1/*
   2 * Copyright (c) 2016 Intel Corporation
   3 *
   4 * Permission to use, copy, modify, distribute, and sell this software and its
   5 * documentation for any purpose is hereby granted without fee, provided that
   6 * the above copyright notice appear in all copies and that both that copyright
   7 * notice and this permission notice appear in supporting documentation, and
   8 * that the name of the copyright holders not be used in advertising or
   9 * publicity pertaining to distribution of the software without specific,
  10 * written prior permission.  The copyright holders make no representations
  11 * about the suitability of this software for any purpose.  It is provided "as
  12 * is" without express or implied warranty.
  13 *
  14 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  15 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  16 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  17 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  18 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  19 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  20 * OF THIS SOFTWARE.
  21 */
  22
  23#include <linux/slab.h>
  24#include <linux/uaccess.h>
  25
  26#include <drm/drm_plane.h>
  27#include <drm/drm_drv.h>
  28#include <drm/drm_print.h>
  29#include <drm/drm_framebuffer.h>
  30#include <drm/drm_file.h>
  31#include <drm/drm_crtc.h>
  32#include <drm/drm_fourcc.h>
  33#include <drm/drm_managed.h>
  34#include <drm/drm_vblank.h>
  35
  36#include "drm_crtc_internal.h"
  37
  38/**
  39 * DOC: overview
  40 *
  41 * A plane represents an image source that can be blended with or overlaid on
  42 * top of a CRTC during the scanout process. Planes take their input data from a
  43 * &drm_framebuffer object. The plane itself specifies the cropping and scaling
  44 * of that image, and where it is placed on the visible area of a display
  45 * pipeline, represented by &drm_crtc. A plane can also have additional
  46 * properties that specify how the pixels are positioned and blended, like
  47 * rotation or Z-position. All these properties are stored in &drm_plane_state.
  48 *
  49 * Unless explicitly specified (via CRTC property or otherwise), the active area
  50 * of a CRTC will be black by default. This means portions of the active area
  51 * which are not covered by a plane will be black, and alpha blending of any
  52 * planes with the CRTC background will blend with black at the lowest zpos.
  53 *
  54 * To create a plane, a KMS drivers allocates and zeroes an instances of
  55 * &struct drm_plane (possibly as part of a larger structure) and registers it
  56 * with a call to drm_universal_plane_init().
  57 *
  58 * Each plane has a type, see enum drm_plane_type. A plane can be compatible
  59 * with multiple CRTCs, see &drm_plane.possible_crtcs.
  60 *
  61 * Each CRTC must have a unique primary plane userspace can attach to enable
  62 * the CRTC. In other words, userspace must be able to attach a different
  63 * primary plane to each CRTC at the same time. Primary planes can still be
  64 * compatible with multiple CRTCs. There must be exactly as many primary planes
  65 * as there are CRTCs.
  66 *
  67 * Legacy uAPI doesn't expose the primary and cursor planes directly. DRM core
  68 * relies on the driver to set the primary and optionally the cursor plane used
  69 * for legacy IOCTLs. This is done by calling drm_crtc_init_with_planes(). All
  70 * drivers must provide one primary plane per CRTC to avoid surprising legacy
  71 * userspace too much.
  72 */
  73
  74/**
  75 * DOC: standard plane properties
  76 *
  77 * DRM planes have a few standardized properties:
  78 *
  79 * type:
  80 *     Immutable property describing the type of the plane.
  81 *
  82 *     For user-space which has enabled the &DRM_CLIENT_CAP_ATOMIC capability,
  83 *     the plane type is just a hint and is mostly superseded by atomic
  84 *     test-only commits. The type hint can still be used to come up more
  85 *     easily with a plane configuration accepted by the driver.
  86 *
  87 *     The value of this property can be one of the following:
  88 *
  89 *     "Primary":
  90 *         To light up a CRTC, attaching a primary plane is the most likely to
  91 *         work if it covers the whole CRTC and doesn't have scaling or
  92 *         cropping set up.
  93 *
  94 *         Drivers may support more features for the primary plane, user-space
  95 *         can find out with test-only atomic commits.
  96 *
  97 *         Some primary planes are implicitly used by the kernel in the legacy
  98 *         IOCTLs &DRM_IOCTL_MODE_SETCRTC and &DRM_IOCTL_MODE_PAGE_FLIP.
  99 *         Therefore user-space must not mix explicit usage of any primary
 100 *         plane (e.g. through an atomic commit) with these legacy IOCTLs.
 101 *
 102 *     "Cursor":
 103 *         To enable this plane, using a framebuffer configured without scaling
 104 *         or cropping and with the following properties is the most likely to
 105 *         work:
 106 *
 107 *         - If the driver provides the capabilities &DRM_CAP_CURSOR_WIDTH and
 108 *           &DRM_CAP_CURSOR_HEIGHT, create the framebuffer with this size.
 109 *           Otherwise, create a framebuffer with the size 64x64.
 110 *         - If the driver doesn't support modifiers, create a framebuffer with
 111 *           a linear layout. Otherwise, use the IN_FORMATS plane property.
 112 *
 113 *         Drivers may support more features for the cursor plane, user-space
 114 *         can find out with test-only atomic commits.
 115 *
 116 *         Some cursor planes are implicitly used by the kernel in the legacy
 117 *         IOCTLs &DRM_IOCTL_MODE_CURSOR and &DRM_IOCTL_MODE_CURSOR2.
 118 *         Therefore user-space must not mix explicit usage of any cursor
 119 *         plane (e.g. through an atomic commit) with these legacy IOCTLs.
 120 *
 121 *         Some drivers may support cursors even if no cursor plane is exposed.
 122 *         In this case, the legacy cursor IOCTLs can be used to configure the
 123 *         cursor.
 124 *
 125 *     "Overlay":
 126 *         Neither primary nor cursor.
 127 *
 128 *         Overlay planes are the only planes exposed when the
 129 *         &DRM_CLIENT_CAP_UNIVERSAL_PLANES capability is disabled.
 130 *
 131 * IN_FORMATS:
 132 *     Blob property which contains the set of buffer format and modifier
 133 *     pairs supported by this plane. The blob is a struct
 134 *     drm_format_modifier_blob. Without this property the plane doesn't
 135 *     support buffers with modifiers. Userspace cannot change this property.
 136 *
 137 *     Note that userspace can check the &DRM_CAP_ADDFB2_MODIFIERS driver
 138 *     capability for general modifier support. If this flag is set then every
 139 *     plane will have the IN_FORMATS property, even when it only supports
 140 *     DRM_FORMAT_MOD_LINEAR. Before linux kernel release v5.1 there have been
 141 *     various bugs in this area with inconsistencies between the capability
 142 *     flag and per-plane properties.
 143 */
 144
 145static unsigned int drm_num_planes(struct drm_device *dev)
 146{
 147	unsigned int num = 0;
 148	struct drm_plane *tmp;
 149
 150	drm_for_each_plane(tmp, dev) {
 151		num++;
 152	}
 153
 154	return num;
 155}
 156
 157static inline u32 *
 158formats_ptr(struct drm_format_modifier_blob *blob)
 159{
 160	return (u32 *)(((char *)blob) + blob->formats_offset);
 161}
 162
 163static inline struct drm_format_modifier *
 164modifiers_ptr(struct drm_format_modifier_blob *blob)
 165{
 166	return (struct drm_format_modifier *)(((char *)blob) + blob->modifiers_offset);
 167}
 168
 169static int create_in_format_blob(struct drm_device *dev, struct drm_plane *plane)
 170{
 171	const struct drm_mode_config *config = &dev->mode_config;
 172	struct drm_property_blob *blob;
 173	struct drm_format_modifier *mod;
 174	size_t blob_size, formats_size, modifiers_size;
 175	struct drm_format_modifier_blob *blob_data;
 176	unsigned int i, j;
 177
 178	formats_size = sizeof(__u32) * plane->format_count;
 179	if (WARN_ON(!formats_size)) {
 180		/* 0 formats are never expected */
 181		return 0;
 182	}
 183
 184	modifiers_size =
 185		sizeof(struct drm_format_modifier) * plane->modifier_count;
 186
 187	blob_size = sizeof(struct drm_format_modifier_blob);
 188	/* Modifiers offset is a pointer to a struct with a 64 bit field so it
 189	 * should be naturally aligned to 8B.
