2 * Copyright (c) 2016 Intel Corporation
4 * Permission to use, copy, modify, distribute, and sell this software and its
5 * documentation for any purpose is hereby granted without fee, provided that
6 * the above copyright notice appear in all copies and that both that copyright
7 * notice and this permission notice appear in supporting documentation, and
8 * that the name of the copyright holders not be used in advertising or
9 * publicity pertaining to distribution of the software without specific,
10 * written prior permission. The copyright holders make no representations
11 * about the suitability of this software for any purpose. It is provided "as
12 * is" without express or implied warranty.
14 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
15 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
16 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
17 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
18 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
19 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
23 #include <linux/export.h>
24 #include <linux/uaccess.h>
26 #include <drm/drm_atomic.h>
27 #include <drm/drm_atomic_uapi.h>
28 #include <drm/drm_auth.h>
29 #include <drm/drm_debugfs.h>
30 #include <drm/drm_drv.h>
31 #include <drm/drm_file.h>
32 #include <drm/drm_fourcc.h>
33 #include <drm/drm_framebuffer.h>
34 #include <drm/drm_gem.h>
35 #include <drm/drm_print.h>
36 #include <drm/drm_util.h>
38 #include "drm_crtc_internal.h"
39 #include "drm_internal.h"
44 * Frame buffers are abstract memory objects that provide a source of pixels to
45 * scanout to a CRTC. Applications explicitly request the creation of frame
46 * buffers through the DRM_IOCTL_MODE_ADDFB(2) ioctls and receive an opaque
47 * handle that can be passed to the KMS CRTC control, plane configuration and
48 * page flip functions.
50 * Frame buffers rely on the underlying memory manager for allocating backing
51 * storage. When creating a frame buffer applications pass a memory handle
52 * (or a list of memory handles for multi-planar formats) through the
53 * &struct drm_mode_fb_cmd2 argument. For drivers using GEM as their userspace
54 * buffer management interface this would be a GEM handle. Drivers are however
55 * free to use their own backing storage object handles, e.g. vmwgfx directly
56 * exposes special TTM handles to userspace and so expects TTM handles in the
57 * create ioctl and not GEM handles.
59 * Framebuffers are tracked with &struct drm_framebuffer. They are published
60 * using drm_framebuffer_init() - after calling that function userspace can use
61 * and access the framebuffer object. The helper function
62 * drm_helper_mode_fill_fb_struct() can be used to pre-fill the required
65 * The lifetime of a drm framebuffer is controlled with a reference count,
66 * drivers can grab additional references with drm_framebuffer_get() and drop
67 * them again with drm_framebuffer_put(). For driver-private framebuffers for
68 * which the last reference is never dropped (e.g. for the fbdev framebuffer
69 * when the struct &struct drm_framebuffer is embedded into the fbdev helper
70 * struct) drivers can manually clean up a framebuffer at module unload time
71 * with drm_framebuffer_unregister_private(). But doing this is not
72 * recommended, and it's better to have a normal free-standing &struct
76 int drm_framebuffer_check_src_coords(uint32_t src_x
, uint32_t src_y
,
77 uint32_t src_w
, uint32_t src_h
,
78 const struct drm_framebuffer
*fb
)
80 unsigned int fb_width
, fb_height
;
82 fb_width
= fb
->width
<< 16;
83 fb_height
= fb
->height
<< 16;
85 /* Make sure source coordinates are inside the fb. */
86 if (src_w
> fb_width
||
87 src_x
> fb_width
- src_w
||
89 src_y
> fb_height
- src_h
) {
90 DRM_DEBUG_KMS("Invalid source coordinates "
91 "%u.%06ux%u.%06u+%u.%06u+%u.%06u (fb %ux%u)\n",
92 src_w
>> 16, ((src_w
& 0xffff) * 15625) >> 10,
93 src_h
>> 16, ((src_h
& 0xffff) * 15625) >> 10,
94 src_x
>> 16, ((src_x
& 0xffff) * 15625) >> 10,
95 src_y
>> 16, ((src_y
& 0xffff) * 15625) >> 10,
96 fb
->width
, fb
->height
);
104 * drm_mode_addfb - add an FB to the graphics configuration
105 * @dev: drm device for the ioctl
106 * @or: pointer to request structure
107 * @file_priv: drm file
109 * Add a new FB to the specified CRTC, given a user request. This is the
110 * original addfb ioctl which only supported RGB formats.
112 * Called by the user via ioctl, or by an in-kernel client.
115 * Zero on success, negative errno on failure.
