % 4);
5348 	}
5349 
5350 	return rotation;
5351 }
5352 EXPORT_SYMBOL(drm_rotation_simplify);
5353 
5354 /**
5355  * drm_mode_config_init - initialize DRM mode_configuration structure
5356  * @dev: DRM device
5357  *
5358  * Initialize @dev's mode_config structure, used for tracking the graphics
5359  * configuration of @dev.
5360  *
5361  * Since this initializes the modeset locks, no locking is possible. Which is no
5362  * problem, since this should happen single threaded at init time. It is the
5363  * driver's problem to ensure this guarantee.
5364  *
5365  */
5366 void drm_mode_config_init(struct drm_device *dev)
5367 {
5368 	lockinit(&dev->mode_config.mutex, "drmmcm", 0, LK_CANRECURSE);
5369 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5370 	lockinit(&dev->mode_config.idr_mutex, "mcfgidr", 0, LK_CANRECURSE);
5371 	lockinit(&dev->mode_config.fb_lock, "drmfbl", 0, LK_CANRECURSE);
5372 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5373 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5374 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5375 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5376 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5377 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5378 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5379 	idr_init(&dev->mode_config.crtc_idr);
5380 	idr_init(&dev->mode_config.tile_idr);
5381 
5382 	drm_modeset_lock_all(dev);
5383 	drm_mode_create_standard_properties(dev);
5384 	drm_modeset_unlock_all(dev);
5385 
5386 	/* Just to be sure */
5387 	dev->mode_config.num_fb = 0;
5388 	dev->mode_config.num_connector = 0;
5389 	dev->mode_config.num_crtc = 0;
5390 	dev->mode_config.num_encoder = 0;
5391 	dev->mode_config.num_overlay_plane = 0;
5392 	dev->mode_config.num_total_plane = 0;
5393 }
5394 EXPORT_SYMBOL(drm_mode_config_init);
5395 
5396 /**
5397  * drm_mode_config_cleanup - free up DRM mode_config info
5398  * @dev: DRM device
5399  *
5400  * Free up all the connectors and CRTCs associated with this DRM device, then
5401  * free up the framebuffers and associated buffer objects.
5402  *
5403  * Note that since this /should/ happen single-threaded at driver/device
5404  * teardown time, no locking is required. It's the driver's job to ensure that
5405  * this guarantee actually holds true.
5406  *
5407  * FIXME: cleanup any dangling user buffer objects too
5408  */
5409 void drm_mode_config_cleanup(struct drm_device *dev)
5410 {
5411 	struct drm_connector *connector, *ot;
5412 	struct drm_crtc *crtc, *ct;
5413 	struct drm_encoder *encoder, *enct;
5414 	struct drm_framebuffer *fb, *fbt;
5415 	struct drm_property *property, *pt;
5416 	struct drm_property_blob *blob, *bt;
5417 	struct drm_plane *plane, *plt;
5418 
5419 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5420 				 head) {
5421 		encoder->funcs->destroy(encoder);
5422 	}
5423 
5424 	list_for_each_entry_safe(connector, ot,
5425 				 &dev->mode_config.connector_list, head) {
5426 		connector->funcs->destroy(connector);
5427 	}
5428 
5429 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5430 				 head) {
5431 		drm_property_destroy(dev, property);
5432 	}
5433 
5434 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5435 				 head) {
5436 		drm_property_destroy_blob(dev, blob);
5437 	}
5438 
5439 	/*
5440 	 * Single-threaded teardown context, so it's not required to grab the
5441 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5442 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5443 	 *
5444 	 * Also, if there are any framebuffers left, that's a driver leak now,
5445 	 * so politely WARN about this.
