1/*
2 * Copyright (c) 2016 Intel Corporation
3 *
4 * Permission to use, copy, modify, distribute, and sell this software and its
5 * documentation for any purpose is hereby granted without fee, provided that
6 * the above copyright notice appear in all copies and that both that copyright
7 * notice and this permission notice appear in supporting documentation, and
8 * that the name of the copyright holders not be used in advertising or
9 * publicity pertaining to distribution of the software without specific,
10 * written prior permission.  The copyright holders make no representations
11 * about the suitability of this software for any purpose.  It is provided "as
12 * is" without express or implied warranty.
13 *
14 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
15 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
16 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
17 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
18 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
19 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
20 * OF THIS SOFTWARE.
21 */
22
23#include <linux/slab.h>
24#include <linux/uaccess.h>
25
26#include <drm/drm_plane.h>
27#include <drm/drm_drv.h>
28#include <drm/drm_print.h>
29#include <drm/drm_framebuffer.h>
30#include <drm/drm_file.h>
31#include <drm/drm_crtc.h>
32#include <drm/drm_fourcc.h>
33#include <drm/drm_vblank.h>
34
35#include "drm_crtc_internal.h"
36
37/**
38 * DOC: overview
39 *
40 * A plane represents an image source that can be blended with or overlayed on
41 * top of a CRTC during the scanout process. Planes take their input data from a
42 * &drm_framebuffer object. The plane itself specifies the cropping and scaling
43 * of that image, and where it is placed on the visible are of a display
44 * pipeline, represented by &drm_crtc. A plane can also have additional
45 * properties that specify how the pixels are positioned and blended, like
46 * rotation or Z-position. All these properties are stored in &drm_plane_state.
47 *
48 * To create a plane, a KMS drivers allocates and zeroes an instances of
49 * &struct drm_plane (possibly as part of a larger structure) and registers it
50 * with a call to drm_universal_plane_init().
51 *
52 * Cursor and overlay planes are optional. All drivers should provide one
53 * primary plane per CRTC to avoid surprising userspace too much. See enum
54 * drm_plane_type for a more in-depth discussion of these special uapi-relevant
55 * plane types. Special planes are associated with their CRTC by calling
56 * drm_crtc_init_with_planes().
57 *
58 * The type of a plane is exposed in the immutable "type" enumeration property,
59 * which has one of the following values: "Overlay", "Primary", "Cursor".
60 */
61
62static unsigned int drm_num_planes(struct drm_device *dev)
63{
64	unsigned int num = 0;
65	struct drm_plane *tmp;
66
67	drm_for_each_plane(tmp, dev) {
68		num++;
69	}
70
71	return num;
72}
73
74static inline u32 *
75formats_ptr(struct drm_format_modifier_blob *blob)
76{
77	return (u32 *)(((char *)blob) + blob->formats_offset);
78}
79
80static inline struct drm_format_modifier *
81modifiers_ptr(struct drm_format_modifier_blob *blob)
82{
83	return (struct drm_format_modifier *)(((char *)blob) + blob->modifiers_offset);
84}
85
86static int create_in_format_blob(struct drm_device *dev, struct drm_plane *plane)
87{
88	const struct drm_mode_config *config = &dev->mode_config;
89	struct drm_property_blob *blob;
90	struct drm_format_modifier *mod;
91	size_t blob_size, formats_size, modifiers_size;
92	struct drm_format_modifier_blob *blob_data;
93	unsigned int i, j;
94
95	formats_size = sizeof(__u32) * plane->format_count;
96	if (WARN_ON(!formats_size)) {
97		/* 0 formats are never expected */
98		return 0;
99	}
100
101	modifiers_size =
102		sizeof(struct drm_format_modifier) * plane->modifier_count;
103
104	blob_size = sizeof(struct drm_format_modifier_blob);
105	/* Modifiers offset is a pointer to a struct with a 64 bit field so it
106	 * should be naturally aligned to 8B.
107	 */
108	BUILD_BUG_ON(sizeof(struct drm_format_modifier_blob) % 8);
109	blob_size += ALIGN(formats_size, 8);
110	blob_size += modifiers_size;
111
112	blob = drm_property_create_blob(dev, blob_size, NULL);
113	if (IS_ERR(blob))
114		return -1;
115
116	blob_data = blob->data;
117	blob_data->version = FORMAT_BLOB_CURRENT;
118	blob_data->count_formats = plane->format_count;
119	blob_data->formats_offset = sizeof(struct drm_format_modifier_blob);
120	blob_data->count_modifiers = plane->modifier_count;
121
122	blob_data->modifiers_offset =
123		ALIGN(blob_data->formats_offset + formats_size, 8);
124
125	memcpy(formats_ptr(blob_data), plane->format_types, formats_size);
126
127	/* If we can't determine support, just bail */
128	if (!plane->funcs->format_mod_supported)
129		goto done;
130
131	mod = modifiers_ptr(blob_data);
132	for (i = 0; i < plane->modifier_count; i++) {
133		for (j = 0; j < plane->format_count; j++) {
134			if (plane->funcs->format_mod_supported(plane,
135							       plane->format_types[j],
136							       plane->modifiers[i])) {
137
138				mod->formats |= 1ULL << j;
139			}
140		}
141
142		mod->modifier = plane->modifiers[i];
143		mod->offset = 0;
144		mod->pad = 0;
145		mod++;
146	}
147
148done:
149	drm_object_attach_property(&plane->base, config->modifiers_property,
150				   blob->base.id);
151
152	return 0;
153}
154
155/**
156 * drm_universal_plane_init - Initialize a new universal plane object
157 * @dev: DRM device
158 * @plane: plane object to init
159 * @possible_crtcs: bitmask of possible CRTCs
160 * @funcs: callbacks for the new plane
161 * @formats: array of supported formats (DRM_FORMAT\_\*)
162 * @format_count: number of elements in @formats
163 * @format_modifiers: array of struct drm_format modifiers terminated by
164 *                    DRM_FORMAT_MOD_INVALID
165 * @type: type of plane (overlay, primary, cursor)
166 * @name: printf style format string for the plane name, or NULL for default name
167 *
168 * Initializes a plane object of type @type.