 190	 */
 191	BUILD_BUG_ON(sizeof(struct drm_format_modifier_blob) % 8);
 192	blob_size += ALIGN(formats_size, 8);
 193	blob_size += modifiers_size;
 194
 195	blob = drm_property_create_blob(dev, blob_size, NULL);
 196	if (IS_ERR(blob))
 197		return -1;
 198
 199	blob_data = blob->data;
 200	blob_data->version = FORMAT_BLOB_CURRENT;
 201	blob_data->count_formats = plane->format_count;
 202	blob_data->formats_offset = sizeof(struct drm_format_modifier_blob);
 203	blob_data->count_modifiers = plane->modifier_count;
 204
 205	blob_data->modifiers_offset =
 206		ALIGN(blob_data->formats_offset + formats_size, 8);
 207
 208	memcpy(formats_ptr(blob_data), plane->format_types, formats_size);
 209
 210	mod = modifiers_ptr(blob_data);
 211	for (i = 0; i < plane->modifier_count; i++) {
 212		for (j = 0; j < plane->format_count; j++) {
 213			if (!plane->funcs->format_mod_supported ||
 214			    plane->funcs->format_mod_supported(plane,
 215							       plane->format_types[j],
 216							       plane->modifiers[i])) {
 217				mod->formats |= 1ULL << j;
 218			}
 219		}
 220
 221		mod->modifier = plane->modifiers[i];
 222		mod->offset = 0;
 223		mod->pad = 0;
 224		mod++;
 225	}
 226
 227	drm_object_attach_property(&plane->base, config->modifiers_property,
 228				   blob->base.id);
 229
 230	return 0;
 231}
 232
 233/**
 234 * DOC: hotspot properties
 235 *
 236 * HOTSPOT_X: property to set mouse hotspot x offset.
 237 * HOTSPOT_Y: property to set mouse hotspot y offset.
 238 *
 239 * When the plane is being used as a cursor image to display a mouse pointer,
 240 * the "hotspot" is the offset within the cursor image where mouse events
 241 * are expected to go.
 242 *
 243 * Positive values move the hotspot from the top-left corner of the cursor
 244 * plane towards the right and bottom.
 245 *
 246 * Most display drivers do not need this information because the
 247 * hotspot is not actually connected to anything visible on screen.
 248 * However, this is necessary for display drivers like the para-virtualized
 249 * drivers (eg qxl, vbox, virtio, vmwgfx), that are attached to a user console
 250 * with a mouse pointer.  Since these consoles are often being remoted over a
 251 * network, they would otherwise have to wait to display the pointer movement to
 252 * the user until a full network round-trip has occurred.  New mouse events have
 253 * to be sent from the user's console, over the network to the virtual input
 254 * devices, forwarded to the desktop for processing, and then the cursor plane's
 255 * position can be updated and sent back to the user's console over the network.
 256 * Instead, with the hotspot information, the console can anticipate the new
 257 * location, and draw the mouse cursor there before the confirmation comes in.
 258 * To do that correctly, the user's console must be able predict how the
 259 * desktop will process mouse events, which normally requires the desktop's
 260 * mouse topology information, ie where each CRTC sits in the mouse coordinate
 261 * space.  This is typically sent to the para-virtualized drivers using some
 262 * driver-specific method, and the driver then forwards it to the console by
 263 * way of the virtual display device or hypervisor.
 264 *
 265 * The assumption is generally made that there is only one cursor plane being
 266 * used this way at a time, and that the desktop is feeding all mouse devices
 267 * into the same global pointer.  Para-virtualized drivers that require this
 268 * should only be exposing a single cursor plane, or find some other way
 269 * to coordinate with a userspace desktop that supports multiple pointers.
 270 * If the hotspot properties are set, the cursor plane is therefore assumed to be
 271 * used only for displaying a mouse cursor image, and the position of the combined
 272 * cursor plane + offset can therefore be used for coordinating with input from a
 273 * mouse device.
 274 *
 275 * The cursor will then be drawn either at the location of the plane in the CRTC
 276 * console, or as a free-floating cursor plane on the user's console
 277 * corresponding to their desktop mouse position.
 278 *
 279 * DRM clients which would like to work correctly on drivers which expose
 280 * hotspot properties should advertise DRM_CLIENT_CAP_CURSOR_PLANE_HOTSPOT.
 281 * Setting this property on drivers which do not special case
 282 * cursor planes will return EOPNOTSUPP, which can be used by userspace to
 283 * gauge requirements of the hardware/drivers they're running on. Advertising
 284 * DRM_CLIENT_CAP_CURSOR_PLANE_HOTSPOT implies that the userspace client will be
 285 * correctly setting the hotspot properties.
 286 */
 287
 288/**
 289 * drm_plane_create_hotspot_properties - creates the mouse hotspot
 290 * properties and attaches them to the given cursor plane
 291 *
 292 * @plane: drm cursor plane
 293 *
 294 * This function enables the mouse hotspot property on a given
 295 * cursor plane. Look at the documentation for hotspot properties
 296 * to get a better understanding for what they're used for.
 297 *
 298 * RETURNS:
 299 * Zero for success or -errno
 300 */
 301static int drm_plane_create_hotspot_properties(struct drm_plane *plane)
 302{
 303	struct drm_property *prop_x;
 304	struct drm_property *prop_y;
 305
 306	drm_WARN_ON(plane->dev,
 307		    !drm_core_check_feature(plane->dev,
 308					    DRIVER_CURSOR_HOTSPOT));
 309
 310	prop_x = drm_property_create_signed_range(plane->dev, 0, "HOTSPOT_X",
 311						  INT_MIN, INT_MAX);
 312	if (IS_ERR(prop_x))
 313		return PTR_ERR(prop_x);
 314
 315	prop_y = drm_property_create_signed_range(plane->dev, 0, "HOTSPOT_Y",
 316						  INT_MIN, INT_MAX);
 317	if (IS_ERR(prop_y)) {
 318		drm_property_destroy(plane->dev, prop_x);
 319		return PTR_ERR(prop_y);
 320	}
 321
 322	drm_object_attach_property(&plane->base, prop_x, 0);
 323	drm_object_attach_property(&plane->base, prop_y, 0);
 324	plane->hotspot_x_property = prop_x;
 325	plane->hotspot_y_property = prop_y;
 326
 327	return 0;
 328}
 329
 330__printf(9, 0)
 331static int __drm_universal_plane_init(struct drm_device *dev,
 332				      struct drm_plane *plane,
 333				      uint32_t possible_crtcs,
 334				      const struct drm_plane_funcs *funcs,
 335				      const uint32_t *formats,
 336				      unsigned int format_count,
 337				      const uint64_t *format_modifiers,
 338				      enum drm_plane_type type,
 339				      const char *name, va_list ap)
 340{
 341	struct drm_mode_config *config = &dev->mode_config;
 342	static const uint64_t default_modifiers[] = {
 343		DRM_FORMAT_MOD_LINEAR,
 344	};
 345	unsigned int format_modifier_count = 0;
 346	int ret;
 347
 348	/* plane index is used with 32bit bitmasks */
 349	if (WARN_ON(config->num_total_plane >= 32))
 350		return -EINVAL;
 351
 352	/*
 353	 * First driver to need more than 64 formats needs to fix this. Each
 354	 * format is encoded as a bit and the current code only supports a u64.
