1	/*
2	* Copyright (c) 2016 Intel Corporation
3	*
4	* Permission to use, copy, modify, distribute, and sell this software and its
5	* documentation for any purpose is hereby granted without fee, provided that
6	* the above copyright notice appear in all copies and that both that copyright
7	* notice and this permission notice appear in supporting documentation, and
8	* that the name of the copyright holders not be used in advertising or
9	* publicity pertaining to distribution of the software without specific,
10	* written prior permission. The copyright holders make no representations
11	* about the suitability of this software for any purpose. It is provided "as
12	* is" without express or implied warranty.
13	*
14	* THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
15	* INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
16	* EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
17	* CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
18	* DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
19	* TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
20	* OF THIS SOFTWARE.
21	*/
22
23	#include <linux/slab.h>
24	#include <linux/uaccess.h>
25
26	#include <drm/drm_plane.h>
27	#include <drm/drm_drv.h>
28	#include <drm/drm_print.h>
29	#include <drm/drm_framebuffer.h>
30	#include <drm/drm_file.h>
31	#include <drm/drm_crtc.h>
32	#include <drm/drm_fourcc.h>
33	#include <drm/drm_managed.h>
34	#include <drm/drm_vblank.h>
35
36	#include "drm_crtc_internal.h"
37
38	/**
39	* DOC: overview
40	*
41	* A plane represents an image source that can be blended with or overlaid on
42	* top of a CRTC during the scanout process. Planes take their input data from a
43	* &drm_framebuffer object. The plane itself specifies the cropping and scaling
44	* of that image, and where it is placed on the visible area of a display
45	* pipeline, represented by &drm_crtc. A plane can also have additional
46	* properties that specify how the pixels are positioned and blended, like
47	* rotation or Z-position. All these properties are stored in &drm_plane_state.
48	*
49	* Unless explicitly specified (via CRTC property or otherwise), the active area
50	* of a CRTC will be black by default. This means portions of the active area
51	* which are not covered by a plane will be black, and alpha blending of any
52	* planes with the CRTC background will blend with black at the lowest zpos.
53	*
54	* To create a plane, a KMS drivers allocates and zeroes an instances of
55	* &struct drm_plane (possibly as part of a larger structure) and registers it
56	* with a call to drm_universal_plane_init().
57	*
58	* Each plane has a type, see enum drm_plane_type. A plane can be compatible
59	* with multiple CRTCs, see &drm_plane.possible_crtcs.
60	*
61	* Each CRTC must have a unique primary plane userspace can attach to enable
62	* the CRTC. In other words, userspace must be able to attach a different
63	* primary plane to each CRTC at the same time. Primary planes can still be
64	* compatible with multiple CRTCs. There must be exactly as many primary planes
65	* as there are CRTCs.
66	*
67	* Legacy uAPI doesn't expose the primary and cursor planes directly. DRM core
68	* relies on the driver to set the primary and optionally the cursor plane used
69	* for legacy IOCTLs. This is done by calling drm_crtc_init_with_planes(). All
70	* drivers must provide one primary plane per CRTC to avoid surprising legacy
71	* userspace too much.
72	*/
73
74	/**
75	* DOC: standard plane properties
76	*
77	* DRM planes have a few standardized properties:
78	*
79	* type:
80	* Immutable property describing the type of the plane.
81	*
82	* For user-space which has enabled the &DRM_CLIENT_CAP_ATOMIC capability,
83	* the plane type is just a hint and is mostly superseded by atomic
84	* test-only commits. The type hint can still be used to come up more
85	* easily with a plane configuration accepted by the driver.
86	*
87	* The value of this property can be one of the following:
88	*
89	* "Primary":
90	* To light up a CRTC, attaching a primary plane is the most likely to
91	* work if it covers the whole CRTC and doesn't have scaling or
92	* cropping set up.
93	*
94	* Drivers may support more features for the primary plane, user-space
95	* can find out with test-only atomic commits.
96	*
97	* Some primary planes are implicitly used by the kernel in the legacy
98	* IOCTLs &DRM_IOCTL_MODE_SETCRTC and &DRM_IOCTL_MODE_PAGE_FLIP.
99	* Therefore user-space must not mix explicit usage of any primary
100	* plane (e.g. through an atomic commit) with these legacy IOCTLs.
101	*
102	* "Cursor":
103	* To enable this plane, using a framebuffer configured without scaling
104	* or cropping and with the following properties is the most likely to
105	* work:
106	*
107	* - If the driver provides the capabilities &DRM_CAP_CURSOR_WIDTH and
108	* &DRM_CAP_CURSOR_HEIGHT, create the framebuffer with this size.
109	* Otherwise, create a framebuffer with the size 64x64.
110	* - If the driver doesn't support modifiers, create a framebuffer with
111	* a linear layout. Otherwise, use the IN_FORMATS plane property.
112	*
113	* Drivers may support more features for the cursor plane, user-space
114	* can find out with test-only atomic commits.
115	*
116	* Some cursor planes are implicitly used by the kernel in the legacy
117	* IOCTLs &DRM_IOCTL_MODE_CURSOR and &DRM_IOCTL_MODE_CURSOR2.
118	* Therefore user-space must not mix explicit usage of any cursor
119	* plane (e.g. through an atomic commit) with these legacy IOCTLs.
120	*
121	* Some drivers may support cursors even if no cursor plane is exposed.
122	* In this case, the legacy cursor IOCTLs can be used to configure the
123	* cursor.
124	*
125	* "Overlay":
126	* Neither primary nor cursor.
127	*
128	* Overlay planes are the only planes exposed when the
129	* &DRM_CLIENT_CAP_UNIVERSAL_PLANES capability is disabled.
130	*
131	* IN_FORMATS:
132	* Blob property which contains the set of buffer format and modifier
133	* pairs supported by this plane. The blob is a struct
134	* drm_format_modifier_blob. Without this property the plane doesn't
135	* support buffers with modifiers. Userspace cannot change this property.
136	*
137	* Note that userspace can check the &DRM_CAP_ADDFB2_MODIFIERS driver
138	* capability for general modifier support. If this flag is set then every
139	* plane will have the IN_FORMATS property, even when it only supports
140	* DRM_FORMAT_MOD_LINEAR. Before linux kernel release v5.1 there have been
141	* various bugs in this area with inconsistencies between the capability
142	* flag and per-plane properties.
143	*/
144
145	static unsigned int drm_num_planes(struct drm_device *dev)
146	{
147	unsigned int num = 0;
148	struct drm_plane *tmp;
149
150	drm_for_each_plane(tmp, dev) {
151	num++;
152	}
153
154	return num;
155	}
156
157	static inline u32 *
158	formats_ptr(struct drm_format_modifier_blob *blob)
159	{
160	return (u32 *)(((char *)blob) + blob->formats_offset);
161	}
162
163	static inline struct drm_format_modifier *
164	modifiers_ptr(struct drm_format_modifier_blob *blob)
165	{
166	return (struct drm_format_modifier *)(((char *)blob) + blob->modifiers_offset);
167	}
168
169	static int create_in_format_blob(struct drm_device *dev, struct drm_plane *plane)
170	{
171	const struct drm_mode_config *config = &dev->mode_config;
172	struct drm_property_blob *blob;
173	struct drm_format_modifier *mod;
174	size_t blob_size, formats_size, modifiers_size;
175	struct drm_format_modifier_blob *blob_data;
176	unsigned int i, j;
177
178	formats_size = sizeof(__u32) * plane->format_count;
179	if (WARN_ON(!formats_size)) {
180	/* 0 formats are never expected */
181	return 0;
182	}
183
184	modifiers_size =
185	sizeof(struct drm_format_modifier) * plane->modifier_count;
186
187	blob_size = sizeof(struct drm_format_modifier_blob);
188	/* Modifiers offset is a pointer to a struct with a 64 bit field so it
189	* should be naturally aligned to 8B.