169 *
170 * Returns:
171 * Zero on success, error code on failure.
172 */
173int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
174			     uint32_t possible_crtcs,
175			     const struct drm_plane_funcs *funcs,
176			     const uint32_t *formats, unsigned int format_count,
177			     const uint64_t *format_modifiers,
178			     enum drm_plane_type type,
179			     const char *name, ...)
180{
181	struct drm_mode_config *config = &dev->mode_config;
182	unsigned int format_modifier_count = 0;
183	int ret;
184
185	/* plane index is used with 32bit bitmasks */
186	if (WARN_ON(config->num_total_plane >= 32))
187		return -EINVAL;
188
189	/*
190	 * First driver to need more than 64 formats needs to fix this. Each
191	 * format is encoded as a bit and the current code only supports a u64.
192	 */
193	if (WARN_ON(format_count > 64))
194		return -EINVAL;
195
196	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
197		(!funcs->atomic_destroy_state ||
198		 !funcs->atomic_duplicate_state));
199
200	ret = drm_mode_object_add(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
201	if (ret)
202		return ret;
203
204	drm_modeset_lock_init(&plane->mutex);
205
206	plane->base.properties = &plane->properties;
207	plane->dev = dev;
208	plane->funcs = funcs;
209	plane->format_types = kmalloc_array(format_count, sizeof(uint32_t),
210					    GFP_KERNEL);
211	if (!plane->format_types) {
212		DRM_DEBUG_KMS("out of memory when allocating plane\n");
213		drm_mode_object_unregister(dev, &plane->base);
214		return -ENOMEM;
215	}
216
217	if (format_modifiers) {
218		const uint64_t *temp_modifiers = format_modifiers;
219
220		while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
221			format_modifier_count++;
222	}
223
224	if (format_modifier_count)
225		config->allow_fb_modifiers = true;
226
227	plane->modifier_count = format_modifier_count;
228	plane->modifiers = kmalloc_array(format_modifier_count,
229					 sizeof(format_modifiers[0]),
230					 GFP_KERNEL);
231
232	if (format_modifier_count && !plane->modifiers) {
233		DRM_DEBUG_KMS("out of memory when allocating plane\n");
234		kfree(plane->format_types);
235		drm_mode_object_unregister(dev, &plane->base);
236		return -ENOMEM;
237	}
238
239	if (name) {
240		va_list ap;
241
242		va_start(ap, name);
243		plane->name = kvasprintf(GFP_KERNEL, name, ap);
244		va_end(ap);
245	} else {
246		plane->name = kasprintf(GFP_KERNEL, "plane-%d",
247					drm_num_planes(dev));
248	}
249	if (!plane->name) {
250		kfree(plane->format_types);
251		kfree(plane->modifiers);
252		drm_mode_object_unregister(dev, &plane->base);
253		return -ENOMEM;
254	}
255
256	memcpy(plane->format_types, formats, format_count * sizeof(uint32_t));
257	plane->format_count = format_count;
258	memcpy(plane->modifiers, format_modifiers,
259	       format_modifier_count * sizeof(format_modifiers[0]));
260	plane->possible_crtcs = possible_crtcs;
261	plane->type = type;
262
263	list_add_tail(&plane->head, &config->plane_list);
264	plane->index = config->num_total_plane++;
265
266	drm_object_attach_property(&plane->base,
267				   config->plane_type_property,
268				   plane->type);
269
270	if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
271		drm_object_attach_property(&plane->base, config->prop_fb_id, 0);
272		drm_object_attach_property(&plane->base, config->prop_in_fence_fd, -1);
273		drm_object_attach_property(&plane->base, config->prop_crtc_id, 0);
274		drm_object_attach_property(&plane->base, config->prop_crtc_x, 0);
275		drm_object_attach_property(&plane->base, config->prop_crtc_y, 0);
276		drm_object_attach_property(&plane->base, config->prop_crtc_w, 0);
277		drm_object_attach_property(&plane->base, config->prop_crtc_h, 0);
278		drm_object_attach_property(&plane->base, config->prop_src_x, 0);
279		drm_object_attach_property(&plane->base, config->prop_src_y, 0);
280		drm_object_attach_property(&plane->base, config->prop_src_w, 0);
281		drm_object_attach_property(&plane->base, config->prop_src_h, 0);
282	}
283
284	if (config->allow_fb_modifiers)
285		create_in_format_blob(dev, plane);
286
287	return 0;
288}
289EXPORT_SYMBOL(drm_universal_plane_init);
290
291int drm_plane_register_all(struct drm_device *dev)
292{
293	unsigned int num_planes = 0;
294	unsigned int num_zpos = 0;
295	struct drm_plane *plane;
296	int ret = 0;
297
298	drm_for_each_plane(plane, dev) {
299		if (plane->funcs->late_register)
300			ret = plane->funcs->late_register(plane);
301		if (ret)
302			return ret;
303
304		if (plane->zpos_property)
305			num_zpos++;
306		num_planes++;
307	}
308
309	drm_WARN(dev, num_zpos && num_planes != num_zpos,
310		 "Mixing planes with and without zpos property is invalid\n");
311
312	return 0;
313}
314
315void drm_plane_unregister_all(struct drm_device *dev)
316{
317	struct drm_plane *plane;
318
319	drm_for_each_plane(plane, dev) {
320		if (plane->funcs->early_unregister)
321			plane->funcs->early_unregister(plane);
322	}
323}
324
325/**
326 * drm_plane_init - Initialize a legacy plane
327 * @dev: DRM device
328 * @plane: plane object to init
329 * @possible_crtcs: bitmask of possible CRTCs
330 * @funcs: callbacks for the new plane
331 * @formats: array of supported formats (DRM_FORMAT\_\*)
332 * @format_count: number of elements in @formats
333 * @is_primary: plane type (primary vs overlay)
334 *
335 * Legacy API to initialize a DRM plane.