 355	 */
 356	if (WARN_ON(format_count > 64))
 357		return -EINVAL;
 358
 359	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
 360		(!funcs->atomic_destroy_state ||
 361		 !funcs->atomic_duplicate_state));
 362
 363	ret = drm_mode_object_add(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
 364	if (ret)
 365		return ret;
 366
 367	drm_modeset_lock_init(&plane->mutex);
 368
 369	plane->base.properties = &plane->properties;
 370	plane->dev = dev;
 371	plane->funcs = funcs;
 372	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
 373					    GFP_KERNEL);
 374	if (!plane->format_types) {
 375		DRM_DEBUG_KMS("out of memory when allocating plane\n");
 376		drm_mode_object_unregister(dev, &plane->base);
 377		return -ENOMEM;
 378	}
 379
 380	if (format_modifiers) {
 381		const uint64_t *temp_modifiers = format_modifiers;
 382
 383		while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
 384			format_modifier_count++;
 385	} else {
 386		if (!dev->mode_config.fb_modifiers_not_supported) {
 387			format_modifiers = default_modifiers;
 388			format_modifier_count = ARRAY_SIZE(default_modifiers);
 389		}
 390	}
 391
 392	/* autoset the cap and check for consistency across all planes */
 393	drm_WARN_ON(dev, config->fb_modifiers_not_supported &&
 394				format_modifier_count);
 395
 396	plane->modifier_count = format_modifier_count;
 397	plane->modifiers = kmalloc_array(format_modifier_count,
 398					 sizeof(format_modifiers[0]),
 399					 GFP_KERNEL);
 400
 401	if (format_modifier_count && !plane->modifiers) {
 402		DRM_DEBUG_KMS("out of memory when allocating plane\n");
 403		kfree(plane->format_types);
 404		drm_mode_object_unregister(dev, &plane->base);
 405		return -ENOMEM;
 406	}
 407
 408	if (name) {
 409		plane->name = kvasprintf(GFP_KERNEL, name, ap);
 410	} else {
 411		plane->name = kasprintf(GFP_KERNEL, "plane-%d",
 412					drm_num_planes(dev));
 413	}
 414	if (!plane->name) {
 415		kfree(plane->format_types);
 416		kfree(plane->modifiers);
 417		drm_mode_object_unregister(dev, &plane->base);
 418		return -ENOMEM;
 419	}
 420
 421	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
 422	plane->format_count = format_count;
 423	memcpy(plane->modifiers, format_modifiers,
 424	       format_modifier_count * sizeof(format_modifiers[0]));
 425	plane->possible_crtcs = possible_crtcs;
 426	plane->type = type;
 427
 428	list_add_tail(&plane->head, &config->plane_list);
 429	plane->index = config->num_total_plane++;
 430
 431	drm_object_attach_property(&plane->base,
 432				   config->plane_type_property,
 433				   plane->type);
 434
 435	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
 436		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
 437		drm_object_attach_property(&plane->base, config->prop_in_fence_fd, -1);
 438		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
 439		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
 440		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
 441		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
 442		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
 443		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
 444		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
 445		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
 446		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
 447	}
 448	if (drm_core_check_feature(dev, DRIVER_CURSOR_HOTSPOT) &&
 449	    type == DRM_PLANE_TYPE_CURSOR) {
 450		drm_plane_create_hotspot_properties(plane);
 451	}
 452
 453	if (format_modifier_count)
 454		create_in_format_blob(dev, plane);
 455
 456	return 0;
 457}
 458
 459/**
 460 * drm_universal_plane_init - Initialize a new universal plane object
 461 * @dev: DRM device
 462 * @plane: plane object to init
 463 * @possible_crtcs: bitmask of possible CRTCs
 464 * @funcs: callbacks for the new plane
 465 * @formats: array of supported formats (DRM_FORMAT\_\*)
 466 * @format_count: number of elements in @formats
 467 * @format_modifiers: array of struct drm_format modifiers terminated by
 468 *                    DRM_FORMAT_MOD_INVALID
 469 * @type: type of plane (overlay, primary, cursor)
 470 * @name: printf style format string for the plane name, or NULL for default name
 471 *
 472 * Initializes a plane object of type @type. The &drm_plane_funcs.destroy hook
 473 * should call drm_plane_cleanup() and kfree() the plane structure. The plane
 474 * structure should not be allocated with devm_kzalloc().
 475 *
 476 * Note: consider using drmm_universal_plane_alloc() instead of
 477 * drm_universal_plane_init() to let the DRM managed resource infrastructure
 478 * take care of cleanup and deallocation.
 479 *
 480 * Drivers that only support the DRM_FORMAT_MOD_LINEAR modifier support may set
 481 * @format_modifiers to NULL. The plane will advertise the linear modifier.
 482 *
 483 * Returns:
 484 * Zero on success, error code on failure.
 485 */
 486int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
 487			     uint32_t possible_crtcs,
 488			     const struct drm_plane_funcs *funcs,
 489			     const uint32_t *formats, unsigned int format_count,
 490			     const uint64_t *format_modifiers,
 491			     enum drm_plane_type type,
 492			     const char *name, ...)
 493{
 494	va_list ap;
 495	int ret;
 496
 497	WARN_ON(!funcs->destroy);
 498
 499	va_start(ap, name);
 500	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
 501					 formats, format_count, format_modifiers,
 502					 type, name, ap);
 503	va_end(ap);
 504	return ret;
 505}
 506EXPORT_SYMBOL(drm_universal_plane_init);
 507
 508static void drmm_universal_plane_alloc_release(struct drm_device *dev, void *ptr)
 509{
 510	struct drm_plane *plane = ptr;
 511
 512	if (WARN_ON(!plane->dev))
 513		return;
 514
 515	drm_plane_cleanup(plane);
 516}
 517
 518void *__drmm_universal_plane_alloc(struct drm_device *dev, size_t size,
 519				   size_t offset, uint32_t possible_crtcs,
 520				   const struct drm_plane_funcs *funcs,
 521				   const uint32_t *formats, unsigned int format_count,
 522				   const uint64_t *format_modifiers,
 523				   enum drm_plane_type type,
 524				   const char *name, ...)
 525{
 526	void *container;
 527	struct drm_plane *plane;
 528	va_list ap;
 529	int ret;
 530
 531	if (WARN_ON(!funcs || funcs->destroy))
 532		return ERR_PTR(-EINVAL);
 533
 534	container = drmm_kzalloc(dev, size, GFP_KERNEL);
 535	if (!container)
 536		return ERR_PTR(-ENOMEM);
 537
 538	plane = container + offset;
 539
 540	va_start(ap, name);
 541	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
 542					 formats, format_count, format_modifiers,
 543					 type, name, ap);
 544	va_end(ap);
 545	if (ret)
 546		return ERR_PTR(ret);
 547
 548	ret = drmm_add_action_or_reset(dev, drmm_universal_plane_alloc_release,
 549				       plane);
 550	if (ret)
 551		return ERR_PTR(ret);
 552
 553	return container;
 554}
 555EXPORT_SYMBOL(__drmm_universal_plane_alloc);
 556
 557void *__drm_universal_plane_alloc(struct drm_device *dev, size_t size,
 558				  size_t offset, uint32_t possible_crtcs,
 559				  const struct drm_plane_funcs *funcs,
 560				  const uint32_t *formats, unsigned int format_count,
 561				  const uint64_t *format_modifiers,
 562				  enum drm_plane_type type,
 563				  const char *name, ...)
 564{
 565	void *container;
 566	struct drm_plane *plane;
 567	va_list ap;
 568	int ret;
 569
 570	if (drm_WARN_ON(dev, !funcs))
 571		return ERR_PTR(-EINVAL);
 572
 573	container = kzalloc(size, GFP_KERNEL);
 574	if (!container)
 575		return ERR_PTR(-ENOMEM);
 576
 577	plane = container + offset;
 578
 579	va_start(ap, name);
 580	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
 581					 formats, format_count, format_modifiers,
 582					 type, name, ap);
 583	va_end(ap);
 584	if (ret)
 585		goto err_kfree;
 586
 587	return container;
 588
 589err_kfree:
 590	kfree(container);
 591	return ERR_PTR(ret);
 592}
 593EXPORT_SYMBOL(__drm_universal_plane_alloc);
 594
 595int drm_plane_register_all(struct drm_device *dev)
 596{
 597	unsigned int num_planes = 0;
 598	unsigned int num_zpos = 0;
 599	struct drm_plane *plane;
 600	int ret = 0;
 601
 602	drm_for_each_plane(plane, dev) {
 603		if (plane->funcs->late_register)
 604			ret = plane->funcs->late_register(plane);
 605		if (ret)
 606			return ret;
 607
 608		if (plane->zpos_property)
 609			num_zpos++;
 610		num_planes++;
 611	}
 612
 613	drm_WARN(dev, num_zpos && num_planes != num_zpos,
 614		 "Mixing planes with and without zpos property is invalid\n");
 615
 616	return 0;
 617}
 618
 619void drm_plane_unregister_all(struct drm_device *dev)
 620{
 621	struct drm_plane *plane;
 622
 623	drm_for_each_plane(plane, dev) {
 624		if (plane->funcs->early_unregister)
 625			plane->funcs->early_unregister(plane);
 626	}
 627}
 628
 629/**
 630 * drm_plane_cleanup - Clean up the core plane usage
 631 * @plane: plane to cleanup
 632 *
 633 * This function cleans up @plane and removes it from the DRM mode setting
 634 * core. Note that the function does *not* free the plane structure itself,
 635 * this is the responsibility of the caller.