190	*/
191	BUILD_BUG_ON(sizeof(struct drm_format_modifier_blob) % 8);
192	blob_size += ALIGN(formats_size, 8);
193	blob_size += modifiers_size;
194
195	blob = drm_property_create_blob(dev, length: blob_size, NULL);
196	if (IS_ERR(ptr: blob))
197	return -1;
198
199	blob_data = blob->data;
200	blob_data->version = FORMAT_BLOB_CURRENT;
201	blob_data->count_formats = plane->format_count;
202	blob_data->formats_offset = sizeof(struct drm_format_modifier_blob);
203	blob_data->count_modifiers = plane->modifier_count;
204
205	blob_data->modifiers_offset =
206	ALIGN(blob_data->formats_offset + formats_size, 8);
207
208	memcpy(formats_ptr(blob_data), plane->format_types, formats_size);
209
210	mod = modifiers_ptr(blob: blob_data);
211	for (i = 0; i < plane->modifier_count; i++) {
212	for (j = 0; j < plane->format_count; j++) {
213	if (!plane->funcs->format_mod_supported ||
214	plane->funcs->format_mod_supported(plane,
215	plane->format_types[j],
216	plane->modifiers[i])) {
217	mod->formats |= 1ULL << j;
218	}
219	}
220
221	mod->modifier = plane->modifiers[i];
222	mod->offset = 0;
223	mod->pad = 0;
224	mod++;
225	}
226
227	drm_object_attach_property(obj: &plane->base, property: config->modifiers_property,
228	init_val: blob->base.id);
229
230	return 0;
231	}
232
233	/**
234	* DOC: hotspot properties
235	*
236	* HOTSPOT_X: property to set mouse hotspot x offset.
237	* HOTSPOT_Y: property to set mouse hotspot y offset.
238	*
239	* When the plane is being used as a cursor image to display a mouse pointer,
240	* the "hotspot" is the offset within the cursor image where mouse events
241	* are expected to go.
242	*
243	* Positive values move the hotspot from the top-left corner of the cursor
244	* plane towards the right and bottom.
245	*
246	* Most display drivers do not need this information because the
247	* hotspot is not actually connected to anything visible on screen.
248	* However, this is necessary for display drivers like the para-virtualized
249	* drivers (eg qxl, vbox, virtio, vmwgfx), that are attached to a user console
250	* with a mouse pointer. Since these consoles are often being remoted over a
251	* network, they would otherwise have to wait to display the pointer movement to
252	* the user until a full network round-trip has occurred. New mouse events have
253	* to be sent from the user's console, over the network to the virtual input
254	* devices, forwarded to the desktop for processing, and then the cursor plane's
255	* position can be updated and sent back to the user's console over the network.
256	* Instead, with the hotspot information, the console can anticipate the new
257	* location, and draw the mouse cursor there before the confirmation comes in.
258	* To do that correctly, the user's console must be able predict how the
259	* desktop will process mouse events, which normally requires the desktop's
260	* mouse topology information, ie where each CRTC sits in the mouse coordinate
261	* space. This is typically sent to the para-virtualized drivers using some
262	* driver-specific method, and the driver then forwards it to the console by
263	* way of the virtual display device or hypervisor.
264	*
265	* The assumption is generally made that there is only one cursor plane being
266	* used this way at a time, and that the desktop is feeding all mouse devices
267	* into the same global pointer. Para-virtualized drivers that require this
268	* should only be exposing a single cursor plane, or find some other way
269	* to coordinate with a userspace desktop that supports multiple pointers.
270	* If the hotspot properties are set, the cursor plane is therefore assumed to be
271	* used only for displaying a mouse cursor image, and the position of the combined
272	* cursor plane + offset can therefore be used for coordinating with input from a
273	* mouse device.
274	*
275	* The cursor will then be drawn either at the location of the plane in the CRTC
276	* console, or as a free-floating cursor plane on the user's console
277	* corresponding to their desktop mouse position.
278	*
279	* DRM clients which would like to work correctly on drivers which expose
280	* hotspot properties should advertise DRM_CLIENT_CAP_CURSOR_PLANE_HOTSPOT.
281	* Setting this property on drivers which do not special case
282	* cursor planes will return EOPNOTSUPP, which can be used by userspace to
283	* gauge requirements of the hardware/drivers they're running on. Advertising
284	* DRM_CLIENT_CAP_CURSOR_PLANE_HOTSPOT implies that the userspace client will be
285	* correctly setting the hotspot properties.
286	*/
287
288	/**
289	* drm_plane_create_hotspot_properties - creates the mouse hotspot
290	* properties and attaches them to the given cursor plane
291	*
292	* @plane: drm cursor plane
293	*
294	* This function enables the mouse hotspot property on a given
295	* cursor plane. Look at the documentation for hotspot properties
296	* to get a better understanding for what they're used for.
297	*
298	* RETURNS:
299	* Zero for success or -errno
300	*/
301	static int drm_plane_create_hotspot_properties(struct drm_plane *plane)
302	{
303	struct drm_property *prop_x;
304	struct drm_property *prop_y;
305
306	drm_WARN_ON(plane->dev,
307	!drm_core_check_feature(plane->dev,
308	DRIVER_CURSOR_HOTSPOT));
309
310	prop_x = drm_property_create_signed_range(dev: plane->dev, flags: 0, name: "HOTSPOT_X",
311	INT_MIN, INT_MAX);
312	if (IS_ERR(ptr: prop_x))
313	return PTR_ERR(ptr: prop_x);
314
315	prop_y = drm_property_create_signed_range(dev: plane->dev, flags: 0, name: "HOTSPOT_Y",
316	INT_MIN, INT_MAX);
317	if (IS_ERR(ptr: prop_y)) {
318	drm_property_destroy(dev: plane->dev, property: prop_x);
319	return PTR_ERR(ptr: prop_y);
320	}
321
322	drm_object_attach_property(obj: &plane->base, property: prop_x, init_val: 0);
323	drm_object_attach_property(obj: &plane->base, property: prop_y, init_val: 0);
324	plane->hotspot_x_property = prop_x;
325	plane->hotspot_y_property = prop_y;
326
327	return 0;
328	}
329
330	__printf(9, 0)
331	static int __drm_universal_plane_init(struct drm_device *dev,
332	struct drm_plane *plane,
333	uint32_t possible_crtcs,
334	const struct drm_plane_funcs *funcs,
335	const uint32_t *formats,
336	unsigned int format_count,
337	const uint64_t *format_modifiers,
338	enum drm_plane_type type,
339	const char *name, va_list ap)
340	{
341	struct drm_mode_config *config = &dev->mode_config;
342	static const uint64_t default_modifiers[] = {
343	DRM_FORMAT_MOD_LINEAR,
344	};
345	unsigned int format_modifier_count = 0;
346	int ret;
347
348	/* plane index is used with 32bit bitmasks */
349	if (WARN_ON(config->num_total_plane >= 32))
350	return -EINVAL;
351
352	/*
353	* First driver to need more than 64 formats needs to fix this. Each
354	* format is encoded as a bit and the current code only supports a u64.