117 int drm_mode_addfb(struct drm_device
*dev
, struct drm_mode_fb_cmd
*or,
118 struct drm_file
*file_priv
)
120 struct drm_mode_fb_cmd2 r
= {};
123 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
126 r
.pixel_format
= drm_driver_legacy_fb_format(dev
, or->bpp
, or->depth
);
127 if (r
.pixel_format
== DRM_FORMAT_INVALID
) {
128 DRM_DEBUG("bad {bpp:%d, depth:%d}\n", or->bpp
, or->depth
);
132 /* convert to new format and call new ioctl */
135 r
.height
= or->height
;
136 r
.pitches
[0] = or->pitch
;
137 r
.handles
[0] = or->handle
;
139 ret
= drm_mode_addfb2(dev
, &r
, file_priv
);
148 int drm_mode_addfb_ioctl(struct drm_device
*dev
,
149 void *data
, struct drm_file
*file_priv
)
151 return drm_mode_addfb(dev
, data
, file_priv
);
154 static int fb_plane_width(int width
,
155 const struct drm_format_info
*format
, int plane
)
160 return DIV_ROUND_UP(width
, format
->hsub
);
163 static int fb_plane_height(int height
,
164 const struct drm_format_info
*format
, int plane
)
169 return DIV_ROUND_UP(height
, format
->vsub
);
172 static int framebuffer_check(struct drm_device
*dev
,
173 const struct drm_mode_fb_cmd2
*r
)
175 const struct drm_format_info
*info
;
178 /* check if the format is supported at all */
179 if (!__drm_format_info(r
->pixel_format
)) {
180 DRM_DEBUG_KMS("bad framebuffer format %p4cc\n",
186 DRM_DEBUG_KMS("bad framebuffer width %u\n", r
->width
);
190 if (r
->height
== 0) {
191 DRM_DEBUG_KMS("bad framebuffer height %u\n", r
->height
);
195 /* now let the driver pick its own format info */
196 info
= drm_get_format_info(dev
, r
);
198 for (i
= 0; i
< info
->num_planes
; i
++) {
199 unsigned int width
= fb_plane_width(r
->width
, info
, i
);
200 unsigned int height
= fb_plane_height(r
->height
, info
, i
);
201 unsigned int block_size
= info
->char_per_block
[i
];
202 u64 min_pitch
= drm_format_info_min_pitch(info
, i
, width
);
204 if (!block_size
&& (r
->modifier
[i
] == DRM_FORMAT_MOD_LINEAR
)) {
205 DRM_DEBUG_KMS("Format requires non-linear modifier for plane %d\n", i
);
209 if (!r
->handles
[i
]) {
210 DRM_DEBUG_KMS("no buffer object handle for plane %d\n", i
);
214 if (min_pitch
> UINT_MAX
)
217 if ((uint64_t) height
* r
->pitches
[i
] + r
->offsets
[i
] > UINT_MAX
)
220 if (block_size
&& r
->pitches
[i
] < min_pitch
) {
221 DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r
->pitches
[i
], i
);
225 if (r
->modifier
[i
] && !(r
->flags
& DRM_MODE_FB_MODIFIERS
)) {
226 DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
231 if (r
->flags
& DRM_MODE_FB_MODIFIERS
&&
232 r
->modifier
[i
] != r
->modifier
[0]) {
233 DRM_DEBUG_KMS("bad fb modifier %llu for plane %d\n",
238 /* modifier specific checks: */
239 switch (r
->modifier
[i
]) {
240 case DRM_FORMAT_MOD_SAMSUNG_64_32_TILE
:
241 /* NOTE: the pitch restriction may be lifted later if it turns
242 * out that no hw has this restriction:
244 if (r
->pixel_format
!= DRM_FORMAT_NV12
||
245 width
% 128 || height
% 32 ||
246 r
->pitches
[i
] % 128) {
247 DRM_DEBUG_KMS("bad modifier data for plane %d\n", i
);
257 for (i
= info
->num_planes
; i
< 4; i
++) {
258 if (r
->modifier
[i
]) {
259 DRM_DEBUG_KMS("non-zero modifier for unused plane %d\n", i
);
263 /* Pre-FB_MODIFIERS userspace didn't clear the structs properly. */
264 if (!(r
->flags
& DRM_MODE_FB_MODIFIERS
))
268 DRM_DEBUG_KMS("buffer object handle for unused plane %d\n", i
);
273 DRM_DEBUG_KMS("non-zero pitch for unused plane %d\n", i
);
278 DRM_DEBUG_KMS("non-zero offset for unused plane %d\n", i
);
286 struct drm_framebuffer
*
287 drm_internal_framebuffer_create(struct drm_device
*dev
,
288 const struct drm_mode_fb_cmd2
