1/*
   2 * Copyright (c) 2016 Intel Corporation
   3 *
   4 * Permission to use, copy, modify, distribute, and sell this software and its
   5 * documentation for any purpose is hereby granted without fee, provided that
   6 * the above copyright notice appear in all copies and that both that copyright
   7 * notice and this permission notice appear in supporting documentation, and
   8 * that the name of the copyright holders not be used in advertising or
   9 * publicity pertaining to distribution of the software without specific,
  10 * written prior permission.  The copyright holders make no representations
  11 * about the suitability of this software for any purpose.  It is provided "as
  12 * is" without express or implied warranty.
  13 *
  14 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  15 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  16 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  17 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  18 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  19 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  20 * OF THIS SOFTWARE.
  21 */
  22
  23#include <linux/export.h>
  24#include <linux/uaccess.h>
  25
  26#include <drm/drm_atomic.h>
  27#include <drm/drm_atomic_uapi.h>
  28#include <drm/drm_auth.h>
  29#include <drm/drm_debugfs.h>
  30#include <drm/drm_drv.h>
  31#include <drm/drm_file.h>
  32#include <drm/drm_fourcc.h>
  33#include <drm/drm_framebuffer.h>
  34#include <drm/drm_gem.h>
  35#include <drm/drm_print.h>
  36#include <drm/drm_util.h>
  37
  38#include "drm_crtc_internal.h"
  39#include "drm_internal.h"
  40
  41/**
  42 * DOC: overview
  43 *
  44 * Frame buffers are abstract memory objects that provide a source of pixels to
  45 * scanout to a CRTC. Applications explicitly request the creation of frame
  46 * buffers through the DRM_IOCTL_MODE_ADDFB(2) ioctls and receive an opaque
  47 * handle that can be passed to the KMS CRTC control, plane configuration and
  48 * page flip functions.
  49 *
  50 * Frame buffers rely on the underlying memory manager for allocating backing
  51 * storage. When creating a frame buffer applications pass a memory handle
  52 * (or a list of memory handles for multi-planar formats) through the
  53 * &struct drm_mode_fb_cmd2 argument. For drivers using GEM as their userspace
  54 * buffer management interface this would be a GEM handle.  Drivers are however
  55 * free to use their own backing storage object handles, e.g. vmwgfx directly
  56 * exposes special TTM handles to userspace and so expects TTM handles in the
  57 * create ioctl and not GEM handles.
  58 *
  59 * Framebuffers are tracked with &struct drm_framebuffer. They are published
  60 * using drm_framebuffer_init() - after calling that function userspace can use
  61 * and access the framebuffer object. The helper function
  62 * drm_helper_mode_fill_fb_struct() can be used to pre-fill the required
  63 * metadata fields.
  64 *
  65 * The lifetime of a drm framebuffer is controlled with a reference count,
  66 * drivers can grab additional references with drm_framebuffer_get() and drop
  67 * them again with drm_framebuffer_put(). For driver-private framebuffers for
  68 * which the last reference is never dropped (e.g. for the fbdev framebuffer
  69 * when the struct &struct drm_framebuffer is embedded into the fbdev helper
  70 * struct) drivers can manually clean up a framebuffer at module unload time
  71 * with drm_framebuffer_unregister_private(). But doing this is not
  72 * recommended, and it's better to have a normal free-standing &struct
  73 * drm_framebuffer.
  74 */
  75
  76int drm_framebuffer_check_src_coords(uint32_t src_x, uint32_t src_y,
  77				     uint32_t src_w, uint32_t src_h,
  78				     const struct drm_framebuffer *fb)
  79{
  80	unsigned int fb_width, fb_height;
  81
  82	fb_width = fb->width << 16;
  83	fb_height = fb->height << 16;
  84
  85	/* Make sure source coordinates are inside the fb. */
  86	if (src_w > fb_width ||
  87	    src_x > fb_width - src_w ||
  88	    src_h > fb_height ||
  89	    src_y > fb_height - src_h) {
  90		DRM_DEBUG_KMS("Invalid source coordinates "
  91			      "%u.%06ux%u.%06u+%u.%06u+%u.%06u (fb %ux%u)\n",
  92			      src_w >> 16, ((src_w & 0xffff) * 15625) >> 10,
  93			      src_h >> 16, ((src_h & 0xffff) * 15625) >> 10,
  94			      src_x >> 16, ((src_x & 0xffff) * 15625) >> 10,
  95			      src_y >> 16, ((src_y & 0xffff) * 15625) >> 10,
  96			      fb->width, fb->height);
  97		return -ENOSPC;
  98	}
  99
 100	return 0;
 101}
 102
 103/**
 104 * drm_mode_addfb - add an FB to the graphics configuration
 105 * @dev: drm device for the ioctl
 106 * @or: pointer to request structure
 107 * @file_priv: drm file
 108 *
 109 * Add a new FB to the specified CRTC, given a user request. This is the
 110 * original addfb ioctl which only supported RGB formats.
 111 *
 112 * Called by the user via ioctl, or by an in-kernel client.
 113 *
 114 * Returns:
 115 * Zero on success, negative errno on failure.