355	*/
356	if (WARN_ON(format_count > 64))
357	return -EINVAL;
358
359	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
360	(!funcs->atomic_destroy_state ||
361	!funcs->atomic_duplicate_state));
362
363	ret = drm_mode_object_add(dev, obj: &plane->base, DRM_MODE_OBJECT_PLANE);
364	if (ret)
365	return ret;
366
367	drm_modeset_lock_init(lock: &plane->mutex);
368
369	plane->base.properties = &plane->properties;
370	plane->dev = dev;
371	plane->funcs = funcs;
372	plane->format_types = kmalloc_array(n: format_count, size: sizeof(uint32_t),
373	GFP_KERNEL);
374	if (!plane->format_types) {
375	DRM_DEBUG_KMS("out of memory when allocating plane\n");
376	drm_mode_object_unregister(dev, object: &plane->base);
377	return -ENOMEM;
378	}
379
380	if (format_modifiers) {
381	const uint64_t *temp_modifiers = format_modifiers;
382
383	while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
384	format_modifier_count++;
385	} else {
386	if (!dev->mode_config.fb_modifiers_not_supported) {
387	format_modifiers = default_modifiers;
388	format_modifier_count = ARRAY_SIZE(default_modifiers);
389	}
390	}
391
392	/* autoset the cap and check for consistency across all planes */
393	drm_WARN_ON(dev, config->fb_modifiers_not_supported &&
394	format_modifier_count);
395
396	plane->modifier_count = format_modifier_count;
397	plane->modifiers = kmalloc_array(n: format_modifier_count,
398	size: sizeof(format_modifiers[0]),
399	GFP_KERNEL);
400
401	if (format_modifier_count && !plane->modifiers) {
402	DRM_DEBUG_KMS("out of memory when allocating plane\n");
403	kfree(objp: plane->format_types);
404	drm_mode_object_unregister(dev, object: &plane->base);
405	return -ENOMEM;
406	}
407
408	if (name) {
409	plane->name = kvasprintf(GFP_KERNEL, fmt: name, args: ap);
410	} else {
411	plane->name = kasprintf(GFP_KERNEL, fmt: "plane-%d",
412	drm_num_planes(dev));
413	}
414	if (!plane->name) {
415	kfree(objp: plane->format_types);
416	kfree(objp: plane->modifiers);
417	drm_mode_object_unregister(dev, object: &plane->base);
418	return -ENOMEM;
419	}
420
421	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
422	plane->format_count = format_count;
423	memcpy(plane->modifiers, format_modifiers,
424	format_modifier_count * sizeof(format_modifiers[0]));
425	plane->possible_crtcs = possible_crtcs;
426	plane->type = type;
427
428	list_add_tail(new: &plane->head, head: &config->plane_list);
429	plane->index = config->num_total_plane++;
430
431	drm_object_attach_property(obj: &plane->base,
432	property: config->plane_type_property,
433	init_val: plane->type);
434
435	if (drm_core_check_feature(dev, feature: DRIVER_ATOMIC)) {
436	drm_object_attach_property(obj: &plane->base, property: config->prop_fb_id, init_val: 0);
437	drm_object_attach_property(obj: &plane->base, property: config->prop_in_fence_fd, init_val: -1);
438	drm_object_attach_property(obj: &plane->base, property: config->prop_crtc_id, init_val: 0);
439	drm_object_attach_property(obj: &plane->base, property: config->prop_crtc_x, init_val: 0);
440	drm_object_attach_property(obj: &plane->base, property: config->prop_crtc_y, init_val: 0);
441	drm_object_attach_property(obj: &plane->base, property: config->prop_crtc_w, init_val: 0);
442	drm_object_attach_property(obj: &plane->base, property: config->prop_crtc_h, init_val: 0);
443	drm_object_attach_property(obj: &plane->base, property: config->prop_src_x, init_val: 0);
444	drm_object_attach_property(obj: &plane->base, property: config->prop_src_y, init_val: 0);
445	drm_object_attach_property(obj: &plane->base, property: config->prop_src_w, init_val: 0);
446	drm_object_attach_property(obj: &plane->base, property: config->prop_src_h, init_val: 0);
447	}
448	if (drm_core_check_feature(dev, feature: DRIVER_CURSOR_HOTSPOT) &&
449	type == DRM_PLANE_TYPE_CURSOR) {
450	drm_plane_create_hotspot_properties(plane);
451	}
452
453	if (format_modifier_count)
454	create_in_format_blob(dev, plane);
455
456	return 0;
457	}
458
459	/**
460	* drm_universal_plane_init - Initialize a new universal plane object
461	* @dev: DRM device
462	* @plane: plane object to init
463	* @possible_crtcs: bitmask of possible CRTCs
464	* @funcs: callbacks for the new plane
465	* @formats: array of supported formats (DRM_FORMAT\_\*)
466	* @format_count: number of elements in @formats
467	* @format_modifiers: array of struct drm_format modifiers terminated by
468	* DRM_FORMAT_MOD_INVALID
469	* @type: type of plane (overlay, primary, cursor)
470	* @name: printf style format string for the plane name, or NULL for default name
471	*
472	* Initializes a plane object of type @type. The &drm_plane_funcs.destroy hook
473	* should call drm_plane_cleanup() and kfree() the plane structure. The plane
474	* structure should not be allocated with devm_kzalloc().
475	*
476	* Note: consider using drmm_universal_plane_alloc() instead of
477	* drm_universal_plane_init() to let the DRM managed resource infrastructure
478	* take care of cleanup and deallocation.
479	*
480	* Drivers that only support the DRM_FORMAT_MOD_LINEAR modifier support may set
481	* @format_modifiers to NULL. The plane will advertise the linear modifier.
482	*
483	* Returns:
484	* Zero on success, error code on failure.
485	*/
486	int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
487	uint32_t possible_crtcs,
488	const struct drm_plane_funcs *funcs,
489	const uint32_t *formats, unsigned int format_count,
490	const uint64_t *format_modifiers,
491	enum drm_plane_type type,
492	const char *name, ...)
493	{
494	va_list ap;
495	int ret;
496
497	WARN_ON(!funcs->destroy);
498
499	va_start(ap, name);
500	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
501	formats, format_count, format_modifiers,
502	type, name, ap);
503	va_end(ap);
504	return ret;
505	}
506	EXPORT_SYMBOL(drm_universal_plane_init);
507
508	static void drmm_universal_plane_alloc_release(struct drm_device *dev, void *ptr)
509	{
510	struct drm_plane *plane = ptr;
511
512	if (WARN_ON(!plane->dev))
513	return;
514
515	drm_plane_cleanup(plane);
516	}
517
518	void *__drmm_universal_plane_alloc(struct drm_device *dev, size_t size,
519	size_t offset, uint32_t possible_crtcs,
520	const struct drm_plane_funcs *funcs,
521	const uint32_t *formats, unsigned int format_count,
522	const uint64_t *format_modifiers,
523	enum drm_plane_type type,
524	const char *name, ...)
525	{
526	void *container;
527	struct drm_plane *plane;
528	va_list ap;
529	int ret;
530
531	if (WARN_ON(!funcs || funcs->destroy))
532	return ERR_PTR(error: -EINVAL);
533
534	container = drmm_kzalloc(dev, size, GFP_KERNEL);
535	if (!container)
536	return ERR_PTR(error: -ENOMEM);
537
538	plane = container + offset;
539
540	va_start(ap, name);
541	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
542	formats, format_count, format_modifiers,
543	type, name, ap);
544	va_end(ap);
545	if (ret)
546	return ERR_PTR(error: ret);
547
548	ret = drmm_add_action_or_reset(dev, drmm_universal_plane_alloc_release,
549	plane);
550	if (ret)
551	return ERR_PTR(error: ret);
552
553	return container;
554	}
555	EXPORT_SYMBOL(__drmm_universal_plane_alloc);
556
557	void *__drm_universal_plane_alloc(struct drm_device *dev, size_t size,
558	size_t offset, uint32_t possible_crtcs,
559	const struct drm_plane_funcs *funcs,
560	const uint32_t *formats, unsigned int format_count,
561	const uint64_t *format_modifiers,
562	enum drm_plane_type type,
563	const char *name, ...)
564	{
565	void *container;
566	struct drm_plane *plane;
567	va_list ap;
568	int ret;
569
570	if (drm_WARN_ON(dev, !funcs))
571	return ERR_PTR(error: -EINVAL);
572
573	container = kzalloc(size, GFP_KERNEL);
574	if (!container)
575	return ERR_PTR(error: -ENOMEM);
576
577	plane = container + offset;
578
579	va_start(ap, name);
580	ret = __drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
581	formats, format_count, format_modifiers,
582	type, name, ap);
583	va_end(ap);
584	if (ret)
585	goto err_kfree;
586
587	return container;
588
589	err_kfree:
590	kfree(objp: container);
591	return ERR_PTR(error: ret);
592	}
593	EXPORT_SYMBOL(__drm_universal_plane_alloc);
594
595	int drm_plane_register_all(struct drm_device *dev)
596	{
597	unsigned int num_planes = 0;
598	unsigned int num_zpos = 0;
599	struct drm_plane *plane;
600	int ret = 0;
601
602	drm_for_each_plane(plane, dev) {
603	if (plane->funcs->late_register)
604	ret = plane->funcs->late_register(plane);
605	if (ret)
606	return ret;
607
608	if (plane->zpos_property)
609	num_zpos++;
610	num_planes++;
611	}
612
613	drm_WARN(dev, num_zpos && num_planes != num_zpos,
614	"Mixing planes with and without zpos property is invalid\n");
615
616	return 0;
617	}
618
619	void drm_plane_unregister_all(struct drm_device *dev)
620	{
621	struct drm_plane *plane;
622
623	drm_for_each_plane(plane, dev) {
624	if (plane->funcs->early_unregister)
625	plane->funcs->early_unregister(plane);
626	}
627	}
628
629	/**
630	* drm_plane_cleanup - Clean up the core plane usage
631	* @plane: plane to cleanup
632	*
633	* This function cleans up @plane and removes it from the DRM mode setting
634	* core. Note that the function does *not* free the plane structure itself,
635	* this is the responsibility of the caller.