*r
,
289 struct drm_file
*file_priv
)
291 struct drm_mode_config
*config
= &dev
->mode_config
;
292 struct drm_framebuffer
*fb
;
295 if (r
->flags
& ~(DRM_MODE_FB_INTERLACED
| DRM_MODE_FB_MODIFIERS
)) {
296 DRM_DEBUG_KMS("bad framebuffer flags 0x%08x\n", r
->flags
);
297 return ERR_PTR(-EINVAL
);
300 if ((config
->min_width
> r
->width
) || (r
->width
> config
->max_width
)) {
301 DRM_DEBUG_KMS("bad framebuffer width %d, should be >= %d && <= %d\n",
302 r
->width
, config
->min_width
, config
->max_width
);
303 return ERR_PTR(-EINVAL
);
305 if ((config
->min_height
> r
->height
) || (r
->height
> config
->max_height
)) {
306 DRM_DEBUG_KMS("bad framebuffer height %d, should be >= %d && <= %d\n",
307 r
->height
, config
->min_height
, config
->max_height
);
308 return ERR_PTR(-EINVAL
);
311 if (r
->flags
& DRM_MODE_FB_MODIFIERS
&&
312 !dev
->mode_config
.allow_fb_modifiers
) {
313 DRM_DEBUG_KMS("driver does not support fb modifiers\n");
314 return ERR_PTR(-EINVAL
);
317 ret
= framebuffer_check(dev
, r
);
321 fb
= dev
->mode_config
.funcs
->fb_create(dev
, file_priv
, r
);
323 DRM_DEBUG_KMS("could not create framebuffer\n");
329 EXPORT_SYMBOL_FOR_TESTS_ONLY(drm_internal_framebuffer_create
);
332 * drm_mode_addfb2 - add an FB to the graphics configuration
333 * @dev: drm device for the ioctl
334 * @data: data pointer for the ioctl
335 * @file_priv: drm file for the ioctl call
337 * Add a new FB to the specified CRTC, given a user request with format. This is
338 * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
339 * and uses fourcc codes as pixel format specifiers.
341 * Called by the user via ioctl.
344 * Zero on success, negative errno on failure.
346 int drm_mode_addfb2(struct drm_device
*dev
,
347 void *data
, struct drm_file
*file_priv
)
349 struct drm_mode_fb_cmd2
*r
= data
;
350 struct drm_framebuffer
*fb
;
352 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
355 fb
= drm_internal_framebuffer_create(dev
, r
, file_priv
);
359 DRM_DEBUG_KMS("[FB:%d]\n", fb
->base
.id
);
360 r
->fb_id
= fb
->base
.id
;
362 /* Transfer ownership to the filp for reaping on close */
363 mutex_lock(&file_priv
->fbs_lock
);
364 list_add(&fb
->filp_head
, &file_priv
->fbs
);
365 mutex_unlock(&file_priv
->fbs_lock
);
370 int drm_mode_addfb2_ioctl(struct drm_device
*dev
,
371 void *data
, struct drm_file
*file_priv
)
374 if (!dev
->mode_config
.quirk_addfb_prefer_host_byte_order
) {
376 * Drivers must set the
377 * quirk_addfb_prefer_host_byte_order quirk to make
378 * the drm_mode_addfb() compat code work correctly on
379 * bigendian machines.
381 * If they don't they interpret pixel_format values
382 * incorrectly for bug compatibility, which in turn
383 * implies the ADDFB2 ioctl does not work correctly
384 * then. So block it to make userspace fallback to
387 DRM_DEBUG_KMS("addfb2 broken on bigendian");
391 return drm_mode_addfb2(dev
, data
, file_priv
);
394 struct drm_mode_rmfb_work
{
395 struct work_struct work
;
396 struct list_head fbs
;
399 static void drm_mode_rmfb_work_fn(struct work_struct
*w
)
401 struct drm_mode_rmfb_work
*arg
= container_of(w
, typeof(*arg
), work
);
403 while (!list_empty(&arg
->fbs
)) {
404 struct drm_framebuffer
*fb
=
405 list_first_entry(&arg
->fbs
, typeof(*fb
), filp_head
);
407 list_del_init(&fb
->filp_head
);
408 drm_framebuffer_remove(fb
);
413 * drm_mode_rmfb - remove an FB from the configuration
415 * @fb_id: id of framebuffer to remove
416 * @file_priv: drm file
418 * Remove the specified FB.
420 * Called by the user via ioctl, or by an in-kernel client.
423 * Zero on success, negative errno on failure.