336 *
337 * New drivers should call drm_universal_plane_init() instead.
338 *
339 * Returns:
340 * Zero on success, error code on failure.
341 */
342int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
343		   uint32_t possible_crtcs,
344		   const struct drm_plane_funcs *funcs,
345		   const uint32_t *formats, unsigned int format_count,
346		   bool is_primary)
347{
348	enum drm_plane_type type;
349
350	type = is_primary ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
351	return drm_universal_plane_init(dev, plane, possible_crtcs, funcs,
352					formats, format_count,
353					NULL, type, NULL);
354}
355EXPORT_SYMBOL(drm_plane_init);
356
357/**
358 * drm_plane_cleanup - Clean up the core plane usage
359 * @plane: plane to cleanup
360 *
361 * This function cleans up @plane and removes it from the DRM mode setting
362 * core. Note that the function does *not* free the plane structure itself,
363 * this is the responsibility of the caller.
364 */
365void drm_plane_cleanup(struct drm_plane *plane)
366{
367	struct drm_device *dev = plane->dev;
368
369	drm_modeset_lock_fini(&plane->mutex);
370
371	kfree(plane->format_types);
372	kfree(plane->modifiers);
373	drm_mode_object_unregister(dev, &plane->base);
374
375	BUG_ON(list_empty(&plane->head));
376
377	/* Note that the plane_list is considered to be static; should we
378	 * remove the drm_plane at runtime we would have to decrement all
379	 * the indices on the drm_plane after us in the plane_list.
380	 */
381
382	list_del(&plane->head);
383	dev->mode_config.num_total_plane--;
384
385	WARN_ON(plane->state && !plane->funcs->atomic_destroy_state);
386	if (plane->state && plane->funcs->atomic_destroy_state)
387		plane->funcs->atomic_destroy_state(plane, plane->state);
388
389	kfree(plane->name);
390
391	memset(plane, 0, sizeof(*plane));
392}
393EXPORT_SYMBOL(drm_plane_cleanup);
394
395/**
396 * drm_plane_from_index - find the registered plane at an index
397 * @dev: DRM device
398 * @idx: index of registered plane to find for
399 *
400 * Given a plane index, return the registered plane from DRM device's
401 * list of planes with matching index. This is the inverse of drm_plane_index().
402 */
403struct drm_plane *
404drm_plane_from_index(struct drm_device *dev, int idx)
405{
406	struct drm_plane *plane;
407
408	drm_for_each_plane(plane, dev)
409		if (idx == plane->index)
410			return plane;
411
412	return NULL;
413}
414EXPORT_SYMBOL(drm_plane_from_index);
415
416/**
417 * drm_plane_force_disable - Forcibly disable a plane
418 * @plane: plane to disable
419 *
420 * Forces the plane to be disabled.
421 *
422 * Used when the plane's current framebuffer is destroyed,
423 * and when restoring fbdev mode.
424 *
425 * Note that this function is not suitable for atomic drivers, since it doesn't
426 * wire through the lock acquisition context properly and hence can't handle
427 * retries or driver private locks. You probably want to use
428 * drm_atomic_helper_disable_plane() or
429 * drm_atomic_helper_disable_planes_on_crtc() instead.
430 */
431void drm_plane_force_disable(struct drm_plane *plane)
432{
433	int ret;
434
435	if (!plane->fb)
436		return;
437
438	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
439
440	plane->old_fb = plane->fb;
441	ret = plane->funcs->disable_plane(plane, NULL);
442	if (ret) {
443		DRM_ERROR("failed to disable plane with busy fb\n");
444		plane->old_fb = NULL;
445		return;
446	}
447	/* disconnect the plane from the fb and crtc: */
448	drm_framebuffer_put(plane->old_fb);
449	plane->old_fb = NULL;
450	plane->fb = NULL;
451	plane->crtc = NULL;
452}
453EXPORT_SYMBOL(drm_plane_force_disable);
454
455/**
456 * drm_mode_plane_set_obj_prop - set the value of a property
457 * @plane: drm plane object to set property value for
458 * @property: property to set
459 * @value: value the property should be set to
460 *
461 * This functions sets a given property on a given plane object. This function
462 * calls the driver's ->set_property callback and changes the software state of
463 * the property if the callback succeeds.