636	*/
637	void drm_plane_cleanup(struct drm_plane *plane)
638	{
639	struct drm_device *dev = plane->dev;
640
641	drm_modeset_lock_fini(lock: &plane->mutex);
642
643	kfree(objp: plane->format_types);
644	kfree(objp: plane->modifiers);
645	drm_mode_object_unregister(dev, object: &plane->base);
646
647	BUG_ON(list_empty(&plane->head));
648
649	/* Note that the plane_list is considered to be static; should we
650	* remove the drm_plane at runtime we would have to decrement all
651	* the indices on the drm_plane after us in the plane_list.
652	*/
653
654	list_del(entry: &plane->head);
655	dev->mode_config.num_total_plane--;
656
657	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
658	if (plane->state && plane->funcs->atomic_destroy_state)
659	plane->funcs->atomic_destroy_state(plane, plane->state);
660
661	kfree(objp: plane->name);
662
663	memset(plane, 0, sizeof(*plane));
664	}
665	EXPORT_SYMBOL(drm_plane_cleanup);
666
667	/**
668	* drm_plane_from_index - find the registered plane at an index
669	* @dev: DRM device
670	* @idx: index of registered plane to find for
671	*
672	* Given a plane index, return the registered plane from DRM device's
673	* list of planes with matching index. This is the inverse of drm_plane_index().
674	*/
675	struct drm_plane *
676	drm_plane_from_index(struct drm_device *dev, int idx)
677	{
678	struct drm_plane *plane;
679
680	drm_for_each_plane(plane, dev)
681	if (idx == plane->index)
682	return plane;
683
684	return NULL;
685	}
686	EXPORT_SYMBOL(drm_plane_from_index);
687
688	/**
689	* drm_plane_force_disable - Forcibly disable a plane
690	* @plane: plane to disable
691	*
692	* Forces the plane to be disabled.
693	*
694	* Used when the plane's current framebuffer is destroyed,
695	* and when restoring fbdev mode.
696	*
697	* Note that this function is not suitable for atomic drivers, since it doesn't
698	* wire through the lock acquisition context properly and hence can't handle
699	* retries or driver private locks. You probably want to use
700	* drm_atomic_helper_disable_plane() or
701	* drm_atomic_helper_disable_planes_on_crtc() instead.
702	*/
703	void drm_plane_force_disable(struct drm_plane *plane)
704	{
705	int ret;
706
707	if (!plane->fb)
708	return;
709
710	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
711
712	plane->old_fb = plane->fb;
713	ret = plane->funcs->disable_plane(plane, NULL);
714	if (ret) {
715	DRM_ERROR("failed to disable plane with busy fb\n");
716	plane->old_fb = NULL;
717	return;
718	}
719	/* disconnect the plane from the fb and crtc: */
720	drm_framebuffer_put(fb: plane->old_fb);
721	plane->old_fb = NULL;
722	plane->fb = NULL;
723	plane->crtc = NULL;
724	}
725	EXPORT_SYMBOL(drm_plane_force_disable);
726
727	/**
728	* drm_mode_plane_set_obj_prop - set the value of a property
729	* @plane: drm plane object to set property value for
730	* @property: property to set
731	* @value: value the property should be set to
732	*
733	* This functions sets a given property on a given plane object. This function
734	* calls the driver's ->set_property callback and changes the software state of
735	* the property if the callback succeeds.
736	*
737	* Returns:
738	* Zero on success, error code on failure.
739	*/
740	int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
741	struct drm_property *property,
742	uint64_t value)
743	{
744	int ret = -EINVAL;
745	struct drm_mode_object *obj = &plane->base;
746
747	if (plane->funcs->set_property)
748	ret = plane->funcs->set_property(plane, property, value);
749	if (!ret)
750	drm_object_property_set_value(obj, property, val: value);
751
752	return ret;
753	}
754	EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
755
756	int drm_mode_getplane_res(struct drm_device *dev, void *data,
757	struct drm_file *file_priv)
758	{
759	struct drm_mode_get_plane_res *plane_resp = data;
760	struct drm_plane *plane;
761	uint32_t __user *plane_ptr;
762	int count = 0;
763
764	if (!drm_core_check_feature(dev, feature: DRIVER_MODESET))
765	return -EOPNOTSUPP;
766
767	plane_ptr = u64_to_user_ptr(plane_resp->plane_id_ptr);
768
769	/*
770	* This ioctl is called twice, once to determine how much space is
771	* needed, and the 2nd time to fill it.
772	*/
773	drm_for_each_plane(plane, dev) {
774	/*
775	* Unless userspace set the 'universal planes'
776	* capability bit, only advertise overlays.
777	*/
778	if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
779	!file_priv->universal_planes)
780	continue;
781
782	/*
783	* If we're running on a virtualized driver then,
784	* unless userspace advertizes support for the
785	* virtualized cursor plane, disable cursor planes
786	* because they'll be broken due to missing cursor
787	* hotspot info.
788	*/
789	if (plane->type == DRM_PLANE_TYPE_CURSOR &&
790	drm_core_check_feature(dev, feature: DRIVER_CURSOR_HOTSPOT) &&
791	file_priv->atomic &&
792	!file_priv->supports_virtualized_cursor_plane)
793	continue;
794
795	if (drm_lease_held(file_priv, id: plane->base.id)) {
796	if (count < plane_resp->count_planes &&
797	put_user(plane->base.id, plane_ptr + count))
798	return -EFAULT;
799	count++;
800	}
801	}
802	plane_resp->count_planes = count;
803
804	return 0;
805	}
806
807	int drm_mode_getplane(struct drm_device *dev, void *data,
808	struct drm_file *file_priv)
809	{
810	struct drm_mode_get_plane *plane_resp = data;
811	struct drm_plane *plane;
812	uint32_t __user *format_ptr;
813
814	if (!drm_core_check_feature(dev, feature: DRIVER_MODESET))
815	return -EOPNOTSUPP;
816
817	plane = drm_plane_find(dev, file_priv, id: plane_resp->plane_id);
818	if (!plane)
819	return -ENOENT;
820
821	drm_modeset_lock(lock: &plane->mutex, NULL);
822	if (plane->state && plane->state->crtc && drm_lease_held(file_priv, id: plane->state->crtc->base.id))
823	plane_resp->crtc_id = plane->state->crtc->base.id;
824	else if (!plane->state && plane->crtc && drm_lease_held(file_priv, id: plane->crtc->base.id))
825	plane_resp->crtc_id = plane->crtc->base.id;
826	else
827	plane_resp->crtc_id = 0;
828
829	if (plane->state && plane->state->fb)
830	plane_resp->fb_id = plane->state->fb->base.id;
831	else if (!plane->state && plane->fb)
832	plane_resp->fb_id = plane->fb->base.id;
833	else
834	plane_resp->fb_id = 0;
835	drm_modeset_unlock(lock: &plane->mutex);
836
837	plane_resp->plane_id = plane->base.id;
838	plane_resp->possible_crtcs = drm_lease_filter_crtcs(file_priv,
839	crtcs: plane->possible_crtcs);
840
841	plane_resp->gamma_size = 0;
842
843	/*
844	* This ioctl is called twice, once to determine how much space is
845	* needed, and the 2nd time to fill it.
