xref: /dragonfly/sys/dev/drm/drm_crtc.c (revision cad2e385)
1 /*
2  * Copyright (c) 2006-2008 Intel Corporation
3  * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4  * Copyright (c) 2008 Red Hat Inc.
5  *
6  * DRM core CRTC related functions
7  *
8  * Permission to use, copy, modify, distribute, and sell this software and its
9  * documentation for any purpose is hereby granted without fee, provided that
10  * the above copyright notice appear in all copies and that both that copyright
11  * notice and this permission notice appear in supporting documentation, and
12  * that the name of the copyright holders not be used in advertising or
13  * publicity pertaining to distribution of the software without specific,
14  * written prior permission.  The copyright holders make no representations
15  * about the suitability of this software for any purpose.  It is provided "as
16  * is" without express or implied warranty.
17  *
18  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  *
26  * Authors:
27  *      Keith Packard
28  *	Eric Anholt <eric@anholt.net>
29  *      Dave Airlie <airlied@linux.ie>
30  *      Jesse Barnes <jesse.barnes@intel.com>
31  */
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/export.h>
35 #include <drm/drmP.h>
36 #include <drm/drm_crtc.h>
37 #include <drm/drm_edid.h>
38 #include <uapi_drm/drm_fourcc.h>
39 #include <linux/slab.h>
40 #include <drm/drm_modeset_lock.h>
41 
42 #include "drm_crtc_internal.h"
43 
44 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
45 							struct drm_mode_fb_cmd2 *r,
46 							struct drm_file *file_priv);
47 
48 /* Avoid boilerplate.  I'm tired of typing. */
49 #define DRM_ENUM_NAME_FN(fnname, list)				\
50 	const char *fnname(int val)				\
51 	{							\
52 		int i;						\
53 		for (i = 0; i < ARRAY_SIZE(list); i++) {	\
54 			if (list[i].type == val)		\
55 				return list[i].name;		\
56 		}						\
57 		return "(unknown)";				\
58 	}
59 
60 /*
61  * Global properties
62  */
63 static const struct drm_prop_enum_list drm_dpms_enum_list[] =
64 {	{ DRM_MODE_DPMS_ON, "On" },
65 	{ DRM_MODE_DPMS_STANDBY, "Standby" },
66 	{ DRM_MODE_DPMS_SUSPEND, "Suspend" },
67 	{ DRM_MODE_DPMS_OFF, "Off" }
68 };
69 
70 DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
71 
72 static const struct drm_prop_enum_list drm_plane_type_enum_list[] =
73 {
74 	{ DRM_PLANE_TYPE_OVERLAY, "Overlay" },
75 	{ DRM_PLANE_TYPE_PRIMARY, "Primary" },
76 	{ DRM_PLANE_TYPE_CURSOR, "Cursor" },
77 };
78 
79 /*
80  * Optional properties
81  */
82 static const struct drm_prop_enum_list drm_scaling_mode_enum_list[] =
83 {
84 	{ DRM_MODE_SCALE_NONE, "None" },
85 	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
86 	{ DRM_MODE_SCALE_CENTER, "Center" },
87 	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
88 };
89 
90 static const struct drm_prop_enum_list drm_aspect_ratio_enum_list[] = {
91 	{ DRM_MODE_PICTURE_ASPECT_NONE, "Automatic" },
92 	{ DRM_MODE_PICTURE_ASPECT_4_3, "4:3" },
93 	{ DRM_MODE_PICTURE_ASPECT_16_9, "16:9" },
94 };
95 
96 /*
97  * Non-global properties, but "required" for certain connectors.
98  */
99 static const struct drm_prop_enum_list drm_dvi_i_select_enum_list[] =
100 {
101 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
102 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
103 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
104 };
105 
106 DRM_ENUM_NAME_FN(drm_get_dvi_i_select_name, drm_dvi_i_select_enum_list)
107 
108 static const struct drm_prop_enum_list drm_dvi_i_subconnector_enum_list[] =
109 {
110 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
111 	{ DRM_MODE_SUBCONNECTOR_DVID,      "DVI-D"     }, /* DVI-I  */
112 	{ DRM_MODE_SUBCONNECTOR_DVIA,      "DVI-A"     }, /* DVI-I  */
113 };
114 
115 DRM_ENUM_NAME_FN(drm_get_dvi_i_subconnector_name,
116 		 drm_dvi_i_subconnector_enum_list)
117 
118 static const struct drm_prop_enum_list drm_tv_select_enum_list[] =
119 {
120 	{ DRM_MODE_SUBCONNECTOR_Automatic, "Automatic" }, /* DVI-I and TV-out */
121 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
122 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
123 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
124 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
125 };
126 
127 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
128 
129 static const struct drm_prop_enum_list drm_tv_subconnector_enum_list[] =
130 {
131 	{ DRM_MODE_SUBCONNECTOR_Unknown,   "Unknown"   }, /* DVI-I and TV-out */
132 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
133 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
134 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
135 	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
136 };
137 
138 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
139 		 drm_tv_subconnector_enum_list)
140 
141 static const struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
142 	{ DRM_MODE_DIRTY_OFF,      "Off"      },
143 	{ DRM_MODE_DIRTY_ON,       "On"       },
144 	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
145 };
146 
147 struct drm_conn_prop_enum_list {
148 	int type;
149 	const char *name;
150 	int count;
151 };
152 
153 /*
154  * Connector and encoder types.
155  */
156 static struct drm_conn_prop_enum_list drm_connector_enum_list[] =
157 {	{ DRM_MODE_CONNECTOR_Unknown, "Unknown" },
158 	{ DRM_MODE_CONNECTOR_VGA, "VGA" },
159 	{ DRM_MODE_CONNECTOR_DVII, "DVI-I" },
160 	{ DRM_MODE_CONNECTOR_DVID, "DVI-D" },
161 	{ DRM_MODE_CONNECTOR_DVIA, "DVI-A" },
162 	{ DRM_MODE_CONNECTOR_Composite, "Composite" },
163 	{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO" },
164 	{ DRM_MODE_CONNECTOR_LVDS, "LVDS" },
165 	{ DRM_MODE_CONNECTOR_Component, "Component" },
166 	{ DRM_MODE_CONNECTOR_9PinDIN, "DIN" },
167 	{ DRM_MODE_CONNECTOR_DisplayPort, "DP" },
168 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI-A" },
169 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI-B" },
170 	{ DRM_MODE_CONNECTOR_TV, "TV" },
171 	{ DRM_MODE_CONNECTOR_eDP, "eDP" },
172 	{ DRM_MODE_CONNECTOR_VIRTUAL, "Virtual" },
173 	{ DRM_MODE_CONNECTOR_DSI, "DSI" },
174 };
175 
176 static const struct drm_prop_enum_list drm_encoder_enum_list[] =
177 {	{ DRM_MODE_ENCODER_NONE, "None" },
178 	{ DRM_MODE_ENCODER_DAC, "DAC" },
179 	{ DRM_MODE_ENCODER_TMDS, "TMDS" },
180 	{ DRM_MODE_ENCODER_LVDS, "LVDS" },
181 	{ DRM_MODE_ENCODER_TVDAC, "TV" },
182 	{ DRM_MODE_ENCODER_VIRTUAL, "Virtual" },
183 	{ DRM_MODE_ENCODER_DSI, "DSI" },
184 	{ DRM_MODE_ENCODER_DPMST, "DP MST" },
185 };
186 
187 static const struct drm_prop_enum_list drm_subpixel_enum_list[] =
188 {
189 	{ SubPixelUnknown, "Unknown" },
190 	{ SubPixelHorizontalRGB, "Horizontal RGB" },
191 	{ SubPixelHorizontalBGR, "Horizontal BGR" },
192 	{ SubPixelVerticalRGB, "Vertical RGB" },
193 	{ SubPixelVerticalBGR, "Vertical BGR" },
194 	{ SubPixelNone, "None" },
195 };
196 
197 void drm_connector_ida_init(void)
198 {
199 #if 0
200 	int i;
201 
202 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
203 		ida_init(&drm_connector_enum_list[i].ida);
204 #endif
205 }
206 
207 void drm_connector_ida_destroy(void)
208 {
209 #if 0
210 	int i;
211 
212 	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
213 		ida_destroy(&drm_connector_enum_list[i].ida);
214 #endif
215 }
216 
217 /**
218  * drm_get_connector_status_name - return a string for connector status
219  * @status: connector status to compute name of
220  *
221  * In contrast to the other drm_get_*_name functions this one here returns a
222  * const pointer and hence is threadsafe.
223  */
224 const char *drm_get_connector_status_name(enum drm_connector_status status)
225 {
226 	if (status == connector_status_connected)
227 		return "connected";
228 	else if (status == connector_status_disconnected)
229 		return "disconnected";
230 	else
231 		return "unknown";
232 }
233 EXPORT_SYMBOL(drm_get_connector_status_name);
234 
235 /**
236  * drm_get_subpixel_order_name - return a string for a given subpixel enum
237  * @order: enum of subpixel_order
238  *
239  * Note you could abuse this and return something out of bounds, but that
240  * would be a caller error.  No unscrubbed user data should make it here.
241  */
242 const char *drm_get_subpixel_order_name(enum subpixel_order order)
243 {
244 	return drm_subpixel_enum_list[order].name;
245 }
246 EXPORT_SYMBOL(drm_get_subpixel_order_name);
247 
248 static char printable_char(int c)
249 {
250 	return isascii(c) && isprint(c) ? c : '?';
251 }
252 
253 /**
254  * drm_get_format_name - return a string for drm fourcc format
255  * @format: format to compute name of
256  *
257  * Note that the buffer used by this function is globally shared and owned by
258  * the function itself.
259  *
260  * FIXME: This isn't really multithreading safe.
261  */
262 const char *drm_get_format_name(uint32_t format)
263 {
264 	static char buf[32];
265 
266 	ksnprintf(buf, sizeof(buf),
267 		 "%c%c%c%c %s-endian (0x%08x)",
268 		 printable_char(format & 0xff),
269 		 printable_char((format >> 8) & 0xff),
270 		 printable_char((format >> 16) & 0xff),
271 		 printable_char((format >> 24) & 0x7f),
272 		 format & DRM_FORMAT_BIG_ENDIAN ? "big" : "little",
273 		 format);
274 
275 	return buf;
276 }
277 EXPORT_SYMBOL(drm_get_format_name);
278 
279 /**
280  * drm_mode_object_get - allocate a new modeset identifier
281  * @dev: DRM device
282  * @obj: object pointer, used to generate unique ID
283  * @obj_type: object type
284  *
285  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
286  * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
287  * modeset identifiers are _not_ reference counted. Hence don't use this for
288  * reference counted modeset objects like framebuffers.
289  *
290  * Returns:
291  * New unique (relative to other objects in @dev) integer identifier for the
292  * object.
293  */
294 int drm_mode_object_get(struct drm_device *dev,
295 			struct drm_mode_object *obj, uint32_t obj_type)
296 {
297 	int ret;
298 
299 	mutex_lock(&dev->mode_config.idr_mutex);
300 	ret = idr_alloc(&dev->mode_config.crtc_idr, obj, 1, 0, GFP_KERNEL);
301 	if (ret >= 0) {
302 		/*
303 		 * Set up the object linking under the protection of the idr
304 		 * lock so that other users can't see inconsistent state.
305 		 */
306 		obj->id = ret;
307 		obj->type = obj_type;
308 	}
309 	mutex_unlock(&dev->mode_config.idr_mutex);
310 
311 	return ret < 0 ? ret : 0;
312 }
313 
314 /**
315  * drm_mode_object_put - free a modeset identifer
316  * @dev: DRM device
317  * @object: object to free
318  *
319  * Free @id from @dev's unique identifier pool. Note that despite the _get
320  * postfix modeset identifiers are _not_ reference counted. Hence don't use this
321  * for reference counted modeset objects like framebuffers.
322  */
323 void drm_mode_object_put(struct drm_device *dev,
324 			 struct drm_mode_object *object)
325 {
326 	mutex_lock(&dev->mode_config.idr_mutex);
327 	idr_remove(&dev->mode_config.crtc_idr, object->id);
328 	mutex_unlock(&dev->mode_config.idr_mutex);
329 }
330 
331 static struct drm_mode_object *_object_find(struct drm_device *dev,
332 		uint32_t id, uint32_t type)
333 {
334 	struct drm_mode_object *obj = NULL;
335 
336 	mutex_lock(&dev->mode_config.idr_mutex);
337 	obj = idr_find(&dev->mode_config.crtc_idr, id);
338 	if (obj && type != DRM_MODE_OBJECT_ANY && obj->type != type)
339 		obj = NULL;
340 	if (obj && obj->id != id)
341 		obj = NULL;
342 	/* don't leak out unref'd fb's */
343 	if (obj && (obj->type == DRM_MODE_OBJECT_FB))
344 		obj = NULL;
345 	mutex_unlock(&dev->mode_config.idr_mutex);
346 
347 	return obj;
348 }
349 
350 /**
351  * drm_mode_object_find - look up a drm object with static lifetime
352  * @dev: drm device
353  * @id: id of the mode object
354  * @type: type of the mode object
355  *
356  * Note that framebuffers cannot be looked up with this functions - since those
357  * are reference counted, they need special treatment.  Even with
358  * DRM_MODE_OBJECT_ANY (although that will simply return NULL
359  * rather than WARN_ON()).
360  */
361 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
362 		uint32_t id, uint32_t type)
363 {
364 	struct drm_mode_object *obj = NULL;
365 
366 	/* Framebuffers are reference counted and need their own lookup
367 	 * function.*/
368 	WARN_ON(type == DRM_MODE_OBJECT_FB);
369 	obj = _object_find(dev, id, type);
370 	return obj;
371 }
372 EXPORT_SYMBOL(drm_mode_object_find);
373 
374 /**
375  * drm_framebuffer_init - initialize a framebuffer
376  * @dev: DRM device
377  * @fb: framebuffer to be initialized
378  * @funcs: ... with these functions
379  *
380  * Allocates an ID for the framebuffer's parent mode object, sets its mode
381  * functions & device file and adds it to the master fd list.
382  *
383  * IMPORTANT:
384  * This functions publishes the fb and makes it available for concurrent access
385  * by other users. Which means by this point the fb _must_ be fully set up -
386  * since all the fb attributes are invariant over its lifetime, no further
387  * locking but only correct reference counting is required.
388  *
389  * Returns:
390  * Zero on success, error code on failure.
391  */
392 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
393 			 const struct drm_framebuffer_funcs *funcs)
394 {
395 	int ret;
396 
397 	mutex_lock(&dev->mode_config.fb_lock);
398 	kref_init(&fb->refcount);
399 	INIT_LIST_HEAD(&fb->filp_head);
400 	fb->dev = dev;
401 	fb->funcs = funcs;
402 
403 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
404 	if (ret)
405 		goto out;
406 
407 	dev->mode_config.num_fb++;
408 	list_add(&fb->head, &dev->mode_config.fb_list);
409 out:
410 	mutex_unlock(&dev->mode_config.fb_lock);
411 
412 	return 0;
413 }
414 EXPORT_SYMBOL(drm_framebuffer_init);
415 
416 /* dev->mode_config.fb_lock must be held! */
417 static void __drm_framebuffer_unregister(struct drm_device *dev,
418 					 struct drm_framebuffer *fb)
419 {
420 	mutex_lock(&dev->mode_config.idr_mutex);
421 	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
422 	mutex_unlock(&dev->mode_config.idr_mutex);
423 
424 	fb->base.id = 0;
425 }
426 
427 static void drm_framebuffer_free(struct kref *kref)
428 {
429 	struct drm_framebuffer *fb =
430 			container_of(kref, struct drm_framebuffer, refcount);
431 	struct drm_device *dev = fb->dev;
432 
433 	/*
434 	 * The lookup idr holds a weak reference, which has not necessarily been
435 	 * removed at this point. Check for that.
436 	 */
437 	mutex_lock(&dev->mode_config.fb_lock);
438 	if (fb->base.id) {
439 		/* Mark fb as reaped and drop idr ref. */
440 		__drm_framebuffer_unregister(dev, fb);
441 	}
442 	mutex_unlock(&dev->mode_config.fb_lock);
443 
444 	fb->funcs->destroy(fb);
445 }
446 
447 static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
448 							uint32_t id)
449 {
450 	struct drm_mode_object *obj = NULL;
451 	struct drm_framebuffer *fb;
452 
453 	mutex_lock(&dev->mode_config.idr_mutex);
454 	obj = idr_find(&dev->mode_config.crtc_idr, id);
455 	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
456 		fb = NULL;
457 	else
458 		fb = obj_to_fb(obj);
459 	mutex_unlock(&dev->mode_config.idr_mutex);
460 
461 	return fb;
462 }
463 
464 /**
465  * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
466  * @dev: drm device
467  * @id: id of the fb object
468  *
469  * If successful, this grabs an additional reference to the framebuffer -
470  * callers need to make sure to eventually unreference the returned framebuffer
471  * again, using @drm_framebuffer_unreference.
472  */
473 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
474 					       uint32_t id)
475 {
476 	struct drm_framebuffer *fb;
477 
478 	mutex_lock(&dev->mode_config.fb_lock);
479 	fb = __drm_framebuffer_lookup(dev, id);
480 	if (fb) {
481 		if (!kref_get_unless_zero(&fb->refcount))
482 			fb = NULL;
483 	}
484 	mutex_unlock(&dev->mode_config.fb_lock);
485 
486 	return fb;
487 }
488 EXPORT_SYMBOL(drm_framebuffer_lookup);
489 
490 /**
491  * drm_framebuffer_unreference - unref a framebuffer
492  * @fb: framebuffer to unref
493  *
494  * This functions decrements the fb's refcount and frees it if it drops to zero.
495  */
496 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
497 {
498 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
499 	kref_put(&fb->refcount, drm_framebuffer_free);
500 }
501 EXPORT_SYMBOL(drm_framebuffer_unreference);
502 
503 /**
504  * drm_framebuffer_reference - incr the fb refcnt
505  * @fb: framebuffer
506  *
507  * This functions increments the fb's refcount.
508  */
509 void drm_framebuffer_reference(struct drm_framebuffer *fb)
510 {
511 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
512 	kref_get(&fb->refcount);
513 }
514 EXPORT_SYMBOL(drm_framebuffer_reference);
515 
516 static void drm_framebuffer_free_bug(struct kref *kref)
517 {
518 	BUG();
519 }
520 
521 static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
522 {
523 	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
524 	kref_put(&fb->refcount, drm_framebuffer_free_bug);
525 }
526 
527 /**
528  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
529  * @fb: fb to unregister
530  *
531  * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
532  * those used for fbdev. Note that the caller must hold a reference of it's own,
533  * i.e. the object may not be destroyed through this call (since it'll lead to a
534  * locking inversion).
535  */
536 void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
537 {
538 	struct drm_device *dev = fb->dev;
539 
540 	mutex_lock(&dev->mode_config.fb_lock);
541 	/* Mark fb as reaped and drop idr ref. */
542 	__drm_framebuffer_unregister(dev, fb);
543 	mutex_unlock(&dev->mode_config.fb_lock);
544 }
545 EXPORT_SYMBOL(drm_framebuffer_unregister_private);
546 
547 /**
548  * drm_framebuffer_cleanup - remove a framebuffer object
549  * @fb: framebuffer to remove
550  *
551  * Cleanup framebuffer. This function is intended to be used from the drivers
552  * ->destroy callback. It can also be used to clean up driver private
553  *  framebuffers embedded into a larger structure.
554  *
555  * Note that this function does not remove the fb from active usuage - if it is
556  * still used anywhere, hilarity can ensue since userspace could call getfb on
557  * the id and get back -EINVAL. Obviously no concern at driver unload time.
558  *
559  * Also, the framebuffer will not be removed from the lookup idr - for
560  * user-created framebuffers this will happen in in the rmfb ioctl. For
561  * driver-private objects (e.g. for fbdev) drivers need to explicitly call
562  * drm_framebuffer_unregister_private.
563  */
564 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
565 {
566 	struct drm_device *dev = fb->dev;
567 
568 	mutex_lock(&dev->mode_config.fb_lock);
569 	list_del(&fb->head);
570 	dev->mode_config.num_fb--;
571 	mutex_unlock(&dev->mode_config.fb_lock);
572 }
573 EXPORT_SYMBOL(drm_framebuffer_cleanup);
574 
575 /**
576  * drm_framebuffer_remove - remove and unreference a framebuffer object
577  * @fb: framebuffer to remove
578  *
579  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
580  * using @fb, removes it, setting it to NULL. Then drops the reference to the
581  * passed-in framebuffer. Might take the modeset locks.
582  *
583  * Note that this function optimizes the cleanup away if the caller holds the
584  * last reference to the framebuffer. It is also guaranteed to not take the
585  * modeset locks in this case.
586  */
587 void drm_framebuffer_remove(struct drm_framebuffer *fb)
588 {
589 	struct drm_device *dev = fb->dev;
590 	struct drm_crtc *crtc;
591 	struct drm_plane *plane;
592 	struct drm_mode_set set;
593 	int ret;
594 
595 	WARN_ON(!list_empty(&fb->filp_head));
596 
597 	/*
598 	 * drm ABI mandates that we remove any deleted framebuffers from active
599 	 * useage. But since most sane clients only remove framebuffers they no
600 	 * longer need, try to optimize this away.
601 	 *
602 	 * Since we're holding a reference ourselves, observing a refcount of 1
603 	 * means that we're the last holder and can skip it. Also, the refcount
604 	 * can never increase from 1 again, so we don't need any barriers or
605 	 * locks.
606 	 *
607 	 * Note that userspace could try to race with use and instate a new
608 	 * usage _after_ we've cleared all current ones. End result will be an
609 	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
610 	 * in this manner.