425 int drm_mode_rmfb(struct drm_device
*dev
, u32 fb_id
,
426 struct drm_file
*file_priv
)
428 struct drm_framebuffer
*fb
= NULL
;
429 struct drm_framebuffer
*fbl
= NULL
;
432 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
435 fb
= drm_framebuffer_lookup(dev
, file_priv
, fb_id
);
439 mutex_lock(&file_priv
->fbs_lock
);
440 list_for_each_entry(fbl
, &file_priv
->fbs
, filp_head
)
444 mutex_unlock(&file_priv
->fbs_lock
);
448 list_del_init(&fb
->filp_head
);
449 mutex_unlock(&file_priv
->fbs_lock
);
451 /* drop the reference we picked up in framebuffer lookup */
452 drm_framebuffer_put(fb
);
455 * we now own the reference that was stored in the fbs list
457 * drm_framebuffer_remove may fail with -EINTR on pending signals,
458 * so run this in a separate stack as there's no way to correctly
459 * handle this after the fb is already removed from the lookup table.
461 if (drm_framebuffer_read_refcount(fb
) > 1) {
462 struct drm_mode_rmfb_work arg
;
464 INIT_WORK_ONSTACK(&arg
.work
, drm_mode_rmfb_work_fn
);
465 INIT_LIST_HEAD(&arg
.fbs
);
466 list_add_tail(&fb
->filp_head
, &arg
.fbs
);
468 schedule_work(&arg
.work
);
469 flush_work(&arg
.work
);
470 destroy_work_on_stack(&arg
.work
);
472 drm_framebuffer_put(fb
);
477 drm_framebuffer_put(fb
);
481 int drm_mode_rmfb_ioctl(struct drm_device
*dev
,
482 void *data
, struct drm_file
*file_priv
)
484 uint32_t *fb_id
= data
;
486 return drm_mode_rmfb(dev
, *fb_id
, file_priv
);
490 * drm_mode_getfb - get FB info
491 * @dev: drm device for the ioctl
492 * @data: data pointer for the ioctl
493 * @file_priv: drm file for the ioctl call
495 * Lookup the FB given its ID and return info about it.
497 * Called by the user via ioctl.
500 * Zero on success, negative errno on failure.
502 int drm_mode_getfb(struct drm_device
*dev
,
503 void *data
, struct drm_file
*file_priv
)
505 struct drm_mode_fb_cmd
*r
= data
;
506 struct drm_framebuffer
*fb
;
509 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
512 fb
= drm_framebuffer_lookup(dev
, file_priv
, r
->fb_id
);
516 /* Multi-planar framebuffers need getfb2. */
517 if (fb
->format
->num_planes
> 1) {
522 if (!fb
->funcs
->create_handle
) {
527 r
->height
= fb
->height
;
528 r
->width
= fb
->width
;
529 r
->depth
= fb
->format
->depth
;
530 r
->bpp
= fb
->format
->cpp
[0] * 8;
531 r
->pitch
= fb
->pitches
[0];
533 /* GET_FB() is an unprivileged ioctl so we must not return a
534 * buffer-handle to non-master processes! For
535 * backwards-compatibility reasons, we cannot make GET_FB() privileged,
536 * so just return an invalid handle for non-masters.
538 if (!drm_is_current_master(file_priv
) && !capable(CAP_SYS_ADMIN
)) {
544 ret
= fb
->funcs
->create_handle(fb
, file_priv
, &r
->handle
);
547 drm_framebuffer_put(fb
);
552 * drm_mode_getfb2_ioctl - get extended FB info
553 * @dev: drm device for the ioctl
554 * @data: data pointer for the ioctl
555 * @file_priv: drm file for the ioctl call
557 * Lookup the FB given its ID and return info about it.
559 * Called by the user via ioctl.
562 * Zero on success, negative errno on failure.
564 int drm_mode_getfb2_ioctl(struct drm_device
*dev
,
565 void *data
, struct drm_file
*file_priv
)
567 struct drm_mode_fb_cmd2
*r
= data
;
568 struct drm_framebuffer
*fb
;
572 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
575 fb
= drm_framebuffer_lookup(dev
, file_priv
, r
->fb_id
);
579 /* For multi-plane framebuffers, we require the driver to place the
580 * GEM objects directly in the drm_framebuffer. For single-plane
581 * framebuffers, we can fall back to create_handle.
584 (fb
->format
->num_planes
> 1 || !fb
->funcs
->create_handle
)) {
589 r
->height
= fb
->height
;
590 r
->width
= fb
->width
;
591 r
->pixel_format
= fb
->format
->format
;
594 if (dev
->mode_config
.allow_fb_modifiers
)
595 r
->flags
|= DRM_MODE_FB_MODIFIERS
;
597 for (i
= 0; i
< ARRAY_SIZE(r
->handles
); i
++) {
604 for (i
= 0; i
< fb
->format
->num_planes
; i
++) {
605 r
->pitches
[i
] = fb
->pitches
[i
];
606 r
->offsets
[i
] = fb
->offsets
[i
];
607 if (dev
->mode_config
.allow_fb_modifiers
)
608 r
->modifier
[i
] = fb
->modifier
;
611 /* GET_FB2() is an unprivileged ioctl so we must not return a
612 * buffer-handle to non master/root processes! To match GET_FB()
613 * just return invalid handles (0) for non masters/root
614 * rather than making GET_FB2() privileged.