464 *
465 * Returns:
466 * Zero on success, error code on failure.
467 */
468int drm_mode_plane_set_obj_prop(struct drm_plane *plane,
469				struct drm_property *property,
470				uint64_t value)
471{
472	int ret = -EINVAL;
473	struct drm_mode_object *obj = &plane->base;
474
475	if (plane->funcs->set_property)
476		ret = plane->funcs->set_property(plane, property, value);
477	if (!ret)
478		drm_object_property_set_value(obj, property, value);
479
480	return ret;
481}
482EXPORT_SYMBOL(drm_mode_plane_set_obj_prop);
483
484int drm_mode_getplane_res(struct drm_device *dev, void *data,
485			  struct drm_file *file_priv)
486{
487	struct drm_mode_get_plane_res *plane_resp = data;
488	struct drm_plane *plane;
489	uint32_t __user *plane_ptr;
490	int count = 0;
491
492	if (!drm_core_check_feature(dev, DRIVER_MODESET))
493		return -EOPNOTSUPP;
494
495	plane_ptr = u64_to_user_ptr(plane_resp->plane_id_ptr);
496
497	/*
498	 * This ioctl is called twice, once to determine how much space is
499	 * needed, and the 2nd time to fill it.
500	 */
501	drm_for_each_plane(plane, dev) {
502		/*
503		 * Unless userspace set the 'universal planes'
504		 * capability bit, only advertise overlays.
505		 */
506		if (plane->type != DRM_PLANE_TYPE_OVERLAY &&
507		    !file_priv->universal_planes)
508			continue;
509
510		if (drm_lease_held(file_priv, plane->base.id)) {
511			if (count < plane_resp->count_planes &&
512			    put_user(plane->base.id, plane_ptr + count))
513				return -EFAULT;
514			count++;
515		}
516	}
517	plane_resp->count_planes = count;
518
519	return 0;
520}
521
522int drm_mode_getplane(struct drm_device *dev, void *data,
523		      struct drm_file *file_priv)
524{
525	struct drm_mode_get_plane *plane_resp = data;
526	struct drm_plane *plane;
527	uint32_t __user *format_ptr;
528
529	if (!drm_core_check_feature(dev, DRIVER_MODESET))
530		return -EOPNOTSUPP;
531
532	plane = drm_plane_find(dev, file_priv, plane_resp->plane_id);
533	if (!plane)
534		return -ENOENT;
535
536	drm_modeset_lock(&plane->mutex, NULL);
537	if (plane->state && plane->state->crtc && drm_lease_held(file_priv, plane->state->crtc->base.id))
538		plane_resp->crtc_id = plane->state->crtc->base.id;
539	else if (!plane->state && plane->crtc && drm_lease_held(file_priv, plane->crtc->base.id))
540		plane_resp->crtc_id = plane->crtc->base.id;
541	else
542		plane_resp->crtc_id = 0;
543
544	if (plane->state && plane->state->fb)
545		plane_resp->fb_id = plane->state->fb->base.id;
546	else if (!plane->state && plane->fb)
547		plane_resp->fb_id = plane->fb->base.id;
548	else
549		plane_resp->fb_id = 0;
550	drm_modeset_unlock(&plane->mutex);
551
552	plane_resp->plane_id = plane->base.id;
553	plane_resp->possible_crtcs = drm_lease_filter_crtcs(file_priv,
554							    plane->possible_crtcs);
555
556	plane_resp->gamma_size = 0;
557
558	/*
559	 * This ioctl is called twice, once to determine how much space is
560	 * needed, and the 2nd time to fill it.