611 	 */
612 	if (atomic_read(&fb->refcount.refcount) > 1) {
613 		drm_modeset_lock_all(dev);
614 		/* remove from any CRTC */
615 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
616 			if (crtc->primary->fb == fb) {
617 				/* should turn off the crtc */
618 				memset(&set, 0, sizeof(struct drm_mode_set));
619 				set.crtc = crtc;
620 				set.fb = NULL;
621 				ret = drm_mode_set_config_internal(&set);
622 				if (ret)
623 					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
624 			}
625 		}
626 
627 		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
628 			if (plane->fb == fb)
629 				drm_plane_force_disable(plane);
630 		}
631 		drm_modeset_unlock_all(dev);
632 	}
633 
634 	drm_framebuffer_unreference(fb);
635 }
636 EXPORT_SYMBOL(drm_framebuffer_remove);
637 
638 DEFINE_WW_CLASS(crtc_ww_class);
639 
640 /**
641  * drm_crtc_init_with_planes - Initialise a new CRTC object with
642  *    specified primary and cursor planes.
643  * @dev: DRM device
644  * @crtc: CRTC object to init
645  * @primary: Primary plane for CRTC
646  * @cursor: Cursor plane for CRTC
647  * @funcs: callbacks for the new CRTC
648  *
649  * Inits a new object created as base part of a driver crtc object.
650  *
651  * Returns:
652  * Zero on success, error code on failure.
653  */
654 int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
655 			      struct drm_plane *primary,
656 			      struct drm_plane *cursor,
657 			      const struct drm_crtc_funcs *funcs)
658 {
659 	struct drm_mode_config *config = &dev->mode_config;
660 	int ret;
661 
662 	crtc->dev = dev;
663 	crtc->funcs = funcs;
664 	crtc->invert_dimensions = false;
665 
666 	drm_modeset_lock_init(&crtc->mutex);
667 	ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
668 	if (ret)
669 		goto out;
670 
671 	crtc->base.properties = &crtc->properties;
672 
673 	list_add_tail(&crtc->head, &config->crtc_list);
674 	config->num_crtc++;
675 
676 	crtc->primary = primary;
677 	crtc->cursor = cursor;
678 	if (primary)
679 		primary->possible_crtcs = 1 << drm_crtc_index(crtc);
680 	if (cursor)
681 		cursor->possible_crtcs = 1 << drm_crtc_index(crtc);
682 
683  out:
684 
685 	return ret;
686 }
687 EXPORT_SYMBOL(drm_crtc_init_with_planes);
688 
689 /**
690  * drm_crtc_cleanup - Clean up the core crtc usage
691  * @crtc: CRTC to cleanup
692  *
693  * This function cleans up @crtc and removes it from the DRM mode setting
694  * core. Note that the function does *not* free the crtc structure itself,
695  * this is the responsibility of the caller.
696  */
697 void drm_crtc_cleanup(struct drm_crtc *crtc)
698 {
699 	struct drm_device *dev = crtc->dev;
700 
701 	kfree(crtc->gamma_store);
702 	crtc->gamma_store = NULL;
703 
704 	drm_modeset_lock_fini(&crtc->mutex);
705 
706 	drm_mode_object_put(dev, &crtc->base);
707 	list_del(&crtc->head);
708 	dev->mode_config.num_crtc--;
709 }
710 EXPORT_SYMBOL(drm_crtc_cleanup);
711 
712 /**
713  * drm_crtc_index - find the index of a registered CRTC
714  * @crtc: CRTC to find index for
715  *
716  * Given a registered CRTC, return the index of that CRTC within a DRM
717  * device's list of CRTCs.
718  */
719 unsigned int drm_crtc_index(struct drm_crtc *crtc)
720 {
721 	unsigned int index = 0;
722 	struct drm_crtc *tmp;
723 
724 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
725 		if (tmp == crtc)
726 			return index;
727 
728 		index++;
729 	}
730 
731 	BUG();
732 }
733 EXPORT_SYMBOL(drm_crtc_index);
734 
735 /*
736  * drm_mode_remove - remove and free a mode
737  * @connector: connector list to modify
738  * @mode: mode to remove
739  *
740  * Remove @mode from @connector's mode list, then free it.
741  */
742 static void drm_mode_remove(struct drm_connector *connector,
743 			    struct drm_display_mode *mode)
744 {
745 	list_del(&mode->head);
746 	drm_mode_destroy(connector->dev, mode);
747 }
748 
749 /**
750  * drm_connector_get_cmdline_mode - reads the user's cmdline mode
751  * @connector: connector to quwery
752  * @mode: returned mode
753  *
754  * The kernel supports per-connector configration of its consoles through
755  * use of the video= parameter. This function parses that option and
756  * extracts the user's specified mode (or enable/disable status) for a
757  * particular connector. This is typically only used during the early fbdev
758  * setup.
759  */
760 static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
761 {
762 	struct drm_cmdline_mode *mode = &connector->cmdline_mode;
763 	char *option = NULL;
764 
765 	if (fb_get_options(connector->name, &option))
766 		return;
767 
768 	if (!drm_mode_parse_command_line_for_connector(option,
769 						       connector,
770 						       mode))
771 		return;
772 
773 	if (mode->force) {
774 		const char *s;
775 
776 		switch (mode->force) {
777 		case DRM_FORCE_OFF:
778 			s = "OFF";
779 			break;
780 		case DRM_FORCE_ON_DIGITAL:
781 			s = "ON - dig";
782 			break;
783 		default:
784 		case DRM_FORCE_ON:
785 			s = "ON";
786 			break;
787 		}
788 
789 		DRM_INFO("forcing %s connector %s\n", connector->name, s);
790 		connector->force = mode->force;
791 	}
792 
793 	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
794 		      connector->name,
795 		      mode->xres, mode->yres,
796 		      mode->refresh_specified ? mode->refresh : 60,
797 		      mode->rb ? " reduced blanking" : "",
798 		      mode->margins ? " with margins" : "",
799 		      mode->interlace ?  " interlaced" : "");
800 }
801 
802 /**
803  * drm_connector_init - Init a preallocated connector
804  * @dev: DRM device
805  * @connector: the connector to init
806  * @funcs: callbacks for this connector
807  * @connector_type: user visible type of the connector
808  *
809  * Initialises a preallocated connector. Connectors should be
810  * subclassed as part of driver connector objects.
811  *
812  * Returns:
813  * Zero on success, error code on failure.
814  */
815 int drm_connector_init(struct drm_device *dev,
816 		       struct drm_connector *connector,
817 		       const struct drm_connector_funcs *funcs,
818 		       int connector_type)
819 {
820 	int ret;
821 
822 	drm_modeset_lock_all(dev);
823 
824 	ret = drm_mode_object_get(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR);
825 	if (ret)
826 		goto out_unlock;
827 
828 	connector->base.properties = &connector->properties;
829 	connector->dev = dev;
830 	connector->funcs = funcs;
831 	connector->connector_type = connector_type;
832 	connector->connector_type_id =
833 		++drm_connector_enum_list[connector_type].count; /* TODO */
834 	if (connector->connector_type_id < 0) {
835 		ret = connector->connector_type_id;
836 		goto out_put;
837 	}
838 	connector->name =
839 		drm_asprintf(GFP_KERNEL, "%s-%d",
840 			  drm_connector_enum_list[connector_type].name,
841 			  connector->connector_type_id);
842 	if (!connector->name) {
843 		ret = -ENOMEM;
844 		goto out_put;
845 	}
846 
847 	INIT_LIST_HEAD(&connector->probed_modes);
848 	INIT_LIST_HEAD(&connector->modes);
849 	connector->edid_blob_ptr = NULL;
850 	connector->status = connector_status_unknown;
851 
852 	drm_connector_get_cmdline_mode(connector);
853 
854 	list_add_tail(&connector->head, &dev->mode_config.connector_list);
855 	dev->mode_config.num_connector++;
856 
857 	if (connector_type != DRM_MODE_CONNECTOR_VIRTUAL)
858 		drm_object_attach_property(&connector->base,
859 					      dev->mode_config.edid_property,
860 					      0);
861 
862 	drm_object_attach_property(&connector->base,
863 				      dev->mode_config.dpms_property, 0);
864 
865 	connector->debugfs_entry = NULL;
866 
867 out_put:
868 	if (ret)
869 		drm_mode_object_put(dev, &connector->base);
870 
871 out_unlock:
872 	drm_modeset_unlock_all(dev);
873 
874 	return ret;
875 }
876 EXPORT_SYMBOL(drm_connector_init);
877 
878 /**
879  * drm_connector_cleanup - cleans up an initialised connector
880  * @connector: connector to cleanup
881  *
882  * Cleans up the connector but doesn't free the object.
883  */
884 void drm_connector_cleanup(struct drm_connector *connector)
885 {
886 	struct drm_device *dev = connector->dev;
887 	struct drm_display_mode *mode, *t;
888 
889 	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
890 		drm_mode_remove(connector, mode);
891 
892 	list_for_each_entry_safe(mode, t, &connector->modes, head)
893 		drm_mode_remove(connector, mode);
894 
895 	drm_mode_object_put(dev, &connector->base);
896 	kfree(connector->name);
897 	connector->name = NULL;
898 	list_del(&connector->head);
899 	dev->mode_config.num_connector--;
900 }
901 EXPORT_SYMBOL(drm_connector_cleanup);
902 
903 /**
904  * drm_connector_index - find the index of a registered connector
905  * @connector: connector to find index for
906  *
907  * Given a registered connector, return the index of that connector within a DRM
908  * device's list of connectors.
909  */
910 unsigned int drm_connector_index(struct drm_connector *connector)
911 {
912 	unsigned int index = 0;
913 	struct drm_connector *tmp;
914 
915 	list_for_each_entry(tmp, &connector->dev->mode_config.connector_list, head) {
916 		if (tmp == connector)
917 			return index;
918 
919 		index++;
920 	}
921 
922 	BUG();
923 }
924 EXPORT_SYMBOL(drm_connector_index);
925 
926 /**
927  * drm_connector_register - register a connector
928  * @connector: the connector to register
929  *
930  * Register userspace interfaces for a connector
931  *
932  * Returns:
933  * Zero on success, error code on failure.
934  */
935 int drm_connector_register(struct drm_connector *connector)
936 {
937 	int ret;
938 
939 	ret = drm_sysfs_connector_add(connector);
940 	if (ret)
941 		return ret;
942 
943 #if 0
944 	ret = drm_debugfs_connector_add(connector);
945 #endif
946 	if (ret) {
947 		drm_sysfs_connector_remove(connector);
948 		return ret;
949 	}
950 
951 	return 0;
952 }
953 EXPORT_SYMBOL(drm_connector_register);
954 
955 /**
956  * drm_connector_unregister - unregister a connector
957  * @connector: the connector to unregister
958  *
959  * Unregister userspace interfaces for a connector
960  */
961 void drm_connector_unregister(struct drm_connector *connector)
962 {
963 	drm_sysfs_connector_remove(connector);
964 #if 0
965 	drm_debugfs_connector_remove(connector);
966 #endif
967 }
968 EXPORT_SYMBOL(drm_connector_unregister);
969 
970 
971 /**
972  * drm_connector_unplug_all - unregister connector userspace interfaces
973  * @dev: drm device
974  *
975  * This function unregisters all connector userspace interfaces in sysfs. Should
976  * be call when the device is disconnected, e.g. from an usb driver's
977  * ->disconnect callback.
978  */
979 void drm_connector_unplug_all(struct drm_device *dev)
980 {
981 	struct drm_connector *connector;
982 
983 	/* taking the mode config mutex ends up in a clash with sysfs */
984 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
985 		drm_connector_unregister(connector);
986 
987 }
988 EXPORT_SYMBOL(drm_connector_unplug_all);
989 
990 /**
991  * drm_bridge_init - initialize a drm transcoder/bridge
992  * @dev: drm device
993  * @bridge: transcoder/bridge to set up
994  * @funcs: bridge function table
995  *
996  * Initialises a preallocated bridge. Bridges should be
997  * subclassed as part of driver connector objects.
998  *
999  * Returns:
1000  * Zero on success, error code on failure.
1001  */
1002 int drm_bridge_init(struct drm_device *dev, struct drm_bridge *bridge,
1003 		const struct drm_bridge_funcs *funcs)
1004 {
1005 	int ret;
1006 
1007 	drm_modeset_lock_all(dev);
1008 
1009 	ret = drm_mode_object_get(dev, &bridge->base, DRM_MODE_OBJECT_BRIDGE);
1010 	if (ret)
1011 		goto out;
1012 
1013 	bridge->dev = dev;
1014 	bridge->funcs = funcs;
1015 
1016 	list_add_tail(&bridge->head, &dev->mode_config.bridge_list);
1017 	dev->mode_config.num_bridge++;
1018 
1019  out:
1020 	drm_modeset_unlock_all(dev);
1021 	return ret;
1022 }
1023 EXPORT_SYMBOL(drm_bridge_init);
1024 
1025 /**
1026  * drm_bridge_cleanup - cleans up an initialised bridge
1027  * @bridge: bridge to cleanup
1028  *
1029  * Cleans up the bridge but doesn't free the object.
1030  */
1031 void drm_bridge_cleanup(struct drm_bridge *bridge)
1032 {
1033 	struct drm_device *dev = bridge->dev;
1034 
1035 	drm_modeset_lock_all(dev);
1036 	drm_mode_object_put(dev, &bridge->base);
1037 	list_del(&bridge->head);
1038 	dev->mode_config.num_bridge--;
1039 	drm_modeset_unlock_all(dev);
1040 }
1041 EXPORT_SYMBOL(drm_bridge_cleanup);
1042 
1043 /**
1044  * drm_encoder_init - Init a preallocated encoder
1045  * @dev: drm device
1046  * @encoder: the encoder to init
1047  * @funcs: callbacks for this encoder
1048  * @encoder_type: user visible type of the encoder
1049  *
1050  * Initialises a preallocated encoder. Encoder should be
1051  * subclassed as part of driver encoder objects.
1052  *
1053  * Returns:
1054  * Zero on success, error code on failure.
1055  */
1056 int drm_encoder_init(struct drm_device *dev,
1057 		      struct drm_encoder *encoder,
1058 		      const struct drm_encoder_funcs *funcs,
1059 		      int encoder_type)
1060 {
1061 	int ret;
1062 
1063 	drm_modeset_lock_all(dev);
1064 
1065 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
1066 	if (ret)
1067 		goto out_unlock;
1068 
1069 	encoder->dev = dev;
1070 	encoder->encoder_type = encoder_type;
1071 	encoder->funcs = funcs;
1072 	encoder->name = drm_asprintf(GFP_KERNEL, "%s-%d",
1073 				  drm_encoder_enum_list[encoder_type].name,
1074 				  encoder->base.id);
1075 	if (!encoder->name) {
1076 		ret = -ENOMEM;
1077 		goto out_put;
1078 	}
1079 
1080 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
1081 	dev->mode_config.num_encoder++;
1082 
1083 out_put:
1084 	if (ret)
1085 		drm_mode_object_put(dev, &encoder->base);
1086 
1087 out_unlock:
1088 	drm_modeset_unlock_all(dev);
1089 
1090 	return ret;
1091 }
1092 EXPORT_SYMBOL(drm_encoder_init);
1093 
1094 /**
1095  * drm_encoder_cleanup - cleans up an initialised encoder
1096  * @encoder: encoder to cleanup
1097  *
1098  * Cleans up the encoder but doesn't free the object.
1099  */
1100 void drm_encoder_cleanup(struct drm_encoder *encoder)
1101 {
1102 	struct drm_device *dev = encoder->dev;
1103 	drm_modeset_lock_all(dev);
1104 	drm_mode_object_put(dev, &encoder->base);
1105 	kfree(encoder->name);
1106 	encoder->name = NULL;
1107 	list_del(&encoder->head);
1108 	dev->mode_config.num_encoder--;
1109 	drm_modeset_unlock_all(dev);
1110 }
1111 EXPORT_SYMBOL(drm_encoder_cleanup);
1112 
1113 /**
1114  * drm_universal_plane_init - Initialize a new universal plane object
1115  * @dev: DRM device
1116  * @plane: plane object to init
1117  * @possible_crtcs: bitmask of possible CRTCs
1118  * @funcs: callbacks for the new plane
1119  * @formats: array of supported formats (%DRM_FORMAT_*)
1120  * @format_count: number of elements in @formats
1121  * @type: type of plane (overlay, primary, cursor)
1122  *
1123  * Initializes a plane object of type @type.
1124  *
1125  * Returns:
1126  * Zero on success, error code on failure.
1127  */
1128 int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
1129 			     unsigned long possible_crtcs,
1130 			     const struct drm_plane_funcs *funcs,
1131 			     const uint32_t *formats, uint32_t format_count,
1132 			     enum drm_plane_type type)
1133 {
1134 	int ret;
1135 
1136 	drm_modeset_lock_all(dev);
1137 
1138 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
1139 	if (ret)
1140 		goto out;
1141 
1142 	plane->base.properties = &plane->properties;
1143 	plane->dev = dev;
1144 	plane->funcs = funcs;
1145 	plane->format_types = kmalloc(sizeof(uint32_t) * format_count,
1146 				      M_DRM, M_WAITOK);
1147 	if (!plane->format_types) {
1148 		DRM_DEBUG_KMS("out of memory when allocating plane\n");
1149 		drm_mode_object_put(dev, &plane->base);
1150 		ret = -ENOMEM;
1151 		goto out;
1152 	}
1153 
1154 	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
1155 	plane->format_count = format_count;
1156 	plane->possible_crtcs = possible_crtcs;
1157 	plane->type = type;
1158 
1159 	list_add_tail(&plane->head, &dev->mode_config.plane_list);
1160 	dev->mode_config.num_total_plane++;
1161 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1162 		dev->mode_config.num_overlay_plane++;
1163 
1164 	drm_object_attach_property(&plane->base,
1165 				   dev->mode_config.plane_type_property,
1166 				   plane->type);
1167 
1168  out:
1169 	drm_modeset_unlock_all(dev);
1170 
1171 	return ret;
1172 }
1173 EXPORT_SYMBOL(drm_universal_plane_init);
1174 
1175 /**
1176  * drm_plane_init - Initialize a legacy plane
1177  * @dev: DRM device
1178  * @plane: plane object to init
1179  * @possible_crtcs: bitmask of possible CRTCs
1180  * @funcs: callbacks for the new plane
1181  * @formats: array of supported formats (%DRM_FORMAT_*)
1182  * @format_count: number of elements in @formats
1183  * @is_primary: plane type (primary vs overlay)
1184  *
1185  * Legacy API to initialize a DRM plane.
1186  *
1187  * New drivers should call drm_universal_plane_init() instead.
1188  *
1189  * Returns:
1190  * Zero on success, error code on failure.
1191  */
1192 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
1193 		   unsigned long possible_crtcs,
1194 		   const struct drm_plane_funcs *funcs,
1195 		   const uint32_t *formats, uint32_t format_count,
1196 		   bool is_primary)
1197 {
1198 	enum drm_plane_type type;
1199 
1200 	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
1201 	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
1202 					formats, format_count, type);
1203 }
1204 EXPORT_SYMBOL(drm_plane_init);
1205 
1206 /**
1207  * drm_plane_cleanup - Clean up the core plane usage
1208  * @plane: plane to cleanup
1209  *
1210  * This function cleans up @plane and removes it from the DRM mode setting
1211  * core. Note that the function does *not* free the plane structure itself,
1212  * this is the responsibility of the caller.
1213  */
1214 void drm_plane_cleanup(struct drm_plane *plane)
1215 {
1216 	struct drm_device *dev = plane->dev;
1217 
1218 	drm_modeset_lock_all(dev);
1219 	kfree(plane->format_types);
1220 	drm_mode_object_put(dev, &plane->base);
1221 
1222 	BUG_ON(list_empty(&plane->head));
1223 
1224 	list_del(&plane->head);
1225 	dev->mode_config.num_total_plane--;
1226 	if (plane->type == DRM_PLANE_TYPE_OVERLAY)
1227 		dev->mode_config.num_overlay_plane--;
1228 	drm_modeset_unlock_all(dev);
1229 }
1230 EXPORT_SYMBOL(drm_plane_cleanup);
1231 
1232 /**
1233  * drm_plane_index - find the index of a registered plane
1234  * @plane: plane to find index for
1235  *
1236  * Given a registered plane, return the index of that CRTC within a DRM
1237  * device's list of planes.
1238  */
1239 unsigned int drm_plane_index(struct drm_plane *plane)
1240 {
1241 	unsigned int index = 0;
1242 	struct drm_plane *tmp;
1243 
1244 	list_for_each_entry(tmp, &plane->dev->mode_config.plane_list, head) {
1245 		if (tmp == plane)
1246 			return index;
1247 
1248 		index++;
1249 	}
1250 
1251 	BUG();
1252 }
1253 EXPORT_SYMBOL(drm_plane_index);
1254 
1255 /**
1256  * drm_plane_force_disable - Forcibly disable a plane
1257  * @plane: plane to disable
1258  *
1259  * Forces the plane to be disabled.
1260  *
1261  * Used when the plane's current framebuffer is destroyed,
1262  * and when restoring fbdev mode.
1263  */
1264 void drm_plane_force_disable(struct drm_plane *plane)
1265 {
1266 	int ret;
1267 
1268 	if (!plane->fb)
1269 		return;
1270 
1271 	plane->old_fb = plane->fb;
1272 	ret = plane->funcs->disable_plane(plane);
1273 	if (ret) {
1274 		DRM_ERROR("failed to disable plane with busy fb\n");
1275 		plane->old_fb = NULL;
1276 		return;
1277 	}
1278 	/* disconnect the plane from the fb and crtc: */
1279 	__drm_framebuffer_unreference(plane->old_fb);
1280 	plane->old_fb = NULL;
1281 	plane->fb = NULL;
1282 	plane->crtc = NULL;
1283 }
1284 EXPORT_SYMBOL(drm_plane_force_disable);
1285 
1286 static int drm_mode_create_standard_connector_properties(struct drm_device *dev)
1287 {
1288 	struct drm_property *edid;
1289 	struct drm_property *dpms;
1290 	struct drm_property *dev_path;
1291 
1292 	/*
1293 	 * Standard properties (apply to all connectors)
1294 	 */
1295 	edid = drm_property_create(dev, DRM_MODE_PROP_BLOB |
1296 				   DRM_MODE_PROP_IMMUTABLE,
1297 				   "EDID", 0);
1298 	dev->mode_config.edid_property = edid;
1299 
1300 	dpms = drm_property_create_enum(dev, 0,
1301 				   "DPMS", drm_dpms_enum_list,
1302 				   ARRAY_SIZE(drm_dpms_enum_list));
1303 	dev->mode_config.dpms_property = dpms;
1304 
1305 	dev_path = drm_property_create(dev,
1306 				       DRM_MODE_PROP_BLOB |
1307 				       DRM_MODE_PROP_IMMUTABLE,
1308 				       "PATH", 0);
1309 	dev->mode_config.path_property = dev_path;
1310 
1311 	return 0;
1312 }
1313 
1314 static int drm_mode_create_standard_plane_properties(struct drm_device *dev)
1315 {
1316 	struct drm_property *type;
1317 
1318 	/*
1319 	 * Standard properties (apply to all planes)
1320 	 */
1321 	type = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1322 					"type", drm_plane_type_enum_list,
1323 					ARRAY_SIZE(drm_plane_type_enum_list));
1324 	dev->mode_config.plane_type_property = type;
1325 
1326 	return 0;
1327 }
1328 
1329 /**
1330  * drm_mode_create_dvi_i_properties - create DVI-I specific connector properties
1331  * @dev: DRM device
1332  *
1333  * Called by a driver the first time a DVI-I connector is made.