 116 */
 117int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or,
 118		   struct drm_file *file_priv)
 119{
 120	struct drm_mode_fb_cmd2 r = {};
 121	int ret;
 122
 123	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 124		return -EOPNOTSUPP;
 125
 126	r.pixel_format = drm_driver_legacy_fb_format(dev, or->bpp, or->depth);
 127	if (r.pixel_format == DRM_FORMAT_INVALID) {
 128		DRM_DEBUG("bad {bpp:%d, depth:%d}\n", or->bpp, or->depth);
 129		return -EINVAL;
 130	}
 131
 132	/* convert to new format and call new ioctl */
 133	r.fb_id = or->fb_id;
 134	r.width = or->width;
 135	r.height = or->height;
 136	r.pitches[0] = or->pitch;
 137	r.handles[0] = or->handle;
 138
 139	ret = drm_mode_addfb2(dev, &r, file_priv);
 140	if (ret)
 141		return ret;
 142
 143	or->fb_id = r.fb_id;
 144
 145	return 0;
 146}
 147
 148int drm_mode_addfb_ioctl(struct drm_device *dev,
 149			 void *data, struct drm_file *file_priv)
 150{
 151	return drm_mode_addfb(dev, data, file_priv);
 152}
 153
 154static int fb_plane_width(int width,
 155			  const struct drm_format_info *format, int plane)
 156{
 157	if (plane == 0)
 158		return width;
 159
 160	return DIV_ROUND_UP(width, format->hsub);
 161}
 162
 163static int fb_plane_height(int height,
 164			   const struct drm_format_info *format, int plane)
 165{
 166	if (plane == 0)
 167		return height;
 168
 169	return DIV_ROUND_UP(height, format->vsub);
 170}
 171
 172static int framebuffer_check(struct drm_device *dev,
 173			     const struct drm_mode_fb_cmd2 *r)
 174{
 175	const struct drm_format_info *info;
 176	int i;
 177
 178	/* check if the format is supported at all */
 179	info = __drm_format_info(r->pixel_format);
 180	if (!info) {
 181		struct drm_format_name_buf format_name;
 182
 183		DRM_DEBUG_KMS("bad framebuffer format %s\n",
 184			      drm_get_format_name(r->pixel_format,
 185						  &format_name));
 186		return -EINVAL;
 187	}
 188
 189	/* now let the driver pick its own format info */
 190	info = drm_get_format_info(dev, r);
 191
 192	if (r->width == 0) {
 193		DRM_DEBUG_KMS("bad framebuffer width %u\n", r->width);
 194		return -EINVAL;
 195	}
 196
 197	if (r->height == 0) {
 198		DRM_DEBUG_KMS("bad framebuffer height %u\n", r->height);
 199		return -EINVAL;
 200	}
 201
 202	for (i = 0; i < info->num_planes; i++) {
 203		unsigned int width = fb_plane_width(r->width, info, i);
 204		unsigned int height = fb_plane_height(r->height, info, i);
 205		unsigned int block_size = info->char_per_block[i];
 206		u64 min_pitch = drm_format_info_min_pitch(info, i, width);
 207
 208		if (!block_size && (r->modifier[i] == DRM_FORMAT_MOD_LINEAR)) {
 209			DRM_DEBUG_KMS("Format requires non-linear modifier for plane %d\n", i);
 210			return -EINVAL;
 211		}
 212
 213		if (!r->handles[i]) {
 214			DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i);
 215			return -EINVAL;
 216		}
 217
 218		if (min_pitch > UINT_MAX)
 219			return -ERANGE;
 220
 221		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
 222			return -ERANGE;
 223
 224		if (block_size && r->pitches[i] < min_pitch) {
 225			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
 226			return -EINVAL;
 227		}
 228
 229		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
 230			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
 231				      r->modifier[i], i);
 232			return -EINVAL;
 233		}
 234
 235		if (r->flags & DRM_MODE_FB_MODIFIERS &&
 236		    r->modifier[i] != r->modifier[0]) {
 237			DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
 238				      r->modifier[i], i);
 239			return -EINVAL;
 240		}
 241
 242		/* modifier specific checks: */
 243		switch (r->modifier[i]) {
 244		case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE:
 245			/* NOTE: the pitch restriction may be lifted later if it turns
 246			 * out that no hw has this restriction:
 247			 */
 248			if (r->pixel_format != DRM_FORMAT_NV12 ||
 249					width % 128 || height % 32 ||
 250					r->pitches[i] % 128) {
 251				DRM_DEBUG_KMS("bad modifier data for plane %d\n", i);
 252				return -EINVAL;
 253			}
 254			break;
 255
 256		default:
 257			break;
 258		}
 259	}
 260
 261	for (i = info->num_planes; i < 4; i++) {
 262		if (r->modifier[i]) {
 263			DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i);
 264			return -EINVAL;
 265		}
 266
 267		/* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
 268		if (!(r->flags & DRM_MODE_FB_MODIFIERS))
 269			continue;
 270
 271		if (r->handles[i]) {
 272			DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i);
 273			return -EINVAL;
 274		}
 275
 276		if (r->pitches[i]) {
 277			DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i);
 278			return -EINVAL;
 279		}
 280
 281		if (r->offsets[i]) {
 282			DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i);
 283			return -EINVAL;
 284		}
 285	}
 286
 287	return 0;
 288}
 289
 290struct drm_framebuffer *
 291drm_internal_framebuffer_create(struct drm_device *dev,
 292				const struct drm_mode_fb_cmd2 *r,
 293				struct drm_file *file_priv)
 294{
 295	struct drm_mode_config *config = &dev->mode_config;
 296	struct drm_framebuffer *fb;
 297	int ret;
 298