561	 */
562	if (plane->format_count &&
563	    (plane_resp->count_format_types >= plane->format_count)) {
564		format_ptr = (uint32_t __user *)(unsigned long)plane_resp->format_type_ptr;
565		if (copy_to_user(format_ptr,
566				 plane->format_types,
567				 sizeof(uint32_t) * plane->format_count)) {
568			return -EFAULT;
569		}
570	}
571	plane_resp->count_format_types = plane->format_count;
572
573	return 0;
574}
575
576int drm_plane_check_pixel_format(struct drm_plane *plane,
577				 u32 format, u64 modifier)
578{
579	unsigned int i;
580
581	for (i = 0; i < plane->format_count; i++) {
582		if (format == plane->format_types[i])
583			break;
584	}
585	if (i == plane->format_count)
586		return -EINVAL;
587
588	if (plane->funcs->format_mod_supported) {
589		if (!plane->funcs->format_mod_supported(plane, format, modifier))
590			return -EINVAL;
591	} else {
592		if (!plane->modifier_count)
593			return 0;
594
595		for (i = 0; i < plane->modifier_count; i++) {
596			if (modifier == plane->modifiers[i])
597				break;
598		}
599		if (i == plane->modifier_count)
600			return -EINVAL;
601	}
602
603	return 0;
604}
605
606static int __setplane_check(struct drm_plane *plane,
607			    struct drm_crtc *crtc,
608			    struct drm_framebuffer *fb,
609			    int32_t crtc_x, int32_t crtc_y,
610			    uint32_t crtc_w, uint32_t crtc_h,
611			    uint32_t src_x, uint32_t src_y,
612			    uint32_t src_w, uint32_t src_h)
613{
614	int ret;
615
616	/* Check whether this plane is usable on this CRTC */
617	if (!(plane->possible_crtcs & drm_crtc_mask(crtc))) {
618		DRM_DEBUG_KMS("Invalid crtc for plane\n");
619		return -EINVAL;
620	}
621
622	/* Check whether this plane supports the fb pixel format. */
623	ret = drm_plane_check_pixel_format(plane, fb->format->format,
624					   fb->modifier);
625	if (ret) {
626		struct drm_format_name_buf format_name;
627
628		DRM_DEBUG_KMS("Invalid pixel format %s, modifier 0x%llx\n",
629			      drm_get_format_name(fb->format->format,
630						  &format_name),
631			      fb->modifier);
632		return ret;
633	}
634
635	/* Give drivers some help against integer overflows */
636	if (crtc_w > INT_MAX ||
637	    crtc_x > INT_MAX - (int32_t) crtc_w ||
638	    crtc_h > INT_MAX ||
639	    crtc_y > INT_MAX - (int32_t) crtc_h) {
640		DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
641			      crtc_w, crtc_h, crtc_x, crtc_y);
642		return -ERANGE;
643	}
644
645	ret = drm_framebuffer_check_src_coords(src_x, src_y, src_w, src_h, fb);
646	if (ret)
647		return ret;
648
649	return 0;
650}
651
652/**
653 * drm_any_plane_has_format - Check whether any plane supports this format and modifier combination
654 * @dev: DRM device
655 * @format: pixel format (DRM_FORMAT_*)
656 * @modifier: data layout modifier
657 *
658 * Returns:
659 * Whether at least one plane supports the specified format and modifier combination.
660 */
661bool drm_any_plane_has_format(struct drm_device *dev,
662			      u32 format, u64 modifier)
663{
664	struct drm_plane *plane;
665
666	drm_for_each_plane(plane, dev) {
667		if (drm_plane_check_pixel_format(plane, format, modifier) == 0)
668			return true;
669	}
670
671	return false;
672}
673EXPORT_SYMBOL(drm_any_plane_has_format);
674
675/*
676 * __setplane_internal - setplane handler for internal callers
677 *
678 * This function will take a reference on the new fb for the plane
679 * on success.
680 *
681 * src_{x,y,w,h} are provided in 16.16 fixed point format
682 */
683static int __setplane_internal(struct drm_plane *plane,
684			       struct drm_crtc *crtc,
685			       struct drm_framebuffer *fb,
686			       int32_t crtc_x, int32_t crtc_y,
687			       uint32_t crtc_w, uint32_t crtc_h,
688			       /* src_{x,y,w,h} values are 16.16 fixed point */
689			       uint32_t src_x, uint32_t src_y,
690			       uint32_t src_w, uint32_t src_h,
691			       struct drm_modeset_acquire_ctx *ctx)
692{
693	int ret = 0;
694
695	WARN_ON(drm_drv_uses_atomic_modeset(plane->dev));
696
697	/* No fb means shut it down */
698	if (!fb) {
699		plane->old_fb = plane->fb;
700		ret = plane->funcs->disable_plane(plane, ctx);
701		if (!ret) {
702			plane->crtc = NULL;
703			plane->fb = NULL;
704		} else {
705			plane->old_fb = NULL;
706		}
707		goto out;
708	}
709
710	ret = __setplane_check(plane, crtc, fb,
711			       crtc_x, crtc_y, crtc_w, crtc_h,
712			       src_x, src_y, src_w, src_h);
713	if (ret)
714		goto out;
715
716	plane->old_fb = plane->fb;
717	ret = plane->funcs->update_plane(plane, crtc, fb,
718					 crtc_x, crtc_y, crtc_w, crtc_h,
719					 src_x, src_y, src_w, src_h, ctx);
720	if (!ret) {
721		plane->crtc = crtc;
722		plane->fb = fb;
723		drm_framebuffer_get(plane->fb);
724	} else {
725		plane->old_fb = NULL;
726	}
727
728out:
729	if (plane->old_fb)
730		drm_framebuffer_put(plane->old_fb);
731	plane->old_fb = NULL;
732
733	return ret;
734}
735
736static int __setplane_atomic(struct drm_plane *plane,
737			     struct drm_crtc *crtc,
738			     struct drm_framebuffer *fb,
739			     int32_t crtc_x, int32_t crtc_y,
740			     uint32_t crtc_w, uint32_t crtc_h,
741			     uint32_t src_x, uint32_t src_y,
742			     uint32_t src_w, uint32_t src_h,
743			     struct drm_modeset_acquire_ctx *ctx)
744{
745	int ret;
746
747	WARN_ON(!drm_drv_uses_atomic_modeset(plane->dev));
748
749	/* No fb means shut it down */
750	if (!fb)
751		return plane->funcs->disable_plane(plane, ctx);
752
753	/*
754	 * FIXME: This is redundant with drm_atomic_plane_check(),
755	 * but the legacy cursor/"async" .update_plane() tricks
756	 * don't call that so we still need this here. Should remove
757	 * this when all .update_plane() implementations have been
758	 * fixed to call drm_atomic_plane_check().