846	*/
847	if (plane->format_count &&
848	(plane_resp->count_format_types >= plane->format_count)) {
849	format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
850	if (copy_to_user(to: format_ptr,
851	from: plane->format_types,
852	n: sizeof(uint32_t) * plane->format_count)) {
853	return -EFAULT;
854	}
855	}
856	plane_resp->count_format_types = plane->format_count;
857
858	return 0;
859	}
860
861	int drm_plane_check_pixel_format(struct drm_plane *plane,
862	u32 format, u64 modifier)
863	{
864	unsigned int i;
865
866	for (i = 0; i < plane->format_count; i++) {
867	if (format == plane->format_types[i])
868	break;
869	}
870	if (i == plane->format_count)
871	return -EINVAL;
872
873	if (plane->funcs->format_mod_supported) {
874	if (!plane->funcs->format_mod_supported(plane, format, modifier))
875	return -EINVAL;
876	} else {
877	if (!plane->modifier_count)
878	return 0;
879
880	for (i = 0; i < plane->modifier_count; i++) {
881	if (modifier == plane->modifiers[i])
882	break;
883	}
884	if (i == plane->modifier_count)
885	return -EINVAL;
886	}
887
888	return 0;
889	}
890
891	static int __setplane_check(struct drm_plane *plane,
892	struct drm_crtc *crtc,
893	struct drm_framebuffer *fb,
894	int32_t crtc_x, int32_t crtc_y,
895	uint32_t crtc_w, uint32_t crtc_h,
896	uint32_t src_x, uint32_t src_y,
897	uint32_t src_w, uint32_t src_h)
898	{
899	int ret;
900
901	/* Check whether this plane is usable on this CRTC */
902	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
903	DRM_DEBUG_KMS("Invalid crtc for plane\n");
904	return -EINVAL;
905	}
906
907	/* Check whether this plane supports the fb pixel format. */
908	ret = drm_plane_check_pixel_format(plane, format: fb->format->format,
909	modifier: fb->modifier);
910	if (ret) {
911	DRM_DEBUG_KMS("Invalid pixel format %p4cc, modifier 0x%llx\n",
912	&fb->format->format, fb->modifier);
913	return ret;
914	}
915
916	/* Give drivers some help against integer overflows */
917	if (crtc_w > INT_MAX ||
918	crtc_x > INT_MAX - (int32_t) crtc_w ||
919	crtc_h > INT_MAX ||
920	crtc_y > INT_MAX - (int32_t) crtc_h) {
921	DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
922	crtc_w, crtc_h, crtc_x, crtc_y);
923	return -ERANGE;
924	}
925
926	ret = drm_framebuffer_check_src_coords(src_x, src_y, src_w, src_h, fb);
927	if (ret)
928	return ret;
929
930	return 0;
931	}
932
933	/**
934	* drm_any_plane_has_format - Check whether any plane supports this format and modifier combination
935	* @dev: DRM device
936	* @format: pixel format (DRM_FORMAT_*)
937	* @modifier: data layout modifier
938	*
939	* Returns:
940	* Whether at least one plane supports the specified format and modifier combination.
941	*/
942	bool drm_any_plane_has_format(struct drm_device *dev,
943	u32 format, u64 modifier)
944	{
945	struct drm_plane *plane;
946
947	drm_for_each_plane(plane, dev) {
948	if (drm_plane_check_pixel_format(plane, format, modifier) == 0)
949	return true;
950	}
951
952	return false;
953	}
954	EXPORT_SYMBOL(drm_any_plane_has_format);
955
956	/*
957	* __setplane_internal - setplane handler for internal callers
958	*
959	* This function will take a reference on the new fb for the plane
960	* on success.
961	*
962	* src_{x,y,w,h} are provided in 16.16 fixed point format
963	*/
964	static int __setplane_internal(struct drm_plane *plane,
965	struct drm_crtc *crtc,
966	struct drm_framebuffer *fb,
967	int32_t crtc_x, int32_t crtc_y,
968	uint32_t crtc_w, uint32_t crtc_h,
969	/* src_{x,y,w,h} values are 16.16 fixed point */
970	uint32_t src_x, uint32_t src_y,
971	uint32_t src_w, uint32_t src_h,
972	struct drm_modeset_acquire_ctx *ctx)
973	{
974	int ret = 0;
975
976	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
977
978	/* No fb means shut it down */
979	if (!fb) {
980	plane->old_fb = plane->fb;
981	ret = plane->funcs->disable_plane(plane, ctx);
982	if (!ret) {
983	plane->crtc = NULL;
984	plane->fb = NULL;
985	} else {
986	plane->old_fb = NULL;
987	}
988	goto out;
989	}
990
991	ret = __setplane_check(plane, crtc, fb,
992	crtc_x, crtc_y, crtc_w, crtc_h,
993	src_x, src_y, src_w, src_h);
994	if (ret)
995	goto out;
996
997	plane->old_fb = plane->fb;
998	ret = plane->funcs->update_plane(plane, crtc, fb,
999	crtc_x, crtc_y, crtc_w, crtc_h,
1000	src_x, src_y, src_w, src_h, ctx);
1001	if (!ret) {
1002	plane->crtc = crtc;
1003	plane->fb = fb;
1004	drm_framebuffer_get(fb: plane->fb);
1005	} else {
1006	plane->old_fb = NULL;
1007	}
1008
1009	out:
1010	if (plane->old_fb)
1011	drm_framebuffer_put(fb: plane->old_fb);
1012	plane->old_fb = NULL;
1013
1014	return ret;
1015	}
1016
1017	static int __setplane_atomic(struct drm_plane *plane,
1018	struct drm_crtc *crtc,
1019	struct drm_framebuffer *fb,
1020	int32_t crtc_x, int32_t crtc_y,
1021	uint32_t crtc_w, uint32_t crtc_h,
1022	uint32_t src_x, uint32_t src_y,
1023	uint32_t src_w, uint32_t src_h,
1024	struct drm_modeset_acquire_ctx *ctx)
1025	{
1026	int ret;
1027
1028	WARN_ON(!drm_drv_uses_atomic_modeset(plane->dev));
1029
1030	/* No fb means shut it down */
1031	if (!fb)
1032	return plane->funcs->disable_plane(plane, ctx);
1033
1034	/*
1035	* FIXME: This is redundant with drm_atomic_plane_check(),
1036	* but the legacy cursor/"async" .update_plane() tricks
1037	* don't call that so we still need this here. Should remove
1038	* this when all .update_plane() implementations have been
1039	* fixed to call drm_atomic_plane_check().
1040	*/
1041	ret = __setplane_check(plane, crtc, fb,
1042	crtc_x, crtc_y, crtc_w, crtc_h,
1043	src_x, src_y, src_w, src_h);
1044	if (ret)
1045	return ret;
1046
1047	return plane->funcs->update_plane(plane, crtc, fb,
1048	crtc_x, crtc_y, crtc_w, crtc_h,
1049	src_x, src_y, src_w, src_h, ctx);
1050	}
1051
1052	static int setplane_internal(struct drm_plane *plane,
1053	struct drm_crtc *crtc,
1054	struct drm_framebuffer *fb,
1055	int32_t crtc_x, int32_t crtc_y,
1056	uint32_t crtc_w, uint32_t crtc_h,
1057	/* src_{x,y,w,h} values are 16.16 fixed point */
1058	uint32_t src_x, uint32_t src_y,
1059	uint32_t src_w, uint32_t src_h)
1060	{
1061	struct drm_modeset_acquire_ctx ctx;
1062	int ret;
1063
1064	DRM_MODESET_LOCK_ALL_BEGIN(plane->dev, ctx,
1065	DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);
1066
1067	if (drm_drv_uses_atomic_modeset(dev: plane->dev))
1068	ret = __setplane_atomic(plane, crtc, fb,
1069	crtc_x, crtc_y, crtc_w, crtc_h,
1070	src_x, src_y, src_w, src_h, ctx: &ctx);
1071	else
1072	ret = __setplane_internal(plane, crtc, fb,
1073	crtc_x, crtc_y, crtc_w, crtc_h,
1074	src_x, src_y, src_w, src_h, ctx: &ctx);
1075
1076	DRM_MODESET_LOCK_ALL_END(plane->dev, ctx, ret);
1077
1078	return ret;
1079	}
1080
1081	int drm_mode_setplane(struct drm_device *dev, void *data,
1082	struct drm_file *file_priv)
1083	{
1084	struct drm_mode_set_plane *plane_req = data;
1085	struct drm_plane *plane;
1086	struct drm_crtc *crtc = NULL;
1087	struct drm_framebuffer *fb = NULL;
1088	int ret;
1089
1090	if (!drm_core_check_feature(dev, feature: DRIVER_MODESET))
1091	return -EOPNOTSUPP;
1092
1093	/*
1094	* First, find the plane, crtc, and fb objects. If not available,
1095	* we don't bother to call the driver.