1334  */
1335 int drm_mode_create_dvi_i_properties(struct drm_device *dev)
1336 {
1337 	struct drm_property *dvi_i_selector;
1338 	struct drm_property *dvi_i_subconnector;
1339 
1340 	if (dev->mode_config.dvi_i_select_subconnector_property)
1341 		return 0;
1342 
1343 	dvi_i_selector =
1344 		drm_property_create_enum(dev, 0,
1345 				    "select subconnector",
1346 				    drm_dvi_i_select_enum_list,
1347 				    ARRAY_SIZE(drm_dvi_i_select_enum_list));
1348 	dev->mode_config.dvi_i_select_subconnector_property = dvi_i_selector;
1349 
1350 	dvi_i_subconnector = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1351 				    "subconnector",
1352 				    drm_dvi_i_subconnector_enum_list,
1353 				    ARRAY_SIZE(drm_dvi_i_subconnector_enum_list));
1354 	dev->mode_config.dvi_i_subconnector_property = dvi_i_subconnector;
1355 
1356 	return 0;
1357 }
1358 EXPORT_SYMBOL(drm_mode_create_dvi_i_properties);
1359 
1360 /**
1361  * drm_create_tv_properties - create TV specific connector properties
1362  * @dev: DRM device
1363  * @num_modes: number of different TV formats (modes) supported
1364  * @modes: array of pointers to strings containing name of each format
1365  *
1366  * Called by a driver's TV initialization routine, this function creates
1367  * the TV specific connector properties for a given device.  Caller is
1368  * responsible for allocating a list of format names and passing them to
1369  * this routine.
1370  */
1371 int drm_mode_create_tv_properties(struct drm_device *dev, int num_modes,
1372 				  char *modes[])
1373 {
1374 	struct drm_property *tv_selector;
1375 	struct drm_property *tv_subconnector;
1376 	int i;
1377 
1378 	if (dev->mode_config.tv_select_subconnector_property)
1379 		return 0;
1380 
1381 	/*
1382 	 * Basic connector properties
1383 	 */
1384 	tv_selector = drm_property_create_enum(dev, 0,
1385 					  "select subconnector",
1386 					  drm_tv_select_enum_list,
1387 					  ARRAY_SIZE(drm_tv_select_enum_list));
1388 	dev->mode_config.tv_select_subconnector_property = tv_selector;
1389 
1390 	tv_subconnector =
1391 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1392 				    "subconnector",
1393 				    drm_tv_subconnector_enum_list,
1394 				    ARRAY_SIZE(drm_tv_subconnector_enum_list));
1395 	dev->mode_config.tv_subconnector_property = tv_subconnector;
1396 
1397 	/*
1398 	 * Other, TV specific properties: margins & TV modes.
1399 	 */
1400 	dev->mode_config.tv_left_margin_property =
1401 		drm_property_create_range(dev, 0, "left margin", 0, 100);
1402 
1403 	dev->mode_config.tv_right_margin_property =
1404 		drm_property_create_range(dev, 0, "right margin", 0, 100);
1405 
1406 	dev->mode_config.tv_top_margin_property =
1407 		drm_property_create_range(dev, 0, "top margin", 0, 100);
1408 
1409 	dev->mode_config.tv_bottom_margin_property =
1410 		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
1411 
1412 	dev->mode_config.tv_mode_property =
1413 		drm_property_create(dev, DRM_MODE_PROP_ENUM,
1414 				    "mode", num_modes);
1415 	for (i = 0; i < num_modes; i++)
1416 		drm_property_add_enum(dev->mode_config.tv_mode_property, i,
1417 				      i, modes[i]);
1418 
1419 	dev->mode_config.tv_brightness_property =
1420 		drm_property_create_range(dev, 0, "brightness", 0, 100);
1421 
1422 	dev->mode_config.tv_contrast_property =
1423 		drm_property_create_range(dev, 0, "contrast", 0, 100);
1424 
1425 	dev->mode_config.tv_flicker_reduction_property =
1426 		drm_property_create_range(dev, 0, "flicker reduction", 0, 100);
1427 
1428 	dev->mode_config.tv_overscan_property =
1429 		drm_property_create_range(dev, 0, "overscan", 0, 100);
1430 
1431 	dev->mode_config.tv_saturation_property =
1432 		drm_property_create_range(dev, 0, "saturation", 0, 100);
1433 
1434 	dev->mode_config.tv_hue_property =
1435 		drm_property_create_range(dev, 0, "hue", 0, 100);
1436 
1437 	return 0;
1438 }
1439 EXPORT_SYMBOL(drm_mode_create_tv_properties);
1440 
1441 /**
1442  * drm_mode_create_scaling_mode_property - create scaling mode property
1443  * @dev: DRM device
1444  *
1445  * Called by a driver the first time it's needed, must be attached to desired
1446  * connectors.
1447  */
1448 int drm_mode_create_scaling_mode_property(struct drm_device *dev)
1449 {
1450 	struct drm_property *scaling_mode;
1451 
1452 	if (dev->mode_config.scaling_mode_property)
1453 		return 0;
1454 
1455 	scaling_mode =
1456 		drm_property_create_enum(dev, 0, "scaling mode",
1457 				drm_scaling_mode_enum_list,
1458 				    ARRAY_SIZE(drm_scaling_mode_enum_list));
1459 
1460 	dev->mode_config.scaling_mode_property = scaling_mode;
1461 
1462 	return 0;
1463 }
1464 EXPORT_SYMBOL(drm_mode_create_scaling_mode_property);
1465 
1466 /**
1467  * drm_mode_create_aspect_ratio_property - create aspect ratio property
1468  * @dev: DRM device
1469  *
1470  * Called by a driver the first time it's needed, must be attached to desired
1471  * connectors.
1472  *
1473  * Returns:
1474  * Zero on success, errno on failure.
1475  */
1476 int drm_mode_create_aspect_ratio_property(struct drm_device *dev)
1477 {
1478 	if (dev->mode_config.aspect_ratio_property)
1479 		return 0;
1480 
1481 	dev->mode_config.aspect_ratio_property =
1482 		drm_property_create_enum(dev, 0, "aspect ratio",
1483 				drm_aspect_ratio_enum_list,
1484 				ARRAY_SIZE(drm_aspect_ratio_enum_list));
1485 
1486 	if (dev->mode_config.aspect_ratio_property == NULL)
1487 		return -ENOMEM;
1488 
1489 	return 0;
1490 }
1491 EXPORT_SYMBOL(drm_mode_create_aspect_ratio_property);
1492 
1493 /**
1494  * drm_mode_create_dirty_property - create dirty property
1495  * @dev: DRM device
1496  *
1497  * Called by a driver the first time it's needed, must be attached to desired
1498  * connectors.
1499  */
1500 int drm_mode_create_dirty_info_property(struct drm_device *dev)
1501 {
1502 	struct drm_property *dirty_info;
1503 
1504 	if (dev->mode_config.dirty_info_property)
1505 		return 0;
1506 
1507 	dirty_info =
1508 		drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
1509 				    "dirty",
1510 				    drm_dirty_info_enum_list,
1511 				    ARRAY_SIZE(drm_dirty_info_enum_list));
1512 	dev->mode_config.dirty_info_property = dirty_info;
1513 
1514 	return 0;
1515 }
1516 EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
1517 
1518 static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
1519 {
1520 	uint32_t total_objects = 0;
1521 
1522 	total_objects += dev->mode_config.num_crtc;
1523 	total_objects += dev->mode_config.num_connector;
1524 	total_objects += dev->mode_config.num_encoder;
1525 	total_objects += dev->mode_config.num_bridge;
1526 
1527 	group->id_list = kzalloc(total_objects * sizeof(uint32_t), GFP_KERNEL);
1528 	if (!group->id_list)
1529 		return -ENOMEM;
1530 
1531 	group->num_crtcs = 0;
1532 	group->num_connectors = 0;
1533 	group->num_encoders = 0;
1534 	group->num_bridges = 0;
1535 	return 0;
1536 }
1537 
1538 void drm_mode_group_destroy(struct drm_mode_group *group)
1539 {
1540 	kfree(group->id_list);
1541 	group->id_list = NULL;
1542 }
1543 
1544 /*
1545  * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
1546  * the drm core's responsibility to set up mode control groups.
1547  */
1548 int drm_mode_group_init_legacy_group(struct drm_device *dev,
1549 				     struct drm_mode_group *group)
1550 {
1551 	struct drm_crtc *crtc;
1552 	struct drm_encoder *encoder;
1553 	struct drm_connector *connector;
1554 	struct drm_bridge *bridge;
1555 	int ret;
1556 
1557 	if ((ret = drm_mode_group_init(dev, group)))
1558 		return ret;
1559 
1560 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
1561 		group->id_list[group->num_crtcs++] = crtc->base.id;
1562 
1563 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
1564 		group->id_list[group->num_crtcs + group->num_encoders++] =
1565 		encoder->base.id;
1566 
1567 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
1568 		group->id_list[group->num_crtcs + group->num_encoders +
1569 			       group->num_connectors++] = connector->base.id;
1570 
1571 	list_for_each_entry(bridge, &dev->mode_config.bridge_list, head)
1572 		group->id_list[group->num_crtcs + group->num_encoders +
1573 			       group->num_connectors + group->num_bridges++] =
1574 					bridge->base.id;
1575 
1576 	return 0;
1577 }
1578 EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
1579 
1580 void drm_reinit_primary_mode_group(struct drm_device *dev)
1581 {
1582 	drm_modeset_lock_all(dev);
1583 	drm_mode_group_destroy(&dev->primary->mode_group);
1584 	drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
1585 	drm_modeset_unlock_all(dev);
1586 }
1587 EXPORT_SYMBOL(drm_reinit_primary_mode_group);
1588 
1589 /**
1590  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
1591  * @out: drm_mode_modeinfo struct to return to the user
1592  * @in: drm_display_mode to use
1593  *
1594  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
1595  * the user.
1596  */
1597 static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
1598 				      const struct drm_display_mode *in)
1599 {
1600 	WARN(in->hdisplay > USHRT_MAX || in->hsync_start > USHRT_MAX ||
1601 	     in->hsync_end > USHRT_MAX || in->htotal > USHRT_MAX ||
1602 	     in->hskew > USHRT_MAX || in->vdisplay > USHRT_MAX ||
1603 	     in->vsync_start > USHRT_MAX || in->vsync_end > USHRT_MAX ||
1604 	     in->vtotal > USHRT_MAX || in->vscan > USHRT_MAX,
1605 	     "timing values too large for mode info\n");
1606 
1607 	out->clock = in->clock;
1608 	out->hdisplay = in->hdisplay;
1609 	out->hsync_start = in->hsync_start;
1610 	out->hsync_end = in->hsync_end;
1611 	out->htotal = in->htotal;
1612 	out->hskew = in->hskew;
1613 	out->vdisplay = in->vdisplay;
1614 	out->vsync_start = in->vsync_start;
1615 	out->vsync_end = in->vsync_end;
1616 	out->vtotal = in->vtotal;
1617 	out->vscan = in->vscan;
1618 	out->vrefresh = in->vrefresh;
1619 	out->flags = in->flags;
1620 	out->type = in->type;
1621 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1622 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1623 }
1624 
1625 /**
1626  * drm_crtc_convert_umode - convert a modeinfo into a drm_display_mode
1627  * @out: drm_display_mode to return to the user
1628  * @in: drm_mode_modeinfo to use
1629  *
1630  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
1631  * the caller.
1632  *
1633  * Returns:
1634  * Zero on success, errno on failure.
1635  */
1636 static int drm_crtc_convert_umode(struct drm_display_mode *out,
1637 				  const struct drm_mode_modeinfo *in)
1638 {
1639 	if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
1640 		return -ERANGE;
1641 
1642 	if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
1643 		return -EINVAL;
1644 
1645 	out->clock = in->clock;
1646 	out->hdisplay = in->hdisplay;
1647 	out->hsync_start = in->hsync_start;
1648 	out->hsync_end = in->hsync_end;
1649 	out->htotal = in->htotal;
1650 	out->hskew = in->hskew;
1651 	out->vdisplay = in->vdisplay;
1652 	out->vsync_start = in->vsync_start;
1653 	out->vsync_end = in->vsync_end;
1654 	out->vtotal = in->vtotal;
1655 	out->vscan = in->vscan;
1656 	out->vrefresh = in->vrefresh;
1657 	out->flags = in->flags;
1658 	out->type = in->type;
1659 	strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
1660 	out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
1661 
1662 	return 0;
1663 }
1664 
1665 /**
1666  * drm_mode_getresources - get graphics configuration
1667  * @dev: drm device for the ioctl
1668  * @data: data pointer for the ioctl
1669  * @file_priv: drm file for the ioctl call
1670  *
1671  * Construct a set of configuration description structures and return
1672  * them to the user, including CRTC, connector and framebuffer configuration.
1673  *
1674  * Called by the user via ioctl.
1675  *
1676  * Returns:
1677  * Zero on success, errno on failure.
1678  */
1679 int drm_mode_getresources(struct drm_device *dev, void *data,
1680 			  struct drm_file *file_priv)
1681 {
1682 	struct drm_mode_card_res *card_res = data;
1683 	struct list_head *lh;
1684 	struct drm_framebuffer *fb;
1685 	struct drm_connector *connector;
1686 	struct drm_crtc *crtc;
1687 	struct drm_encoder *encoder;
1688 	int ret = 0;
1689 	int connector_count = 0;
1690 	int crtc_count = 0;
1691 	int fb_count = 0;
1692 	int encoder_count = 0;
1693 	int copied = 0, i;
1694 	uint32_t __user *fb_id;
1695 	uint32_t __user *crtc_id;
1696 	uint32_t __user *connector_id;
1697 	uint32_t __user *encoder_id;
1698 	struct drm_mode_group *mode_group;
1699 
1700 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1701 		return -EINVAL;
1702 
1703 
1704 	mutex_lock(&file_priv->fbs_lock);
1705 	/*
1706 	 * For the non-control nodes we need to limit the list of resources
1707 	 * by IDs in the group list for this node
1708 	 */
1709 	list_for_each(lh, &file_priv->fbs)
1710 		fb_count++;
1711 
1712 	/* handle this in 4 parts */
1713 	/* FBs */
1714 	if (card_res->count_fbs >= fb_count) {
1715 		copied = 0;
1716 		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
1717 		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
1718 			if (put_user(fb->base.id, fb_id + copied)) {
1719 				mutex_unlock(&file_priv->fbs_lock);
1720 				return -EFAULT;
1721 			}
1722 			copied++;
1723 		}
1724 	}
1725 	card_res->count_fbs = fb_count;
1726 	mutex_unlock(&file_priv->fbs_lock);
1727 
1728 	drm_modeset_lock_all(dev);
1729 	if (!drm_is_primary_client(file_priv)) {
1730 
1731 		mode_group = NULL;
1732 		list_for_each(lh, &dev->mode_config.crtc_list)
1733 			crtc_count++;
1734 
1735 		list_for_each(lh, &dev->mode_config.connector_list)
1736 			connector_count++;
1737 
1738 		list_for_each(lh, &dev->mode_config.encoder_list)
1739 			encoder_count++;
1740 	} else {
1741 
1742 		crtc_count = mode_group->num_crtcs;
1743 		connector_count = mode_group->num_connectors;
1744 		encoder_count = mode_group->num_encoders;
1745 	}
1746 
1747 	card_res->max_height = dev->mode_config.max_height;
1748 	card_res->min_height = dev->mode_config.min_height;
1749 	card_res->max_width = dev->mode_config.max_width;
1750 	card_res->min_width = dev->mode_config.min_width;
1751 
1752 	/* CRTCs */
1753 	if (card_res->count_crtcs >= crtc_count) {
1754 		copied = 0;
1755 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
1756 		if (!mode_group) {
1757 			list_for_each_entry(crtc, &dev->mode_config.crtc_list,
1758 					    head) {
1759 				DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
1760 				if (put_user(crtc->base.id, crtc_id + copied)) {
1761 					ret = -EFAULT;
1762 					goto out;
1763 				}
1764 				copied++;
1765 			}
1766 		} else {
1767 			for (i = 0; i < mode_group->num_crtcs; i++) {
1768 				if (put_user(mode_group->id_list[i],
1769 					     crtc_id + copied)) {
1770 					ret = -EFAULT;
1771 					goto out;
1772 				}
1773 				copied++;
1774 			}
1775 		}
1776 	}
1777 	card_res->count_crtcs = crtc_count;
1778 
1779 	/* Encoders */
1780 	if (card_res->count_encoders >= encoder_count) {
1781 		copied = 0;
1782 		encoder_id = (uint32_t __user *)(unsigned long)card_res->encoder_id_ptr;
1783 		if (!mode_group) {
1784 			list_for_each_entry(encoder,
1785 					    &dev->mode_config.encoder_list,
1786 					    head) {
1787 				DRM_DEBUG_KMS("[ENCODER:%d:%s]\n", encoder->base.id,
1788 						encoder->name);
1789 				if (put_user(encoder->base.id, encoder_id +
1790 					     copied)) {
1791 					ret = -EFAULT;
1792 					goto out;
1793 				}
1794 				copied++;
1795 			}
1796 		} else {
1797 			for (i = mode_group->num_crtcs; i < mode_group->num_crtcs + mode_group->num_encoders; i++) {
1798 				if (put_user(mode_group->id_list[i],
1799 					     encoder_id + copied)) {
1800 					ret = -EFAULT;
1801 					goto out;
1802 				}
1803 				copied++;
1804 			}
1805 
1806 		}
1807 	}
1808 	card_res->count_encoders = encoder_count;
1809 
1810 	/* Connectors */
1811 	if (card_res->count_connectors >= connector_count) {
1812 		copied = 0;
1813 		connector_id = (uint32_t __user *)(unsigned long)card_res->connector_id_ptr;
1814 		if (!mode_group) {
1815 			list_for_each_entry(connector,
1816 					    &dev->mode_config.connector_list,
1817 					    head) {
1818 				DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
1819 					connector->base.id,
1820 					connector->name);
1821 				if (put_user(connector->base.id,
1822 					     connector_id + copied)) {
1823 					ret = -EFAULT;
1824 					goto out;
1825 				}
1826 				copied++;
1827 			}
1828 		} else {
1829 			int start = mode_group->num_crtcs +
1830 				mode_group->num_encoders;
1831 			for (i = start; i < start + mode_group->num_connectors; i++) {
1832 				if (put_user(mode_group->id_list[i],
1833 					     connector_id + copied)) {
1834 					ret = -EFAULT;
1835 					goto out;
1836 				}
1837 				copied++;
1838 			}
1839 		}
1840 	}
1841 	card_res->count_connectors = connector_count;
1842 
1843 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
1844 		  card_res->count_connectors, card_res->count_encoders);
1845 
1846 out:
1847 	drm_modeset_unlock_all(dev);
1848 	return ret;
1849 }
1850 
1851 /**
1852  * drm_mode_getcrtc - get CRTC configuration
1853  * @dev: drm device for the ioctl
1854  * @data: data pointer for the ioctl
1855  * @file_priv: drm file for the ioctl call
1856  *
1857  * Construct a CRTC configuration structure to return to the user.
1858  *
1859  * Called by the user via ioctl.
1860  *
1861  * Returns:
1862  * Zero on success, errno on failure.
1863  */
1864 int drm_mode_getcrtc(struct drm_device *dev,
1865 		     void *data, struct drm_file *file_priv)
1866 {
1867 	struct drm_mode_crtc *crtc_resp = data;
1868 	struct drm_crtc *crtc;
1869 	int ret = 0;
1870 
1871 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1872 		return -EINVAL;
1873 
1874 	drm_modeset_lock_all(dev);
1875 
1876 	crtc = drm_crtc_find(dev, crtc_resp->crtc_id);
1877 	if (!crtc) {
1878 		ret = -ENOENT;
1879 		goto out;
1880 	}
1881 
1882 	crtc_resp->x = crtc->x;
1883 	crtc_resp->y = crtc->y;
1884 	crtc_resp->gamma_size = crtc->gamma_size;
1885 	if (crtc->primary->fb)
1886 		crtc_resp->fb_id = crtc->primary->fb->base.id;
1887 	else
1888 		crtc_resp->fb_id = 0;
1889 
1890 	if (crtc->enabled) {
1891 
1892 		drm_crtc_convert_to_umode(&crtc_resp->mode, &crtc->mode);
1893 		crtc_resp->mode_valid = 1;
1894 
1895 	} else {
1896 		crtc_resp->mode_valid = 0;
1897 	}
1898 
1899 out:
1900 	drm_modeset_unlock_all(dev);
1901 	return ret;
1902 }
1903 
1904 static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
1905 					 const struct drm_file *file_priv)
1906 {
1907 	/*
1908 	 * If user-space hasn't configured the driver to expose the stereo 3D
1909 	 * modes, don't expose them.