616 if (!drm_is_current_master(file_priv
) && !capable(CAP_SYS_ADMIN
)) {
621 for (i
= 0; i
< fb
->format
->num_planes
; i
++) {
624 /* If we reuse the same object for multiple planes, also
625 * return the same handle.
627 for (j
= 0; j
< i
; j
++) {
628 if (fb
->obj
[i
] == fb
->obj
[j
]) {
629 r
->handles
[i
] = r
->handles
[j
];
638 ret
= drm_gem_handle_create(file_priv
, fb
->obj
[i
],
642 ret
= fb
->funcs
->create_handle(fb
, file_priv
,
652 /* Delete any previously-created handles on failure. */
653 for (i
= 0; i
< ARRAY_SIZE(r
->handles
); i
++) {
657 drm_gem_handle_delete(file_priv
, r
->handles
[i
]);
659 /* Zero out any handles identical to the one we just
662 for (j
= i
+ 1; j
< ARRAY_SIZE(r
->handles
); j
++) {
663 if (r
->handles
[j
] == r
->handles
[i
])
669 drm_framebuffer_put(fb
);
674 * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
675 * @dev: drm device for the ioctl
676 * @data: data pointer for the ioctl
677 * @file_priv: drm file for the ioctl call
679 * Lookup the FB and flush out the damaged area supplied by userspace as a clip
680 * rectangle list. Generic userspace which does frontbuffer rendering must call
681 * this ioctl to flush out the changes on manual-update display outputs, e.g.
682 * usb display-link, mipi manual update panels or edp panel self refresh modes.
684 * Modesetting drivers which always update the frontbuffer do not need to
685 * implement the corresponding &drm_framebuffer_funcs.dirty callback.
687 * Called by the user via ioctl.
690 * Zero on success, negative errno on failure.
692 int drm_mode_dirtyfb_ioctl(struct drm_device
*dev
,
693 void *data
, struct drm_file
*file_priv
)
695 struct drm_clip_rect __user
*clips_ptr
;
696 struct drm_clip_rect
*clips
= NULL
;
697 struct drm_mode_fb_dirty_cmd
*r
= data
;
698 struct drm_framebuffer
*fb
;
703 if (!drm_core_check_feature(dev
, DRIVER_MODESET
))
706 fb
= drm_framebuffer_lookup(dev
, file_priv
, r
->fb_id
);
710 num_clips
= r
->num_clips
;
711 clips_ptr
= (struct drm_clip_rect __user
*)(unsigned long)r
->clips_ptr
;
713 if (!num_clips
!= !clips_ptr
) {
718 flags
= DRM_MODE_FB_DIRTY_FLAGS
& r
->flags
;
720 /* If userspace annotates copy, clips must come in pairs */
721 if (flags
& DRM_MODE_FB_DIRTY_ANNOTATE_COPY
&& (num_clips
% 2)) {
726 if (num_clips
&& clips_ptr
) {
727 if (num_clips
< 0 || num_clips
> DRM_MODE_FB_DIRTY_MAX_CLIPS
) {
731 clips
= kcalloc(num_clips
, sizeof(*clips
), GFP_KERNEL
);
737 ret
= copy_from_user(clips
, clips_ptr
,
738 num_clips
* sizeof(*clips
));
745 if (fb
->funcs
->dirty
) {
746 ret
= fb
->funcs
->dirty(fb
, file_priv
, flags
, r
->color
,
755 drm_framebuffer_put(fb
);
761 * drm_fb_release - remove and free the FBs on this file
762 * @priv: drm file for the ioctl
764 * Destroy all the FBs associated with @filp.
766 * Called by the user via ioctl.
769 * Zero on success, negative errno on failure.
771 void drm_fb_release(struct drm_file
*priv
)
773 struct drm_framebuffer
*fb
, *tfb
;
774 struct drm_mode_rmfb_work arg
;
776 INIT_LIST_HEAD(&arg
.fbs
);
779 * When the file gets released that means no one else can access the fb
780 * list any more, so no need to grab fpriv->fbs_lock. And we need to
781 * avoid upsetting lockdep since the universal cursor code adds a
782 * framebuffer while holding mutex locks.