1096	*/
1097	plane = drm_plane_find(dev, file_priv, id: plane_req->plane_id);
1098	if (!plane) {
1099	DRM_DEBUG_KMS("Unknown plane ID %d\n",
1100	plane_req->plane_id);
1101	return -ENOENT;
1102	}
1103
1104	if (plane_req->fb_id) {
1105	fb = drm_framebuffer_lookup(dev, file_priv, id: plane_req->fb_id);
1106	if (!fb) {
1107	DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
1108	plane_req->fb_id);
1109	return -ENOENT;
1110	}
1111
1112	crtc = drm_crtc_find(dev, file_priv, id: plane_req->crtc_id);
1113	if (!crtc) {
1114	drm_framebuffer_put(fb);
1115	DRM_DEBUG_KMS("Unknown crtc ID %d\n",
1116	plane_req->crtc_id);
1117	return -ENOENT;
1118	}
1119	}
1120
1121	ret = setplane_internal(plane, crtc, fb,
1122	crtc_x: plane_req->crtc_x, crtc_y: plane_req->crtc_y,
1123	crtc_w: plane_req->crtc_w, crtc_h: plane_req->crtc_h,
1124	src_x: plane_req->src_x, src_y: plane_req->src_y,
1125	src_w: plane_req->src_w, src_h: plane_req->src_h);
1126
1127	if (fb)
1128	drm_framebuffer_put(fb);
1129
1130	return ret;
1131	}
1132
1133	static int drm_mode_cursor_universal(struct drm_crtc *crtc,
1134	struct drm_mode_cursor2 *req,
1135	struct drm_file *file_priv,
1136	struct drm_modeset_acquire_ctx *ctx)
1137	{
1138	struct drm_device *dev = crtc->dev;
1139	struct drm_plane *plane = crtc->cursor;
1140	struct drm_framebuffer *fb = NULL;
1141	struct drm_mode_fb_cmd2 fbreq = {
1142	.width = req->width,
1143	.height = req->height,
1144	.pixel_format = DRM_FORMAT_ARGB8888,
1145	.pitches = { req->width * 4 },
1146	.handles = { req->handle },
1147	};
1148	int32_t crtc_x, crtc_y;
1149	uint32_t crtc_w = 0, crtc_h = 0;
1150	uint32_t src_w = 0, src_h = 0;
1151	int ret = 0;
1152
1153	BUG_ON(!plane);
1154	WARN_ON(plane->crtc != crtc && plane->crtc != NULL);
1155
1156	/*
1157	* Obtain fb we'll be using (either new or existing) and take an extra
1158	* reference to it if fb != null. setplane will take care of dropping
1159	* the reference if the plane update fails.
1160	*/
1161	if (req->flags & DRM_MODE_CURSOR_BO) {
1162	if (req->handle) {
1163	fb = drm_internal_framebuffer_create(dev, r: &fbreq, file_priv);
1164	if (IS_ERR(ptr: fb)) {
1165	DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
1166	return PTR_ERR(ptr: fb);
1167	}
1168
1169	if (plane->hotspot_x_property && plane->state)
1170	plane->state->hotspot_x = req->hot_x;
1171	if (plane->hotspot_y_property && plane->state)
1172	plane->state->hotspot_y = req->hot_y;
1173	} else {
1174	fb = NULL;
1175	}
1176	} else {
1177	if (plane->state)
1178	fb = plane->state->fb;
1179	else
1180	fb = plane->fb;
1181
1182	if (fb)
1183	drm_framebuffer_get(fb);
1184	}
1185
1186	if (req->flags & DRM_MODE_CURSOR_MOVE) {
1187	crtc_x = req->x;
1188	crtc_y = req->y;
1189	} else {
1190	crtc_x = crtc->cursor_x;
1191	crtc_y = crtc->cursor_y;
1192	}
1193
1194	if (fb) {
1195	crtc_w = fb->width;
1196	crtc_h = fb->height;
1197	src_w = fb->width << 16;
1198	src_h = fb->height << 16;
1199	}
1200
1201	if (drm_drv_uses_atomic_modeset(dev))
1202	ret = __setplane_atomic(plane, crtc, fb,
1203	crtc_x, crtc_y, crtc_w, crtc_h,
1204	src_x: 0, src_y: 0, src_w, src_h, ctx);
1205	else
1206	ret = __setplane_internal(plane, crtc, fb,
1207	crtc_x, crtc_y, crtc_w, crtc_h,
1208	src_x: 0, src_y: 0, src_w, src_h, ctx);
1209
1210	if (fb)
1211	drm_framebuffer_put(fb);
1212
1213	/* Update successful; save new cursor position, if necessary */
1214	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
1215	crtc->cursor_x = req->x;
1216	crtc->cursor_y = req->y;
1217	}
1218
1219	return ret;
1220	}
1221
1222	static int drm_mode_cursor_common(struct drm_device *dev,
1223	struct drm_mode_cursor2 *req,
1224	struct drm_file *file_priv)
1225	{
1226	struct drm_crtc *crtc;
1227	struct drm_modeset_acquire_ctx ctx;
1228	int ret = 0;
1229
1230	if (!drm_core_check_feature(dev, feature: DRIVER_MODESET))
1231	return -EOPNOTSUPP;
1232
1233	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
1234	return -EINVAL;
1235
1236	crtc = drm_crtc_find(dev, file_priv, id: req->crtc_id);
1237	if (!crtc) {
1238	DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
1239	return -ENOENT;
1240	}
1241
1242	drm_modeset_acquire_init(ctx: &ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
1243	retry:
1244	ret = drm_modeset_lock(lock: &crtc->mutex, ctx: &ctx);
1245	if (ret)
1246	goto out;
1247	/*
1248	* If this crtc has a universal cursor plane, call that plane's update
1249	* handler rather than using legacy cursor handlers.
1250	*/
1251	if (crtc->cursor) {
1252	ret = drm_modeset_lock(lock: &crtc->cursor->mutex, ctx: &ctx);
1253	if (ret)
1254	goto out;
1255
1256	if (!drm_lease_held(file_priv, id: crtc->cursor->base.id)) {
1257	ret = -EACCES;
1258	goto out;
1259	}
1260
1261	ret = drm_mode_cursor_universal(crtc, req, file_priv, ctx: &ctx);
1262	goto out;
1263	}
1264
1265	if (req->flags & DRM_MODE_CURSOR_BO) {
1266	if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
1267	ret = -ENXIO;
1268	goto out;
1269	}
1270	/* Turns off the cursor if handle is 0 */
1271	if (crtc->funcs->cursor_set2)
1272	ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
1273	req->width, req->height, req->hot_x, req->hot_y);
1274	else
1275	ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
1276	req->width, req->height);
1277	}
1278
1279	if (req->flags & DRM_MODE_CURSOR_MOVE) {
1280	if (crtc->funcs->cursor_move) {
1281	ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
1282	} else {
1283	ret = -EFAULT;
1284	goto out;
1285	}
1286	}
1287	out:
1288	if (ret == -EDEADLK) {
1289	ret = drm_modeset_backoff(ctx: &ctx);
1290	if (!ret)
1291	goto retry;
1292	}
1293
1294	drm_modeset_drop_locks(ctx: &ctx);
1295	drm_modeset_acquire_fini(ctx: &ctx);
1296
1297	return ret;
1298
1299	}
1300
1301
1302	int drm_mode_cursor_ioctl(struct drm_device *dev,
1303	void *data, struct drm_file *file_priv)
1304	{
1305	struct drm_mode_cursor *req = data;
1306	struct drm_mode_cursor2 new_req;
1307
1308	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
1309	new_req.hot_x = new_req.hot_y = 0;
1310
1311	return drm_mode_cursor_common(dev, req: &new_req, file_priv);
1312	}
1313
1314	/*
1315	* Set the cursor configuration based on user request. This implements the 2nd
1316	* version of the cursor ioctl, which allows userspace to additionally specify
1317	* the hotspot of the pointer.