1910 	 */
1911 	if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
1912 		return false;
1913 
1914 	return true;
1915 }
1916 
1917 /**
1918  * drm_mode_getconnector - get connector configuration
1919  * @dev: drm device for the ioctl
1920  * @data: data pointer for the ioctl
1921  * @file_priv: drm file for the ioctl call
1922  *
1923  * Construct a connector configuration structure to return to the user.
1924  *
1925  * Called by the user via ioctl.
1926  *
1927  * Returns:
1928  * Zero on success, errno on failure.
1929  */
1930 int drm_mode_getconnector(struct drm_device *dev, void *data,
1931 			  struct drm_file *file_priv)
1932 {
1933 	struct drm_mode_get_connector *out_resp = data;
1934 	struct drm_connector *connector;
1935 	struct drm_display_mode *mode;
1936 	int mode_count = 0;
1937 	int props_count = 0;
1938 	int encoders_count = 0;
1939 	int ret = 0;
1940 	int copied = 0;
1941 	int i;
1942 	struct drm_mode_modeinfo u_mode;
1943 	struct drm_mode_modeinfo __user *mode_ptr;
1944 	uint32_t __user *prop_ptr;
1945 	uint64_t __user *prop_values;
1946 	uint32_t __user *encoder_ptr;
1947 
1948 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1949 		return -EINVAL;
1950 
1951 	memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
1952 
1953 	DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
1954 
1955 	mutex_lock(&dev->mode_config.mutex);
1956 	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
1957 
1958 	connector = drm_connector_find(dev, out_resp->connector_id);
1959 	if (!connector) {
1960 		ret = -ENOENT;
1961 		goto out;
1962 	}
1963 
1964 	props_count = connector->properties.count;
1965 
1966 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
1967 		if (connector->encoder_ids[i] != 0) {
1968 			encoders_count++;
1969 		}
1970 	}
1971 
1972 	if (out_resp->count_modes == 0) {
1973 		connector->funcs->fill_modes(connector,
1974 					     dev->mode_config.max_width,
1975 					     dev->mode_config.max_height);
1976 	}
1977 
1978 	/* delayed so we get modes regardless of pre-fill_modes state */
1979 	list_for_each_entry(mode, &connector->modes, head)
1980 		if (drm_mode_expose_to_userspace(mode, file_priv))
1981 			mode_count++;
1982 
1983 	out_resp->connector_id = connector->base.id;
1984 	out_resp->connector_type = connector->connector_type;
1985 	out_resp->connector_type_id = connector->connector_type_id;
1986 	out_resp->mm_width = connector->display_info.width_mm;
1987 	out_resp->mm_height = connector->display_info.height_mm;
1988 	out_resp->subpixel = connector->display_info.subpixel_order;
1989 	out_resp->connection = connector->status;
1990 	if (connector->encoder)
1991 		out_resp->encoder_id = connector->encoder->base.id;
1992 	else
1993 		out_resp->encoder_id = 0;
1994 
1995 	/*
1996 	 * This ioctl is called twice, once to determine how much space is
1997 	 * needed, and the 2nd time to fill it.
1998 	 */
1999 	if ((out_resp->count_modes >= mode_count) && mode_count) {
2000 		copied = 0;
2001 		mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
2002 		list_for_each_entry(mode, &connector->modes, head) {
2003 			if (!drm_mode_expose_to_userspace(mode, file_priv))
2004 				continue;
2005 
2006 			drm_crtc_convert_to_umode(&u_mode, mode);
2007 			if (copy_to_user(mode_ptr + copied,
2008 					 &u_mode, sizeof(u_mode))) {
2009 				ret = -EFAULT;
2010 				goto out;
2011 			}
2012 			copied++;
2013 		}
2014 	}
2015 	out_resp->count_modes = mode_count;
2016 
2017 	if ((out_resp->count_props >= props_count) && props_count) {
2018 		copied = 0;
2019 		prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
2020 		prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
2021 		for (i = 0; i < connector->properties.count; i++) {
2022 			if (put_user(connector->properties.ids[i],
2023 				     prop_ptr + copied)) {
2024 				ret = -EFAULT;
2025 				goto out;
2026 			}
2027 
2028 			if (put_user(connector->properties.values[i],
2029 				     prop_values + copied)) {
2030 				ret = -EFAULT;
2031 				goto out;
2032 			}
2033 			copied++;
2034 		}
2035 	}
2036 	out_resp->count_props = props_count;
2037 
2038 	if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
2039 		copied = 0;
2040 		encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
2041 		for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
2042 			if (connector->encoder_ids[i] != 0) {
2043 				if (put_user(connector->encoder_ids[i],
2044 					     encoder_ptr + copied)) {
2045 					ret = -EFAULT;
2046 					goto out;
2047 				}
2048 				copied++;
2049 			}
2050 		}
2051 	}
2052 	out_resp->count_encoders = encoders_count;
2053 
2054 out:
2055 	drm_modeset_unlock(&dev->mode_config.connection_mutex);
2056 	mutex_unlock(&dev->mode_config.mutex);
2057 
2058 	return ret;
2059 }
2060 
2061 /**
2062  * drm_mode_getencoder - get encoder configuration
2063  * @dev: drm device for the ioctl
2064  * @data: data pointer for the ioctl
2065  * @file_priv: drm file for the ioctl call
2066  *
2067  * Construct a encoder configuration structure to return to the user.
2068  *
2069  * Called by the user via ioctl.
2070  *
2071  * Returns:
2072  * Zero on success, errno on failure.
2073  */
2074 int drm_mode_getencoder(struct drm_device *dev, void *data,
2075 			struct drm_file *file_priv)
2076 {
2077 	struct drm_mode_get_encoder *enc_resp = data;
2078 	struct drm_encoder *encoder;
2079 	int ret = 0;
2080 
2081 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2082 		return -EINVAL;
2083 
2084 	drm_modeset_lock_all(dev);
2085 	encoder = drm_encoder_find(dev, enc_resp->encoder_id);
2086 	if (!encoder) {
2087 		ret = -ENOENT;
2088 		goto out;
2089 	}
2090 
2091 	if (encoder->crtc)
2092 		enc_resp->crtc_id = encoder->crtc->base.id;
2093 	else
2094 		enc_resp->crtc_id = 0;
2095 	enc_resp->encoder_type = encoder->encoder_type;
2096 	enc_resp->encoder_id = encoder->base.id;
2097 	enc_resp->possible_crtcs = encoder->possible_crtcs;
2098 	enc_resp->possible_clones = encoder->possible_clones;
2099 
2100 out:
2101 	drm_modeset_unlock_all(dev);
2102 	return ret;
2103 }
2104 
2105 /**
2106  * drm_mode_getplane_res - enumerate all plane resources
2107  * @dev: DRM device
2108  * @data: ioctl data
2109  * @file_priv: DRM file info
2110  *
2111  * Construct a list of plane ids to return to the user.
2112  *
2113  * Called by the user via ioctl.
2114  *
2115  * Returns:
2116  * Zero on success, errno on failure.
2117  */
2118 int drm_mode_getplane_res(struct drm_device *dev, void *data,
2119 			  struct drm_file *file_priv)
2120 {
2121 	struct drm_mode_get_plane_res *plane_resp = data;
2122 	struct drm_mode_config *config;
2123 	struct drm_plane *plane;
2124 	uint32_t __user *plane_ptr;
2125 	int copied = 0, ret = 0;
2126 	unsigned num_planes;
2127 
2128 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2129 		return -EINVAL;
2130 
2131 	drm_modeset_lock_all(dev);
2132 	config = &dev->mode_config;
2133 
2134 	if (file_priv->universal_planes)
2135 		num_planes = config->num_total_plane;
2136 	else
2137 		num_planes = config->num_overlay_plane;
2138 
2139 	/*
2140 	 * This ioctl is called twice, once to determine how much space is
2141 	 * needed, and the 2nd time to fill it.
2142 	 */
2143 	if (num_planes &&
2144 	    (plane_resp->count_planes >= num_planes)) {
2145 		plane_ptr = (uint32_t __user *)(unsigned long)plane_resp->plane_id_ptr;
2146 
2147 		list_for_each_entry(plane, &config->plane_list, head) {
2148 			/*
2149 			 * Unless userspace set the 'universal planes'
2150 			 * capability bit, only advertise overlays.
2151 			 */
2152 			if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
2153 			    !file_priv->universal_planes)
2154 				continue;
2155 
2156 			if (put_user(plane->base.id, plane_ptr + copied)) {
2157 				ret = -EFAULT;
2158 				goto out;
2159 			}
2160 			copied++;
2161 		}
2162 	}
2163 	plane_resp->count_planes = num_planes;
2164 
2165 out:
2166 	drm_modeset_unlock_all(dev);
2167 	return ret;
2168 }
2169 
2170 /**
2171  * drm_mode_getplane - get plane configuration
2172  * @dev: DRM device
2173  * @data: ioctl data
2174  * @file_priv: DRM file info
2175  *
2176  * Construct a plane configuration structure to return to the user.
2177  *
2178  * Called by the user via ioctl.
2179  *
2180  * Returns:
2181  * Zero on success, errno on failure.
2182  */
2183 int drm_mode_getplane(struct drm_device *dev, void *data,
2184 		      struct drm_file *file_priv)
2185 {
2186 	struct drm_mode_get_plane *plane_resp = data;
2187 	struct drm_plane *plane;
2188 	uint32_t __user *format_ptr;
2189 	int ret = 0;
2190 
2191 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2192 		return -EINVAL;
2193 
2194 	drm_modeset_lock_all(dev);
2195 	plane = drm_plane_find(dev, plane_resp->plane_id);
2196 	if (!plane) {
2197 		ret = -ENOENT;
2198 		goto out;
2199 	}
2200 
2201 	if (plane->crtc)
2202 		plane_resp->crtc_id = plane->crtc->base.id;
2203 	else
2204 		plane_resp->crtc_id = 0;
2205 
2206 	if (plane->fb)
2207 		plane_resp->fb_id = plane->fb->base.id;
2208 	else
2209 		plane_resp->fb_id = 0;
2210 
2211 	plane_resp->plane_id = plane->base.id;
2212 	plane_resp->possible_crtcs = plane->possible_crtcs;
2213 	plane_resp->gamma_size = 0;
2214 
2215 	/*
2216 	 * This ioctl is called twice, once to determine how much space is
2217 	 * needed, and the 2nd time to fill it.
2218 	 */
2219 	if (plane->format_count &&
2220 	    (plane_resp->count_format_types >= plane->format_count)) {
2221 		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
2222 		if (copy_to_user(format_ptr,
2223 				 plane->format_types,
2224 				 sizeof(uint32_t) * plane->format_count)) {
2225 			ret = -EFAULT;
2226 			goto out;
2227 		}
2228 	}
2229 	plane_resp->count_format_types = plane->format_count;
2230 
2231 out:
2232 	drm_modeset_unlock_all(dev);
2233 	return ret;
2234 }
2235 
2236 /*
2237  * setplane_internal - setplane handler for internal callers
2238  *
2239  * Note that we assume an extra reference has already been taken on fb.  If the
2240  * update fails, this reference will be dropped before return; if it succeeds,
2241  * the previous framebuffer (if any) will be unreferenced instead.
2242  *
2243  * src_{x,y,w,h} are provided in 16.16 fixed point format
2244  */
2245 static int __setplane_internal(struct drm_plane *plane,
2246 			       struct drm_crtc *crtc,
2247 			       struct drm_framebuffer *fb,
2248 			       int32_t crtc_x, int32_t crtc_y,
2249 			       uint32_t crtc_w, uint32_t crtc_h,
2250 			       /* src_{x,y,w,h} values are 16.16 fixed point */
2251 			       uint32_t src_x, uint32_t src_y,
2252 			       uint32_t src_w, uint32_t src_h)
2253 {
2254 	int ret = 0;
2255 	unsigned int fb_width, fb_height;
2256 	int i;
2257 
2258 	/* No fb means shut it down */
2259 	if (!fb) {
2260 		plane->old_fb = plane->fb;
2261 		ret = plane->funcs->disable_plane(plane);
2262 		if (!ret) {
2263 			plane->crtc = NULL;
2264 			plane->fb = NULL;
2265 		} else {
2266 			plane->old_fb = NULL;
2267 		}
2268 		goto out;
2269 	}
2270 
2271 	/* Check whether this plane is usable on this CRTC */
2272 	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
2273 		DRM_DEBUG_KMS("Invalid crtc for plane\n");
2274 		ret = -EINVAL;
2275 		goto out;
2276 	}
2277 
2278 	/* Check whether this plane supports the fb pixel format. */
2279 	for (i = 0; i < plane->format_count; i++)
2280 		if (fb->pixel_format == plane->format_types[i])
2281 			break;
2282 	if (i == plane->format_count) {
2283 		DRM_DEBUG_KMS("Invalid pixel format %s\n",
2284 			      drm_get_format_name(fb->pixel_format));
2285 		ret = -EINVAL;
2286 		goto out;
2287 	}
2288 
2289 	fb_width = fb->width << 16;
2290 	fb_height = fb->height << 16;
2291 
2292 	/* Make sure source coordinates are inside the fb. */
2293 	if (src_w > fb_width ||
2294 	    src_x > fb_width - src_w ||
2295 	    src_h > fb_height ||
2296 	    src_y > fb_height - src_h) {
2297 		DRM_DEBUG_KMS("Invalid source coordinates "
2298 			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u\n",
2299 			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
2300 			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
2301 			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
2302 			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10);
2303 		ret = -ENOSPC;
2304 		goto out;
2305 	}
2306 
2307 	plane->old_fb = plane->fb;
2308 	ret = plane->funcs->update_plane(plane, crtc, fb,
2309 					 crtc_x, crtc_y, crtc_w, crtc_h,
2310 					 src_x, src_y, src_w, src_h);
2311 	if (!ret) {
2312 		plane->crtc = crtc;
2313 		plane->fb = fb;
2314 		fb = NULL;
2315 	} else {
2316 		plane->old_fb = NULL;
2317 	}
2318 
2319 out:
2320 	if (fb)
2321 		drm_framebuffer_unreference(fb);
2322 	if (plane->old_fb)
2323 		drm_framebuffer_unreference(plane->old_fb);
2324 	plane->old_fb = NULL;
2325 
2326 	return ret;
2327 }
2328 
2329 static int setplane_internal(struct drm_plane *plane,
2330 			     struct drm_crtc *crtc,
2331 			     struct drm_framebuffer *fb,
2332 			     int32_t crtc_x, int32_t crtc_y,
2333 			     uint32_t crtc_w, uint32_t crtc_h,
2334 			     /* src_{x,y,w,h} values are 16.16 fixed point */
2335 			     uint32_t src_x, uint32_t src_y,
2336 			     uint32_t src_w, uint32_t src_h)
2337 {
2338 	int ret;
2339 
2340 	drm_modeset_lock_all(plane->dev);
2341 	ret = __setplane_internal(plane, crtc, fb,
2342 				  crtc_x, crtc_y, crtc_w, crtc_h,
2343 				  src_x, src_y, src_w, src_h);
2344 	drm_modeset_unlock_all(plane->dev);
2345 
2346 	return ret;
2347 }
2348 
2349 /**
2350  * drm_mode_setplane - configure a plane's configuration
2351  * @dev: DRM device
2352  * @data: ioctl data*
2353  * @file_priv: DRM file info
2354  *
2355  * Set plane configuration, including placement, fb, scaling, and other factors.
2356  * Or pass a NULL fb to disable (planes may be disabled without providing a
2357  * valid crtc).
2358  *
2359  * Returns:
2360  * Zero on success, errno on failure.
2361  */
2362 int drm_mode_setplane(struct drm_device *dev, void *data,
2363 		      struct drm_file *file_priv)
2364 {
2365 	struct drm_mode_set_plane *plane_req = data;
2366 	struct drm_mode_object *obj;
2367 	struct drm_plane *plane;
2368 	struct drm_crtc *crtc = NULL;
2369 	struct drm_framebuffer *fb = NULL;
2370 
2371 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2372 		return -EINVAL;
2373 
2374 	/* Give drivers some help against integer overflows */
2375 	if (plane_req->crtc_w > INT_MAX ||
2376 	    plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
2377 	    plane_req->crtc_h > INT_MAX ||
2378 	    plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
2379 		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
2380 			      plane_req->crtc_w, plane_req->crtc_h,
2381 			      plane_req->crtc_x, plane_req->crtc_y);
2382 		return -ERANGE;
2383 	}
2384 
2385 	/*
2386 	 * First, find the plane, crtc, and fb objects.  If not available,
2387 	 * we don't bother to call the driver.
2388 	 */
2389 	obj = drm_mode_object_find(dev, plane_req->plane_id,
2390 				   DRM_MODE_OBJECT_PLANE);
2391 	if (!obj) {
2392 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
2393 			      plane_req->plane_id);
2394 		return -ENOENT;
2395 	}
2396 	plane = obj_to_plane(obj);
2397 
2398 	if (plane_req->fb_id) {
2399 		fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
2400 		if (!fb) {
2401 			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
2402 				      plane_req->fb_id);
2403 			return -ENOENT;
2404 		}
2405 
2406 		obj = drm_mode_object_find(dev, plane_req->crtc_id,
2407 					   DRM_MODE_OBJECT_CRTC);
2408 		if (!obj) {
2409 			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
2410 				      plane_req->crtc_id);
2411 			return -ENOENT;
2412 		}
2413 		crtc = obj_to_crtc(obj);
2414 	}
2415 
2416 	/*
2417 	 * setplane_internal will take care of deref'ing either the old or new
2418 	 * framebuffer depending on success.
2419 	 */
2420 	return setplane_internal(plane, crtc, fb,
2421 				 plane_req->crtc_x, plane_req->crtc_y,
2422 				 plane_req->crtc_w, plane_req->crtc_h,
2423 				 plane_req->src_x, plane_req->src_y,
2424 				 plane_req->src_w, plane_req->src_h);
2425 }
2426 
2427 /**
2428  * drm_mode_set_config_internal - helper to call ->set_config
2429  * @set: modeset config to set
2430  *
2431  * This is a little helper to wrap internal calls to the ->set_config driver
2432  * interface. The only thing it adds is correct refcounting dance.
2433  *
2434  * Returns:
2435  * Zero on success, errno on failure.
2436  */
2437 int drm_mode_set_config_internal(struct drm_mode_set *set)
2438 {
2439 	struct drm_crtc *crtc = set->crtc;
2440 	struct drm_framebuffer *fb;
2441 	struct drm_crtc *tmp;
2442 	int ret;
2443 
2444 	/*
2445 	 * NOTE: ->set_config can also disable other crtcs (if we steal all
2446 	 * connectors from it), hence we need to refcount the fbs across all
2447 	 * crtcs. Atomic modeset will have saner semantics ...
2448 	 */
2449 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head)
2450 		tmp->primary->old_fb = tmp->primary->fb;
2451 
2452 	fb = set->fb;
2453 
2454 	ret = crtc->funcs->set_config(set);
2455 	if (ret == 0) {
2456 		crtc->primary->crtc = crtc;
2457 		crtc->primary->fb = fb;
2458 	}
2459 
2460 	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
2461 		if (tmp->primary->fb)
2462 			drm_framebuffer_reference(tmp->primary->fb);
2463 		if (tmp->primary->old_fb)
2464 			drm_framebuffer_unreference(tmp->primary->old_fb);
2465 		tmp->primary->old_fb = NULL;
2466 	}
2467 
2468 	return ret;
2469 }
2470 EXPORT_SYMBOL(drm_mode_set_config_internal);
2471 
2472 /**
2473  * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
2474  *     CRTC viewport
2475  * @crtc: CRTC that framebuffer will be displayed on
2476  * @x: x panning
2477  * @y: y panning
2478  * @mode: mode that framebuffer will be displayed under
2479  * @fb: framebuffer to check size of
2480  */
2481 int drm_crtc_check_viewport(const struct drm_crtc *crtc,
2482 			    int x, int y,
2483 			    const struct drm_display_mode *mode,
2484 			    const struct drm_framebuffer *fb)
2485 
2486 {
2487 	int hdisplay, vdisplay;
2488 
2489 	hdisplay = mode->hdisplay;
2490 	vdisplay = mode->vdisplay;
2491 
2492 	if (drm_mode_is_stereo(mode)) {
2493 		struct drm_display_mode adjusted = *mode;
2494 
2495 		drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE);
2496 		hdisplay = adjusted.crtc_hdisplay;
2497 		vdisplay = adjusted.crtc_vdisplay;
2498 	}
2499 
2500 	if (crtc->invert_dimensions)
2501 		swap(hdisplay, vdisplay);
2502 
2503 	if (hdisplay > fb->width ||
2504 	    vdisplay > fb->height ||
2505 	    x > fb->width - hdisplay ||
2506 	    y > fb->height - vdisplay) {
2507 		DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
2508 			      fb->width, fb->height, hdisplay, vdisplay, x, y,
2509 			      crtc->invert_dimensions ? " (inverted)" : "");
2510 		return -ENOSPC;
2511 	}
2512 
2513 	return 0;
2514 }
2515 EXPORT_SYMBOL(drm_crtc_check_viewport);
2516 
2517 /**
2518  * drm_mode_setcrtc - set CRTC configuration
2519  * @dev: drm device for the ioctl
2520  * @data: data pointer for the ioctl
2521  * @file_priv: drm file for the ioctl call
2522  *
2523  * Build a new CRTC configuration based on user request.
2524  *
2525  * Called by the user via ioctl.
2526  *
2527  * Returns:
2528  * Zero on success, errno on failure.