 636 */
 637void drm_plane_cleanup(struct drm_plane *plane)
 638{
 639	struct drm_device *dev = plane->dev;
 640
 641	drm_modeset_lock_fini(&plane->mutex);
 642
 643	kfree(plane->format_types);
 644	kfree(plane->modifiers);
 645	drm_mode_object_unregister(dev, &plane->base);
 646
 647	BUG_ON(list_empty(&plane->head));
 648
 649	/* Note that the plane_list is considered to be static; should we
 650	 * remove the drm_plane at runtime we would have to decrement all
 651	 * the indices on the drm_plane after us in the plane_list.
 652	 */
 653
 654	list_del(&plane->head);
 655	dev->mode_config.num_total_plane--;
 656
 657	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
 658	if (plane->state && plane->funcs->atomic_destroy_state)
 659		plane->funcs->atomic_destroy_state(plane, plane->state);
 660
 661	kfree(plane->name);
 662
 663	memset(plane, 0, sizeof(*plane));
 664}
 665EXPORT_SYMBOL(drm_plane_cleanup);
 666
 667/**
 668 * drm_plane_from_index - find the registered plane at an index
 669 * @dev: DRM device
 670 * @idx: index of registered plane to find for
 671 *
 672 * Given a plane index, return the registered plane from DRM device's
 673 * list of planes with matching index. This is the inverse of drm_plane_index().
 674 */
 675struct drm_plane *
 676drm_plane_from_index(struct drm_device *dev, int idx)
 677{
 678	struct drm_plane *plane;
 679
 680	drm_for_each_plane(plane, dev)
 681		if (idx == plane->index)
 682			return plane;
 683
 684	return NULL;
 685}
 686EXPORT_SYMBOL(drm_plane_from_index);
 687
 688/**
 689 * drm_plane_force_disable - Forcibly disable a plane
 690 * @plane: plane to disable
 691 *
 692 * Forces the plane to be disabled.
 693 *
 694 * Used when the plane's current framebuffer is destroyed,
 695 * and when restoring fbdev mode.
 696 *
 697 * Note that this function is not suitable for atomic drivers, since it doesn't
 698 * wire through the lock acquisition context properly and hence can't handle
 699 * retries or driver private locks. You probably want to use
 700 * drm_atomic_helper_disable_plane() or
 701 * drm_atomic_helper_disable_planes_on_crtc() instead.
 702 */
 703void drm_plane_force_disable(struct drm_plane *plane)
 704{
 705	int ret;
 706
 707	if (!plane->fb)
 708		return;
 709
 710	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
 711
 712	plane->old_fb = plane->fb;
 713	ret = plane->funcs->disable_plane(plane, NULL);
 714	if (ret) {
 715		DRM_ERROR("failed to disable plane with busy fb\n");
 716		plane->old_fb = NULL;
 717		return;
 718	}
 719	/* disconnect the plane from the fb and crtc: */
 720	drm_framebuffer_put(plane->old_fb);
 721	plane->old_fb = NULL;
 722	plane->fb = NULL;
 723	plane->crtc = NULL;
 724}
 725EXPORT_SYMBOL(drm_plane_force_disable);
 726
 727/**
 728 * drm_mode_plane_set_obj_prop - set the value of a property
 729 * @plane: drm plane object to set property value for
 730 * @property: property to set
 731 * @value: value the property should be set to
 732 *
 733 * This functions sets a given property on a given plane object. This function
 734 * calls the driver's ->set_property callback and changes the software state of
 735 * the property if the callback succeeds.
 736 *
 737 * Returns:
 738 * Zero on success, error code on failure.
 739 */
 740int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
 741				struct drm_property *property,
 742				uint64_t value)
 743{
 744	int ret = -EINVAL;
 745	struct drm_mode_object *obj = &plane->base;
 746
 747	if (plane->funcs->set_property)
 748		ret = plane->funcs->set_property(plane, property, value);
 749	if (!ret)
 750		drm_object_property_set_value(obj, property, value);
 751
 752	return ret;
 753}
 754EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
 755
 756int drm_mode_getplane_res(struct drm_device *dev, void *data,
 757			  struct drm_file *file_priv)
 758{
 759	struct drm_mode_get_plane_res *plane_resp = data;
 760	struct drm_plane *plane;
 761	uint32_t __user *plane_ptr;
 762	int count = 0;
 763
 764	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 765		return -EOPNOTSUPP;
 766
 767	plane_ptr = u64_to_user_ptr(plane_resp->plane_id_ptr);
 768
 769	/*
 770	 * This ioctl is called twice, once to determine how much space is
 771	 * needed, and the 2nd time to fill it.
 772	 */
 773	drm_for_each_plane(plane, dev) {
 774		/*
 775		 * Unless userspace set the 'universal planes'
 776		 * capability bit, only advertise overlays.
 777		 */
 778		if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
 779		    !file_priv->universal_planes)
 780			continue;
 781
 782		/*
 783		 * If we're running on a virtualized driver then,
 784		 * unless userspace advertizes support for the
 785		 * virtualized cursor plane, disable cursor planes
 786		 * because they'll be broken due to missing cursor
 787		 * hotspot info.
 788		 */
 789		if (plane->type == DRM_PLANE_TYPE_CURSOR &&
 790		    drm_core_check_feature(dev, DRIVER_CURSOR_HOTSPOT) &&
 791		    file_priv->atomic &&
 792		    !file_priv->supports_virtualized_cursor_plane)
 793			continue;
 794
 795		if (drm_lease_held(file_priv, plane->base.id)) {
 796			if (count < plane_resp->count_planes &&
 797			    put_user(plane->base.id, plane_ptr + count))
 798				return -EFAULT;
 799			count++;
 800		}
 801	}
 802	plane_resp->count_planes = count;
 803
 804	return 0;
 805}
 806
 807int drm_mode_getplane(struct drm_device *dev, void *data,
 808		      struct drm_file *file_priv)
 809{
 810	struct drm_mode_get_plane *plane_resp = data;
 811	struct drm_plane *plane;
 812	uint32_t __user *format_ptr;
 813
 814	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 815		return -EOPNOTSUPP;
 816
 817	plane = drm_plane_find(dev, file_priv, plane_resp->plane_id);
 818	if (!plane)
 819		return -ENOENT;
 820
 821	drm_modeset_lock(&plane->mutex, NULL);
 822	if (plane->state && plane->state->crtc && drm_lease_held(file_priv, plane->state->crtc->base.id))
 823		plane_resp->crtc_id = plane->state->crtc->base.id;
 824	else if (!plane->state && plane->crtc && drm_lease_held(file_priv, plane->crtc->base.id))
 825		plane_resp->crtc_id = plane->crtc->base.id;
 826	else
 827		plane_resp->crtc_id = 0;
 828
 829	if (plane->state && plane->state->fb)
 830		plane_resp->fb_id = plane->state->fb->base.id;
 831	else if (!plane->state && plane->fb)
 832		plane_resp->fb_id = plane->fb->base.id;
 833	else
 834		plane_resp->fb_id = 0;
 835	drm_modeset_unlock(&plane->mutex);
 836
 837	plane_resp->plane_id = plane->base.id;
 838	plane_resp->possible_crtcs = drm_lease_filter_crtcs(file_priv,
 839							    plane->possible_crtcs);
 840
 841	plane_resp->gamma_size = 0;
 842
 843	/*
 844	 * This ioctl is called twice, once to determine how much space is
 845	 * needed, and the 2nd time to fill it.