1318	*/
1319	int drm_mode_cursor2_ioctl(struct drm_device *dev,
1320	void *data, struct drm_file *file_priv)
1321	{
1322	struct drm_mode_cursor2 *req = data;
1323
1324	return drm_mode_cursor_common(dev, req, file_priv);
1325	}
1326
1327	int drm_mode_page_flip_ioctl(struct drm_device *dev,
1328	void *data, struct drm_file *file_priv)
1329	{
1330	struct drm_mode_crtc_page_flip_target *page_flip = data;
1331	struct drm_crtc *crtc;
1332	struct drm_plane *plane;
1333	struct drm_framebuffer *fb = NULL, *old_fb;
1334	struct drm_pending_vblank_event *e = NULL;
1335	u32 target_vblank = page_flip->sequence;
1336	struct drm_modeset_acquire_ctx ctx;
1337	int ret = -EINVAL;
1338
1339	if (!drm_core_check_feature(dev, feature: DRIVER_MODESET))
1340	return -EOPNOTSUPP;
1341
1342	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS)
1343	return -EINVAL;
1344
1345	if (page_flip->sequence != 0 && !(page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET))
1346	return -EINVAL;
1347
1348	/* Only one of the DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE/RELATIVE flags
1349	* can be specified
1350	*/
1351	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) == DRM_MODE_PAGE_FLIP_TARGET)
1352	return -EINVAL;
1353
1354	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
1355	return -EINVAL;
1356
1357	crtc = drm_crtc_find(dev, file_priv, id: page_flip->crtc_id);
1358	if (!crtc)
1359	return -ENOENT;
1360
1361	plane = crtc->primary;
1362
1363	if (!drm_lease_held(file_priv, id: plane->base.id))
1364	return -EACCES;
1365
1366	if (crtc->funcs->page_flip_target) {
1367	u32 current_vblank;
1368	int r;
1369
1370	r = drm_crtc_vblank_get(crtc);
1371	if (r)
1372	return r;
1373
1374	current_vblank = (u32)drm_crtc_vblank_count(crtc);
1375
1376	switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
1377	case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
1378	if ((int)(target_vblank - current_vblank) > 1) {
1379	DRM_DEBUG("Invalid absolute flip target %u, "
1380	"must be <= %u\n", target_vblank,
1381	current_vblank + 1);
1382	drm_crtc_vblank_put(crtc);
1383	return -EINVAL;
1384	}
1385	break;
1386	case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
1387	if (target_vblank != 0 && target_vblank != 1) {
1388	DRM_DEBUG("Invalid relative flip target %u, "
1389	"must be 0 or 1\n", target_vblank);
1390	drm_crtc_vblank_put(crtc);
1391	return -EINVAL;
1392	}
1393	target_vblank += current_vblank;
1394	break;
1395	default:
1396	target_vblank = current_vblank +
1397	!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
1398	break;
1399	}
1400	} else if (crtc->funcs->page_flip == NULL ||
1401	(page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
1402	return -EINVAL;
1403	}
1404
1405	drm_modeset_acquire_init(ctx: &ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
1406	retry:
1407	ret = drm_modeset_lock(lock: &crtc->mutex, ctx: &ctx);
1408	if (ret)
1409	goto out;
1410	ret = drm_modeset_lock(lock: &plane->mutex, ctx: &ctx);
1411	if (ret)
1412	goto out;
1413
1414	if (plane->state)
1415	old_fb = plane->state->fb;
1416	else
1417	old_fb = plane->fb;
1418
1419	if (old_fb == NULL) {
1420	/* The framebuffer is currently unbound, presumably
1421	* due to a hotplug event, that userspace has not
1422	* yet discovered.
1423	*/
1424	ret = -EBUSY;
1425	goto out;
1426	}
1427
1428	fb = drm_framebuffer_lookup(dev, file_priv, id: page_flip->fb_id);
1429	if (!fb) {
1430	ret = -ENOENT;
1431	goto out;
1432	}
1433
1434	if (plane->state) {
1435	const struct drm_plane_state *state = plane->state;
1436
1437	ret = drm_framebuffer_check_src_coords(src_x: state->src_x,
1438	src_y: state->src_y,
1439	src_w: state->src_w,
1440	src_h: state->src_h,
1441	fb);
1442	} else {
1443	ret = drm_crtc_check_viewport(crtc, x: crtc->x, y: crtc->y,
1444	mode: &crtc->mode, fb);
1445	}
1446	if (ret)
1447	goto out;
1448
1449	/*
1450	* Only check the FOURCC format code, excluding modifiers. This is
1451	* enough for all legacy drivers. Atomic drivers have their own
1452	* checks in their ->atomic_check implementation, which will
1453	* return -EINVAL if any hw or driver constraint is violated due
1454	* to modifier changes.
1455	*/
1456	if (old_fb->format->format != fb->format->format) {
1457	DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
1458	ret = -EINVAL;
1459	goto out;
1460	}
1461
1462	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
1463	e = kzalloc(size: sizeof *e, GFP_KERNEL);
1464	if (!e) {
1465	ret = -ENOMEM;
1466	goto out;
1467	}
1468
1469	e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
1470	e->event.base.length = sizeof(e->event);
1471	e->event.vbl.user_data = page_flip->user_data;
1472	e->event.vbl.crtc_id = crtc->base.id;
1473
1474	ret = drm_event_reserve_init(dev, file_priv, p: &e->base, e: &e->event.base);
1475	if (ret) {
1476	kfree(objp: e);
1477	e = NULL;
1478	goto out;
1479	}
1480	}
1481
1482	plane->old_fb = plane->fb;
1483	if (crtc->funcs->page_flip_target)
1484	ret = crtc->funcs->page_flip_target(crtc, fb, e,
1485	page_flip->flags,
1486	target_vblank,
1487	&ctx);
1488	else
1489	ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags,
1490	&ctx);
1491	if (ret) {
1492	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
1493	drm_event_cancel_free(dev, p: &e->base);
1494	/* Keep the old fb, don't unref it. */
1495	plane->old_fb = NULL;
1496	} else {
1497	if (!plane->state) {
1498	plane->fb = fb;
1499	drm_framebuffer_get(fb);
1500	}
1501	}
1502
1503	out:
1504	if (fb)
1505	drm_framebuffer_put(fb);
1506	fb = NULL;
1507	if (plane->old_fb)
1508	drm_framebuffer_put(fb: plane->old_fb);
1509	plane->old_fb = NULL;
1510
1511	if (ret == -EDEADLK) {
1512	ret = drm_modeset_backoff(ctx: &ctx);
1513	if (!ret)
1514	goto retry;
1515	}
1516
1517	drm_modeset_drop_locks(ctx: &ctx);
1518	drm_modeset_acquire_fini(ctx: &ctx);
1519
1520	if (ret && crtc->funcs->page_flip_target)
1521	drm_crtc_vblank_put(crtc);
1522
1523	return ret;
1524	}
1525
1526	/**
1527	* DOC: damage tracking
1528	*
1529	* FB_DAMAGE_CLIPS is an optional plane property which provides a means to
1530	* specify a list of damage rectangles on a plane in framebuffer coordinates of
1531	* the framebuffer attached to the plane. In current context damage is the area
1532	* of plane framebuffer that has changed since last plane update (also called
1533	* page-flip), irrespective of whether currently attached framebuffer is same as
1534	* framebuffer attached during last plane update or not.
1535	*
1536	* FB_DAMAGE_CLIPS is a hint to kernel which could be helpful for some drivers
1537	* to optimize internally especially for virtual devices where each framebuffer
1538	* change needs to be transmitted over network, usb, etc.
1539	*
1540	* Since FB_DAMAGE_CLIPS is a hint so it is an optional property. User-space can
1541	* ignore damage clips property and in that case driver will do a full plane
1542	* update. In case damage clips are provided then it is guaranteed that the area
1543	* inside damage clips will be updated to plane. For efficiency driver can do
1544	* full update or can update more than specified in damage clips. Since driver
1545	* is free to read more, user-space must always render the entire visible
1546	* framebuffer. Otherwise there can be corruptions. Also, if a user-space
1547	* provides damage clips which doesn't encompass the actual damage to
1548	* framebuffer (since last plane update) can result in incorrect rendering.