 299	if (r->flags & ~(DRM_MODE_FB_INTERLACED | DRM_MODE_FB_MODIFIERS)) {
 300		DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r->flags);
 301		return ERR_PTR(-EINVAL);
 302	}
 303
 304	if ((config->min_width > r->width) || (r->width > config->max_width)) {
 305		DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
 306			  r->width, config->min_width, config->max_width);
 307		return ERR_PTR(-EINVAL);
 308	}
 309	if ((config->min_height > r->height) || (r->height > config->max_height)) {
 310		DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
 311			  r->height, config->min_height, config->max_height);
 312		return ERR_PTR(-EINVAL);
 313	}
 314
 315	if (r->flags & DRM_MODE_FB_MODIFIERS &&
 316	    !dev->mode_config.allow_fb_modifiers) {
 317		DRM_DEBUG_KMS("driver does not support fb modifiers\n");
 318		return ERR_PTR(-EINVAL);
 319	}
 320
 321	ret = framebuffer_check(dev, r);
 322	if (ret)
 323		return ERR_PTR(ret);
 324
 325	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
 326	if (IS_ERR(fb)) {
 327		DRM_DEBUG_KMS("could not create framebuffer\n");
 328		return fb;
 329	}
 330
 331	return fb;
 332}
 333EXPORT_SYMBOL_FOR_TESTS_ONLY(drm_internal_framebuffer_create);
 334
 335/**
 336 * drm_mode_addfb2 - add an FB to the graphics configuration
 337 * @dev: drm device for the ioctl
 338 * @data: data pointer for the ioctl
 339 * @file_priv: drm file for the ioctl call
 340 *
 341 * Add a new FB to the specified CRTC, given a user request with format. This is
 342 * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
 343 * and uses fourcc codes as pixel format specifiers.
 344 *
 345 * Called by the user via ioctl.
 346 *
 347 * Returns:
 348 * Zero on success, negative errno on failure.
 349 */
 350int drm_mode_addfb2(struct drm_device *dev,
 351		    void *data, struct drm_file *file_priv)
 352{
 353	struct drm_mode_fb_cmd2 *r = data;
 354	struct drm_framebuffer *fb;
 355
 356	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 357		return -EOPNOTSUPP;
 358
 359	fb = drm_internal_framebuffer_create(dev, r, file_priv);
 360	if (IS_ERR(fb))
 361		return PTR_ERR(fb);
 362
 363	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
 364	r->fb_id = fb->base.id;
 365
 366	/* Transfer ownership to the filp for reaping on close */
 367	mutex_lock(&file_priv->fbs_lock);
 368	list_add(&fb->filp_head, &file_priv->fbs);
 369	mutex_unlock(&file_priv->fbs_lock);
 370
 371	return 0;
 372}
 373
 374int drm_mode_addfb2_ioctl(struct drm_device *dev,
 375			  void *data, struct drm_file *file_priv)
 376{
 377#ifdef __BIG_ENDIAN
 378	if (!dev->mode_config.quirk_addfb_prefer_host_byte_order) {
 379		/*
 380		 * Drivers must set the
 381		 * quirk_addfb_prefer_host_byte_order quirk to make
 382		 * the drm_mode_addfb() compat code work correctly on
 383		 * bigendian machines.
 384		 *
 385		 * If they don't they interpret pixel_format values
 386		 * incorrectly for bug compatibility, which in turn
 387		 * implies the ADDFB2 ioctl does not work correctly
 388		 * then.  So block it to make userspace fallback to
 389		 * ADDFB.
 390		 */
 391		DRM_DEBUG_KMS("addfb2 broken on bigendian");
 392		return -EOPNOTSUPP;
 393	}
 394#endif
 395	return drm_mode_addfb2(dev, data, file_priv);
 396}
 397
 398struct drm_mode_rmfb_work {
 399	struct work_struct work;
 400	struct list_head fbs;
 401};
 402
 403static void drm_mode_rmfb_work_fn(struct work_struct *w)
 404{
 405	struct drm_mode_rmfb_work *arg = container_of(w, typeof(*arg), work);
 406
 407	while (!list_empty(&arg->fbs)) {
 408		struct drm_framebuffer *fb =
 409			list_first_entry(&arg->fbs, typeof(*fb), filp_head);
 410
 411		list_del_init(&fb->filp_head);
 412		drm_framebuffer_remove(fb);
 413	}
 414}
 415
 416/**
 417 * drm_mode_rmfb - remove an FB from the configuration
 418 * @dev: drm device
 419 * @fb_id: id of framebuffer to remove
 420 * @file_priv: drm file
 421 *
 422 * Remove the specified FB.
 423 *
 424 * Called by the user via ioctl, or by an in-kernel client.
 425 *
 426 * Returns:
 427 * Zero on success, negative errno on failure.
 428 */
 429int drm_mode_rmfb(struct drm_device *dev, u32 fb_id,
 430		  struct drm_file *file_priv)
 431{
 432	struct drm_framebuffer *fb = NULL;
 433	struct drm_framebuffer *fbl = NULL;
 434	int found = 0;
 435
 436	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 437		return -EOPNOTSUPP;
 438
 439	fb = drm_framebuffer_lookup(dev, file_priv, fb_id);
 440	if (!fb)
 441		return -ENOENT;
 442
 443	mutex_lock(&file_priv->fbs_lock);
 444	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
 445		if (fb == fbl)
 446			found = 1;
 447	if (!found) {
 448		mutex_unlock(&file_priv->fbs_lock);
 449		goto fail_unref;
 450	}
 451
 452	list_del_init(&fb->filp_head);
 453	mutex_unlock(&file_priv->fbs_lock);
 454
 455	/* drop the reference we picked up in framebuffer lookup */
 456	drm_framebuffer_put(fb);
 457
 458	/*
 459	 * we now own the reference that was stored in the fbs list
 460	 *
 461	 * drm_framebuffer_remove may fail with -EINTR on pending signals,
 462	 * so run this in a separate stack as there's no way to correctly
 463	 * handle this after the fb is already removed from the lookup table.