 846	 */
 847	if (plane->format_count &&
 848	    (plane_resp->count_format_types >= plane->format_count)) {
 849		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
 850		if (copy_to_user(format_ptr,
 851				 plane->format_types,
 852				 sizeof(uint32_t) * plane->format_count)) {
 853			return -EFAULT;
 854		}
 855	}
 856	plane_resp->count_format_types = plane->format_count;
 857
 858	return 0;
 859}
 860
 861int drm_plane_check_pixel_format(struct drm_plane *plane,
 862				 u32 format, u64 modifier)
 863{
 864	unsigned int i;
 865
 866	for (i = 0; i < plane->format_count; i++) {
 867		if (format == plane->format_types[i])
 868			break;
 869	}
 870	if (i == plane->format_count)
 871		return -EINVAL;
 872
 873	if (plane->funcs->format_mod_supported) {
 874		if (!plane->funcs->format_mod_supported(plane, format, modifier))
 875			return -EINVAL;
 876	} else {
 877		if (!plane->modifier_count)
 878			return 0;
 879
 880		for (i = 0; i < plane->modifier_count; i++) {
 881			if (modifier == plane->modifiers[i])
 882				break;
 883		}
 884		if (i == plane->modifier_count)
 885			return -EINVAL;
 886	}
 887
 888	return 0;
 889}
 890
 891static int __setplane_check(struct drm_plane *plane,
 892			    struct drm_crtc *crtc,
 893			    struct drm_framebuffer *fb,
 894			    int32_t crtc_x, int32_t crtc_y,
 895			    uint32_t crtc_w, uint32_t crtc_h,
 896			    uint32_t src_x, uint32_t src_y,
 897			    uint32_t src_w, uint32_t src_h)
 898{
 899	int ret;
 900
 901	/* Check whether this plane is usable on this CRTC */
 902	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
 903		DRM_DEBUG_KMS("Invalid crtc for plane\n");
 904		return -EINVAL;
 905	}
 906
 907	/* Check whether this plane supports the fb pixel format. */
 908	ret = drm_plane_check_pixel_format(plane, fb->format->format,
 909					   fb->modifier);
 910	if (ret) {
 911		DRM_DEBUG_KMS("Invalid pixel format %p4cc, modifier 0x%llx\n",
 912			      &fb->format->format, fb->modifier);
 913		return ret;
 914	}
 915
 916	/* Give drivers some help against integer overflows */
 917	if (crtc_w > INT_MAX ||
 918	    crtc_x > INT_MAX - (int32_t) crtc_w ||
 919	    crtc_h > INT_MAX ||
 920	    crtc_y > INT_MAX - (int32_t) crtc_h) {
 921		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
 922			      crtc_w, crtc_h, crtc_x, crtc_y);
 923		return -ERANGE;
 924	}
 925
 926	ret = drm_framebuffer_check_src_coords(src_x, src_y, src_w, src_h, fb);
 927	if (ret)
 928		return ret;
 929
 930	return 0;
 931}
 932
 933/**
 934 * drm_any_plane_has_format - Check whether any plane supports this format and modifier combination
 935 * @dev: DRM device
 936 * @format: pixel format (DRM_FORMAT_*)
 937 * @modifier: data layout modifier
 938 *
 939 * Returns:
 940 * Whether at least one plane supports the specified format and modifier combination.
 941 */
 942bool drm_any_plane_has_format(struct drm_device *dev,
 943			      u32 format, u64 modifier)
 944{
 945	struct drm_plane *plane;
 946
 947	drm_for_each_plane(plane, dev) {
 948		if (drm_plane_check_pixel_format(plane, format, modifier) == 0)
 949			return true;
 950	}
 951
 952	return false;
 953}
 954EXPORT_SYMBOL(drm_any_plane_has_format);
 955
 956/*
 957 * __setplane_internal - setplane handler for internal callers
 958 *
 959 * This function will take a reference on the new fb for the plane
 960 * on success.
 961 *
 962 * src_{x,y,w,h} are provided in 16.16 fixed point format
 963 */
 964static int __setplane_internal(struct drm_plane *plane,
 965			       struct drm_crtc *crtc,
 966			       struct drm_framebuffer *fb,
 967			       int32_t crtc_x, int32_t crtc_y,
 968			       uint32_t crtc_w, uint32_t crtc_h,
 969			       /* src_{x,y,w,h} values are 16.16 fixed point */
 970			       uint32_t src_x, uint32_t src_y,
 971			       uint32_t src_w, uint32_t src_h,
 972			       struct drm_modeset_acquire_ctx *ctx)
 973{
 974	int ret = 0;
 975
 976	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
 977
 978	/* No fb means shut it down */
 979	if (!fb) {
 980		plane->old_fb = plane->fb;
 981		ret = plane->funcs->disable_plane(plane, ctx);
 982		if (!ret) {
 983			plane->crtc = NULL;
 984			plane->fb = NULL;
 985		} else {
 986			plane->old_fb = NULL;
 987		}
 988		goto out;
 989	}
 990
 991	ret = __setplane_check(plane, crtc, fb,
 992			       crtc_x, crtc_y, crtc_w, crtc_h,
 993			       src_x, src_y, src_w, src_h);
 994	if (ret)
 995		goto out;
 996
 997	plane->old_fb = plane->fb;
 998	ret = plane->funcs->update_plane(plane, crtc, fb,
 999					 crtc_x, crtc_y, crtc_w, crtc_h,
1000					 src_x, src_y, src_w, src_h, ctx);
1001	if (!ret) {
1002		plane->crtc = crtc;
1003		plane->fb = fb;
1004		drm_framebuffer_get(plane->fb);
1005	} else {
1006		plane->old_fb = NULL;
1007	}
1008
1009out:
1010	if (plane->old_fb)
1011		drm_framebuffer_put(plane->old_fb);
1012	plane->old_fb = NULL;
1013
1014	return ret;
1015}
1016
1017static int __setplane_atomic(struct drm_plane *plane,
1018			     struct drm_crtc *crtc,
1019			     struct drm_framebuffer *fb,
1020			     int32_t crtc_x, int32_t crtc_y,
1021			     uint32_t crtc_w, uint32_t crtc_h,
1022			     uint32_t src_x, uint32_t src_y,
1023			     uint32_t src_w, uint32_t src_h,
1024			     struct drm_modeset_acquire_ctx *ctx)
1025{
1026	int ret;
1027
1028	WARN_ON(!drm_drv_uses_atomic_modeset(plane->dev));
1029
1030	/* No fb means shut it down */
1031	if (!fb)
1032		return plane->funcs->disable_plane(plane, ctx);
1033
1034	/*
1035	 * FIXME: This is redundant with drm_atomic_plane_check(),
1036	 * but the legacy cursor/"async" .update_plane() tricks
1037	 * don't call that so we still need this here. Should remove
1038	 * this when all .update_plane() implementations have been
1039	 * fixed to call drm_atomic_plane_check().
1040	 */
1041	ret = __setplane_check(plane, crtc, fb,
1042			       crtc_x, crtc_y, crtc_w, crtc_h,
1043			       src_x, src_y, src_w, src_h);
1044	if (ret)
1045		return ret;
1046
1047	return plane->funcs->update_plane(plane, crtc, fb,
1048					  crtc_x, crtc_y, crtc_w, crtc_h,
1049					  src_x, src_y, src_w, src_h, ctx);
1050}
1051
1052static int setplane_internal(struct drm_plane *plane,
1053			     struct drm_crtc *crtc,
1054			     struct drm_framebuffer *fb,
1055			     int32_t crtc_x, int32_t crtc_y,
1056			     uint32_t crtc_w, uint32_t crtc_h,
1057			     /* src_{x,y,w,h} values are 16.16 fixed point */
1058			     uint32_t src_x, uint32_t src_y,
1059			     uint32_t src_w, uint32_t src_h)
1060{
1061	struct drm_modeset_acquire_ctx ctx;
1062	int ret;
1063
1064	DRM_MODESET_LOCK_ALL_BEGIN(plane->dev, ctx,
1065				   DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);
1066
1067	if (drm_drv_uses_atomic_modeset(plane->dev))
1068		ret = __setplane_atomic(plane, crtc, fb,
1069					crtc_x, crtc_y, crtc_w, crtc_h,
1070					src_x, src_y, src_w, src_h, &ctx);
1071	else
1072		ret = __setplane_internal(plane, crtc, fb,
1073					  crtc_x, crtc_y, crtc_w, crtc_h,
1074					  src_x, src_y, src_w, src_h, &ctx);
1075
1076	DRM_MODESET_LOCK_ALL_END(plane->dev, ctx, ret);
1077
1078	return ret;
1079}
1080
1081int drm_mode_setplane(struct drm_device *dev, void *data,
1082		      struct drm_file *file_priv)
1083{
1084	struct drm_mode_set_plane *plane_req = data;
1085	struct drm_plane *plane;
1086	struct drm_crtc *crtc = NULL;
1087	struct drm_framebuffer *fb = NULL;
1088	int ret;
1089
1090	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1091		return -EOPNOTSUPP;
1092
1093	/*
1094	 * First, find the plane, crtc, and fb objects.  If not available,
1095	 * we don't bother to call the driver.