759	 */
760	ret = __setplane_check(plane, crtc, fb,
761			       crtc_x, crtc_y, crtc_w, crtc_h,
762			       src_x, src_y, src_w, src_h);
763	if (ret)
764		return ret;
765
766	return plane->funcs->update_plane(plane, crtc, fb,
767					  crtc_x, crtc_y, crtc_w, crtc_h,
768					  src_x, src_y, src_w, src_h, ctx);
769}
770
771static int setplane_internal(struct drm_plane *plane,
772			     struct drm_crtc *crtc,
773			     struct drm_framebuffer *fb,
774			     int32_t crtc_x, int32_t crtc_y,
775			     uint32_t crtc_w, uint32_t crtc_h,
776			     /* src_{x,y,w,h} values are 16.16 fixed point */
777			     uint32_t src_x, uint32_t src_y,
778			     uint32_t src_w, uint32_t src_h)
779{
780	struct drm_modeset_acquire_ctx ctx;
781	int ret;
782
783	DRM_MODESET_LOCK_ALL_BEGIN(plane->dev, ctx,
784				   DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);
785
786	if (drm_drv_uses_atomic_modeset(plane->dev))
787		ret = __setplane_atomic(plane, crtc, fb,
788					crtc_x, crtc_y, crtc_w, crtc_h,
789					src_x, src_y, src_w, src_h, &ctx);
790	else
791		ret = __setplane_internal(plane, crtc, fb,
792					  crtc_x, crtc_y, crtc_w, crtc_h,
793					  src_x, src_y, src_w, src_h, &ctx);
794
795	DRM_MODESET_LOCK_ALL_END(plane->dev, ctx, ret);
796
797	return ret;
798}
799
800int drm_mode_setplane(struct drm_device *dev, void *data,
801		      struct drm_file *file_priv)
802{
803	struct drm_mode_set_plane *plane_req = data;
804	struct drm_plane *plane;
805	struct drm_crtc *crtc = NULL;
806	struct drm_framebuffer *fb = NULL;
807	int ret;
808
809	if (!drm_core_check_feature(dev, DRIVER_MODESET))
810		return -EOPNOTSUPP;
811
812	/*
813	 * First, find the plane, crtc, and fb objects.  If not available,
814	 * we don't bother to call the driver.
815	 */
816	plane = drm_plane_find(dev, file_priv, plane_req->plane_id);
817	if (!plane) {
818		DRM_DEBUG_KMS("Unknown plane ID %d\n",
819			      plane_req->plane_id);
820		return -ENOENT;
821	}
822
823	if (plane_req->fb_id) {
824		fb = drm_framebuffer_lookup(dev, file_priv, plane_req->fb_id);
825		if (!fb) {
826			DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
827				      plane_req->fb_id);
828			return -ENOENT;
829		}
830
831		crtc = drm_crtc_find(dev, file_priv, plane_req->crtc_id);
832		if (!crtc) {
833			drm_framebuffer_put(fb);
834			DRM_DEBUG_KMS("Unknown crtc ID %d\n",
835				      plane_req->crtc_id);
836			return -ENOENT;
837		}
838	}
839
840	ret = setplane_internal(plane, crtc, fb,
841				plane_req->crtc_x, plane_req->crtc_y,
842				plane_req->crtc_w, plane_req->crtc_h,
843				plane_req->src_x, plane_req->src_y,
844				plane_req->src_w, plane_req->src_h);
845
846	if (fb)
847		drm_framebuffer_put(fb);
848
849	return ret;
850}
851
852static int drm_mode_cursor_universal(struct drm_crtc *crtc,
853				     struct drm_mode_cursor2 *req,
854				     struct drm_file *file_priv,
855				     struct drm_modeset_acquire_ctx *ctx)
856{
857	struct drm_device *dev = crtc->dev;
858	struct drm_plane *plane = crtc->cursor;
859	struct drm_framebuffer *fb = NULL;
860	struct drm_mode_fb_cmd2 fbreq = {
861		.width = req->width,
862		.height = req->height,
863		.pixel_format = DRM_FORMAT_ARGB8888,
864		.pitches = { req->width * 4 },
865		.handles = { req->handle },
866	};
867	int32_t crtc_x, crtc_y;
868	uint32_t crtc_w = 0, crtc_h = 0;
869	uint32_t src_w = 0, src_h = 0;
870	int ret = 0;
871
872	BUG_ON(!plane);
873	WARN_ON(plane->crtc != crtc && plane->crtc != NULL);
874
875	/*
876	 * Obtain fb we'll be using (either new or existing) and take an extra
877	 * reference to it if fb != null.  setplane will take care of dropping
878	 * the reference if the plane update fails.