 464	 */
 465	if (drm_framebuffer_read_refcount(fb) > 1) {
 466		struct drm_mode_rmfb_work arg;
 467
 468		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
 469		INIT_LIST_HEAD(&arg.fbs);
 470		list_add_tail(&fb->filp_head, &arg.fbs);
 471
 472		schedule_work(&arg.work);
 473		flush_work(&arg.work);
 474		destroy_work_on_stack(&arg.work);
 475	} else
 476		drm_framebuffer_put(fb);
 477
 478	return 0;
 479
 480fail_unref:
 481	drm_framebuffer_put(fb);
 482	return -ENOENT;
 483}
 484
 485int drm_mode_rmfb_ioctl(struct drm_device *dev,
 486			void *data, struct drm_file *file_priv)
 487{
 488	uint32_t *fb_id = data;
 489
 490	return drm_mode_rmfb(dev, *fb_id, file_priv);
 491}
 492
 493/**
 494 * drm_mode_getfb - get FB info
 495 * @dev: drm device for the ioctl
 496 * @data: data pointer for the ioctl
 497 * @file_priv: drm file for the ioctl call
 498 *
 499 * Lookup the FB given its ID and return info about it.
 500 *
 501 * Called by the user via ioctl.
 502 *
 503 * Returns:
 504 * Zero on success, negative errno on failure.
 505 */
 506int drm_mode_getfb(struct drm_device *dev,
 507		   void *data, struct drm_file *file_priv)
 508{
 509	struct drm_mode_fb_cmd *r = data;
 510	struct drm_framebuffer *fb;
 511	int ret;
 512
 513	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 514		return -EOPNOTSUPP;
 515
 516	fb = drm_framebuffer_lookup(dev, file_priv, r->fb_id);
 517	if (!fb)
 518		return -ENOENT;
 519
 520	/* Multi-planar framebuffers need getfb2. */
 521	if (fb->format->num_planes > 1) {
 522		ret = -EINVAL;
 523		goto out;
 524	}
 525
 526	if (!fb->funcs->create_handle) {
 527		ret = -ENODEV;
 528		goto out;
 529	}
 530
 531	r->height = fb->height;
 532	r->width = fb->width;
 533	r->depth = fb->format->depth;
 534	r->bpp = fb->format->cpp[0] * 8;
 535	r->pitch = fb->pitches[0];
 536
 537	/* GET_FB() is an unprivileged ioctl so we must not return a
 538	 * buffer-handle to non-master processes! For
 539	 * backwards-compatibility reasons, we cannot make GET_FB() privileged,
 540	 * so just return an invalid handle for non-masters.
 541	 */
 542	if (!drm_is_current_master(file_priv) && !capable(CAP_SYS_ADMIN)) {
 543		r->handle = 0;
 544		ret = 0;
 545		goto out;
 546	}
 547
 548	ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
 549
 550out:
 551	drm_framebuffer_put(fb);
 552	return ret;
 553}
 554
 555/**
 556 * drm_mode_getfb2 - get extended FB info
 557 * @dev: drm device for the ioctl
 558 * @data: data pointer for the ioctl
 559 * @file_priv: drm file for the ioctl call
 560 *
 561 * Lookup the FB given its ID and return info about it.
 562 *
 563 * Called by the user via ioctl.
 564 *
 565 * Returns:
 566 * Zero on success, negative errno on failure.
 567 */
 568int drm_mode_getfb2_ioctl(struct drm_device *dev,
 569			  void *data, struct drm_file *file_priv)
 570{
 571	struct drm_mode_fb_cmd2 *r = data;
 572	struct drm_framebuffer *fb;
 573	unsigned int i;
 574	int ret;
 575
 576	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 577		return -EINVAL;
 578
 579	fb = drm_framebuffer_lookup(dev, file_priv, r->fb_id);
 580	if (!fb)
 581		return -ENOENT;
 582
 583	/* For multi-plane framebuffers, we require the driver to place the
 584	 * GEM objects directly in the drm_framebuffer. For single-plane
 585	 * framebuffers, we can fall back to create_handle.
 586	 */
 587	if (!fb->obj[0] &&
 588	    (fb->format->num_planes > 1 || !fb->funcs->create_handle)) {
 589		ret = -ENODEV;
 590		goto out;
 591	}
 592
 593	r->height = fb->height;
 594	r->width = fb->width;
 595	r->pixel_format = fb->format->format;
 596
 597	r->flags = 0;
 598	if (dev->mode_config.allow_fb_modifiers)
 599		r->flags |= DRM_MODE_FB_MODIFIERS;
 600
 601	for (i = 0; i < ARRAY_SIZE(r->handles); i++) {
 602		r->handles[i] = 0;
 603		r->pitches[i] = 0;
 604		r->offsets[i] = 0;
 605		r->modifier[i] = 0;
 606	}
 607
 608	for (i = 0; i < fb->format->num_planes; i++) {
 609		r->pitches[i] = fb->pitches[i];
 610		r->offsets[i] = fb->offsets[i];
 611		if (dev->mode_config.allow_fb_modifiers)
 612			r->modifier[i] = fb->modifier;
 613	}
 614
 615	/* GET_FB2() is an unprivileged ioctl so we must not return a
 616	 * buffer-handle to non master/root processes! To match GET_FB()
 617	 * just return invalid handles (0) for non masters/root
 618	 * rather than making GET_FB2() privileged.