1549	*
1550	* FB_DAMAGE_CLIPS is a blob property with the layout of blob data is simply an
1551	* array of &drm_mode_rect. Unlike plane &drm_plane_state.src coordinates,
1552	* damage clips are not in 16.16 fixed point. Similar to plane src in
1553	* framebuffer, damage clips cannot be negative. In damage clip, x1/y1 are
1554	* inclusive and x2/y2 are exclusive. While kernel does not error for overlapped
1555	* damage clips, it is strongly discouraged.
1556	*
1557	* Drivers that are interested in damage interface for plane should enable
1558	* FB_DAMAGE_CLIPS property by calling drm_plane_enable_fb_damage_clips().
1559	* Drivers implementing damage can use drm_atomic_helper_damage_iter_init() and
1560	* drm_atomic_helper_damage_iter_next() helper iterator function to get damage
1561	* rectangles clipped to &drm_plane_state.src.
1562	*
1563	* Note that there are two types of damage handling: frame damage and buffer
1564	* damage, the type of damage handling implemented depends on a driver's upload
1565	* target. Drivers implementing a per-plane or per-CRTC upload target need to
1566	* handle frame damage, while drivers implementing a per-buffer upload target
1567	* need to handle buffer damage.
1568	*
1569	* The existing damage helpers only support the frame damage type, there is no
1570	* buffer age support or similar damage accumulation algorithm implemented yet.
1571	*
1572	* Only drivers handling frame damage can use the mentioned damage helpers to
1573	* iterate over the damaged regions. Drivers that handle buffer damage, must set
1574	* &drm_plane_state.ignore_damage_clips for drm_atomic_helper_damage_iter_init()
1575	* to know that damage clips should be ignored and return &drm_plane_state.src
1576	* as the damage rectangle, to force a full plane update.
1577	*
1578	* Drivers with a per-buffer upload target could compare the &drm_plane_state.fb
1579	* of the old and new plane states to determine if the framebuffer attached to a
1580	* plane has changed or not since the last plane update. If &drm_plane_state.fb
1581	* has changed, then &drm_plane_state.ignore_damage_clips must be set to true.
1582	*
1583	* That is because drivers with a per-plane upload target, expect the backing
1584	* storage buffer to not change for a given plane. If the upload buffer changes
1585	* between page flips, the new upload buffer has to be updated as a whole. This
1586	* can be improved in the future if support for frame damage is added to the DRM
1587	* damage helpers, similarly to how user-space already handle this case as it is
1588	* explained in the following documents:
1589	*
1590	* https://registry.khronos.org/EGL/extensions/KHR/EGL_KHR_swap_buffers_with_damage.txt
1591	* https://emersion.fr/blog/2019/intro-to-damage-tracking/
1592	*/
1593
1594	/**
1595	* drm_plane_enable_fb_damage_clips - Enables plane fb damage clips property.
1596	* @plane: Plane on which to enable damage clips property.
1597	*
1598	* This function lets driver to enable the damage clips property on a plane.
1599	*/
1600	void drm_plane_enable_fb_damage_clips(struct drm_plane *plane)
1601	{
1602	struct drm_device *dev = plane->dev;
1603	struct drm_mode_config *config = &dev->mode_config;
1604
1605	drm_object_attach_property(obj: &plane->base, property: config->prop_fb_damage_clips,
1606	init_val: 0);
1607	}
1608	EXPORT_SYMBOL(drm_plane_enable_fb_damage_clips);
1609
1610	/**
1611	* drm_plane_get_damage_clips_count - Returns damage clips count.
1612	* @state: Plane state.
1613	*
1614	* Simple helper to get the number of &drm_mode_rect clips set by user-space
1615	* during plane update.
1616	*
1617	* Return: Number of clips in plane fb_damage_clips blob property.
1618	*/
1619	unsigned int
1620	drm_plane_get_damage_clips_count(const struct drm_plane_state *state)
1621	{
1622	return (state && state->fb_damage_clips) ?
1623	state->fb_damage_clips->length/sizeof(struct drm_mode_rect) : 0;
1624	}
1625	EXPORT_SYMBOL(drm_plane_get_damage_clips_count);
1626
1627	struct drm_mode_rect *
1628	__drm_plane_get_damage_clips(const struct drm_plane_state *state)
1629	{
1630	return (struct drm_mode_rect *)((state && state->fb_damage_clips) ?
1631	state->fb_damage_clips->data : NULL);
1632	}
1633
1634	/**
1635	* drm_plane_get_damage_clips - Returns damage clips.
1636	* @state: Plane state.
1637	*
1638	* Note that this function returns uapi type &drm_mode_rect. Drivers might want
1639	* to use the helper functions drm_atomic_helper_damage_iter_init() and
1640	* drm_atomic_helper_damage_iter_next() or drm_atomic_helper_damage_merged() if
1641	* the driver can only handle a single damage region at most.
1642	*
1643	* Return: Damage clips in plane fb_damage_clips blob property.
1644	*/
1645	struct drm_mode_rect *
1646	drm_plane_get_damage_clips(const struct drm_plane_state *state)
1647	{
1648	struct drm_device *dev = state->plane->dev;
1649	struct drm_mode_config *config = &dev->mode_config;
1650
1651	/* check that drm_plane_enable_fb_damage_clips() was called */
1652	if (!drm_mode_obj_find_prop_id(obj: &state->plane->base,
1653	prop_id: config->prop_fb_damage_clips->base.id))
1654	drm_warn_once(dev, "drm_plane_enable_fb_damage_clips() not called\n");
1655
1656	return __drm_plane_get_damage_clips(state);
1657	}
1658	EXPORT_SYMBOL(drm_plane_get_damage_clips);
1659
1660	struct drm_property *
1661	drm_create_scaling_filter_prop(struct drm_device *dev,
1662	unsigned int supported_filters)
1663	{
1664	struct drm_property *prop;
1665	static const struct drm_prop_enum_list props[] = {
1666	{ DRM_SCALING_FILTER_DEFAULT, "Default" },
1667	{ DRM_SCALING_FILTER_NEAREST_NEIGHBOR, "Nearest Neighbor" },
1668	};
1669	unsigned int valid_mode_mask = BIT(DRM_SCALING_FILTER_DEFAULT) |
1670	BIT(DRM_SCALING_FILTER_NEAREST_NEIGHBOR);
1671	int i;
1672
1673	if (WARN_ON((supported_filters & ~valid_mode_mask) ||
1674	((supported_filters & BIT(DRM_SCALING_FILTER_DEFAULT)) == 0)))
1675	return ERR_PTR(error: -EINVAL);
1676
1677	prop = drm_property_create(dev, DRM_MODE_PROP_ENUM,
1678	name: "SCALING_FILTER",
1679	hweight32(supported_filters));
1680	if (!prop)
1681	return ERR_PTR(error: -ENOMEM);
1682
1683	for (i = 0; i < ARRAY_SIZE(props); i++) {
1684	int ret;
1685
1686	if (!(BIT(props[i].type) & supported_filters))
1687	continue;
1688
1689	ret = drm_property_add_enum(property: prop, value: props[i].type,
1690	name: props[i].name);
1691
1692	if (ret) {
1693	drm_property_destroy(dev, property: prop);
1694
1695	return ERR_PTR(error: ret);
1696	}
1697	}
1698
1699	return prop;
1700	}
1701
1702	/**
1703	* drm_plane_create_scaling_filter_property - create a new scaling filter
1704	* property
1705	*
1706	* @plane: drm plane
1707	* @supported_filters: bitmask of supported scaling filters, must include
1708	* BIT(DRM_SCALING_FILTER_DEFAULT).
1709	*
1710	* This function lets driver to enable the scaling filter property on a given
1711	* plane.
1712	*
1713	* RETURNS:
1714	* Zero for success or -errno
1715	*/
1716	int drm_plane_create_scaling_filter_property(struct drm_plane *plane,
1717	unsigned int supported_filters)
1718	{
1719	struct drm_property *prop =
1720	drm_create_scaling_filter_prop(dev: plane->dev, supported_filters);
1721
1722	if (IS_ERR(ptr: prop))
1723	return PTR_ERR(ptr: prop);
1724
1725	drm_object_attach_property(obj: &plane->base, property: prop,
1726	init_val: DRM_SCALING_FILTER_DEFAULT);
1727	plane->scaling_filter_property = prop;
1728
1729	return 0;
1730	}
1731	EXPORT_SYMBOL(drm_plane_create_scaling_filter_property);
1732