2529  */
2530 int drm_mode_setcrtc(struct drm_device *dev, void *data,
2531 		     struct drm_file *file_priv)
2532 {
2533 	struct drm_mode_config *config = &dev->mode_config;
2534 	struct drm_mode_crtc *crtc_req = data;
2535 	struct drm_crtc *crtc;
2536 	struct drm_connector **connector_set = NULL, *connector;
2537 	struct drm_framebuffer *fb = NULL;
2538 	struct drm_display_mode *mode = NULL;
2539 	struct drm_mode_set set;
2540 	uint32_t __user *set_connectors_ptr;
2541 	int ret;
2542 	int i;
2543 
2544 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2545 		return -EINVAL;
2546 
2547 	/* For some reason crtc x/y offsets are signed internally. */
2548 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
2549 		return -ERANGE;
2550 
2551 	drm_modeset_lock_all(dev);
2552 	crtc = drm_crtc_find(dev, crtc_req->crtc_id);
2553 	if (!crtc) {
2554 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id);
2555 		ret = -ENOENT;
2556 		goto out;
2557 	}
2558 	DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
2559 
2560 	if (crtc_req->mode_valid) {
2561 		/* If we have a mode we need a framebuffer. */
2562 		/* If we pass -1, set the mode with the currently bound fb */
2563 		if (crtc_req->fb_id == -1) {
2564 			if (!crtc->primary->fb) {
2565 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
2566 				ret = -EINVAL;
2567 				goto out;
2568 			}
2569 			fb = crtc->primary->fb;
2570 			/* Make refcounting symmetric with the lookup path. */
2571 			drm_framebuffer_reference(fb);
2572 		} else {
2573 			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
2574 			if (!fb) {
2575 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
2576 						crtc_req->fb_id);
2577 				ret = -ENOENT;
2578 				goto out;
2579 			}
2580 		}
2581 
2582 		mode = drm_mode_create(dev);
2583 		if (!mode) {
2584 			ret = -ENOMEM;
2585 			goto out;
2586 		}
2587 
2588 		ret = drm_crtc_convert_umode(mode, &crtc_req->mode);
2589 		if (ret) {
2590 			DRM_DEBUG_KMS("Invalid mode\n");
2591 			goto out;
2592 		}
2593 
2594 		drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
2595 
2596 		ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
2597 					      mode, fb);
2598 		if (ret)
2599 			goto out;
2600 
2601 	}
2602 
2603 	if (crtc_req->count_connectors == 0 && mode) {
2604 		DRM_DEBUG_KMS("Count connectors is 0 but mode set\n");
2605 		ret = -EINVAL;
2606 		goto out;
2607 	}
2608 
2609 	if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
2610 		DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",
2611 			  crtc_req->count_connectors);
2612 		ret = -EINVAL;
2613 		goto out;
2614 	}
2615 
2616 	if (crtc_req->count_connectors > 0) {
2617 		u32 out_id;
2618 
2619 		/* Avoid unbounded kernel memory allocation */
2620 		if (crtc_req->count_connectors > config->num_connector) {
2621 			ret = -EINVAL;
2622 			goto out;
2623 		}
2624 
2625 		connector_set = kmalloc(crtc_req->count_connectors *
2626 					sizeof(struct drm_connector *),
2627 					M_DRM, M_WAITOK);
2628 		if (!connector_set) {
2629 			ret = -ENOMEM;
2630 			goto out;
2631 		}
2632 
2633 		for (i = 0; i < crtc_req->count_connectors; i++) {
2634 			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
2635 			if (get_user(out_id, &set_connectors_ptr[i])) {
2636 				ret = -EFAULT;
2637 				goto out;
2638 			}
2639 
2640 			connector = drm_connector_find(dev, out_id);
2641 			if (!connector) {
2642 				DRM_DEBUG_KMS("Connector id %d unknown\n",
2643 						out_id);
2644 				ret = -ENOENT;
2645 				goto out;
2646 			}
2647 			DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
2648 					connector->base.id,
2649 					connector->name);
2650 
2651 			connector_set[i] = connector;
2652 		}
2653 	}
2654 
2655 	set.crtc = crtc;
2656 	set.x = crtc_req->x;
2657 	set.y = crtc_req->y;
2658 	set.mode = mode;
2659 	set.connectors = connector_set;
2660 	set.num_connectors = crtc_req->count_connectors;
2661 	set.fb = fb;
2662 	ret = drm_mode_set_config_internal(&set);
2663 
2664 out:
2665 	if (fb)
2666 		drm_framebuffer_unreference(fb);
2667 
2668 	kfree(connector_set);
2669 	drm_mode_destroy(dev, mode);
2670 	drm_modeset_unlock_all(dev);
2671 	return ret;
2672 }
2673 
2674 /**
2675  * drm_mode_cursor_universal - translate legacy cursor ioctl call into a
2676  *     universal plane handler call
2677  * @crtc: crtc to update cursor for
2678  * @req: data pointer for the ioctl
2679  * @file_priv: drm file for the ioctl call
2680  *
2681  * Legacy cursor ioctl's work directly with driver buffer handles.  To
2682  * translate legacy ioctl calls into universal plane handler calls, we need to
2683  * wrap the native buffer handle in a drm_framebuffer.
2684  *
2685  * Note that we assume any handle passed to the legacy ioctls was a 32-bit ARGB
2686  * buffer with a pitch of 4*width; the universal plane interface should be used
2687  * directly in cases where the hardware can support other buffer settings and
2688  * userspace wants to make use of these capabilities.
2689  *
2690  * Returns:
2691  * Zero on success, errno on failure.
2692  */
2693 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
2694 				     struct drm_mode_cursor2 *req,
2695 				     struct drm_file *file_priv)
2696 {
2697 	struct drm_device *dev = crtc->dev;
2698 	struct drm_framebuffer *fb = NULL;
2699 	struct drm_mode_fb_cmd2 fbreq = {
2700 		.width = req->width,
2701 		.height = req->height,
2702 		.pixel_format = DRM_FORMAT_ARGB8888,
2703 		.pitches = { req->width * 4 },
2704 		.handles = { req->handle },
2705 	};
2706 	int32_t crtc_x, crtc_y;
2707 	uint32_t crtc_w = 0, crtc_h = 0;
2708 	uint32_t src_w = 0, src_h = 0;
2709 	int ret = 0;
2710 
2711 	BUG_ON(!crtc->cursor);
2712 	WARN_ON(crtc->cursor->crtc != crtc && crtc->cursor->crtc != NULL);
2713 
2714 	/*
2715 	 * Obtain fb we'll be using (either new or existing) and take an extra
2716 	 * reference to it if fb != null.  setplane will take care of dropping
2717 	 * the reference if the plane update fails.
2718 	 */
2719 	if (req->flags & DRM_MODE_CURSOR_BO) {
2720 		if (req->handle) {
2721 			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
2722 			if (IS_ERR(fb)) {
2723 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
2724 				return PTR_ERR(fb);
2725 			}
2726 
2727 			drm_framebuffer_reference(fb);
2728 		} else {
2729 			fb = NULL;
2730 		}
2731 	} else {
2732 		fb = crtc->cursor->fb;
2733 		if (fb)
2734 			drm_framebuffer_reference(fb);
2735 	}
2736 
2737 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2738 		crtc_x = req->x;
2739 		crtc_y = req->y;
2740 	} else {
2741 		crtc_x = crtc->cursor_x;
2742 		crtc_y = crtc->cursor_y;
2743 	}
2744 
2745 	if (fb) {
2746 		crtc_w = fb->width;
2747 		crtc_h = fb->height;
2748 		src_w = fb->width << 16;
2749 		src_h = fb->height << 16;
2750 	}
2751 
2752 	/*
2753 	 * setplane_internal will take care of deref'ing either the old or new
2754 	 * framebuffer depending on success.
2755 	 */
2756 	ret = __setplane_internal(crtc->cursor, crtc, fb,
2757 				crtc_x, crtc_y, crtc_w, crtc_h,
2758 				0, 0, src_w, src_h);
2759 
2760 	/* Update successful; save new cursor position, if necessary */
2761 	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
2762 		crtc->cursor_x = req->x;
2763 		crtc->cursor_y = req->y;
2764 	}
2765 
2766 	return ret;
2767 }
2768 
2769 static int drm_mode_cursor_common(struct drm_device *dev,
2770 				  struct drm_mode_cursor2 *req,
2771 				  struct drm_file *file_priv)
2772 {
2773 	struct drm_crtc *crtc;
2774 	int ret = 0;
2775 
2776 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2777 		return -EINVAL;
2778 
2779 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
2780 		return -EINVAL;
2781 
2782 	crtc = drm_crtc_find(dev, req->crtc_id);
2783 	if (!crtc) {
2784 		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
2785 		return -ENOENT;
2786 	}
2787 
2788 	/*
2789 	 * If this crtc has a universal cursor plane, call that plane's update
2790 	 * handler rather than using legacy cursor handlers.
2791 	 */
2792 	drm_modeset_lock_crtc(crtc);
2793 	if (crtc->cursor) {
2794 		ret = drm_mode_cursor_universal(crtc, req, file_priv);
2795 		goto out;
2796 	}
2797 
2798 	if (req->flags & DRM_MODE_CURSOR_BO) {
2799 		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
2800 			ret = -ENXIO;
2801 			goto out;
2802 		}
2803 		/* Turns off the cursor if handle is 0 */
2804 		if (crtc->funcs->cursor_set2)
2805 			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
2806 						      req->width, req->height, req->hot_x, req->hot_y);
2807 		else
2808 			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
2809 						      req->width, req->height);
2810 	}
2811 
2812 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
2813 		if (crtc->funcs->cursor_move) {
2814 			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
2815 		} else {
2816 			ret = -EFAULT;
2817 			goto out;
2818 		}
2819 	}
2820 out:
2821 	drm_modeset_unlock_crtc(crtc);
2822 
2823 	return ret;
2824 
2825 }
2826 
2827 
2828 /**
2829  * drm_mode_cursor_ioctl - set CRTC's cursor configuration
2830  * @dev: drm device for the ioctl
2831  * @data: data pointer for the ioctl
2832  * @file_priv: drm file for the ioctl call
2833  *
2834  * Set the cursor configuration based on user request.
2835  *
2836  * Called by the user via ioctl.
2837  *
2838  * Returns:
2839  * Zero on success, errno on failure.
2840  */
2841 int drm_mode_cursor_ioctl(struct drm_device *dev,
2842 			  void *data, struct drm_file *file_priv)
2843 {
2844 	struct drm_mode_cursor *req = data;
2845 	struct drm_mode_cursor2 new_req;
2846 
2847 	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
2848 	new_req.hot_x = new_req.hot_y = 0;
2849 
2850 	return drm_mode_cursor_common(dev, &new_req, file_priv);
2851 }
2852 
2853 /**
2854  * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
2855  * @dev: drm device for the ioctl
2856  * @data: data pointer for the ioctl
2857  * @file_priv: drm file for the ioctl call
2858  *
2859  * Set the cursor configuration based on user request. This implements the 2nd
2860  * version of the cursor ioctl, which allows userspace to additionally specify
2861  * the hotspot of the pointer.
2862  *
2863  * Called by the user via ioctl.
2864  *
2865  * Returns:
2866  * Zero on success, errno on failure.
2867  */
2868 int drm_mode_cursor2_ioctl(struct drm_device *dev,
2869 			   void *data, struct drm_file *file_priv)
2870 {
2871 	struct drm_mode_cursor2 *req = data;
2872 	return drm_mode_cursor_common(dev, req, file_priv);
2873 }
2874 
2875 /**
2876  * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
2877  * @bpp: bits per pixels
2878  * @depth: bit depth per pixel
2879  *
2880  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
2881  * Useful in fbdev emulation code, since that deals in those values.
2882  */
2883 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
2884 {
2885 	uint32_t fmt;
2886 
2887 	switch (bpp) {
2888 	case 8:
2889 		fmt = DRM_FORMAT_C8;
2890 		break;
2891 	case 16:
2892 		if (depth == 15)
2893 			fmt = DRM_FORMAT_XRGB1555;
2894 		else
2895 			fmt = DRM_FORMAT_RGB565;
2896 		break;
2897 	case 24:
2898 		fmt = DRM_FORMAT_RGB888;
2899 		break;
2900 	case 32:
2901 		if (depth == 24)
2902 			fmt = DRM_FORMAT_XRGB8888;
2903 		else if (depth == 30)
2904 			fmt = DRM_FORMAT_XRGB2101010;
2905 		else
2906 			fmt = DRM_FORMAT_ARGB8888;
2907 		break;
2908 	default:
2909 		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
2910 		fmt = DRM_FORMAT_XRGB8888;
2911 		break;
2912 	}
2913 
2914 	return fmt;
2915 }
2916 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
2917 
2918 /**
2919  * drm_mode_addfb - add an FB to the graphics configuration
2920  * @dev: drm device for the ioctl
2921  * @data: data pointer for the ioctl
2922  * @file_priv: drm file for the ioctl call
2923  *
2924  * Add a new FB to the specified CRTC, given a user request. This is the
2925  * original addfb ioclt which only supported RGB formats.
2926  *
2927  * Called by the user via ioctl.
2928  *
2929  * Returns:
2930  * Zero on success, errno on failure.
2931  */
2932 int drm_mode_addfb(struct drm_device *dev,
2933 		   void *data, struct drm_file *file_priv)
2934 {
2935 	struct drm_mode_fb_cmd *or = data;
2936 	struct drm_mode_fb_cmd2 r = {};
2937 	struct drm_mode_config *config = &dev->mode_config;
2938 	struct drm_framebuffer *fb;
2939 	int ret = 0;
2940 
2941 	/* Use new struct with format internally */
2942 	r.fb_id = or->fb_id;
2943 	r.width = or->width;
2944 	r.height = or->height;
2945 	r.pitches[0] = or->pitch;
2946 	r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
2947 	r.handles[0] = or->handle;
2948 
2949 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
2950 		return -EINVAL;
2951 
2952 	if ((config->min_width > r.width) || (r.width > config->max_width))
2953 		return -EINVAL;
2954 
2955 	if ((config->min_height > r.height) || (r.height > config->max_height))
2956 		return -EINVAL;
2957 
2958 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, &r);
2959 	if (IS_ERR(fb)) {
2960 		DRM_DEBUG_KMS("could not create framebuffer\n");
2961 		return PTR_ERR(fb);
2962 	}
2963 
2964 	mutex_lock(&file_priv->fbs_lock);
2965 	or->fb_id = fb->base.id;
2966 	list_add(&fb->filp_head, &file_priv->fbs);
2967 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
2968 	mutex_unlock(&file_priv->fbs_lock);
2969 
2970 	return ret;
2971 }
2972 
2973 static int format_check(const struct drm_mode_fb_cmd2 *r)
2974 {
2975 	uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN;
2976 
2977 	switch (format) {
2978 	case DRM_FORMAT_C8:
2979 	case DRM_FORMAT_RGB332:
2980 	case DRM_FORMAT_BGR233:
2981 	case DRM_FORMAT_XRGB4444:
2982 	case DRM_FORMAT_XBGR4444:
2983 	case DRM_FORMAT_RGBX4444:
2984 	case DRM_FORMAT_BGRX4444:
2985 	case DRM_FORMAT_ARGB4444:
2986 	case DRM_FORMAT_ABGR4444:
2987 	case DRM_FORMAT_RGBA4444:
2988 	case DRM_FORMAT_BGRA4444:
2989 	case DRM_FORMAT_XRGB1555:
2990 	case DRM_FORMAT_XBGR1555:
2991 	case DRM_FORMAT_RGBX5551:
2992 	case DRM_FORMAT_BGRX5551:
2993 	case DRM_FORMAT_ARGB1555:
2994 	case DRM_FORMAT_ABGR1555:
2995 	case DRM_FORMAT_RGBA5551:
2996 	case DRM_FORMAT_BGRA5551:
2997 	case DRM_FORMAT_RGB565:
2998 	case DRM_FORMAT_BGR565:
2999 	case DRM_FORMAT_RGB888:
3000 	case DRM_FORMAT_BGR888:
3001 	case DRM_FORMAT_XRGB8888:
3002 	case DRM_FORMAT_XBGR8888:
3003 	case DRM_FORMAT_RGBX8888:
3004 	case DRM_FORMAT_BGRX8888:
3005 	case DRM_FORMAT_ARGB8888:
3006 	case DRM_FORMAT_ABGR8888:
3007 	case DRM_FORMAT_RGBA8888:
3008 	case DRM_FORMAT_BGRA8888:
3009 	case DRM_FORMAT_XRGB2101010:
3010 	case DRM_FORMAT_XBGR2101010:
3011 	case DRM_FORMAT_RGBX1010102:
3012 	case DRM_FORMAT_BGRX1010102:
3013 	case DRM_FORMAT_ARGB2101010:
3014 	case DRM_FORMAT_ABGR2101010:
3015 	case DRM_FORMAT_RGBA1010102:
3016 	case DRM_FORMAT_BGRA1010102:
3017 	case DRM_FORMAT_YUYV:
3018 	case DRM_FORMAT_YVYU:
3019 	case DRM_FORMAT_UYVY:
3020 	case DRM_FORMAT_VYUY:
3021 	case DRM_FORMAT_AYUV:
3022 	case DRM_FORMAT_NV12:
3023 	case DRM_FORMAT_NV21:
3024 	case DRM_FORMAT_NV16:
3025 	case DRM_FORMAT_NV61:
3026 	case DRM_FORMAT_NV24:
3027 	case DRM_FORMAT_NV42:
3028 	case DRM_FORMAT_YUV410:
3029 	case DRM_FORMAT_YVU410:
3030 	case DRM_FORMAT_YUV411:
3031 	case DRM_FORMAT_YVU411:
3032 	case DRM_FORMAT_YUV420:
3033 	case DRM_FORMAT_YVU420:
3034 	case DRM_FORMAT_YUV422:
3035 	case DRM_FORMAT_YVU422:
3036 	case DRM_FORMAT_YUV444:
3037 	case DRM_FORMAT_YVU444:
3038 		return 0;
3039 	default:
3040 		DRM_DEBUG_KMS("invalid pixel format %s\n",
3041 			      drm_get_format_name(r->pixel_format));
3042 		return -EINVAL;
3043 	}
3044 }
3045 
3046 static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
3047 {
3048 	int ret, hsub, vsub, num_planes, i;
3049 
3050 	ret = format_check(r);
3051 	if (ret) {
3052 		DRM_DEBUG_KMS("bad framebuffer format %s\n",
3053 			      drm_get_format_name(r->pixel_format));
3054 		return ret;
3055 	}
3056 
3057 	hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
3058 	vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
3059 	num_planes = drm_format_num_planes(r->pixel_format);
3060 
3061 	if (r->width == 0 || r->width % hsub) {
3062 		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->height);
3063 		return -EINVAL;
3064 	}
3065 
3066 	if (r->height == 0 || r->height % vsub) {
3067 		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
3068 		return -EINVAL;
3069 	}
3070 
3071 	for (i = 0; i < num_planes; i++) {
3072 		unsigned int width = r->width / (i != 0 ? hsub : 1);
3073 		unsigned int height = r->height / (i != 0 ? vsub : 1);
3074 		unsigned int cpp = drm_format_plane_cpp(r->pixel_format, i);
3075 
3076 		if (!r->handles[i]) {
3077 			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
3078 			return -EINVAL;
3079 		}
3080 
3081 		if ((uint64_t) width * cpp > UINT_MAX)
3082 			return -ERANGE;
3083 
3084 		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
3085 			return -ERANGE;
3086 
3087 		if (r->pitches[i] < width * cpp) {
3088 			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
3089 			return -EINVAL;
3090 		}
3091 	}
3092 
3093 	return 0;
3094 }
3095 
3096 static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
3097 							struct drm_mode_fb_cmd2 *r,
3098 							struct drm_file *file_priv)
3099 {
3100 	struct drm_mode_config *config = &dev->mode_config;
3101 	struct drm_framebuffer *fb;
3102 	int ret;
3103 
3104 	if (r->flags & ~DRM_MODE_FB_INTERLACED) {
3105 		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
3106 		return ERR_PTR(-EINVAL);
3107 	}
3108 
3109 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
3110 		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
3111 			  r->width, config->min_width, config->max_width);
3112 		return ERR_PTR(-EINVAL);
3113 	}
3114 	if ((config->min_height > r->height) || (r->height > config->max_height)) {
3115 		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
3116 			  r->height, config->min_height, config->max_height);
3117 		return ERR_PTR(-EINVAL);
3118 	}
3119 
3120 	ret = framebuffer_check(r);
3121 	if (ret)
3122 		return ERR_PTR(ret);
3123 
3124 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
3125 	if (IS_ERR(fb)) {
3126 		DRM_DEBUG_KMS("could not create framebuffer\n");
3127 		return fb;
3128 	}
3129 
3130 	mutex_lock(&file_priv->fbs_lock);
3131 	r->fb_id = fb->base.id;
3132 	list_add(&fb->filp_head, &file_priv->fbs);
3133 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
3134 	mutex_unlock(&file_priv->fbs_lock);
3135 
3136 	return fb;
3137 }
3138 
3139 /**
3140  * drm_mode_addfb2 - add an FB to the graphics configuration
3141  * @dev: drm device for the ioctl
3142  * @data: data pointer for the ioctl
3143  * @file_priv: drm file for the ioctl call
3144  *
3145  * Add a new FB to the specified CRTC, given a user request with format. This is
3146  * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
3147  * and uses fourcc codes as pixel format specifiers.
3148  *
3149  * Called by the user via ioctl.
3150  *
3151  * Returns:
3152  * Zero on success, errno on failure.
3153  */
3154 int drm_mode_addfb2(struct drm_device *dev,
3155 		    void *data, struct drm_file *file_priv)
3156 {
3157 	struct drm_framebuffer *fb;
3158 
3159 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3160 		return -EINVAL;
3161 
3162 	fb = add_framebuffer_internal(dev, data, file_priv);
3163 	if (IS_ERR(fb))
3164 		return PTR_ERR(fb);
3165 
3166 	return 0;
3167 }
3168 
3169 /**
3170  * drm_mode_rmfb - remove an FB from the configuration
3171  * @dev: drm device for the ioctl
3172  * @data: data pointer for the ioctl
3173  * @file_priv: drm file for the ioctl call
3174  *
3175  * Remove the FB specified by the user.
3176  *
3177  * Called by the user via ioctl.
3178  *
3179  * Returns:
3180  * Zero on success, errno on failure.