 619	 */
 620	if (!drm_is_current_master(file_priv) && !capable(CAP_SYS_ADMIN)) {
 621		ret = 0;
 622		goto out;
 623	}
 624
 625	for (i = 0; i < fb->format->num_planes; i++) {
 626		int j;
 627
 628		/* If we reuse the same object for multiple planes, also
 629		 * return the same handle.
 630		 */
 631		for (j = 0; j < i; j++) {
 632			if (fb->obj[i] == fb->obj[j]) {
 633				r->handles[i] = r->handles[j];
 634				break;
 635			}
 636		}
 637
 638		if (r->handles[i])
 639			continue;
 640
 641		if (fb->obj[i]) {
 642			ret = drm_gem_handle_create(file_priv, fb->obj[i],
 643						    &r->handles[i]);
 644		} else {
 645			WARN_ON(i > 0);
 646			ret = fb->funcs->create_handle(fb, file_priv,
 647						       &r->handles[i]);
 648		}
 649
 650		if (ret != 0)
 651			goto out;
 652	}
 653
 654out:
 655	if (ret != 0) {
 656		/* Delete any previously-created handles on failure. */
 657		for (i = 0; i < ARRAY_SIZE(r->handles); i++) {
 658			int j;
 659
 660			if (r->handles[i])
 661				drm_gem_handle_delete(file_priv, r->handles[i]);
 662
 663			/* Zero out any handles identical to the one we just
 664			 * deleted.
 665			 */
 666			for (j = i + 1; j < ARRAY_SIZE(r->handles); j++) {
 667				if (r->handles[j] == r->handles[i])
 668					r->handles[j] = 0;
 669			}
 670		}
 671	}
 672
 673	drm_framebuffer_put(fb);
 674	return ret;
 675}
 676
 677/**
 678 * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
 679 * @dev: drm device for the ioctl
 680 * @data: data pointer for the ioctl
 681 * @file_priv: drm file for the ioctl call
 682 *
 683 * Lookup the FB and flush out the damaged area supplied by userspace as a clip
 684 * rectangle list. Generic userspace which does frontbuffer rendering must call
 685 * this ioctl to flush out the changes on manual-update display outputs, e.g.
 686 * usb display-link, mipi manual update panels or edp panel self refresh modes.
 687 *
 688 * Modesetting drivers which always update the frontbuffer do not need to
 689 * implement the corresponding &drm_framebuffer_funcs.dirty callback.
 690 *
 691 * Called by the user via ioctl.
 692 *
 693 * Returns:
 694 * Zero on success, negative errno on failure.
 695 */
 696int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 697			   void *data, struct drm_file *file_priv)
 698{
 699	struct drm_clip_rect __user *clips_ptr;
 700	struct drm_clip_rect *clips = NULL;
 701	struct drm_mode_fb_dirty_cmd *r = data;
 702	struct drm_framebuffer *fb;
 703	unsigned flags;
 704	int num_clips;
 705	int ret;
 706
 707	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 708		return -EOPNOTSUPP;
 709
 710	fb = drm_framebuffer_lookup(dev, file_priv, r->fb_id);
 711	if (!fb)
 712		return -ENOENT;
 713
 714	num_clips = r->num_clips;
 715	clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
 716
 717	if (!num_clips != !clips_ptr) {
 718		ret = -EINVAL;
 719		goto out_err1;
 720	}
 721
 722	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
 723
 724	/* If userspace annotates copy, clips must come in pairs */
 725	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
 726		ret = -EINVAL;
 727		goto out_err1;
 728	}
 729
 730	if (num_clips && clips_ptr) {
 731		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
 732			ret = -EINVAL;
 733			goto out_err1;
 734		}
 735		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
 736		if (!clips) {
 737			ret = -ENOMEM;
 738			goto out_err1;
 739		}
 740
 741		ret = copy_from_user(clips, clips_ptr,
 742				     num_clips * sizeof(*clips));
 743		if (ret) {
 744			ret = -EFAULT;
 745			goto out_err2;
 746		}
 747	}
 748
 749	if (fb->funcs->dirty) {
 750		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
 751				       clips, num_clips);
 752	} else {
 753		ret = -ENOSYS;
 754	}
 755
 756out_err2:
 757	kfree(clips);
 758out_err1:
 759	drm_framebuffer_put(fb);
 760
 761	return ret;
 762}
 763
 764/**
 765 * drm_fb_release - remove and free the FBs on this file
 766 * @priv: drm file for the ioctl
 767 *
 768 * Destroy all the FBs associated with @filp.
 769 *
 770 * Called by the user via ioctl.
 771 *
 772 * Returns:
 773 * Zero on success, negative errno on failure.
 774 */
 775void drm_fb_release(struct drm_file *priv)
 776{
 777	struct drm_framebuffer *fb, *tfb;
 778	struct drm_mode_rmfb_work arg;
 779
 780	INIT_LIST_HEAD(&arg.fbs);
 781
 782	/*
 783	 * When the file gets released that means no one else can access the fb
 784	 * list any more, so no need to grab fpriv->fbs_lock. And we need to
 785	 * avoid upsetting lockdep since the universal cursor code adds a
 786	 * framebuffer while holding mutex locks.