879	 */
880	if (req->flags & DRM_MODE_CURSOR_BO) {
881		if (req->handle) {
882			fb = drm_internal_framebuffer_create(dev, &fbreq, file_priv);
883			if (IS_ERR(fb)) {
884				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
885				return PTR_ERR(fb);
886			}
887
888			fb->hot_x = req->hot_x;
889			fb->hot_y = req->hot_y;
890		} else {
891			fb = NULL;
892		}
893	} else {
894		if (plane->state)
895			fb = plane->state->fb;
896		else
897			fb = plane->fb;
898
899		if (fb)
900			drm_framebuffer_get(fb);
901	}
902
903	if (req->flags & DRM_MODE_CURSOR_MOVE) {
904		crtc_x = req->x;
905		crtc_y = req->y;
906	} else {
907		crtc_x = crtc->cursor_x;
908		crtc_y = crtc->cursor_y;
909	}
910
911	if (fb) {
912		crtc_w = fb->width;
913		crtc_h = fb->height;
914		src_w = fb->width << 16;
915		src_h = fb->height << 16;
916	}
917
918	if (drm_drv_uses_atomic_modeset(dev))
919		ret = __setplane_atomic(plane, crtc, fb,
920					crtc_x, crtc_y, crtc_w, crtc_h,
921					0, 0, src_w, src_h, ctx);
922	else
923		ret = __setplane_internal(plane, crtc, fb,
924					  crtc_x, crtc_y, crtc_w, crtc_h,
925					  0, 0, src_w, src_h, ctx);
926
927	if (fb)
928		drm_framebuffer_put(fb);
929
930	/* Update successful; save new cursor position, if necessary */
931	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
932		crtc->cursor_x = req->x;
933		crtc->cursor_y = req->y;
934	}
935
936	return ret;
937}
938
939static int drm_mode_cursor_common(struct drm_device *dev,
940				  struct drm_mode_cursor2 *req,
941				  struct drm_file *file_priv)
942{
943	struct drm_crtc *crtc;
944	struct drm_modeset_acquire_ctx ctx;
945	int ret = 0;
946
947	if (!drm_core_check_feature(dev, DRIVER_MODESET))
948		return -EOPNOTSUPP;
949
950	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
951		return -EINVAL;
952
953	crtc = drm_crtc_find(dev, file_priv, req->crtc_id);
954	if (!crtc) {
955		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
956		return -ENOENT;
957	}
958
959	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
960retry:
961	ret = drm_modeset_lock(&crtc->mutex, &ctx);
962	if (ret)
963		goto out;
964	/*
965	 * If this crtc has a universal cursor plane, call that plane's update
966	 * handler rather than using legacy cursor handlers.
967	 */
968	if (crtc->cursor) {
969		ret = drm_modeset_lock(&crtc->cursor->mutex, &ctx);
970		if (ret)
971			goto out;
972
973		if (!drm_lease_held(file_priv, crtc->cursor->base.id)) {
974			ret = -EACCES;
975			goto out;
976		}
977
978		ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
979		goto out;
980	}
981
982	if (req->flags & DRM_MODE_CURSOR_BO) {
983		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
984			ret = -ENXIO;
985			goto out;
986		}
987		/* Turns off the cursor if handle is 0 */
988		if (crtc->funcs->cursor_set2)
989			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
990						      req->width, req->height, req->hot_x, req->hot_y);
991		else
992			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
993						      req->width, req->height);
994	}
995
996	if (req->flags & DRM_MODE_CURSOR_MOVE) {
997		if (crtc->funcs->cursor_move) {
998			ret = crtc->funcs->cursor_move(crtc, req->x, req->y);
999		} else {
1000			ret = -EFAULT;
1001			goto out;
1002		}
1003	}
1004out:
1005	if (ret == -EDEADLK) {
1006		ret = drm_modeset_backoff(&ctx);
1007		if (!ret)
1008			goto retry;
1009	}
1010
1011	drm_modeset_drop_locks(&ctx);
1012	drm_modeset_acquire_fini(&ctx);
1013
1014	return ret;
1015
1016}
1017
1018
1019int drm_mode_cursor_ioctl(struct drm_device *dev,
1020			  void *data, struct drm_file *file_priv)
1021{
1022	struct drm_mode_cursor *req = data;
1023	struct drm_mode_cursor2 new_req;
1024
1025	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
1026	new_req.hot_x = new_req.hot_y = 0;
1027
1028	return drm_mode_cursor_common(dev, &new_req, file_priv);
1029}
1030
1031/*
1032 * Set the cursor configuration based on user request. This implements the 2nd
1033 * version of the cursor ioctl, which allows userspace to additionally specify
1034 * the hotspot of the pointer.