3181  */
3182 int drm_mode_rmfb(struct drm_device *dev,
3183 		   void *data, struct drm_file *file_priv)
3184 {
3185 	struct drm_framebuffer *fb = NULL;
3186 	struct drm_framebuffer *fbl = NULL;
3187 	uint32_t *id = data;
3188 	int found = 0;
3189 
3190 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3191 		return -EINVAL;
3192 
3193 	mutex_lock(&file_priv->fbs_lock);
3194 	mutex_lock(&dev->mode_config.fb_lock);
3195 	fb = __drm_framebuffer_lookup(dev, *id);
3196 	if (!fb)
3197 		goto fail_lookup;
3198 
3199 	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
3200 		if (fb == fbl)
3201 			found = 1;
3202 	if (!found)
3203 		goto fail_lookup;
3204 
3205 	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3206 	__drm_framebuffer_unregister(dev, fb);
3207 
3208 	list_del_init(&fb->filp_head);
3209 	mutex_unlock(&dev->mode_config.fb_lock);
3210 	mutex_unlock(&file_priv->fbs_lock);
3211 
3212 	drm_framebuffer_remove(fb);
3213 
3214 	return 0;
3215 
3216 fail_lookup:
3217 	mutex_unlock(&dev->mode_config.fb_lock);
3218 	mutex_unlock(&file_priv->fbs_lock);
3219 
3220 	return -ENOENT;
3221 }
3222 
3223 /**
3224  * drm_mode_getfb - get FB info
3225  * @dev: drm device for the ioctl
3226  * @data: data pointer for the ioctl
3227  * @file_priv: drm file for the ioctl call
3228  *
3229  * Lookup the FB given its ID and return info about it.
3230  *
3231  * Called by the user via ioctl.
3232  *
3233  * Returns:
3234  * Zero on success, errno on failure.
3235  */
3236 int drm_mode_getfb(struct drm_device *dev,
3237 		   void *data, struct drm_file *file_priv)
3238 {
3239 	struct drm_mode_fb_cmd *r = data;
3240 	struct drm_framebuffer *fb;
3241 	int ret;
3242 
3243 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3244 		return -EINVAL;
3245 
3246 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3247 	if (!fb)
3248 		return -ENOENT;
3249 
3250 	r->height = fb->height;
3251 	r->width = fb->width;
3252 	r->depth = fb->depth;
3253 	r->bpp = fb->bits_per_pixel;
3254 	r->pitch = fb->pitches[0];
3255 	if (fb->funcs->create_handle) {
3256 		ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
3257 	} else {
3258 		ret = -ENODEV;
3259 	}
3260 
3261 	drm_framebuffer_unreference(fb);
3262 
3263 	return ret;
3264 }
3265 
3266 /**
3267  * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
3268  * @dev: drm device for the ioctl
3269  * @data: data pointer for the ioctl
3270  * @file_priv: drm file for the ioctl call
3271  *
3272  * Lookup the FB and flush out the damaged area supplied by userspace as a clip
3273  * rectangle list. Generic userspace which does frontbuffer rendering must call
3274  * this ioctl to flush out the changes on manual-update display outputs, e.g.
3275  * usb display-link, mipi manual update panels or edp panel self refresh modes.
3276  *
3277  * Modesetting drivers which always update the frontbuffer do not need to
3278  * implement the corresponding ->dirty framebuffer callback.
3279  *
3280  * Called by the user via ioctl.
3281  *
3282  * Returns:
3283  * Zero on success, errno on failure.
3284  */
3285 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
3286 			   void *data, struct drm_file *file_priv)
3287 {
3288 	struct drm_clip_rect __user *clips_ptr;
3289 	struct drm_clip_rect *clips = NULL;
3290 	struct drm_mode_fb_dirty_cmd *r = data;
3291 	struct drm_framebuffer *fb;
3292 	unsigned flags;
3293 	int num_clips;
3294 	int ret;
3295 
3296 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3297 		return -EINVAL;
3298 
3299 	fb = drm_framebuffer_lookup(dev, r->fb_id);
3300 	if (!fb)
3301 		return -ENOENT;
3302 
3303 	num_clips = r->num_clips;
3304 	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
3305 
3306 	if (!num_clips != !clips_ptr) {
3307 		ret = -EINVAL;
3308 		goto out_err1;
3309 	}
3310 
3311 	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
3312 
3313 	/* If userspace annotates copy, clips must come in pairs */
3314 	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
3315 		ret = -EINVAL;
3316 		goto out_err1;
3317 	}
3318 
3319 	if (num_clips && clips_ptr) {
3320 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
3321 			ret = -EINVAL;
3322 			goto out_err1;
3323 		}
3324 		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
3325 		if (!clips) {
3326 			ret = -ENOMEM;
3327 			goto out_err1;
3328 		}
3329 
3330 		ret = copy_from_user(clips, clips_ptr,
3331 				     num_clips * sizeof(*clips));
3332 		if (ret) {
3333 			ret = -EFAULT;
3334 			goto out_err2;
3335 		}
3336 	}
3337 
3338 	if (fb->funcs->dirty) {
3339 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
3340 				       clips, num_clips);
3341 	} else {
3342 		ret = -ENOSYS;
3343 	}
3344 
3345 out_err2:
3346 	kfree(clips);
3347 out_err1:
3348 	drm_framebuffer_unreference(fb);
3349 
3350 	return ret;
3351 }
3352 
3353 
3354 /**
3355  * drm_fb_release - remove and free the FBs on this file
3356  * @priv: drm file for the ioctl
3357  *
3358  * Destroy all the FBs associated with @filp.
3359  *
3360  * Called by the user via ioctl.
3361  *
3362  * Returns:
3363  * Zero on success, errno on failure.
3364  */
3365 void drm_fb_release(struct drm_file *priv)
3366 {
3367 	struct drm_device *dev = priv->dev;
3368 	struct drm_framebuffer *fb, *tfb;
3369 
3370 	/*
3371 	 * When the file gets released that means no one else can access the fb
3372 	 * list any more, so no need to grab fpriv->fbs_lock. And we need to to
3373 	 * avoid upsetting lockdep since the universal cursor code adds a
3374 	 * framebuffer while holding mutex locks.
3375 	 *
3376 	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
3377 	 * locks is impossible here since no one else but this function can get
3378 	 * at it any more.
3379 	 */
3380 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
3381 
3382 		mutex_lock(&dev->mode_config.fb_lock);
3383 		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
3384 		__drm_framebuffer_unregister(dev, fb);
3385 		mutex_unlock(&dev->mode_config.fb_lock);
3386 
3387 		list_del_init(&fb->filp_head);
3388 
3389 		/* This will also drop the fpriv->fbs reference. */
3390 		drm_framebuffer_remove(fb);
3391 	}
3392 }
3393 
3394 /**
3395  * drm_property_create - create a new property type
3396  * @dev: drm device
3397  * @flags: flags specifying the property type
3398  * @name: name of the property
3399  * @num_values: number of pre-defined values
3400  *
3401  * This creates a new generic drm property which can then be attached to a drm
3402  * object with drm_object_attach_property. The returned property object must be
3403  * freed with drm_property_destroy.
3404  *
3405  * Returns:
3406  * A pointer to the newly created property on success, NULL on failure.
3407  */
3408 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
3409 					 const char *name, int num_values)
3410 {
3411 	struct drm_property *property = NULL;
3412 	int ret;
3413 
3414 	property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
3415 	if (!property)
3416 		return NULL;
3417 
3418 	property->dev = dev;
3419 
3420 	if (num_values) {
3421 		property->values = kzalloc(sizeof(uint64_t)*num_values, GFP_KERNEL);
3422 		if (!property->values)
3423 			goto fail;
3424 	}
3425 
3426 	ret = drm_mode_object_get(dev, &property->base, DRM_MODE_OBJECT_PROPERTY);
3427 	if (ret)
3428 		goto fail;
3429 
3430 	property->flags = flags;
3431 	property->num_values = num_values;
3432 	INIT_LIST_HEAD(&property->enum_blob_list);
3433 
3434 	if (name) {
3435 		strncpy(property->name, name, DRM_PROP_NAME_LEN);
3436 		property->name[DRM_PROP_NAME_LEN-1] = '\0';
3437 	}
3438 
3439 	list_add_tail(&property->head, &dev->mode_config.property_list);
3440 
3441 	WARN_ON(!drm_property_type_valid(property));
3442 
3443 	return property;
3444 fail:
3445 	kfree(property->values);
3446 	kfree(property);
3447 	return NULL;
3448 }
3449 EXPORT_SYMBOL(drm_property_create);
3450 
3451 /**
3452  * drm_property_create_enum - create a new enumeration property type
3453  * @dev: drm device
3454  * @flags: flags specifying the property type
3455  * @name: name of the property
3456  * @props: enumeration lists with property values
3457  * @num_values: number of pre-defined values
3458  *
3459  * This creates a new generic drm property which can then be attached to a drm
3460  * object with drm_object_attach_property. The returned property object must be
3461  * freed with drm_property_destroy.
3462  *
3463  * Userspace is only allowed to set one of the predefined values for enumeration
3464  * properties.
3465  *
3466  * Returns:
3467  * A pointer to the newly created property on success, NULL on failure.
3468  */
3469 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
3470 					 const char *name,
3471 					 const struct drm_prop_enum_list *props,
3472 					 int num_values)
3473 {
3474 	struct drm_property *property;
3475 	int i, ret;
3476 
3477 	flags |= DRM_MODE_PROP_ENUM;
3478 
3479 	property = drm_property_create(dev, flags, name, num_values);
3480 	if (!property)
3481 		return NULL;
3482 
3483 	for (i = 0; i < num_values; i++) {
3484 		ret = drm_property_add_enum(property, i,
3485 				      props[i].type,
3486 				      props[i].name);
3487 		if (ret) {
3488 			drm_property_destroy(dev, property);
3489 			return NULL;
3490 		}
3491 	}
3492 
3493 	return property;
3494 }
3495 EXPORT_SYMBOL(drm_property_create_enum);
3496 
3497 /**
3498  * drm_property_create_bitmask - create a new bitmask property type
3499  * @dev: drm device
3500  * @flags: flags specifying the property type
3501  * @name: name of the property
3502  * @props: enumeration lists with property bitflags
3503  * @num_props: size of the @props array
3504  * @supported_bits: bitmask of all supported enumeration values
3505  *
3506  * This creates a new bitmask drm property which can then be attached to a drm
3507  * object with drm_object_attach_property. The returned property object must be
3508  * freed with drm_property_destroy.
3509  *
3510  * Compared to plain enumeration properties userspace is allowed to set any
3511  * or'ed together combination of the predefined property bitflag values
3512  *
3513  * Returns:
3514  * A pointer to the newly created property on success, NULL on failure.
3515  */
3516 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
3517 					 int flags, const char *name,
3518 					 const struct drm_prop_enum_list *props,
3519 					 int num_props,
3520 					 uint64_t supported_bits)
3521 {
3522 	struct drm_property *property;
3523 	int i, ret, index = 0;
3524 	int num_values = hweight64(supported_bits);
3525 
3526 	flags |= DRM_MODE_PROP_BITMASK;
3527 
3528 	property = drm_property_create(dev, flags, name, num_values);
3529 	if (!property)
3530 		return NULL;
3531 	for (i = 0; i < num_props; i++) {
3532 		if (!(supported_bits & (1ULL << props[i].type)))
3533 			continue;
3534 
3535 		if (WARN_ON(index >= num_values)) {
3536 			drm_property_destroy(dev, property);
3537 			return NULL;
3538 		}
3539 
3540 		ret = drm_property_add_enum(property, index++,
3541 				      props[i].type,
3542 				      props[i].name);
3543 		if (ret) {
3544 			drm_property_destroy(dev, property);
3545 			return NULL;
3546 		}
3547 	}
3548 
3549 	return property;
3550 }
3551 EXPORT_SYMBOL(drm_property_create_bitmask);
3552 
3553 static struct drm_property *property_create_range(struct drm_device *dev,
3554 					 int flags, const char *name,
3555 					 uint64_t min, uint64_t max)
3556 {
3557 	struct drm_property *property;
3558 
3559 	property = drm_property_create(dev, flags, name, 2);
3560 	if (!property)
3561 		return NULL;
3562 
3563 	property->values[0] = min;
3564 	property->values[1] = max;
3565 
3566 	return property;
3567 }
3568 
3569 /**
3570  * drm_property_create_range - create a new ranged property type
3571  * @dev: drm device
3572  * @flags: flags specifying the property type
3573  * @name: name of the property
3574  * @min: minimum value of the property
3575  * @max: maximum value of the property
3576  *
3577  * This creates a new generic drm property which can then be attached to a drm
3578  * object with drm_object_attach_property. The returned property object must be
3579  * freed with drm_property_destroy.
3580  *
3581  * Userspace is allowed to set any interger value in the (min, max) range
3582  * inclusive.
3583  *
3584  * Returns:
3585  * A pointer to the newly created property on success, NULL on failure.
3586  */
3587 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
3588 					 const char *name,
3589 					 uint64_t min, uint64_t max)
3590 {
3591 	return property_create_range(dev, DRM_MODE_PROP_RANGE | flags,
3592 			name, min, max);
3593 }
3594 EXPORT_SYMBOL(drm_property_create_range);
3595 
3596 struct drm_property *drm_property_create_signed_range(struct drm_device *dev,
3597 					 int flags, const char *name,
3598 					 int64_t min, int64_t max)
3599 {
3600 	return property_create_range(dev, DRM_MODE_PROP_SIGNED_RANGE | flags,
3601 			name, I642U64(min), I642U64(max));
3602 }
3603 EXPORT_SYMBOL(drm_property_create_signed_range);
3604 
3605 struct drm_property *drm_property_create_object(struct drm_device *dev,
3606 					 int flags, const char *name, uint32_t type)
3607 {
3608 	struct drm_property *property;
3609 
3610 	flags |= DRM_MODE_PROP_OBJECT;
3611 
3612 	property = drm_property_create(dev, flags, name, 1);
3613 	if (!property)
3614 		return NULL;
3615 
3616 	property->values[0] = type;
3617 
3618 	return property;
3619 }
3620 EXPORT_SYMBOL(drm_property_create_object);
3621 
3622 /**
3623  * drm_property_add_enum - add a possible value to an enumeration property
3624  * @property: enumeration property to change
3625  * @index: index of the new enumeration
3626  * @value: value of the new enumeration
3627  * @name: symbolic name of the new enumeration
3628  *
3629  * This functions adds enumerations to a property.
3630  *
3631  * It's use is deprecated, drivers should use one of the more specific helpers
3632  * to directly create the property with all enumerations already attached.
3633  *
3634  * Returns:
3635  * Zero on success, error code on failure.
3636  */
3637 int drm_property_add_enum(struct drm_property *property, int index,
3638 			  uint64_t value, const char *name)
3639 {
3640 	struct drm_property_enum *prop_enum;
3641 
3642 	if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3643 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
3644 		return -EINVAL;
3645 
3646 	/*
3647 	 * Bitmask enum properties have the additional constraint of values
3648 	 * from 0 to 63
3649 	 */
3650 	if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK) &&
3651 			(value > 63))
3652 		return -EINVAL;
3653 
3654 	if (!list_empty(&property->enum_blob_list)) {
3655 		list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
3656 			if (prop_enum->value == value) {
3657 				strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3658 				prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3659 				return 0;
3660 			}
3661 		}
3662 	}
3663 
3664 	prop_enum = kzalloc(sizeof(struct drm_property_enum), GFP_KERNEL);
3665 	if (!prop_enum)
3666 		return -ENOMEM;
3667 
3668 	strncpy(prop_enum->name, name, DRM_PROP_NAME_LEN);
3669 	prop_enum->name[DRM_PROP_NAME_LEN-1] = '\0';
3670 	prop_enum->value = value;
3671 
3672 	property->values[index] = value;
3673 	list_add_tail(&prop_enum->head, &property->enum_blob_list);
3674 	return 0;
3675 }
3676 EXPORT_SYMBOL(drm_property_add_enum);
3677 
3678 /**
3679  * drm_property_destroy - destroy a drm property
3680  * @dev: drm device
3681  * @property: property to destry
3682  *
3683  * This function frees a property including any attached resources like
3684  * enumeration values.
3685  */
3686 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
3687 {
3688 	struct drm_property_enum *prop_enum, *pt;
3689 
3690 	list_for_each_entry_safe(prop_enum, pt, &property->enum_blob_list, head) {
3691 		list_del(&prop_enum->head);
3692 		kfree(prop_enum);
3693 	}
3694 
3695 	if (property->num_values)
3696 		kfree(property->values);
3697 	drm_mode_object_put(dev, &property->base);
3698 	list_del(&property->head);
3699 	kfree(property);
3700 }
3701 EXPORT_SYMBOL(drm_property_destroy);
3702 
3703 /**
3704  * drm_object_attach_property - attach a property to a modeset object
3705  * @obj: drm modeset object
3706  * @property: property to attach
3707  * @init_val: initial value of the property
3708  *
3709  * This attaches the given property to the modeset object with the given initial
3710  * value. Currently this function cannot fail since the properties are stored in
3711  * a statically sized array.
3712  */
3713 void drm_object_attach_property(struct drm_mode_object *obj,
3714 				struct drm_property *property,
3715 				uint64_t init_val)
3716 {
3717 	int count = obj->properties->count;
3718 
3719 	if (count == DRM_OBJECT_MAX_PROPERTY) {
3720 		WARN(1, "Failed to attach object property (type: 0x%x). Please "
3721 			"increase DRM_OBJECT_MAX_PROPERTY by 1 for each time "
3722 			"you see this message on the same object type.\n",
3723 			obj->type);
3724 		return;
3725 	}
3726 
3727 	obj->properties->ids[count] = property->base.id;
3728 	obj->properties->values[count] = init_val;
3729 	obj->properties->count++;
3730 }
3731 EXPORT_SYMBOL(drm_object_attach_property);
3732 
3733 /**
3734  * drm_object_property_set_value - set the value of a property
3735  * @obj: drm mode object to set property value for
3736  * @property: property to set
3737  * @val: value the property should be set to
3738  *
3739  * This functions sets a given property on a given object. This function only
3740  * changes the software state of the property, it does not call into the
3741  * driver's ->set_property callback.
3742  *
3743  * Returns:
3744  * Zero on success, error code on failure.
3745  */
3746 int drm_object_property_set_value(struct drm_mode_object *obj,
3747 				  struct drm_property *property, uint64_t val)
3748 {
3749 	int i;
3750 
3751 	for (i = 0; i < obj->properties->count; i++) {
3752 		if (obj->properties->ids[i] == property->base.id) {
3753 			obj->properties->values[i] = val;
3754 			return 0;
3755 		}
3756 	}
3757 
3758 	return -EINVAL;
3759 }
3760 EXPORT_SYMBOL(drm_object_property_set_value);
3761 
3762 /**
3763  * drm_object_property_get_value - retrieve the value of a property
3764  * @obj: drm mode object to get property value from
3765  * @property: property to retrieve
3766  * @val: storage for the property value
3767  *
3768  * This function retrieves the softare state of the given property for the given
3769  * property. Since there is no driver callback to retrieve the current property
3770  * value this might be out of sync with the hardware, depending upon the driver
3771  * and property.
3772  *
3773  * Returns:
3774  * Zero on success, error code on failure.
3775  */
3776 int drm_object_property_get_value(struct drm_mode_object *obj,
3777 				  struct drm_property *property, uint64_t *val)
3778 {
3779 	int i;
3780 
3781 	for (i = 0; i < obj->properties->count; i++) {
3782 		if (obj->properties->ids[i] == property->base.id) {
3783 			*val = obj->properties->values[i];
3784 			return 0;
3785 		}
3786 	}
3787 
3788 	return -EINVAL;
3789 }
3790 EXPORT_SYMBOL(drm_object_property_get_value);
3791 
3792 /**
3793  * drm_mode_getproperty_ioctl - get the current value of a connector's property
3794  * @dev: DRM device
3795  * @data: ioctl data
3796  * @file_priv: DRM file info
3797  *
3798  * This function retrieves the current value for an connectors's property.
3799  *
3800  * Called by the user via ioctl.
3801  *
3802  * Returns:
3803  * Zero on success, errno on failure.
3804  */
3805 int drm_mode_getproperty_ioctl(struct drm_device *dev,
3806 			       void *data, struct drm_file *file_priv)
3807 {
3808 	struct drm_mode_get_property *out_resp = data;
3809 	struct drm_property *property;
3810 	int enum_count = 0;
3811 	int blob_count = 0;
3812 	int value_count = 0;
3813 	int ret = 0, i;
3814 	int copied;
3815 	struct drm_property_enum *prop_enum;
3816 	struct drm_mode_property_enum __user *enum_ptr;
3817 	struct drm_property_blob *prop_blob;
3818 	uint32_t __user *blob_id_ptr;
3819 	uint64_t __user *values_ptr;
3820 	uint32_t __user *blob_length_ptr;
3821 
3822 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3823 		return -EINVAL;
3824 
3825 	drm_modeset_lock_all(dev);
3826 	property = drm_property_find(dev, out_resp->prop_id);
3827 	if (!property) {
3828 		ret = -ENOENT;
3829 		goto done;
3830 	}
3831 
3832 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3833 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3834 		list_for_each_entry(prop_enum, &property->enum_blob_list, head)
3835 			enum_count++;
3836 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
3837 		list_for_each_entry(prop_blob, &property->enum_blob_list, head)
3838 			blob_count++;
3839 	}
3840 
3841 	value_count = property->num_values;
3842 
3843 	strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
3844 	out_resp->name[DRM_PROP_NAME_LEN-1] = 0;
3845 	out_resp->flags = property->flags;
3846 
3847 	if ((out_resp->count_values >= value_count) && value_count) {
3848 		values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
3849 		for (i = 0; i < value_count; i++) {
3850 			if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
3851 				ret = -EFAULT;
3852 				goto done;
3853 			}
3854 		}
3855 	}
3856 	out_resp->count_values = value_count;
3857 
3858 	if (drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
3859 			drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
3860 		if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
3861 			copied = 0;
3862 			enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
3863 			list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
3864 
3865 				if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
3866 					ret = -EFAULT;
3867 					goto done;
3868 				}
3869 
3870 				if (copy_to_user(&enum_ptr[copied].name,
3871 						 &prop_enum->name, DRM_PROP_NAME_LEN)) {
3872 					ret = -EFAULT;
3873 					goto done;
3874 				}
3875 				copied++;
3876 			}
3877 		}
3878 		out_resp->count_enum_blobs = enum_count;
3879 	}
3880 
3881 	if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
3882 		if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
3883 			copied = 0;
3884 			blob_id_ptr = (uint32_t __user *)(unsigned long)out_resp->enum_blob_ptr;
3885 			blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
3886 
3887 			list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
3888 				if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
3889 					ret = -EFAULT;
3890 					goto done;
3891 				}
3892 
3893 				if (put_user(prop_blob->length, blob_length_ptr + copied)) {
3894 					ret = -EFAULT;
3895 					goto done;
3896 				}
3897 
3898 				copied++;
3899 			}
3900 		}
3901 		out_resp->count_enum_blobs = blob_count;
3902 	}
3903 done:
3904 	drm_modeset_unlock_all(dev);
3905 	return ret;
3906 }
3907 
3908 static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev, int length,
3909 							  void *data)
3910 {
3911 	struct drm_property_blob *blob;
3912 	int ret;
3913 
3914 	if (!length || !data)
3915 		return NULL;
3916 
3917 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
3918 	if (!blob)
3919 		return NULL;
3920 
3921 	ret = drm_mode_object_get(dev, &blob->base, DRM_MODE_OBJECT_BLOB);
3922 	if (ret) {
3923 		kfree(blob);
3924 		return NULL;
3925 	}
3926 
3927 	blob->length = length;
3928 
3929 	memcpy(blob->data, data, length);
3930 
3931 	list_add_tail(&blob->head, &dev->mode_config.property_blob_list);
3932 	return blob;
3933 }
3934 
3935 static void drm_property_destroy_blob(struct drm_device *dev,
3936 			       struct drm_property_blob *blob)
3937 {
3938 	drm_mode_object_put(dev, &blob->base);
3939 	list_del(&blob->head);
3940 	kfree(blob);
3941 }
3942 
3943 /**
3944  * drm_mode_getblob_ioctl - get the contents of a blob property value
3945  * @dev: DRM device
3946  * @data: ioctl data
3947  * @file_priv: DRM file info
3948  *
3949  * This function retrieves the contents of a blob property. The value stored in
3950  * an object's blob property is just a normal modeset object id.