 787	 *
 788	 * Note that a real deadlock between fpriv->fbs_lock and the modeset
 789	 * locks is impossible here since no one else but this function can get
 790	 * at it any more.
 791	 */
 792	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
 793		if (drm_framebuffer_read_refcount(fb) > 1) {
 794			list_move_tail(&fb->filp_head, &arg.fbs);
 795		} else {
 796			list_del_init(&fb->filp_head);
 797
 798			/* This drops the fpriv->fbs reference. */
 799			drm_framebuffer_put(fb);
 800		}
 801	}
 802
 803	if (!list_empty(&arg.fbs)) {
 804		INIT_WORK_ONSTACK(&arg.work, drm_mode_rmfb_work_fn);
 805
 806		schedule_work(&arg.work);
 807		flush_work(&arg.work);
 808		destroy_work_on_stack(&arg.work);
 809	}
 810}
 811
 812void drm_framebuffer_free(struct kref *kref)
 813{
 814	struct drm_framebuffer *fb =
 815			container_of(kref, struct drm_framebuffer, base.refcount);
 816	struct drm_device *dev = fb->dev;
 817
 818	/*
 819	 * The lookup idr holds a weak reference, which has not necessarily been
 820	 * removed at this point. Check for that.
 821	 */
 822	drm_mode_object_unregister(dev, &fb->base);
 823
 824	fb->funcs->destroy(fb);
 825}
 826
 827/**
 828 * drm_framebuffer_init - initialize a framebuffer
 829 * @dev: DRM device
 830 * @fb: framebuffer to be initialized
 831 * @funcs: ... with these functions
 832 *
 833 * Allocates an ID for the framebuffer's parent mode object, sets its mode
 834 * functions & device file and adds it to the master fd list.
 835 *
 836 * IMPORTANT:
 837 * This functions publishes the fb and makes it available for concurrent access
 838 * by other users. Which means by this point the fb _must_ be fully set up -
 839 * since all the fb attributes are invariant over its lifetime, no further
 840 * locking but only correct reference counting is required.
 841 *
 842 * Returns:
 843 * Zero on success, error code on failure.
 844 */
 845int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 846			 const struct drm_framebuffer_funcs *funcs)
 847{
 848	int ret;
 849
 850	if (WARN_ON_ONCE(fb->dev != dev || !fb->format))
 851		return -EINVAL;
 852
 853	INIT_LIST_HEAD(&fb->filp_head);
 854
 855	fb->funcs = funcs;
 856	strcpy(fb->comm, current->comm);
 857
 858	ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB,
 859				    false, drm_framebuffer_free);
 860	if (ret)
 861		goto out;
 862
 863	mutex_lock(&dev->mode_config.fb_lock);
 864	dev->mode_config.num_fb++;
 865	list_add(&fb->head, &dev->mode_config.fb_list);
 866	mutex_unlock(&dev->mode_config.fb_lock);
 867
 868	drm_mode_object_register(dev, &fb->base);
 869out:
 870	return ret;
 871}
 872EXPORT_SYMBOL(drm_framebuffer_init);
 873
 874/**
 875 * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
 876 * @dev: drm device
 877 * @file_priv: drm file to check for lease against.
 878 * @id: id of the fb object
 879 *
 880 * If successful, this grabs an additional reference to the framebuffer -
 881 * callers need to make sure to eventually unreference the returned framebuffer
 882 * again, using drm_framebuffer_put().
 883 */
 884struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
 885					       struct drm_file *file_priv,
 886					       uint32_t id)
 887{
 888	struct drm_mode_object *obj;
 889	struct drm_framebuffer *fb = NULL;
 890
 891	obj = __drm_mode_object_find(dev, file_priv, id, DRM_MODE_OBJECT_FB);
 892	if (obj)
 893		fb = obj_to_fb(obj);
 894	return fb;
 895}
 896EXPORT_SYMBOL(drm_framebuffer_lookup);
 897
 898/**
 899 * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
 900 * @fb: fb to unregister
 901 *
 902 * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
 903 * those used for fbdev. Note that the caller must hold a reference of its own,
 904 * i.e. the object may not be destroyed through this call (since it'll lead to a
 905 * locking inversion).
 906 *
 907 * NOTE: This function is deprecated. For driver-private framebuffers it is not
 908 * recommended to embed a framebuffer struct info fbdev struct, instead, a
 909 * framebuffer pointer is preferred and drm_framebuffer_put() should be called
 910 * when the framebuffer is to be cleaned up.
 911 */
 912void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
 913{
 914	struct drm_device *dev;
 915
 916	if (!fb)
 917		return;
 918
 919	dev = fb->dev;
 920
 921	/* Mark fb as reaped and drop idr ref. */
 922	drm_mode_object_unregister(dev, &fb->base);
 923}
 924EXPORT_SYMBOL(drm_framebuffer_unregister_private);
 925
 926/**
 927 * drm_framebuffer_cleanup - remove a framebuffer object
 928 * @fb: framebuffer to remove
 929 *
 930 * Cleanup framebuffer. This function is intended to be used from the drivers
 931 * &drm_framebuffer_funcs.destroy callback. It can also be used to clean up
 932 * driver private framebuffers embedded into a larger structure.