784 * Note that a real deadlock between fpriv->fbs_lock and the modeset
785 * locks is impossible here since no one else but this function can get
788 list_for_each_entry_safe(fb
, tfb
, &priv
->fbs
, filp_head
) {
789 if (drm_framebuffer_read_refcount(fb
) > 1) {
790 list_move_tail(&fb
->filp_head
, &arg
.fbs
);
792 list_del_init(&fb
->filp_head
);
794 /* This drops the fpriv->fbs reference. */
795 drm_framebuffer_put(fb
);
799 if (!list_empty(&arg
.fbs
)) {
800 INIT_WORK_ONSTACK(&arg
.work
, drm_mode_rmfb_work_fn
);
802 schedule_work(&arg
.work
);
803 flush_work(&arg
.work
);
804 destroy_work_on_stack(&arg
.work
);
808 void drm_framebuffer_free(struct kref
*kref
)
810 struct drm_framebuffer
*fb
=
811 container_of(kref
, struct drm_framebuffer
, base
.refcount
);
812 struct drm_device
*dev
= fb
->dev
;
815 * The lookup idr holds a weak reference, which has not necessarily been
816 * removed at this point. Check for that.
818 drm_mode_object_unregister(dev
, &fb
->base
);
820 fb
->funcs
->destroy(fb
);
824 * drm_framebuffer_init - initialize a framebuffer
826 * @fb: framebuffer to be initialized
827 * @funcs: ... with these functions
829 * Allocates an ID for the framebuffer's parent mode object, sets its mode
830 * functions & device file and adds it to the master fd list.
833 * This functions publishes the fb and makes it available for concurrent access
834 * by other users. Which means by this point the fb _must_ be fully set up -
835 * since all the fb attributes are invariant over its lifetime, no further
836 * locking but only correct reference counting is required.
839 * Zero on success, error code on failure.
841 int drm_framebuffer_init(struct drm_device
*dev
, struct drm_framebuffer
*fb
,
842 const struct drm_framebuffer_funcs
*funcs
)
846 if (WARN_ON_ONCE(fb
->dev
!= dev
|| !fb
->format
))
849 INIT_LIST_HEAD(&fb
->filp_head
);
852 strcpy(fb
->comm
, current
->comm
);
854 ret
= __drm_mode_object_add(dev
, &fb
->base
, DRM_MODE_OBJECT_FB
,
855 false, drm_framebuffer_free
);
859 mutex_lock(&dev
->mode_config
.fb_lock
);
860 dev
->mode_config
.num_fb
++;
861 list_add(&fb
->head
, &dev
->mode_config
.fb_list
);
862 mutex_unlock(&dev
->mode_config
.fb_lock
);
864 drm_mode_object_register(dev
, &fb
->base
);
868 EXPORT_SYMBOL(drm_framebuffer_init
);
871 * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
873 * @file_priv: drm file to check for lease against.
874 * @id: id of the fb object
876 * If successful, this grabs an additional reference to the framebuffer -
877 * callers need to make sure to eventually unreference the returned framebuffer
878 * again, using drm_framebuffer_put().
880 struct drm_framebuffer
*drm_framebuffer_lookup(struct drm_device
*dev
,
881 struct drm_file
*file_priv
,
884 struct drm_mode_object
*obj
;
885 struct drm_framebuffer
*fb
= NULL
;
887 obj
= __drm_mode_object_find(dev
, file_priv
, id
, DRM_MODE_OBJECT_FB
);
892 EXPORT_SYMBOL(drm_framebuffer_lookup
);
895 * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
896 * @fb: fb to unregister
898 * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
899 * those used for fbdev. Note that the caller must hold a reference of its own,
900 * i.e. the object may not be destroyed through this call (since it'll lead to a
901 * locking inversion).
903 * NOTE: This function is deprecated. For driver-private framebuffers it is not
904 * recommended to embed a framebuffer struct info fbdev struct, instead, a
905 * framebuffer pointer is preferred and drm_framebuffer_put() should be called
906 * when the framebuffer is to be cleaned up.
908 void drm_framebuffer_unregister_private(struct drm_framebuffer
*fb
)
910 struct drm_device
*dev
;
917 /* Mark fb as reaped and drop idr ref. */
918 drm_mode_object_unregister(dev
, &fb
->base
);
920 EXPORT_SYMBOL(drm_framebuffer_unregister_private
);
923 * drm_framebuffer_cleanup - remove a framebuffer object
924 * @fb: framebuffer to remove
926 * Cleanup framebuffer. This function is intended to be used from the drivers
927 * &drm_framebuffer_funcs.destroy callback. It can also be used to clean up
928 * driver private framebuffers embedded into a larger structure.
930 * Note that this function does not remove the fb from active usage - if it is
931 * still used anywhere, hilarity can ensue since userspace could call getfb on
932 * the id and get back -EINVAL. Obviously no concern at driver unload time.