1096	 */
1097	plane = drm_plane_find(dev, file_priv, plane_req->plane_id);
1098	if (!plane) {
1099		DRM_DEBUG_KMS("Unknown plane ID %d\n",
1100			      plane_req->plane_id);
1101		return -ENOENT;
1102	}
1103
1104	if (plane_req->fb_id) {
1105		fb = drm_framebuffer_lookup(dev, file_priv, plane_req->fb_id);
1106		if (!fb) {
1107			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
1108				      plane_req->fb_id);
1109			return -ENOENT;
1110		}
1111
1112		crtc = drm_crtc_find(dev, file_priv, plane_req->crtc_id);
1113		if (!crtc) {
1114			drm_framebuffer_put(fb);
1115			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
1116				      plane_req->crtc_id);
1117			return -ENOENT;
1118		}
1119	}
1120
1121	ret = setplane_internal(plane, crtc, fb,
1122				plane_req->crtc_x, plane_req->crtc_y,
1123				plane_req->crtc_w, plane_req->crtc_h,
1124				plane_req->src_x, plane_req->src_y,
1125				plane_req->src_w, plane_req->src_h);
1126
1127	if (fb)
1128		drm_framebuffer_put(fb);
1129
1130	return ret;
1131}
1132
1133static int drm_mode_cursor_universal(struct drm_crtc *crtc,
1134				     struct drm_mode_cursor2 *req,
1135				     struct drm_file *file_priv,
1136				     struct drm_modeset_acquire_ctx *ctx)
1137{
1138	struct drm_device *dev = crtc->dev;
1139	struct drm_plane *plane = crtc->cursor;
1140	struct drm_framebuffer *fb = NULL;
1141	struct drm_mode_fb_cmd2 fbreq = {
1142		.width = req->width,
1143		.height = req->height,
1144		.pixel_format = DRM_FORMAT_ARGB8888,
1145		.pitches = { req->width * 4 },
1146		.handles = { req->handle },
1147	};
1148	int32_t crtc_x, crtc_y;
1149	uint32_t crtc_w = 0, crtc_h = 0;
1150	uint32_t src_w = 0, src_h = 0;
1151	int ret = 0;
1152
1153	BUG_ON(!plane);
1154	WARN_ON(plane->crtc != crtc && plane->crtc != NULL);
1155
1156	/*
1157	 * Obtain fb we'll be using (either new or existing) and take an extra
1158	 * reference to it if fb != null.  setplane will take care of dropping
1159	 * the reference if the plane update fails.
1160	 */
1161	if (req->flags & DRM_MODE_CURSOR_BO) {
1162		if (req->handle) {
1163			fb = drm_internal_framebuffer_create(dev, &fbreq, file_priv);
1164			if (IS_ERR(fb)) {
1165				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
1166				return PTR_ERR(fb);
1167			}
1168
1169			if (plane->hotspot_x_property && plane->state)
1170				plane->state->hotspot_x = req->hot_x;
1171			if (plane->hotspot_y_property && plane->state)
1172				plane->state->hotspot_y = req->hot_y;
1173		} else {
1174			fb = NULL;
1175		}
1176	} else {
1177		if (plane->state)
1178			fb = plane->state->fb;
1179		else
1180			fb = plane->fb;
1181
1182		if (fb)
1183			drm_framebuffer_get(fb);
1184	}
1185
1186	if (req->flags & DRM_MODE_CURSOR_MOVE) {
1187		crtc_x = req->x;
1188		crtc_y = req->y;
1189	} else {
1190		crtc_x = crtc->cursor_x;
1191		crtc_y = crtc->cursor_y;
1192	}
1193
1194	if (fb) {
1195		crtc_w = fb->width;
1196		crtc_h = fb->height;
1197		src_w = fb->width << 16;
1198		src_h = fb->height << 16;
1199	}
1200
1201	if (drm_drv_uses_atomic_modeset(dev))
1202		ret = __setplane_atomic(plane, crtc, fb,
1203					crtc_x, crtc_y, crtc_w, crtc_h,
1204					0, 0, src_w, src_h, ctx);
1205	else
1206		ret = __setplane_internal(plane, crtc, fb,
1207					  crtc_x, crtc_y, crtc_w, crtc_h,
1208					  0, 0, src_w, src_h, ctx);
1209
1210	if (fb)
1211		drm_framebuffer_put(fb);
1212
1213	/* Update successful; save new cursor position, if necessary */
1214	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
1215		crtc->cursor_x = req->x;
1216		crtc->cursor_y = req->y;
1217	}
1218
1219	return ret;
1220}
1221
1222static int drm_mode_cursor_common(struct drm_device *dev,
1223				  struct drm_mode_cursor2 *req,
1224				  struct drm_file *file_priv)
1225{
1226	struct drm_crtc *crtc;
1227	struct drm_modeset_acquire_ctx ctx;
1228	int ret = 0;
1229
1230	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1231		return -EOPNOTSUPP;
1232
1233	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
1234		return -EINVAL;
1235
1236	crtc = drm_crtc_find(dev, file_priv, req->crtc_id);
1237	if (!crtc) {
1238		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
1239		return -ENOENT;
1240	}
1241
1242	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
1243retry:
1244	ret = drm_modeset_lock(&crtc->mutex, &ctx);
1245	if (ret)
1246		goto out;
1247	/*
1248	 * If this crtc has a universal cursor plane, call that plane's update
1249	 * handler rather than using legacy cursor handlers.
1250	 */
1251	if (crtc->cursor) {
1252		ret = drm_modeset_lock(&crtc->cursor->mutex, &ctx);
1253		if (ret)
1254			goto out;
1255
1256		if (!drm_lease_held(file_priv, crtc->cursor->base.id)) {
1257			ret = -EACCES;
1258			goto out;
1259		}
1260
1261		ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
1262		goto out;
1263	}
1264
1265	if (req->flags & DRM_MODE_CURSOR_BO) {
1266		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
1267			ret = -ENXIO;
1268			goto out;
1269		}
1270		/* Turns off the cursor if handle is 0 */
1271		if (crtc->funcs->cursor_set2)
1272			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
1273						      req->width, req->height, req->hot_x, req->hot_y);
1274		else
1275			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
1276						      req->width, req->height);
1277	}
1278
1279	if (req->flags & DRM_MODE_CURSOR_MOVE) {
1280		if (crtc->funcs->cursor_move) {
1281			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
1282		} else {
1283			ret = -EFAULT;
1284			goto out;
1285		}
1286	}
1287out:
1288	if (ret == -EDEADLK) {
1289		ret = drm_modeset_backoff(&ctx);
1290		if (!ret)
1291			goto retry;
1292	}
1293
1294	drm_modeset_drop_locks(&ctx);
1295	drm_modeset_acquire_fini(&ctx);
1296
1297	return ret;
1298
1299}
1300
1301
1302int drm_mode_cursor_ioctl(struct drm_device *dev,
1303			  void *data, struct drm_file *file_priv)
1304{
1305	struct drm_mode_cursor *req = data;
1306	struct drm_mode_cursor2 new_req;
1307
1308	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
1309	new_req.hot_x = new_req.hot_y = 0;
1310
1311	return drm_mode_cursor_common(dev, &new_req, file_priv);
1312}
1313
1314/*
1315 * Set the cursor configuration based on user request. This implements the 2nd
1316 * version of the cursor ioctl, which allows userspace to additionally specify
1317 * the hotspot of the pointer.