 933 *
 934 * Note that this function does not remove the fb from active usage - if it is
 935 * still used anywhere, hilarity can ensue since userspace could call getfb on
 936 * the id and get back -EINVAL. Obviously no concern at driver unload time.
 937 *
 938 * Also, the framebuffer will not be removed from the lookup idr - for
 939 * user-created framebuffers this will happen in in the rmfb ioctl. For
 940 * driver-private objects (e.g. for fbdev) drivers need to explicitly call
 941 * drm_framebuffer_unregister_private.
 942 */
 943void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 944{
 945	struct drm_device *dev = fb->dev;
 946
 947	mutex_lock(&dev->mode_config.fb_lock);
 948	list_del(&fb->head);
 949	dev->mode_config.num_fb--;
 950	mutex_unlock(&dev->mode_config.fb_lock);
 951}
 952EXPORT_SYMBOL(drm_framebuffer_cleanup);
 953
 954static int atomic_remove_fb(struct drm_framebuffer *fb)
 955{
 956	struct drm_modeset_acquire_ctx ctx;
 957	struct drm_device *dev = fb->dev;
 958	struct drm_atomic_state *state;
 959	struct drm_plane *plane;
 960	struct drm_connector *conn __maybe_unused;
 961	struct drm_connector_state *conn_state;
 962	int i, ret;
 963	unsigned plane_mask;
 964	bool disable_crtcs = false;
 965
 966retry_disable:
 967	drm_modeset_acquire_init(&ctx, 0);
 968
 969	state = drm_atomic_state_alloc(dev);
 970	if (!state) {
 971		ret = -ENOMEM;
 972		goto out;
 973	}
 974	state->acquire_ctx = &ctx;
 975
 976retry:
 977	plane_mask = 0;
 978	ret = drm_modeset_lock_all_ctx(dev, &ctx);
 979	if (ret)
 980		goto unlock;
 981
 982	drm_for_each_plane(plane, dev) {
 983		struct drm_plane_state *plane_state;
 984
 985		if (plane->state->fb != fb)
 986			continue;
 987
 988		plane_state = drm_atomic_get_plane_state(state, plane);
 989		if (IS_ERR(plane_state)) {
 990			ret = PTR_ERR(plane_state);
 991			goto unlock;
 992		}
 993
 994		if (disable_crtcs && plane_state->crtc->primary == plane) {
 995			struct drm_crtc_state *crtc_state;
 996
 997			crtc_state = drm_atomic_get_existing_crtc_state(state, plane_state->crtc);
 998
 999			ret = drm_atomic_add_affected_connectors(state, plane_state->crtc);
1000			if (ret)
1001				goto unlock;
1002
1003			crtc_state->active = false;
1004			ret = drm_atomic_set_mode_for_crtc(crtc_state, NULL);
1005			if (ret)
1006				goto unlock;
1007		}
1008
1009		drm_atomic_set_fb_for_plane(plane_state, NULL);
1010		ret = drm_atomic_set_crtc_for_plane(plane_state, NULL);
1011		if (ret)
1012			goto unlock;
1013
1014		plane_mask |= drm_plane_mask(plane);
1015	}
1016
1017	/* This list is only filled when disable_crtcs is set. */
1018	for_each_new_connector_in_state(state, conn, conn_state, i) {
1019		ret = drm_atomic_set_crtc_for_connector(conn_state, NULL);
1020
1021		if (ret)
1022			goto unlock;
1023	}
1024
1025	if (plane_mask)
1026		ret = drm_atomic_commit(state);
1027
1028unlock:
1029	if (ret == -EDEADLK) {
1030		drm_atomic_state_clear(state);
1031		drm_modeset_backoff(&ctx);
1032		goto retry;
1033	}
1034
1035	drm_atomic_state_put(state);
1036
1037out:
1038	drm_modeset_drop_locks(&ctx);
1039	drm_modeset_acquire_fini(&ctx);
1040
1041	if (ret == -EINVAL && !disable_crtcs) {
1042		disable_crtcs = true;
1043		goto retry_disable;
1044	}
1045
1046	return ret;
1047}
1048
1049static void legacy_remove_fb(struct drm_framebuffer *fb)
1050{
1051	struct drm_device *dev = fb->dev;
1052	struct drm_crtc *crtc;
1053	struct drm_plane *plane;
1054
1055	drm_modeset_lock_all(dev);
1056	/* remove from any CRTC */
1057	drm_for_each_crtc(crtc, dev) {
1058		if (crtc->primary->fb == fb) {
1059			/* should turn off the crtc */
1060			if (drm_crtc_force_disable(crtc))
1061				DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
1062		}
1063	}
1064
1065	drm_for_each_plane(plane, dev) {
1066		if (plane->fb == fb)
1067			drm_plane_force_disable(plane);
1068	}
1069	drm_modeset_unlock_all(dev);
1070}
1071
1072/**
1073 * drm_framebuffer_remove - remove and unreference a framebuffer object
1074 * @fb: framebuffer to remove
1075 *
1076 * Scans all the CRTCs and planes in @dev's mode_config.  If they're
1077 * using @fb, removes it, setting it to NULL. Then drops the reference to the
1078 * passed-in framebuffer. Might take the modeset locks.
1079 *
1080 * Note that this function optimizes the cleanup away if the caller holds the
1081 * last reference to the framebuffer. It is also guaranteed to not take the
1082 * modeset locks in this case.