934 * Also, the framebuffer will not be removed from the lookup idr - for
935 * user-created framebuffers this will happen in in the rmfb ioctl. For
936 * driver-private objects (e.g. for fbdev) drivers need to explicitly call
937 * drm_framebuffer_unregister_private.
939 void drm_framebuffer_cleanup(struct drm_framebuffer
*fb
)
941 struct drm_device
*dev
= fb
->dev
;
943 mutex_lock(&dev
->mode_config
.fb_lock
);
945 dev
->mode_config
.num_fb
--;
946 mutex_unlock(&dev
->mode_config
.fb_lock
);
948 EXPORT_SYMBOL(drm_framebuffer_cleanup
);
950 static int atomic_remove_fb(struct drm_framebuffer
*fb
)
952 struct drm_modeset_acquire_ctx ctx
;
953 struct drm_device
*dev
= fb
->dev
;
954 struct drm_atomic_state
*state
;
955 struct drm_plane
*plane
;
956 struct drm_connector
*conn __maybe_unused
;
957 struct drm_connector_state
*conn_state
;
960 bool disable_crtcs
= false;
963 drm_modeset_acquire_init(&ctx
, 0);
965 state
= drm_atomic_state_alloc(dev
);
970 state
->acquire_ctx
= &ctx
;
974 ret
= drm_modeset_lock_all_ctx(dev
, &ctx
);
978 drm_for_each_plane(plane
, dev
) {
979 struct drm_plane_state
*plane_state
;
981 if (plane
->state
->fb
!= fb
)
984 plane_state
= drm_atomic_get_plane_state(state
, plane
);
985 if (IS_ERR(plane_state
)) {
986 ret
= PTR_ERR(plane_state
);
990 if (disable_crtcs
&& plane_state
->crtc
->primary
== plane
) {
991 struct drm_crtc_state
*crtc_state
;
993 crtc_state
= drm_atomic_get_existing_crtc_state(state
, plane_state
->crtc
);
995 ret
= drm_atomic_add_affected_connectors(state
, plane_state
->crtc
);
999 crtc_state
->active
= false;
1000 ret
= drm_atomic_set_mode_for_crtc(crtc_state
, NULL
);
1005 drm_atomic_set_fb_for_plane(plane_state
, NULL
);
1006 ret
= drm_atomic_set_crtc_for_plane(plane_state
, NULL
);
1010 plane_mask
|= drm_plane_mask(plane
);
1013 /* This list is only filled when disable_crtcs is set. */
1014 for_each_new_connector_in_state(state
, conn
, conn_state
, i
) {
1015 ret
= drm_atomic_set_crtc_for_connector(conn_state
, NULL
);
1022 ret
= drm_atomic_commit(state
);
1025 if (ret
== -EDEADLK
) {
1026 drm_atomic_state_clear(state
);
1027 drm_modeset_backoff(&ctx
);
1031 drm_atomic_state_put(state
);
1034 drm_modeset_drop_locks(&ctx
);
1035 drm_modeset_acquire_fini(&ctx
);
1037 if (ret
== -EINVAL
&& !disable_crtcs
) {
1038 disable_crtcs
= true;
1045 static void legacy_remove_fb(struct drm_framebuffer
*fb
)
1047 struct drm_device
*dev
= fb
->dev
;
1048 struct drm_crtc
*crtc
;
1049 struct drm_plane
*plane
;
1051 drm_modeset_lock_all(dev
);
1052 /* remove from any CRTC */
1053 drm_for_each_crtc(crtc
, dev
) {
1054 if (crtc
->primary
->fb
== fb
) {
1055 /* should turn off the crtc */
1056 if (drm_crtc_force_disable(crtc
))
1057 DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc
);
1061 drm_for_each_plane(plane
, dev
) {
1062 if (plane
->fb
== fb
)
1063 drm_plane_force_disable(plane
);
1065 drm_modeset_unlock_all(dev
);
1069 * drm_framebuffer_remove - remove and unreference a framebuffer object
1070 * @fb: framebuffer to remove
1072 * Scans all the CRTCs and planes in @dev's mode_config. If they're
1073 * using @fb, removes it, setting it to NULL. Then drops the reference to the
1074 * passed-in framebuffer. Might take the modeset locks.
1076 * Note that this function optimizes the cleanup away if the caller holds the
1077 * last reference to the framebuffer. It is also guaranteed to not take the
1078 * modeset locks in this case.
1080 void drm_framebuffer_remove(struct drm_framebuffer
*fb
)
1082 struct drm_device
*dev
;
1089 WARN_ON(!list_empty(&fb
->filp_head
));
1092 * drm ABI mandates that we remove any deleted framebuffers from active
1093 * useage. But since most sane clients only remove framebuffers they no
1094 * longer need, try to optimize this away.