1318 */
1319int drm_mode_cursor2_ioctl(struct drm_device *dev,
1320			   void *data, struct drm_file *file_priv)
1321{
1322	struct drm_mode_cursor2 *req = data;
1323
1324	return drm_mode_cursor_common(dev, req, file_priv);
1325}
1326
1327int drm_mode_page_flip_ioctl(struct drm_device *dev,
1328			     void *data, struct drm_file *file_priv)
1329{
1330	struct drm_mode_crtc_page_flip_target *page_flip = data;
1331	struct drm_crtc *crtc;
1332	struct drm_plane *plane;
1333	struct drm_framebuffer *fb = NULL, *old_fb;
1334	struct drm_pending_vblank_event *e = NULL;
1335	u32 target_vblank = page_flip->sequence;
1336	struct drm_modeset_acquire_ctx ctx;
1337	int ret = -EINVAL;
1338
1339	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1340		return -EOPNOTSUPP;
1341
1342	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS)
1343		return -EINVAL;
1344
1345	if (page_flip->sequence != 0 && !(page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET))
1346		return -EINVAL;
1347
1348	/* Only one of the DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE/RELATIVE flags
1349	 * can be specified
1350	 */
1351	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) == DRM_MODE_PAGE_FLIP_TARGET)
1352		return -EINVAL;
1353
1354	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
1355		return -EINVAL;
1356
1357	crtc = drm_crtc_find(dev, file_priv, page_flip->crtc_id);
1358	if (!crtc)
1359		return -ENOENT;
1360
1361	plane = crtc->primary;
1362
1363	if (!drm_lease_held(file_priv, plane->base.id))
1364		return -EACCES;
1365
1366	if (crtc->funcs->page_flip_target) {
1367		u32 current_vblank;
1368		int r;
1369
1370		r = drm_crtc_vblank_get(crtc);
1371		if (r)
1372			return r;
1373
1374		current_vblank = (u32)drm_crtc_vblank_count(crtc);
1375
1376		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
1377		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
1378			if ((int)(target_vblank - current_vblank) > 1) {
1379				DRM_DEBUG("Invalid absolute flip target %u, "
1380					  "must be <= %u\n", target_vblank,
1381					  current_vblank + 1);
1382				drm_crtc_vblank_put(crtc);
1383				return -EINVAL;
1384			}
1385			break;
1386		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
1387			if (target_vblank != 0 && target_vblank != 1) {
1388				DRM_DEBUG("Invalid relative flip target %u, "
1389					  "must be 0 or 1\n", target_vblank);
1390				drm_crtc_vblank_put(crtc);
1391				return -EINVAL;
1392			}
1393			target_vblank += current_vblank;
1394			break;
1395		default:
1396			target_vblank = current_vblank +
1397				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
1398			break;
1399		}
1400	} else if (crtc->funcs->page_flip == NULL ||
1401		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
1402		return -EINVAL;
1403	}
1404
1405	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
1406retry:
1407	ret = drm_modeset_lock(&crtc->mutex, &ctx);
1408	if (ret)
1409		goto out;
1410	ret = drm_modeset_lock(&plane->mutex, &ctx);
1411	if (ret)
1412		goto out;
1413
1414	if (plane->state)
1415		old_fb = plane->state->fb;
1416	else
1417		old_fb = plane->fb;
1418
1419	if (old_fb == NULL) {
1420		/* The framebuffer is currently unbound, presumably
1421		 * due to a hotplug event, that userspace has not
1422		 * yet discovered.
1423		 */
1424		ret = -EBUSY;
1425		goto out;
1426	}
1427
1428	fb = drm_framebuffer_lookup(dev, file_priv, page_flip->fb_id);
1429	if (!fb) {
1430		ret = -ENOENT;
1431		goto out;
1432	}
1433
1434	if (plane->state) {
1435		const struct drm_plane_state *state = plane->state;
1436
1437		ret = drm_framebuffer_check_src_coords(state->src_x,
1438						       state->src_y,
1439						       state->src_w,
1440						       state->src_h,
1441						       fb);
1442	} else {
1443		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y,
1444					      &crtc->mode, fb);
1445	}
1446	if (ret)
1447		goto out;
1448
1449	/*
1450	 * Only check the FOURCC format code, excluding modifiers. This is
1451	 * enough for all legacy drivers. Atomic drivers have their own
1452	 * checks in their ->atomic_check implementation, which will
1453	 * return -EINVAL if any hw or driver constraint is violated due
1454	 * to modifier changes.
1455	 */
1456	if (old_fb->format->format != fb->format->format) {
1457		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
1458		ret = -EINVAL;
1459		goto out;
1460	}
1461
1462	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
1463		e = kzalloc(sizeof *e, GFP_KERNEL);
1464		if (!e) {
1465			ret = -ENOMEM;
1466			goto out;
1467		}
1468
1469		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
1470		e->event.base.length = sizeof(e->event);
1471		e->event.vbl.user_data = page_flip->user_data;
1472		e->event.vbl.crtc_id = crtc->base.id;
1473
1474		ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
1475		if (ret) {
1476			kfree(e);
1477			e = NULL;
1478			goto out;
1479		}
1480	}
1481
1482	plane->old_fb = plane->fb;
1483	if (crtc->funcs->page_flip_target)
1484		ret = crtc->funcs->page_flip_target(crtc, fb, e,
1485						    page_flip->flags,
1486						    target_vblank,
1487						    &ctx);
1488	else
1489		ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags,
1490					     &ctx);
1491	if (ret) {
1492		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
1493			drm_event_cancel_free(dev, &e->base);
1494		/* Keep the old fb, don't unref it. */
1495		plane->old_fb = NULL;
1496	} else {
1497		if (!plane->state) {
1498			plane->fb = fb;
1499			drm_framebuffer_get(fb);
1500		}
1501	}
1502
1503out:
1504	if (fb)
1505		drm_framebuffer_put(fb);
1506	fb = NULL;
1507	if (plane->old_fb)
1508		drm_framebuffer_put(plane->old_fb);
1509	plane->old_fb = NULL;
1510
1511	if (ret == -EDEADLK) {
1512		ret = drm_modeset_backoff(&ctx);
1513		if (!ret)
1514			goto retry;
1515	}
1516
1517	drm_modeset_drop_locks(&ctx);
1518	drm_modeset_acquire_fini(&ctx);
1519
1520	if (ret && crtc->funcs->page_flip_target)
1521		drm_crtc_vblank_put(crtc);
1522
1523	return ret;
1524}
1525
1526/**
1527 * DOC: damage tracking
1528 *
1529 * FB_DAMAGE_CLIPS is an optional plane property which provides a means to
1530 * specify a list of damage rectangles on a plane in framebuffer coordinates of
1531 * the framebuffer attached to the plane. In current context damage is the area
1532 * of plane framebuffer that has changed since last plane update (also called
1533 * page-flip), irrespective of whether currently attached framebuffer is same as
1534 * framebuffer attached during last plane update or not.
1535 *
1536 * FB_DAMAGE_CLIPS is a hint to kernel which could be helpful for some drivers
1537 * to optimize internally especially for virtual devices where each framebuffer
1538 * change needs to be transmitted over network, usb, etc.
1539 *
1540 * Since FB_DAMAGE_CLIPS is a hint so it is an optional property. User-space can
1541 * ignore damage clips property and in that case driver will do a full plane
1542 * update. In case damage clips are provided then it is guaranteed that the area
1543 * inside damage clips will be updated to plane. For efficiency driver can do
1544 * full update or can update more than specified in damage clips. Since driver
1545 * is free to read more, user-space must always render the entire visible
1546 * framebuffer. Otherwise there can be corruptions. Also, if a user-space
1547 * provides damage clips which doesn't encompass the actual damage to
1548 * framebuffer (since last plane update) can result in incorrect rendering.