1035 */
1036int drm_mode_cursor2_ioctl(struct drm_device *dev,
1037			   void *data, struct drm_file *file_priv)
1038{
1039	struct drm_mode_cursor2 *req = data;
1040
1041	return drm_mode_cursor_common(dev, req, file_priv);
1042}
1043
1044int drm_mode_page_flip_ioctl(struct drm_device *dev,
1045			     void *data, struct drm_file *file_priv)
1046{
1047	struct drm_mode_crtc_page_flip_target *page_flip = data;
1048	struct drm_crtc *crtc;
1049	struct drm_plane *plane;
1050	struct drm_framebuffer *fb = NULL, *old_fb;
1051	struct drm_pending_vblank_event *e = NULL;
1052	u32 target_vblank = page_flip->sequence;
1053	struct drm_modeset_acquire_ctx ctx;
1054	int ret = -EINVAL;
1055
1056	if (!drm_core_check_feature(dev, DRIVER_MODESET))
1057		return -EOPNOTSUPP;
1058
1059	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS)
1060		return -EINVAL;
1061
1062	if (page_flip->sequence != 0 && !(page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET))
1063		return -EINVAL;
1064
1065	/* Only one of the DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE/RELATIVE flags
1066	 * can be specified
1067	 */
1068	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) == DRM_MODE_PAGE_FLIP_TARGET)
1069		return -EINVAL;
1070
1071	if ((page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC) && !dev->mode_config.async_page_flip)
1072		return -EINVAL;
1073
1074	crtc = drm_crtc_find(dev, file_priv, page_flip->crtc_id);
1075	if (!crtc)
1076		return -ENOENT;
1077
1078	plane = crtc->primary;
1079
1080	if (!drm_lease_held(file_priv, plane->base.id))
1081		return -EACCES;
1082
1083	if (crtc->funcs->page_flip_target) {
1084		u32 current_vblank;
1085		int r;
1086
1087		r = drm_crtc_vblank_get(crtc);
1088		if (r)
1089			return r;
1090
1091		current_vblank = (u32)drm_crtc_vblank_count(crtc);
1092
1093		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
1094		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
1095			if ((int)(target_vblank - current_vblank) > 1) {
1096				DRM_DEBUG("Invalid absolute flip target %u, "
1097					  "must be <= %u\n", target_vblank,
1098					  current_vblank + 1);
1099				drm_crtc_vblank_put(crtc);
1100				return -EINVAL;
1101			}
1102			break;
1103		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
1104			if (target_vblank != 0 && target_vblank != 1) {
1105				DRM_DEBUG("Invalid relative flip target %u, "
1106					  "must be 0 or 1\n", target_vblank);
1107				drm_crtc_vblank_put(crtc);
1108				return -EINVAL;
1109			}
1110			target_vblank += current_vblank;
1111			break;
1112		default:
1113			target_vblank = current_vblank +
1114				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
1115			break;
1116		}
1117	} else if (crtc->funcs->page_flip == NULL ||
1118		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
1119		return -EINVAL;
1120	}
1121
1122	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
1123retry:
1124	ret = drm_modeset_lock(&crtc->mutex, &ctx);
1125	if (ret)
1126		goto out;
1127	ret = drm_modeset_lock(&plane->mutex, &ctx);
1128	if (ret)
1129		goto out;
1130
1131	if (plane->state)
1132		old_fb = plane->state->fb;
1133	else
1134		old_fb = plane->fb;
1135
1136	if (old_fb == NULL) {
1137		/* The framebuffer is currently unbound, presumably
1138		 * due to a hotplug event, that userspace has not
1139		 * yet discovered.
1140		 */
1141		ret = -EBUSY;
1142		goto out;
1143	}
1144
1145	fb = drm_framebuffer_lookup(dev, file_priv, page_flip->fb_id);
1146	if (!fb) {
1147		ret = -ENOENT;
1148		goto out;
1149	}
1150
1151	if (plane->state) {
1152		const struct drm_plane_state *state = plane->state;
1153
1154		ret = drm_framebuffer_check_src_coords(state->src_x,
1155						       state->src_y,
1156						       state->src_w,
1157						       state->src_h,
1158						       fb);
1159	} else {
1160		ret = drm_crtc_check_viewport(crtc, crtc->x, crtc->y,
1161					      &crtc->mode, fb);
1162	}
1163	if (ret)
1164		goto out;
1165
1166	if (old_fb->format != fb->format) {
1167		DRM_DEBUG_KMS("Page flip is not allowed to change frame buffer format.\n");
1168		ret = -EINVAL;
1169		goto out;
1170	}
1171
1172	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
1173		e = kzalloc(sizeof *e, GFP_KERNEL);
1174		if (!e) {
1175			ret = -ENOMEM;
1176			goto out;
1177		}
1178
1179		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
1180		e->event.base.length = sizeof(e->event);
1181		e->event.vbl.user_data = page_flip->user_data;
1182		e->event.vbl.crtc_id = crtc->base.id;
1183
1184		ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
1185		if (ret) {
1186			kfree(e);
1187			e = NULL;
1188			goto out;
1189		}
1190	}
1191
1192	plane->old_fb = plane->fb;
1193	if (crtc->funcs->page_flip_target)
1194		ret = crtc->funcs->page_flip_target(crtc, fb, e,
1195						    page_flip->flags,
1196						    target_vblank,
1197						    &ctx);
1198	else
1199		ret = crtc->funcs->page_flip(crtc, fb, e, page_flip->flags,
1200					     &ctx);
1201	if (ret) {
1202		if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT)
1203			drm_event_cancel_free(dev, &e->base);
1204		/* Keep the old fb, don't unref it. */
1205		plane->old_fb = NULL;
1206	} else {
1207		if (!plane->state) {
1208			plane->fb = fb;
1209			drm_framebuffer_get(fb);
1210		}
1211	}
1212
1213out:
1214	if (fb)
1215		drm_framebuffer_put(fb);
1216	fb = NULL;
1217	if (plane->old_fb)
1218		drm_framebuffer_put(plane->old_fb);
1219	plane->old_fb = NULL;
1220
1221	if (ret == -EDEADLK) {
1222		ret = drm_modeset_backoff(&ctx);
1223		if (!ret)
1224			goto retry;
1225	}
1226
1227	drm_modeset_drop_locks(&ctx);
1228	drm_modeset_acquire_fini(&ctx);
1229
1230	if (ret && crtc->funcs->page_flip_target)
1231		drm_crtc_vblank_put(crtc);
1232
1233	return ret;
1234}
1235