1096 * Since we're holding a reference ourselves, observing a refcount of 1
1097 * means that we're the last holder and can skip it. Also, the refcount
1098 * can never increase from 1 again, so we don't need any barriers or
1101 * Note that userspace could try to race with use and instate a new
1102 * usage _after_ we've cleared all current ones. End result will be an
1103 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
1106 if (drm_framebuffer_read_refcount(fb
) > 1) {
1107 if (drm_drv_uses_atomic_modeset(dev
)) {
1108 int ret
= atomic_remove_fb(fb
);
1110 WARN(ret
, "atomic remove_fb failed with %i\n", ret
);
1112 legacy_remove_fb(fb
);
1115 drm_framebuffer_put(fb
);
1117 EXPORT_SYMBOL(drm_framebuffer_remove
);
1120 * drm_framebuffer_plane_width - width of the plane given the first plane
1121 * @width: width of the first plane
1122 * @fb: the framebuffer
1123 * @plane: plane index
1126 * The width of @plane, given that the width of the first plane is @width.
1128 int drm_framebuffer_plane_width(int width
,
1129 const struct drm_framebuffer
*fb
, int plane
)
1131 if (plane
>= fb
->format
->num_planes
)
1134 return fb_plane_width(width
, fb
->format
, plane
);
1136 EXPORT_SYMBOL(drm_framebuffer_plane_width
);
1139 * drm_framebuffer_plane_height - height of the plane given the first plane
1140 * @height: height of the first plane
1141 * @fb: the framebuffer
1142 * @plane: plane index
1145 * The height of @plane, given that the height of the first plane is @height.
1147 int drm_framebuffer_plane_height(int height
,
1148 const struct drm_framebuffer
*fb
, int plane
)
1150 if (plane
>= fb
->format
->num_planes
)
1153 return fb_plane_height(height
, fb
->format
, plane
);
1155 EXPORT_SYMBOL(drm_framebuffer_plane_height
);
1157 void drm_framebuffer_print_info(struct drm_printer
*p
, unsigned int indent
,
1158 const struct drm_framebuffer
*fb
)
1162 drm_printf_indent(p
, indent
, "allocated by = %s\n", fb
->comm
);
1163 drm_printf_indent(p
, indent
, "refcount=%u\n",
1164 drm_framebuffer_read_refcount(fb
));
1165 drm_printf_indent(p
, indent
, "format=%p4cc\n", &fb
->format
->format
);
1166 drm_printf_indent(p
, indent
, "modifier=0x%llx\n", fb
->modifier
);
1167 drm_printf_indent(p
, indent
, "size=%ux%u\n", fb
->width
, fb
->height
);
1168 drm_printf_indent(p
, indent
, "layers:\n");
1170 for (i
= 0; i
< fb
->format
->num_planes
; i
++) {
1171 drm_printf_indent(p
, indent
+ 1, "size[%u]=%dx%d\n", i
,
1172 drm_framebuffer_plane_width(fb
->width
, fb
, i
),
1173 drm_framebuffer_plane_height(fb
->height
, fb
, i
));
1174 drm_printf_indent(p
, indent
+ 1, "pitch[%u]=%u\n", i
, fb
->pitches
[i
]);
1175 drm_printf_indent(p
, indent
+ 1, "offset[%u]=%u\n", i
, fb
->offsets
[i
]);
1176 drm_printf_indent(p
, indent
+ 1, "obj[%u]:%s\n", i
,
1177 fb
->obj
[i
] ? "" : "(null)");
1179 drm_gem_print_info(p
, indent
+ 2, fb
->obj
[i
]);
1183 #ifdef CONFIG_DEBUG_FS
1184 static int drm_framebuffer_info(struct seq_file
*m
, void *data
)
1186 struct drm_info_node
*node
= m
->private;
1187 struct drm_device
*dev
= node
->minor
->dev
;
1188 struct drm_printer p
= drm_seq_file_printer(m
);
1189 struct drm_framebuffer
*fb
;
1191 mutex_lock(&dev
->mode_config
.fb_lock
);
1192 drm_for_each_fb(fb
, dev
) {
1193 drm_printf(&p
, "framebuffer[%u]:\n", fb
->base
.id
);
1194 drm_framebuffer_print_info(&p
, 1, fb
);
1196 mutex_unlock(&dev
->mode_config
.fb_lock
);
1201 static const struct drm_info_list drm_framebuffer_debugfs_list
[] = {
1202 { "framebuffer", drm_framebuffer_info
, 0 },
1205 void drm_framebuffer_debugfs_init(struct drm_minor
*minor
)
1207 drm_debugfs_create_files(drm_framebuffer_debugfs_list
,
1208 ARRAY_SIZE(drm_framebuffer_debugfs_list
),
1209 minor
->debugfs_root
, minor
);