3951  *
3952  * Called by the user via ioctl.
3953  *
3954  * Returns:
3955  * Zero on success, errno on failure.
3956  */
3957 int drm_mode_getblob_ioctl(struct drm_device *dev,
3958 			   void *data, struct drm_file *file_priv)
3959 {
3960 	struct drm_mode_get_blob *out_resp = data;
3961 	struct drm_property_blob *blob;
3962 	int ret = 0;
3963 	void __user *blob_ptr;
3964 
3965 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
3966 		return -EINVAL;
3967 
3968 	drm_modeset_lock_all(dev);
3969 	blob = drm_property_blob_find(dev, out_resp->blob_id);
3970 	if (!blob) {
3971 		ret = -ENOENT;
3972 		goto done;
3973 	}
3974 
3975 	if (out_resp->length == blob->length) {
3976 		blob_ptr = (void __user *)(unsigned long)out_resp->data;
3977 		if (copy_to_user(blob_ptr, blob->data, blob->length)){
3978 			ret = -EFAULT;
3979 			goto done;
3980 		}
3981 	}
3982 	out_resp->length = blob->length;
3983 
3984 done:
3985 	drm_modeset_unlock_all(dev);
3986 	return ret;
3987 }
3988 
3989 int drm_mode_connector_set_path_property(struct drm_connector *connector,
3990 					 char *path)
3991 {
3992 	struct drm_device *dev = connector->dev;
3993 	int ret, size;
3994 	size = strlen(path) + 1;
3995 
3996 	connector->path_blob_ptr = drm_property_create_blob(connector->dev,
3997 							    size, path);
3998 	if (!connector->path_blob_ptr)
3999 		return -EINVAL;
4000 
4001 	ret = drm_object_property_set_value(&connector->base,
4002 					    dev->mode_config.path_property,
4003 					    connector->path_blob_ptr->base.id);
4004 	return ret;
4005 }
4006 EXPORT_SYMBOL(drm_mode_connector_set_path_property);
4007 
4008 /**
4009  * drm_mode_connector_update_edid_property - update the edid property of a connector
4010  * @connector: drm connector
4011  * @edid: new value of the edid property
4012  *
4013  * This function creates a new blob modeset object and assigns its id to the
4014  * connector's edid property.
4015  *
4016  * Returns:
4017  * Zero on success, errno on failure.
4018  */
4019 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
4020 					    struct edid *edid)
4021 {
4022 	struct drm_device *dev = connector->dev;
4023 	int ret, size;
4024 
4025 	/* ignore requests to set edid when overridden */
4026 	if (connector->override_edid)
4027 		return 0;
4028 
4029 	if (connector->edid_blob_ptr)
4030 		drm_property_destroy_blob(dev, connector->edid_blob_ptr);
4031 
4032 	/* Delete edid, when there is none. */
4033 	if (!edid) {
4034 		connector->edid_blob_ptr = NULL;
4035 		ret = drm_object_property_set_value(&connector->base, dev->mode_config.edid_property, 0);
4036 		return ret;
4037 	}
4038 
4039 	size = EDID_LENGTH * (1 + edid->extensions);
4040 	connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
4041 							    size, edid);
4042 	if (!connector->edid_blob_ptr)
4043 		return -EINVAL;
4044 
4045 	ret = drm_object_property_set_value(&connector->base,
4046 					       dev->mode_config.edid_property,
4047 					       connector->edid_blob_ptr->base.id);
4048 
4049 	return ret;
4050 }
4051 EXPORT_SYMBOL(drm_mode_connector_update_edid_property);
4052 
4053 static bool drm_property_change_is_valid(struct drm_property *property,
4054 					 uint64_t value)
4055 {
4056 	if (property->flags & DRM_MODE_PROP_IMMUTABLE)
4057 		return false;
4058 
4059 	if (drm_property_type_is(property, DRM_MODE_PROP_RANGE)) {
4060 		if (value < property->values[0] || value > property->values[1])
4061 			return false;
4062 		return true;
4063 	} else if (drm_property_type_is(property, DRM_MODE_PROP_SIGNED_RANGE)) {
4064 		int64_t svalue = U642I64(value);
4065 		if (svalue < U642I64(property->values[0]) ||
4066 				svalue > U642I64(property->values[1]))
4067 			return false;
4068 		return true;
4069 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
4070 		int i;
4071 		uint64_t valid_mask = 0;
4072 		for (i = 0; i < property->num_values; i++)
4073 			valid_mask |= (1ULL << property->values[i]);
4074 		return !(value & ~valid_mask);
4075 	} else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
4076 		/* Only the driver knows */
4077 		return true;
4078 	} else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
4079 		struct drm_mode_object *obj;
4080 		/* a zero value for an object property translates to null: */
4081 		if (value == 0)
4082 			return true;
4083 		/*
4084 		 * NOTE: use _object_find() directly to bypass restriction on
4085 		 * looking up refcnt'd objects (ie. fb's).  For a refcnt'd
4086 		 * object this could race against object finalization, so it
4087 		 * simply tells us that the object *was* valid.  Which is good
4088 		 * enough.
4089 		 */
4090 		obj = _object_find(property->dev, value, property->values[0]);
4091 		return obj != NULL;
4092 	} else {
4093 		int i;
4094 		for (i = 0; i < property->num_values; i++)
4095 			if (property->values[i] == value)
4096 				return true;
4097 		return false;
4098 	}
4099 }
4100 
4101 /**
4102  * drm_mode_connector_property_set_ioctl - set the current value of a connector property
4103  * @dev: DRM device
4104  * @data: ioctl data
4105  * @file_priv: DRM file info
4106  *
4107  * This function sets the current value for a connectors's property. It also
4108  * calls into a driver's ->set_property callback to update the hardware state
4109  *
4110  * Called by the user via ioctl.
4111  *
4112  * Returns:
4113  * Zero on success, errno on failure.
4114  */
4115 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
4116 				       void *data, struct drm_file *file_priv)
4117 {
4118 	struct drm_mode_connector_set_property *conn_set_prop = data;
4119 	struct drm_mode_obj_set_property obj_set_prop = {
4120 		.value = conn_set_prop->value,
4121 		.prop_id = conn_set_prop->prop_id,
4122 		.obj_id = conn_set_prop->connector_id,
4123 		.obj_type = DRM_MODE_OBJECT_CONNECTOR
4124 	};
4125 
4126 	/* It does all the locking and checking we need */
4127 	return drm_mode_obj_set_property_ioctl(dev, &obj_set_prop, file_priv);
4128 }
4129 
4130 static int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
4131 					   struct drm_property *property,
4132 					   uint64_t value)
4133 {
4134 	int ret = -EINVAL;
4135 	struct drm_connector *connector = obj_to_connector(obj);
4136 
4137 	/* Do DPMS ourselves */
4138 	if (property == connector->dev->mode_config.dpms_property) {
4139 		if (connector->funcs->dpms)
4140 			(*connector->funcs->dpms)(connector, (int)value);
4141 		ret = 0;
4142 	} else if (connector->funcs->set_property)
4143 		ret = connector->funcs->set_property(connector, property, value);
4144 
4145 	/* store the property value if successful */
4146 	if (!ret)
4147 		drm_object_property_set_value(&connector->base, property, value);
4148 	return ret;
4149 }
4150 
4151 static int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
4152 				      struct drm_property *property,
4153 				      uint64_t value)
4154 {
4155 	int ret = -EINVAL;
4156 	struct drm_crtc *crtc = obj_to_crtc(obj);
4157 
4158 	if (crtc->funcs->set_property)
4159 		ret = crtc->funcs->set_property(crtc, property, value);
4160 	if (!ret)
4161 		drm_object_property_set_value(obj, property, value);
4162 
4163 	return ret;
4164 }
4165 
4166 /**
4167  * drm_mode_plane_set_obj_prop - set the value of a property
4168  * @plane: drm plane object to set property value for
4169  * @property: property to set
4170  * @value: value the property should be set to
4171  *
4172  * This functions sets a given property on a given plane object. This function
4173  * calls the driver's ->set_property callback and changes the software state of
4174  * the property if the callback succeeds.
4175  *
4176  * Returns:
4177  * Zero on success, error code on failure.
4178  */
4179 int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
4180 				struct drm_property *property,
4181 				uint64_t value)
4182 {
4183 	int ret = -EINVAL;
4184 	struct drm_mode_object *obj = &plane->base;
4185 
4186 	if (plane->funcs->set_property)
4187 		ret = plane->funcs->set_property(plane, property, value);
4188 	if (!ret)
4189 		drm_object_property_set_value(obj, property, value);
4190 
4191 	return ret;
4192 }
4193 EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
4194 
4195 /**
4196  * drm_mode_getproperty_ioctl - get the current value of a object's property
4197  * @dev: DRM device
4198  * @data: ioctl data
4199  * @file_priv: DRM file info
4200  *
4201  * This function retrieves the current value for an object's property. Compared
4202  * to the connector specific ioctl this one is extended to also work on crtc and
4203  * plane objects.
4204  *
4205  * Called by the user via ioctl.
4206  *
4207  * Returns:
4208  * Zero on success, errno on failure.
4209  */
4210 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
4211 				      struct drm_file *file_priv)
4212 {
4213 	struct drm_mode_obj_get_properties *arg = data;
4214 	struct drm_mode_object *obj;
4215 	int ret = 0;
4216 	int i;
4217 	int copied = 0;
4218 	int props_count = 0;
4219 	uint32_t __user *props_ptr;
4220 	uint64_t __user *prop_values_ptr;
4221 
4222 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4223 		return -EINVAL;
4224 
4225 	drm_modeset_lock_all(dev);
4226 
4227 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4228 	if (!obj) {
4229 		ret = -ENOENT;
4230 		goto out;
4231 	}
4232 	if (!obj->properties) {
4233 		ret = -EINVAL;
4234 		goto out;
4235 	}
4236 
4237 	props_count = obj->properties->count;
4238 
4239 	/* This ioctl is called twice, once to determine how much space is
4240 	 * needed, and the 2nd time to fill it. */
4241 	if ((arg->count_props >= props_count) && props_count) {
4242 		copied = 0;
4243 		props_ptr = (uint32_t __user *)(unsigned long)(arg->props_ptr);
4244 		prop_values_ptr = (uint64_t __user *)(unsigned long)
4245 				  (arg->prop_values_ptr);
4246 		for (i = 0; i < props_count; i++) {
4247 			if (put_user(obj->properties->ids[i],
4248 				     props_ptr + copied)) {
4249 				ret = -EFAULT;
4250 				goto out;
4251 			}
4252 			if (put_user(obj->properties->values[i],
4253 				     prop_values_ptr + copied)) {
4254 				ret = -EFAULT;
4255 				goto out;
4256 			}
4257 			copied++;
4258 		}
4259 	}
4260 	arg->count_props = props_count;
4261 out:
4262 	drm_modeset_unlock_all(dev);
4263 	return ret;
4264 }
4265 
4266 /**
4267  * drm_mode_obj_set_property_ioctl - set the current value of an object's property
4268  * @dev: DRM device
4269  * @data: ioctl data
4270  * @file_priv: DRM file info
4271  *
4272  * This function sets the current value for an object's property. It also calls
4273  * into a driver's ->set_property callback to update the hardware state.
4274  * Compared to the connector specific ioctl this one is extended to also work on
4275  * crtc and plane objects.
4276  *
4277  * Called by the user via ioctl.
4278  *
4279  * Returns:
4280  * Zero on success, errno on failure.
4281  */
4282 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
4283 				    struct drm_file *file_priv)
4284 {
4285 	struct drm_mode_obj_set_property *arg = data;
4286 	struct drm_mode_object *arg_obj;
4287 	struct drm_mode_object *prop_obj;
4288 	struct drm_property *property;
4289 	int ret = -EINVAL;
4290 	int i;
4291 
4292 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4293 		return -EINVAL;
4294 
4295 	drm_modeset_lock_all(dev);
4296 
4297 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
4298 	if (!arg_obj) {
4299 		ret = -ENOENT;
4300 		goto out;
4301 	}
4302 	if (!arg_obj->properties)
4303 		goto out;
4304 
4305 	for (i = 0; i < arg_obj->properties->count; i++)
4306 		if (arg_obj->properties->ids[i] == arg->prop_id)
4307 			break;
4308 
4309 	if (i == arg_obj->properties->count)
4310 		goto out;
4311 
4312 	prop_obj = drm_mode_object_find(dev, arg->prop_id,
4313 					DRM_MODE_OBJECT_PROPERTY);
4314 	if (!prop_obj) {
4315 		ret = -ENOENT;
4316 		goto out;
4317 	}
4318 	property = obj_to_property(prop_obj);
4319 
4320 	if (!drm_property_change_is_valid(property, arg->value))
4321 		goto out;
4322 
4323 	switch (arg_obj->type) {
4324 	case DRM_MODE_OBJECT_CONNECTOR:
4325 		ret = drm_mode_connector_set_obj_prop(arg_obj, property,
4326 						      arg->value);
4327 		break;
4328 	case DRM_MODE_OBJECT_CRTC:
4329 		ret = drm_mode_crtc_set_obj_prop(arg_obj, property, arg->value);
4330 		break;
4331 	case DRM_MODE_OBJECT_PLANE:
4332 		ret = drm_mode_plane_set_obj_prop(obj_to_plane(arg_obj),
4333 						  property, arg->value);
4334 		break;
4335 	}
4336 
4337 out:
4338 	drm_modeset_unlock_all(dev);
4339 	return ret;
4340 }
4341 
4342 /**
4343  * drm_mode_connector_attach_encoder - attach a connector to an encoder
4344  * @connector: connector to attach
4345  * @encoder: encoder to attach @connector to
4346  *
4347  * This function links up a connector to an encoder. Note that the routing
4348  * restrictions between encoders and crtcs are exposed to userspace through the
4349  * possible_clones and possible_crtcs bitmasks.
4350  *
4351  * Returns:
4352  * Zero on success, errno on failure.
4353  */
4354 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
4355 				      struct drm_encoder *encoder)
4356 {
4357 	int i;
4358 
4359 	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
4360 		if (connector->encoder_ids[i] == 0) {
4361 			connector->encoder_ids[i] = encoder->base.id;
4362 			return 0;
4363 		}
4364 	}
4365 	return -ENOMEM;
4366 }
4367 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
4368 
4369 /**
4370  * drm_mode_crtc_set_gamma_size - set the gamma table size
4371  * @crtc: CRTC to set the gamma table size for
4372  * @gamma_size: size of the gamma table
4373  *
4374  * Drivers which support gamma tables should set this to the supported gamma
4375  * table size when initializing the CRTC. Currently the drm core only supports a
4376  * fixed gamma table size.
4377  *
4378  * Returns:
4379  * Zero on success, errno on failure.
4380  */
4381 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
4382 				 int gamma_size)
4383 {
4384 	crtc->gamma_size = gamma_size;
4385 
4386 	crtc->gamma_store = kzalloc(gamma_size * sizeof(uint16_t) * 3, GFP_KERNEL);
4387 	if (!crtc->gamma_store) {
4388 		crtc->gamma_size = 0;
4389 		return -ENOMEM;
4390 	}
4391 
4392 	return 0;
4393 }
4394 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
4395 
4396 /**
4397  * drm_mode_gamma_set_ioctl - set the gamma table
4398  * @dev: DRM device
4399  * @data: ioctl data
4400  * @file_priv: DRM file info
4401  *
4402  * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
4403  * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
4404  *
4405  * Called by the user via ioctl.
4406  *
4407  * Returns:
4408  * Zero on success, errno on failure.
4409  */
4410 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
4411 			     void *data, struct drm_file *file_priv)
4412 {
4413 	struct drm_mode_crtc_lut *crtc_lut = data;
4414 	struct drm_crtc *crtc;
4415 	void *r_base, *g_base, *b_base;
4416 	int size;
4417 	int ret = 0;
4418 
4419 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4420 		return -EINVAL;
4421 
4422 	drm_modeset_lock_all(dev);
4423 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4424 	if (!crtc) {
4425 		ret = -ENOENT;
4426 		goto out;
4427 	}
4428 
4429 	if (crtc->funcs->gamma_set == NULL) {
4430 		ret = -ENOSYS;
4431 		goto out;
4432 	}
4433 
4434 	/* memcpy into gamma store */
4435 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4436 		ret = -EINVAL;
4437 		goto out;
4438 	}
4439 
4440 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4441 	r_base = crtc->gamma_store;
4442 	if (copy_from_user(r_base, (void __user *)(unsigned long)crtc_lut->red, size)) {
4443 		ret = -EFAULT;
4444 		goto out;
4445 	}
4446 
4447 	g_base = (char *)r_base + size;
4448 	if (copy_from_user(g_base, (void __user *)(unsigned long)crtc_lut->green, size)) {
4449 		ret = -EFAULT;
4450 		goto out;
4451 	}
4452 
4453 	b_base = (char *)g_base + size;
4454 	if (copy_from_user(b_base, (void __user *)(unsigned long)crtc_lut->blue, size)) {
4455 		ret = -EFAULT;
4456 		goto out;
4457 	}
4458 
4459 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
4460 
4461 out:
4462 	drm_modeset_unlock_all(dev);
4463 	return ret;
4464 
4465 }
4466 
4467 /**
4468  * drm_mode_gamma_get_ioctl - get the gamma table
4469  * @dev: DRM device
4470  * @data: ioctl data
4471  * @file_priv: DRM file info
4472  *
4473  * Copy the current gamma table into the storage provided. This also provides
4474  * the gamma table size the driver expects, which can be used to size the
4475  * allocated storage.
4476  *
4477  * Called by the user via ioctl.
4478  *
4479  * Returns:
4480  * Zero on success, errno on failure.
4481  */
4482 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
4483 			     void *data, struct drm_file *file_priv)
4484 {
4485 	struct drm_mode_crtc_lut *crtc_lut = data;
4486 	struct drm_crtc *crtc;
4487 	void *r_base, *g_base, *b_base;
4488 	int size;
4489 	int ret = 0;
4490 
4491 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
4492 		return -EINVAL;
4493 
4494 	drm_modeset_lock_all(dev);
4495 	crtc = drm_crtc_find(dev, crtc_lut->crtc_id);
4496 	if (!crtc) {
4497 		ret = -ENOENT;
4498 		goto out;
4499 	}
4500 
4501 	/* memcpy into gamma store */
4502 	if (crtc_lut->gamma_size != crtc->gamma_size) {
4503 		ret = -EINVAL;
4504 		goto out;
4505 	}
4506 
4507 	size = crtc_lut->gamma_size * (sizeof(uint16_t));
4508 	r_base = crtc->gamma_store;
4509 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->red, r_base, size)) {
4510 		ret = -EFAULT;
4511 		goto out;
4512 	}
4513 
4514 	g_base = (char *)r_base + size;
4515 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->green, g_base, size)) {
4516 		ret = -EFAULT;
4517 		goto out;
4518 	}
4519 
4520 	b_base = (char *)g_base + size;
4521 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
4522 		ret = -EFAULT;
4523 		goto out;
4524 	}
4525 out:
4526 	drm_modeset_unlock_all(dev);
4527 	return ret;
4528 }
4529 
4530 /*
4531  * The Linux version of kfree() is a macro and can't be called
4532  * directly via a function pointer
4533  */
4534 static void drm_kms_free(void *arg)
4535 {
4536 	kfree(arg);
4537 }
4538 
4539 /**
4540  * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
4541  * @dev: DRM device
4542  * @data: ioctl data
4543  * @file_priv: DRM file info
4544  *
4545  * This schedules an asynchronous update on a given CRTC, called page flip.
4546  * Optionally a drm event is generated to signal the completion of the event.
4547  * Generic drivers cannot assume that a pageflip with changed framebuffer
4548  * properties (including driver specific metadata like tiling layout) will work,
4549  * but some drivers support e.g. pixel format changes through the pageflip
4550  * ioctl.
4551  *
4552  * Called by the user via ioctl.
4553  *
4554  * Returns:
4555  * Zero on success, errno on failure.