1083 */
1084void drm_framebuffer_remove(struct drm_framebuffer *fb)
1085{
1086	struct drm_device *dev;
1087
1088	if (!fb)
1089		return;
1090
1091	dev = fb->dev;
1092
1093	WARN_ON(!list_empty(&fb->filp_head));
1094
1095	/*
1096	 * drm ABI mandates that we remove any deleted framebuffers from active
1097	 * useage. But since most sane clients only remove framebuffers they no
1098	 * longer need, try to optimize this away.
1099	 *
1100	 * Since we're holding a reference ourselves, observing a refcount of 1
1101	 * means that we're the last holder and can skip it. Also, the refcount
1102	 * can never increase from 1 again, so we don't need any barriers or
1103	 * locks.
1104	 *
1105	 * Note that userspace could try to race with use and instate a new
1106	 * usage _after_ we've cleared all current ones. End result will be an
1107	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
1108	 * in this manner.
1109	 */
1110	if (drm_framebuffer_read_refcount(fb) > 1) {
1111		if (drm_drv_uses_atomic_modeset(dev)) {
1112			int ret = atomic_remove_fb(fb);
1113
1114			WARN(ret, "atomic remove_fb failed with %i\n", ret);
1115		} else
1116			legacy_remove_fb(fb);
1117	}
1118
1119	drm_framebuffer_put(fb);
1120}
1121EXPORT_SYMBOL(drm_framebuffer_remove);
1122
1123/**
1124 * drm_framebuffer_plane_width - width of the plane given the first plane
1125 * @width: width of the first plane
1126 * @fb: the framebuffer
1127 * @plane: plane index
1128 *
1129 * Returns:
1130 * The width of @plane, given that the width of the first plane is @width.
1131 */
1132int drm_framebuffer_plane_width(int width,
1133				const struct drm_framebuffer *fb, int plane)
1134{
1135	if (plane >= fb->format->num_planes)
1136		return 0;
1137
1138	return fb_plane_width(width, fb->format, plane);
1139}
1140EXPORT_SYMBOL(drm_framebuffer_plane_width);
1141
1142/**
1143 * drm_framebuffer_plane_height - height of the plane given the first plane
1144 * @height: height of the first plane
1145 * @fb: the framebuffer
1146 * @plane: plane index
1147 *
1148 * Returns:
1149 * The height of @plane, given that the height of the first plane is @height.
1150 */
1151int drm_framebuffer_plane_height(int height,
1152				 const struct drm_framebuffer *fb, int plane)
1153{
1154	if (plane >= fb->format->num_planes)
1155		return 0;
1156
1157	return fb_plane_height(height, fb->format, plane);
1158}
1159EXPORT_SYMBOL(drm_framebuffer_plane_height);
1160
1161void drm_framebuffer_print_info(struct drm_printer *p, unsigned int indent,
1162				const struct drm_framebuffer *fb)
1163{
1164	struct drm_format_name_buf format_name;
1165	unsigned int i;
1166
1167	drm_printf_indent(p, indent, "allocated by = %s\n", fb->comm);
1168	drm_printf_indent(p, indent, "refcount=%u\n",
1169			  drm_framebuffer_read_refcount(fb));
1170	drm_printf_indent(p, indent, "format=%s\n",
1171			  drm_get_format_name(fb->format->format, &format_name));
1172	drm_printf_indent(p, indent, "modifier=0x%llx\n", fb->modifier);
1173	drm_printf_indent(p, indent, "size=%ux%u\n", fb->width, fb->height);
1174	drm_printf_indent(p, indent, "layers:\n");
1175
1176	for (i = 0; i < fb->format->num_planes; i++) {
1177		drm_printf_indent(p, indent + 1, "size[%u]=%dx%d\n", i,
1178				  drm_framebuffer_plane_width(fb->width, fb, i),
1179				  drm_framebuffer_plane_height(fb->height, fb, i));
1180		drm_printf_indent(p, indent + 1, "pitch[%u]=%u\n", i, fb->pitches[i]);
1181		drm_printf_indent(p, indent + 1, "offset[%u]=%u\n", i, fb->offsets[i]);
1182		drm_printf_indent(p, indent + 1, "obj[%u]:%s\n", i,
1183				  fb->obj[i] ? "" : "(null)");
1184		if (fb->obj[i])
1185			drm_gem_print_info(p, indent + 2, fb->obj[i]);
1186	}
1187}
1188
1189#ifdef CONFIG_DEBUG_FS
1190static int drm_framebuffer_info(struct seq_file *m, void *data)
1191{
1192	struct drm_info_node *node = m->private;
1193	struct drm_device *dev = node->minor->dev;
1194	struct drm_printer p = drm_seq_file_printer(m);
1195	struct drm_framebuffer *fb;
1196
1197	mutex_lock(&dev->mode_config.fb_lock);
1198	drm_for_each_fb(fb, dev) {
1199		drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
1200		drm_framebuffer_print_info(&p, 1, fb);
1201	}
1202	mutex_unlock(&dev->mode_config.fb_lock);
1203
1204	return 0;
1205}
1206
1207static const struct drm_info_list drm_framebuffer_debugfs_list[] = {
1208	{ "framebuffer", drm_framebuffer_info, 0 },
1209};
1210
1211void drm_framebuffer_debugfs_init(struct drm_minor *minor)
1212{
1213	drm_debugfs_create_files(drm_framebuffer_debugfs_list,
1214				 ARRAY_SIZE(drm_framebuffer_debugfs_list),
1215				 minor->debugfs_root, minor);
1216}
1217#endif