5446 	 */
5447 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5448 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5449 		drm_framebuffer_remove(fb);
5450 	}
5451 
5452 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5453 				 head) {
5454 		plane->funcs->destroy(plane);
5455 	}
5456 
5457 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5458 		crtc->funcs->destroy(crtc);
5459 	}
5460 
5461 	idr_destroy(&dev->mode_config.tile_idr);
5462 	idr_destroy(&dev->mode_config.crtc_idr);
5463 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5464 }
5465 EXPORT_SYMBOL(drm_mode_config_cleanup);
5466 
5467 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5468 						       unsigned int supported_rotations)
5469 {
5470 	static const struct drm_prop_enum_list props[] = {
5471 		{ DRM_ROTATE_0,   "rotate-0" },
5472 		{ DRM_ROTATE_90,  "rotate-90" },
5473 		{ DRM_ROTATE_180, "rotate-180" },
5474 		{ DRM_ROTATE_270, "rotate-270" },
5475 		{ DRM_REFLECT_X,  "reflect-x" },
5476 		{ DRM_REFLECT_Y,  "reflect-y" },
5477 	};
5478 
5479 	return drm_property_create_bitmask(dev, 0, "rotation",
5480 					   props, ARRAY_SIZE(props),
5481 					   supported_rotations);
5482 }
5483 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5484 
5485 /**
5486  * DOC: Tile group
5487  *
5488  * Tile groups are used to represent tiled monitors with a unique
5489  * integer identifier. Tiled monitors using DisplayID v1.3 have
5490  * a unique 8-byte handle, we store this in a tile group, so we
5491  * have a common identifier for all tiles in a monitor group.
5492  */
5493 static void drm_tile_group_free(struct kref *kref)
5494 {
5495 	struct drm_tile_group *tg = container_of(kref, struct drm_tile_group, refcount);
5496 	struct drm_device *dev = tg->dev;
5497 	mutex_lock(&dev->mode_config.idr_mutex);
5498 	idr_remove(&dev->mode_config.tile_idr, tg->id);
5499 	mutex_unlock(&dev->mode_config.idr_mutex);
5500 	kfree(tg);
5501 }
5502 
5503 /**
5504  * drm_mode_put_tile_group - drop a reference to a tile group.
5505  * @dev: DRM device
5506  * @tg: tile group to drop reference to.
5507  *
5508  * drop reference to tile group and free if 0.
5509  */
5510 void drm_mode_put_tile_group(struct drm_device *dev,
5511 			     struct drm_tile_group *tg)
5512 {
5513 	kref_put(&tg->refcount, drm_tile_group_free);
5514 }
5515 
5516 /**
5517  * drm_mode_get_tile_group - get a reference to an existing tile group
5518  * @dev: DRM device
5519  * @topology: 8-bytes unique per monitor.
5520  *
5521  * Use the unique bytes to get a reference to an existing tile group.
5522  *
5523  * RETURNS:
5524  * tile group or NULL if not found.
5525  */
5526 struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
5527 					       char topology[8])
5528 {
5529 #if 0
5530 	struct drm_tile_group *tg;
5531 	int id;
5532 	mutex_lock(&dev->mode_config.idr_mutex);
5533 	idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
5534 		if (!memcmp(tg->group_data, topology, 8)) {
5535 			if (!kref_get_unless_zero(&tg->refcount))
5536 				tg = NULL;
5537 			mutex_unlock(&dev->mode_config.idr_mutex);
5538 			return tg;
5539 		}
5540 	}
5541 	mutex_unlock(&dev->mode_config.idr_mutex);
5542 #endif
5543 	return NULL;
5544 }
5545 
5546 /**
5547  * drm_mode_create_tile_group - create a tile group from a displayid description
5548  * @dev: DRM device
5549  * @topology: 8-bytes unique per monitor.
5550  *
5551  * Create a tile group for the unique monitor, and get a unique
5552  * identifier for the tile group.
5553  *
5554  * RETURNS:
5555  * new tile group or error.
5556  */
5557 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
5558 						  char topology[8])
5559 {
5560 	struct drm_tile_group *tg;
5561 	int ret;
5562 
5563 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
5564 	if (!tg)
5565 		return ERR_PTR(-ENOMEM);
5566 
5567 	kref_init(&tg->refcount);
5568 	memcpy(tg->group_data, topology, 8);
5569 	tg->dev = dev;
5570 
5571 	mutex_lock(&dev->mode_config.idr_mutex);
5572 	ret = idr_alloc(&dev->mode_config.tile_idr, tg, 1, 0, GFP_KERNEL);
5573 	if (ret >= 0) {
5574 		tg->id = ret;
5575 	} else {
5576 		kfree(tg);
5577 		tg = ERR_PTR(ret);
5578 	}
5579 
5580 	mutex_unlock(&dev->mode_config.idr_mutex);
5581 	return tg;
5582 }
5583