4556  */
4557 int drm_mode_page_flip_ioctl(struct drm_device *dev,
4558 			     void *data, struct drm_file *file_priv)
4559 {
4560 	struct drm_mode_crtc_page_flip *page_flip = data;
4561 	struct drm_crtc *crtc;
4562 	struct drm_framebuffer *fb = NULL;
4563 	struct drm_pending_vblank_event *e = NULL;
4564 	int ret = -EINVAL;
4565 
4566 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
4567 	    page_flip->reserved != 0)
4568 		return -EINVAL;
4569 
4570 	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
4571 		return -EINVAL;
4572 
4573 	crtc = drm_crtc_find(dev, page_flip->crtc_id);
4574 	if (!crtc)
4575 		return -ENOENT;
4576 
4577 	drm_modeset_lock_crtc(crtc);
4578 	if (crtc->primary->fb == NULL) {
4579 		/* The framebuffer is currently unbound, presumably
4580 		 * due to a hotplug event, that userspace has not
4581 		 * yet discovered.
4582 		 */
4583 		ret = -EBUSY;
4584 		goto out;
4585 	}
4586 
4587 	if (crtc->funcs->page_flip == NULL)
4588 		goto out;
4589 
4590 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
4591 	if (!fb) {
4592 		ret = -ENOENT;
4593 		goto out;
4594 	}
4595 
4596 	ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y, &crtc->mode, fb);
4597 	if (ret)
4598 		goto out;
4599 
4600 	if (crtc->primary->fb->pixel_format != fb->pixel_format) {
4601 		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
4602 		ret = -EINVAL;
4603 		goto out;
4604 	}
4605 
4606 	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4607 		ret = -ENOMEM;
4608 		lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4609 		if (file_priv->event_space < sizeof e->event) {
4610 			lockmgr(&dev->event_lock, LK_RELEASE);
4611 			goto out;
4612 		}
4613 		file_priv->event_space -= sizeof e->event;
4614 		lockmgr(&dev->event_lock, LK_RELEASE);
4615 
4616 		e = kzalloc(sizeof *e, GFP_KERNEL);
4617 		if (e == NULL) {
4618 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4619 			file_priv->event_space += sizeof e->event;
4620 			lockmgr(&dev->event_lock, LK_RELEASE);
4621 			goto out;
4622 		}
4623 
4624 		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
4625 		e->event.base.length = sizeof e->event;
4626 		e->event.user_data = page_flip->user_data;
4627 		e->base.event = &e->event.base;
4628 		e->base.file_priv = file_priv;
4629 #ifdef __DragonFly__
4630 		e->base.destroy =
4631 			(void (*) (struct drm_pending_event *)) drm_kms_free;
4632 #else
4633 		e->base.destroy =
4634 			(void (*) (struct drm_pending_event *)) kfree;
4635 #endif
4636 	}
4637 
4638 	crtc->primary->old_fb = crtc->primary->fb;
4639 	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags);
4640 	if (ret) {
4641 		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
4642 			lockmgr(&dev->event_lock, LK_EXCLUSIVE);
4643 			file_priv->event_space += sizeof e->event;
4644 			lockmgr(&dev->event_lock, LK_RELEASE);
4645 			kfree(e);
4646 		}
4647 		/* Keep the old fb, don't unref it. */
4648 		crtc->primary->old_fb = NULL;
4649 	} else {
4650 		/*
4651 		 * Warn if the driver hasn't properly updated the crtc->fb
4652 		 * field to reflect that the new framebuffer is now used.
4653 		 * Failing to do so will screw with the reference counting
4654 		 * on framebuffers.
4655 		 */
4656 		WARN_ON(crtc->primary->fb != fb);
4657 		/* Unref only the old framebuffer. */
4658 		fb = NULL;
4659 	}
4660 
4661 out:
4662 	if (fb)
4663 		drm_framebuffer_unreference(fb);
4664 	if (crtc->primary->old_fb)
4665 		drm_framebuffer_unreference(crtc->primary->old_fb);
4666 	crtc->primary->old_fb = NULL;
4667 	drm_modeset_unlock_crtc(crtc);
4668 
4669 	return ret;
4670 }
4671 
4672 /**
4673  * drm_mode_config_reset - call ->reset callbacks
4674  * @dev: drm device
4675  *
4676  * This functions calls all the crtc's, encoder's and connector's ->reset
4677  * callback. Drivers can use this in e.g. their driver load or resume code to
4678  * reset hardware and software state.
4679  */
4680 void drm_mode_config_reset(struct drm_device *dev)
4681 {
4682 	struct drm_crtc *crtc;
4683 	struct drm_plane *plane;
4684 	struct drm_encoder *encoder;
4685 	struct drm_connector *connector;
4686 
4687 	list_for_each_entry(plane, &dev->mode_config.plane_list, head)
4688 		if (plane->funcs->reset)
4689 			plane->funcs->reset(plane);
4690 
4691 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
4692 		if (crtc->funcs->reset)
4693 			crtc->funcs->reset(crtc);
4694 
4695 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
4696 		if (encoder->funcs->reset)
4697 			encoder->funcs->reset(encoder);
4698 
4699 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
4700 		connector->status = connector_status_unknown;
4701 
4702 		if (connector->funcs->reset)
4703 			connector->funcs->reset(connector);
4704 	}
4705 }
4706 EXPORT_SYMBOL(drm_mode_config_reset);
4707 
4708 /**
4709  * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
4710  * @dev: DRM device
4711  * @data: ioctl data
4712  * @file_priv: DRM file info
4713  *
4714  * This creates a new dumb buffer in the driver's backing storage manager (GEM,
4715  * TTM or something else entirely) and returns the resulting buffer handle. This
4716  * handle can then be wrapped up into a framebuffer modeset object.
4717  *
4718  * Note that userspace is not allowed to use such objects for render
4719  * acceleration - drivers must create their own private ioctls for such a use
4720  * case.
4721  *
4722  * Called by the user via ioctl.
4723  *
4724  * Returns:
4725  * Zero on success, errno on failure.
4726  */
4727 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
4728 			       void *data, struct drm_file *file_priv)
4729 {
4730 	struct drm_mode_create_dumb *args = data;
4731 	u32 cpp, stride, size;
4732 
4733 	if (!dev->driver->dumb_create)
4734 		return -ENOSYS;
4735 	if (!args->width || !args->height || !args->bpp)
4736 		return -EINVAL;
4737 
4738 	/* overflow checks for 32bit size calculations */
4739 	/* NOTE: DIV_ROUND_UP() can overflow */
4740 	cpp = DIV_ROUND_UP(args->bpp, 8);
4741 	if (!cpp || cpp > 0xffffffffU / args->width)
4742 		return -EINVAL;
4743 	stride = cpp * args->width;
4744 	if (args->height > 0xffffffffU / stride)
4745 		return -EINVAL;
4746 
4747 	/* test for wrap-around */
4748 	size = args->height * stride;
4749 	if (PAGE_ALIGN(size) == 0)
4750 		return -EINVAL;
4751 
4752 	return dev->driver->dumb_create(file_priv, dev, args);
4753 }
4754 
4755 /**
4756  * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
4757  * @dev: DRM device
4758  * @data: ioctl data
4759  * @file_priv: DRM file info
4760  *
4761  * Allocate an offset in the drm device node's address space to be able to
4762  * memory map a dumb buffer.
4763  *
4764  * Called by the user via ioctl.
4765  *
4766  * Returns:
4767  * Zero on success, errno on failure.
4768  */
4769 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
4770 			     void *data, struct drm_file *file_priv)
4771 {
4772 	struct drm_mode_map_dumb *args = data;
4773 
4774 	/* call driver ioctl to get mmap offset */
4775 	if (!dev->driver->dumb_map_offset)
4776 		return -ENOSYS;
4777 
4778 	return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
4779 }
4780 
4781 /**
4782  * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
4783  * @dev: DRM device
4784  * @data: ioctl data
4785  * @file_priv: DRM file info
4786  *
4787  * This destroys the userspace handle for the given dumb backing storage buffer.
4788  * Since buffer objects must be reference counted in the kernel a buffer object
4789  * won't be immediately freed if a framebuffer modeset object still uses it.
4790  *
4791  * Called by the user via ioctl.
4792  *
4793  * Returns:
4794  * Zero on success, errno on failure.
4795  */
4796 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
4797 				void *data, struct drm_file *file_priv)
4798 {
4799 	struct drm_mode_destroy_dumb *args = data;
4800 
4801 	if (!dev->driver->dumb_destroy)
4802 		return -ENOSYS;
4803 
4804 	return dev->driver->dumb_destroy(file_priv, dev, args->handle);
4805 }
4806 
4807 /**
4808  * drm_fb_get_bpp_depth - get the bpp/depth values for format
4809  * @format: pixel format (DRM_FORMAT_*)
4810  * @depth: storage for the depth value
4811  * @bpp: storage for the bpp value
4812  *
4813  * This only supports RGB formats here for compat with code that doesn't use
4814  * pixel formats directly yet.
4815  */
4816 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
4817 			  int *bpp)
4818 {
4819 	switch (format) {
4820 	case DRM_FORMAT_C8:
4821 	case DRM_FORMAT_RGB332:
4822 	case DRM_FORMAT_BGR233:
4823 		*depth = 8;
4824 		*bpp = 8;
4825 		break;
4826 	case DRM_FORMAT_XRGB1555:
4827 	case DRM_FORMAT_XBGR1555:
4828 	case DRM_FORMAT_RGBX5551:
4829 	case DRM_FORMAT_BGRX5551:
4830 	case DRM_FORMAT_ARGB1555:
4831 	case DRM_FORMAT_ABGR1555:
4832 	case DRM_FORMAT_RGBA5551:
4833 	case DRM_FORMAT_BGRA5551:
4834 		*depth = 15;
4835 		*bpp = 16;
4836 		break;
4837 	case DRM_FORMAT_RGB565:
4838 	case DRM_FORMAT_BGR565:
4839 		*depth = 16;
4840 		*bpp = 16;
4841 		break;
4842 	case DRM_FORMAT_RGB888:
4843 	case DRM_FORMAT_BGR888:
4844 		*depth = 24;
4845 		*bpp = 24;
4846 		break;
4847 	case DRM_FORMAT_XRGB8888:
4848 	case DRM_FORMAT_XBGR8888:
4849 	case DRM_FORMAT_RGBX8888:
4850 	case DRM_FORMAT_BGRX8888:
4851 		*depth = 24;
4852 		*bpp = 32;
4853 		break;
4854 	case DRM_FORMAT_XRGB2101010:
4855 	case DRM_FORMAT_XBGR2101010:
4856 	case DRM_FORMAT_RGBX1010102:
4857 	case DRM_FORMAT_BGRX1010102:
4858 	case DRM_FORMAT_ARGB2101010:
4859 	case DRM_FORMAT_ABGR2101010:
4860 	case DRM_FORMAT_RGBA1010102:
4861 	case DRM_FORMAT_BGRA1010102:
4862 		*depth = 30;
4863 		*bpp = 32;
4864 		break;
4865 	case DRM_FORMAT_ARGB8888:
4866 	case DRM_FORMAT_ABGR8888:
4867 	case DRM_FORMAT_RGBA8888:
4868 	case DRM_FORMAT_BGRA8888:
4869 		*depth = 32;
4870 		*bpp = 32;
4871 		break;
4872 	default:
4873 		DRM_DEBUG_KMS("unsupported pixel format %s\n",
4874 			      drm_get_format_name(format));
4875 		*depth = 0;
4876 		*bpp = 0;
4877 		break;
4878 	}
4879 }
4880 EXPORT_SYMBOL(drm_fb_get_bpp_depth);
4881 
4882 /**
4883  * drm_format_num_planes - get the number of planes for format
4884  * @format: pixel format (DRM_FORMAT_*)
4885  *
4886  * Returns:
4887  * The number of planes used by the specified pixel format.
4888  */
4889 int drm_format_num_planes(uint32_t format)
4890 {
4891 	switch (format) {
4892 	case DRM_FORMAT_YUV410:
4893 	case DRM_FORMAT_YVU410:
4894 	case DRM_FORMAT_YUV411:
4895 	case DRM_FORMAT_YVU411:
4896 	case DRM_FORMAT_YUV420:
4897 	case DRM_FORMAT_YVU420:
4898 	case DRM_FORMAT_YUV422:
4899 	case DRM_FORMAT_YVU422:
4900 	case DRM_FORMAT_YUV444:
4901 	case DRM_FORMAT_YVU444:
4902 		return 3;
4903 	case DRM_FORMAT_NV12:
4904 	case DRM_FORMAT_NV21:
4905 	case DRM_FORMAT_NV16:
4906 	case DRM_FORMAT_NV61:
4907 	case DRM_FORMAT_NV24:
4908 	case DRM_FORMAT_NV42:
4909 		return 2;
4910 	default:
4911 		return 1;
4912 	}
4913 }
4914 EXPORT_SYMBOL(drm_format_num_planes);
4915 
4916 /**
4917  * drm_format_plane_cpp - determine the bytes per pixel value
4918  * @format: pixel format (DRM_FORMAT_*)
4919  * @plane: plane index
4920  *
4921  * Returns:
4922  * The bytes per pixel value for the specified plane.
4923  */
4924 int drm_format_plane_cpp(uint32_t format, int plane)
4925 {
4926 	unsigned int depth;
4927 	int bpp;
4928 
4929 	if (plane >= drm_format_num_planes(format))
4930 		return 0;
4931 
4932 	switch (format) {
4933 	case DRM_FORMAT_YUYV:
4934 	case DRM_FORMAT_YVYU:
4935 	case DRM_FORMAT_UYVY:
4936 	case DRM_FORMAT_VYUY:
4937 		return 2;
4938 	case DRM_FORMAT_NV12:
4939 	case DRM_FORMAT_NV21:
4940 	case DRM_FORMAT_NV16:
4941 	case DRM_FORMAT_NV61:
4942 	case DRM_FORMAT_NV24:
4943 	case DRM_FORMAT_NV42:
4944 		return plane ? 2 : 1;
4945 	case DRM_FORMAT_YUV410:
4946 	case DRM_FORMAT_YVU410:
4947 	case DRM_FORMAT_YUV411:
4948 	case DRM_FORMAT_YVU411:
4949 	case DRM_FORMAT_YUV420:
4950 	case DRM_FORMAT_YVU420:
4951 	case DRM_FORMAT_YUV422:
4952 	case DRM_FORMAT_YVU422:
4953 	case DRM_FORMAT_YUV444:
4954 	case DRM_FORMAT_YVU444:
4955 		return 1;
4956 	default:
4957 		drm_fb_get_bpp_depth(format, &depth, &bpp);
4958 		return bpp >> 3;
4959 	}
4960 }
4961 EXPORT_SYMBOL(drm_format_plane_cpp);
4962 
4963 /**
4964  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
4965  * @format: pixel format (DRM_FORMAT_*)
4966  *
4967  * Returns:
4968  * The horizontal chroma subsampling factor for the
4969  * specified pixel format.
4970  */
4971 int drm_format_horz_chroma_subsampling(uint32_t format)
4972 {
4973 	switch (format) {
4974 	case DRM_FORMAT_YUV411:
4975 	case DRM_FORMAT_YVU411:
4976 	case DRM_FORMAT_YUV410:
4977 	case DRM_FORMAT_YVU410:
4978 		return 4;
4979 	case DRM_FORMAT_YUYV:
4980 	case DRM_FORMAT_YVYU:
4981 	case DRM_FORMAT_UYVY:
4982 	case DRM_FORMAT_VYUY:
4983 	case DRM_FORMAT_NV12:
4984 	case DRM_FORMAT_NV21:
4985 	case DRM_FORMAT_NV16:
4986 	case DRM_FORMAT_NV61:
4987 	case DRM_FORMAT_YUV422:
4988 	case DRM_FORMAT_YVU422:
4989 	case DRM_FORMAT_YUV420:
4990 	case DRM_FORMAT_YVU420:
4991 		return 2;
4992 	default:
4993 		return 1;
4994 	}
4995 }
4996 EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
4997 
4998 /**
4999  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
5000  * @format: pixel format (DRM_FORMAT_*)
5001  *
5002  * Returns:
5003  * The vertical chroma subsampling factor for the
5004  * specified pixel format.
5005  */
5006 int drm_format_vert_chroma_subsampling(uint32_t format)
5007 {
5008 	switch (format) {
5009 	case DRM_FORMAT_YUV410:
5010 	case DRM_FORMAT_YVU410:
5011 		return 4;
5012 	case DRM_FORMAT_YUV420:
5013 	case DRM_FORMAT_YVU420:
5014 	case DRM_FORMAT_NV12:
5015 	case DRM_FORMAT_NV21:
5016 		return 2;
5017 	default:
5018 		return 1;
5019 	}
5020 }
5021 EXPORT_SYMBOL(drm_format_vert_chroma_subsampling);
5022 
5023 /**
5024  * drm_mode_config_init - initialize DRM mode_configuration structure
5025  * @dev: DRM device
5026  *
5027  * Initialize @dev's mode_config structure, used for tracking the graphics
5028  * configuration of @dev.
5029  *
5030  * Since this initializes the modeset locks, no locking is possible. Which is no
5031  * problem, since this should happen single threaded at init time. It is the
5032  * driver's problem to ensure this guarantee.
5033  *
5034  */
5035 void drm_mode_config_init(struct drm_device *dev)
5036 {
5037 	lockinit(&dev->mode_config.mutex, "drmmcm", 0, LK_CANRECURSE);
5038 	drm_modeset_lock_init(&dev->mode_config.connection_mutex);
5039 	lockinit(&dev->mode_config.idr_mutex, "mcfgidr", 0, LK_CANRECURSE);
5040 	lockinit(&dev->mode_config.fb_lock, "drmfbl", 0, LK_CANRECURSE);
5041 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
5042 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
5043 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
5044 	INIT_LIST_HEAD(&dev->mode_config.bridge_list);
5045 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
5046 	INIT_LIST_HEAD(&dev->mode_config.property_list);
5047 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
5048 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
5049 	idr_init(&dev->mode_config.crtc_idr);
5050 
5051 	drm_modeset_lock_all(dev);
5052 	drm_mode_create_standard_connector_properties(dev);
5053 	drm_mode_create_standard_plane_properties(dev);
5054 	drm_modeset_unlock_all(dev);
5055 
5056 	/* Just to be sure */
5057 	dev->mode_config.num_fb = 0;
5058 	dev->mode_config.num_connector = 0;
5059 	dev->mode_config.num_crtc = 0;
5060 	dev->mode_config.num_encoder = 0;
5061 	dev->mode_config.num_overlay_plane = 0;
5062 	dev->mode_config.num_total_plane = 0;
5063 }
5064 EXPORT_SYMBOL(drm_mode_config_init);
5065 
5066 /**
5067  * drm_mode_config_cleanup - free up DRM mode_config info
5068  * @dev: DRM device
5069  *
5070  * Free up all the connectors and CRTCs associated with this DRM device, then
5071  * free up the framebuffers and associated buffer objects.
5072  *
5073  * Note that since this /should/ happen single-threaded at driver/device
5074  * teardown time, no locking is required. It's the driver's job to ensure that
5075  * this guarantee actually holds true.
5076  *
5077  * FIXME: cleanup any dangling user buffer objects too
5078  */
5079 void drm_mode_config_cleanup(struct drm_device *dev)
5080 {
5081 	struct drm_connector *connector, *ot;
5082 	struct drm_crtc *crtc, *ct;
5083 	struct drm_encoder *encoder, *enct;
5084 	struct drm_bridge *bridge, *brt;
5085 	struct drm_framebuffer *fb, *fbt;
5086 	struct drm_property *property, *pt;
5087 	struct drm_property_blob *blob, *bt;
5088 	struct drm_plane *plane, *plt;
5089 
5090 	list_for_each_entry_safe(encoder, enct, &dev->mode_config.encoder_list,
5091 				 head) {
5092 		encoder->funcs->destroy(encoder);
5093 	}
5094 
5095 	list_for_each_entry_safe(bridge, brt,
5096 				 &dev->mode_config.bridge_list, head) {
5097 		bridge->funcs->destroy(bridge);
5098 	}
5099 
5100 	list_for_each_entry_safe(connector, ot,
5101 				 &dev->mode_config.connector_list, head) {
5102 		connector->funcs->destroy(connector);
5103 	}
5104 
5105 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
5106 				 head) {
5107 		drm_property_destroy(dev, property);
5108 	}
5109 
5110 	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
5111 				 head) {
5112 		drm_property_destroy_blob(dev, blob);
5113 	}
5114 
5115 	/*
5116 	 * Single-threaded teardown context, so it's not required to grab the
5117 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
5118 	 * would actually deadlock with the drm_framebuffer_cleanup function.
5119 	 *
5120 	 * Also, if there are any framebuffers left, that's a driver leak now,
5121 	 * so politely WARN about this.
5122 	 */
5123 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
5124 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
5125 		drm_framebuffer_remove(fb);
5126 	}
5127 
5128 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
5129 				 head) {
5130 		plane->funcs->destroy(plane);
5131 	}
5132 
5133 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
5134 		crtc->funcs->destroy(crtc);
5135 	}
5136 
5137 	idr_destroy(&dev->mode_config.crtc_idr);
5138 	drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
5139 }
5140 EXPORT_SYMBOL(drm_mode_config_cleanup);
5141 
5142 struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev,
5143 						       unsigned int supported_rotations)
5144 {
5145 	static const struct drm_prop_enum_list props[] = {
5146 		{ DRM_ROTATE_0,   "rotate-0" },
5147 		{ DRM_ROTATE_90,  "rotate-90" },
5148 		{ DRM_ROTATE_180, "rotate-180" },
5149 		{ DRM_ROTATE_270, "rotate-270" },
5150 		{ DRM_REFLECT_X,  "reflect-x" },
5151 		{ DRM_REFLECT_Y,  "reflect-y" },
5152 	};
5153 
5154 	return drm_property_create_bitmask(dev, 0, "rotation",
5155 					   props, ARRAY_SIZE(props),
5156 					   supported_rotations);
5157 }
5158 EXPORT_SYMBOL(drm_mode_create_rotation_property);
5159