1549 *
1550 * FB_DAMAGE_CLIPS is a blob property with the layout of blob data is simply an
1551 * array of &drm_mode_rect. Unlike plane &drm_plane_state.src coordinates,
1552 * damage clips are not in 16.16 fixed point. Similar to plane src in
1553 * framebuffer, damage clips cannot be negative. In damage clip, x1/y1 are
1554 * inclusive and x2/y2 are exclusive. While kernel does not error for overlapped
1555 * damage clips, it is strongly discouraged.
1556 *
1557 * Drivers that are interested in damage interface for plane should enable
1558 * FB_DAMAGE_CLIPS property by calling drm_plane_enable_fb_damage_clips().
1559 * Drivers implementing damage can use drm_atomic_helper_damage_iter_init() and
1560 * drm_atomic_helper_damage_iter_next() helper iterator function to get damage
1561 * rectangles clipped to &drm_plane_state.src.
1562 *
1563 * Note that there are two types of damage handling: frame damage and buffer
1564 * damage, the type of damage handling implemented depends on a driver's upload
1565 * target. Drivers implementing a per-plane or per-CRTC upload target need to
1566 * handle frame damage, while drivers implementing a per-buffer upload target
1567 * need to handle buffer damage.
1568 *
1569 * The existing damage helpers only support the frame damage type, there is no
1570 * buffer age support or similar damage accumulation algorithm implemented yet.
1571 *
1572 * Only drivers handling frame damage can use the mentioned damage helpers to
1573 * iterate over the damaged regions. Drivers that handle buffer damage, must set
1574 * &drm_plane_state.ignore_damage_clips for drm_atomic_helper_damage_iter_init()
1575 * to know that damage clips should be ignored and return &drm_plane_state.src
1576 * as the damage rectangle, to force a full plane update.
1577 *
1578 * Drivers with a per-buffer upload target could compare the &drm_plane_state.fb
1579 * of the old and new plane states to determine if the framebuffer attached to a
1580 * plane has changed or not since the last plane update. If &drm_plane_state.fb
1581 * has changed, then &drm_plane_state.ignore_damage_clips must be set to true.
1582 *
1583 * That is because drivers with a per-plane upload target, expect the backing
1584 * storage buffer to not change for a given plane. If the upload buffer changes
1585 * between page flips, the new upload buffer has to be updated as a whole. This
1586 * can be improved in the future if support for frame damage is added to the DRM
1587 * damage helpers, similarly to how user-space already handle this case as it is
1588 * explained in the following documents:
1589 *
1590 *     https://registry.khronos.org/EGL/extensions/KHR/EGL_KHR_swap_buffers_with_damage.txt
1591 *     https://emersion.fr/blog/2019/intro-to-damage-tracking/
1592 */
1593
1594/**
1595 * drm_plane_enable_fb_damage_clips - Enables plane fb damage clips property.
1596 * @plane: Plane on which to enable damage clips property.
1597 *
1598 * This function lets driver to enable the damage clips property on a plane.
1599 */
1600void drm_plane_enable_fb_damage_clips(struct drm_plane *plane)
1601{
1602	struct drm_device *dev = plane->dev;
1603	struct drm_mode_config *config = &dev->mode_config;
1604
1605	drm_object_attach_property(&plane->base, config->prop_fb_damage_clips,
1606				   0);
1607}
1608EXPORT_SYMBOL(drm_plane_enable_fb_damage_clips);
1609
1610/**
1611 * drm_plane_get_damage_clips_count - Returns damage clips count.
1612 * @state: Plane state.
1613 *
1614 * Simple helper to get the number of &drm_mode_rect clips set by user-space
1615 * during plane update.
1616 *
1617 * Return: Number of clips in plane fb_damage_clips blob property.
1618 */
1619unsigned int
1620drm_plane_get_damage_clips_count(const struct drm_plane_state *state)
1621{
1622	return (state && state->fb_damage_clips) ?
1623		state->fb_damage_clips->length/sizeof(struct drm_mode_rect) : 0;
1624}
1625EXPORT_SYMBOL(drm_plane_get_damage_clips_count);
1626
1627struct drm_mode_rect *
1628__drm_plane_get_damage_clips(const struct drm_plane_state *state)
1629{
1630	return (struct drm_mode_rect *)((state && state->fb_damage_clips) ?
1631					state->fb_damage_clips->data : NULL);
1632}
1633
1634/**
1635 * drm_plane_get_damage_clips - Returns damage clips.
1636 * @state: Plane state.
1637 *
1638 * Note that this function returns uapi type &drm_mode_rect. Drivers might want
1639 * to use the helper functions drm_atomic_helper_damage_iter_init() and
1640 * drm_atomic_helper_damage_iter_next() or drm_atomic_helper_damage_merged() if
1641 * the driver can only handle a single damage region at most.
1642 *
1643 * Return: Damage clips in plane fb_damage_clips blob property.
1644 */
1645struct drm_mode_rect *
1646drm_plane_get_damage_clips(const struct drm_plane_state *state)
1647{
1648	struct drm_device *dev = state->plane->dev;
1649	struct drm_mode_config *config = &dev->mode_config;
1650
1651	/* check that drm_plane_enable_fb_damage_clips() was called */
1652	if (!drm_mode_obj_find_prop_id(&state->plane->base,
1653				       config->prop_fb_damage_clips->base.id))
1654		drm_warn_once(dev, "drm_plane_enable_fb_damage_clips() not called\n");
1655
1656	return __drm_plane_get_damage_clips(state);
1657}
1658EXPORT_SYMBOL(drm_plane_get_damage_clips);
1659
1660struct drm_property *
1661drm_create_scaling_filter_prop(struct drm_device *dev,
1662			       unsigned int supported_filters)
1663{
1664	struct drm_property *prop;
1665	static const struct drm_prop_enum_list props[] = {
1666		{ DRM_SCALING_FILTER_DEFAULT, "Default" },
1667		{ DRM_SCALING_FILTER_NEAREST_NEIGHBOR, "Nearest Neighbor" },
1668	};
1669	unsigned int valid_mode_mask = BIT(DRM_SCALING_FILTER_DEFAULT) |
1670				       BIT(DRM_SCALING_FILTER_NEAREST_NEIGHBOR);
1671	int i;
1672
1673	if (WARN_ON((supported_filters & ~valid_mode_mask) ||
1674		    ((supported_filters & BIT(DRM_SCALING_FILTER_DEFAULT)) == 0)))
1675		return ERR_PTR(-EINVAL);
1676
1677	prop = drm_property_create(dev, DRM_MODE_PROP_ENUM,
1678				   "SCALING_FILTER",
1679				   hweight32(supported_filters));
1680	if (!prop)
1681		return ERR_PTR(-ENOMEM);
1682
1683	for (i = 0; i < ARRAY_SIZE(props); i++) {
1684		int ret;
1685
1686		if (!(BIT(props[i].type) & supported_filters))
1687			continue;
1688
1689		ret = drm_property_add_enum(prop, props[i].type,
1690					    props[i].name);
1691
1692		if (ret) {
1693			drm_property_destroy(dev, prop);
1694
1695			return ERR_PTR(ret);
1696		}
1697	}
1698
1699	return prop;
1700}
1701
1702/**
1703 * drm_plane_create_scaling_filter_property - create a new scaling filter
1704 * property
1705 *
1706 * @plane: drm plane
1707 * @supported_filters: bitmask of supported scaling filters, must include
1708 *		       BIT(DRM_SCALING_FILTER_DEFAULT).
1709 *
1710 * This function lets driver to enable the scaling filter property on a given
1711 * plane.
1712 *
1713 * RETURNS:
1714 * Zero for success or -errno
1715 */
1716int drm_plane_create_scaling_filter_property(struct drm_plane *plane,
1717					     unsigned int supported_filters)
1718{
1719	struct drm_property *prop =
1720		drm_create_scaling_filter_prop(plane->dev, supported_filters);
1721
1722	if (IS_ERR(prop))
1723		return PTR_ERR(prop);
1724
1725	drm_object_attach_property(&plane->base, prop,
1726				   DRM_SCALING_FILTER_DEFAULT);
1727	plane->scaling_filter_property = prop;
1728
1729	return 0;
1730}
1731EXPORT_SYMBOL(drm_plane_create_scaling_filter_property);