WebSVN – Kolibri OS – Diff – /drivers/video/drm/drm_crtc.c

 #include
 #include
 #include
 #include
+/**
+ * drm_modeset_lock_all - take all modeset locks
+ * @dev: drm device
+ *
+ * This function takes all modeset locks, suitable where a more fine-grained
+ * scheme isn't (yet) implemented.
+ */
+void drm_modeset_lock_all(struct drm_device *dev)
+{
+	struct drm_crtc *crtc;
+	mutex_lock(&dev->mode_config.mutex);
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		mutex_lock_nest_lock(&crtc->mutex, &dev->mode_config.mutex);
+}
+EXPORT_SYMBOL(drm_modeset_lock_all);
+/**
+ * drm_modeset_unlock_all - drop all modeset locks
+ * @dev: device
+ */
+void drm_modeset_unlock_all(struct drm_device *dev)
+{
+	struct drm_crtc *crtc;
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		mutex_unlock(&crtc->mutex);
+	mutex_unlock(&dev->mode_config.mutex);
+}
+EXPORT_SYMBOL(drm_modeset_unlock_all);
+/**
+ * drm_warn_on_modeset_not_all_locked - check that all modeset locks are locked
+ * @dev: device
+ */
+void drm_warn_on_modeset_not_all_locked(struct drm_device *dev)
+{
+	struct drm_crtc *crtc;
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		WARN_ON(!mutex_is_locked(&crtc->mutex));
+	WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+}
+EXPORT_SYMBOL(drm_warn_on_modeset_not_all_locked);
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)				\
 	char *fnname(int val)					\
 	{							\
 	else
 		return "unknown";
+}
 /**
- * drm_mode_object_get - allocate a new identifier
+ * drm_mode_object_get - allocate a new modeset identifier
  * @dev: DRM device
- * @ptr: object pointer, used to generate unique ID
+ * @obj: object pointer, used to generate unique ID
- * @type: object type
- *
- * LOCKING:
+ * @obj_type: object type
+ *
  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
  * for tracking modes, CRTCs and connectors.
+ *
  * object.
  */
 static int drm_mode_object_get(struct drm_device *dev,
 			       struct drm_mode_object *obj, uint32_t obj_type)
+{
-	int new_id = 0;
 	int ret;
-again:
-	if (idr_pre_get(&dev->mode_config.crtc_idr, GFP_KERNEL) == 0) {
-		DRM_ERROR("Ran out memory getting a mode number\n");
-		return -ENOMEM;
-	}
 	mutex_lock(&dev->mode_config.idr_mutex);
+	ret = idr_alloc(&dev->mode_config.crtc_idr, obj, 1, 0, GFP_KERNEL);
+	if (ret >= 0) {
+		/*
+		 * Set up the object linking under the protection of the idr
+		 * lock so that other users can't see inconsistent state.
+		 */
+		obj->id = ret;
+		obj->type = obj_type;
 	ret = idr_get_new_above(&dev->mode_config.crtc_idr, obj, 1, &new_id);
-	mutex_unlock(&dev->mode_config.idr_mutex);
-	if (ret == -EAGAIN)
-        goto again;
-	else if (ret)
-		return ret;
+	mutex_unlock(&dev->mode_config.idr_mutex);
-	obj->id = new_id;
 	obj->type = obj_type;
-    return 0;
+	return ret < 0 ? ret : 0;
 }
 /**
- * drm_mode_object_put - free an identifer
- * @dev: DRM device
- * @id: ID to free
  * drm_mode_object_put - free a modeset identifer
- * LOCKING:
+ * @dev: DRM device
- * Caller must hold DRM mode_config lock.
+ * @object: object to free
+ *
  * Free @id from @dev's unique identifier pool.
 	mutex_lock(&dev->mode_config.idr_mutex);
 	idr_remove(&dev->mode_config.crtc_idr, object->id);
 	mutex_unlock(&dev->mode_config.idr_mutex);
+}
+/**
+ * drm_mode_object_find - look up a drm object with static lifetime
+ * @dev: drm device
+ * @id: id of the mode object
+ * @type: type of the mode object
+ *
+ * Note that framebuffers cannot be looked up with this functions - since those
+ * are reference counted, they need special treatment.
  */
 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
 		uint32_t id, uint32_t type)
+{
+	struct drm_mode_object *obj = NULL;
+	/* Framebuffers are reference counted and need their own lookup
+	 * function.*/
-	struct drm_mode_object *obj = NULL;
+	WARN_ON(type == DRM_MODE_OBJECT_FB);
 	mutex_lock(&dev->mode_config.idr_mutex);
 	obj = idr_find(&dev->mode_config.crtc_idr, id);
 	if (!obj || (obj->type != type) || (obj->id != id))
 EXPORT_SYMBOL(drm_mode_object_find);
 /**
  * drm_framebuffer_init - initialize a framebuffer
- * @dev: DRM device
- *
+ * @dev: DRM device
- * LOCKING:
+ * @fb: framebuffer to be initialized
- * Caller must hold mode config lock.
+ * @funcs: ... with these functions
+ *
  * Allocates an ID for the framebuffer's parent mode object, sets its mode
  * functions & device file and adds it to the master fd list.
+ *
+ * IMPORTANT:
+ * This functions publishes the fb and makes it available for concurrent access
+ * by other users. Which means by this point the fb _must_ be fully set up -
+ * since all the fb attributes are invariant over its lifetime, no further
+ * locking but only correct reference counting is required.
+ *
  * RETURNS:
  * Zero on success, error code on failure.
  */
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 			 const struct drm_framebuffer_funcs *funcs)
+{
+	int ret;
+	mutex_lock(&dev->mode_config.fb_lock);
+	kref_init(&fb->refcount);
+	INIT_LIST_HEAD(&fb->filp_head);
+	fb->dev = dev;
-	int ret;
+	fb->funcs = funcs;
 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
+	if (ret)
+		goto out;
-	if (ret)
-		return ret;
 	/* Grab the idr reference. */
-	fb->dev = dev;
+	drm_framebuffer_reference(fb);
+	dev->mode_config.num_fb++;
-	fb->funcs = funcs;
+	list_add(&fb->head, &dev->mode_config.fb_list);
-	dev->mode_config.num_fb++;
+out:
-	list_add(&fb->head, &dev->mode_config.fb_list);
+	mutex_unlock(&dev->mode_config.fb_lock);
+	return 0;
+}
+EXPORT_SYMBOL(drm_framebuffer_init);
+static void drm_framebuffer_free(struct kref *kref)
+{
+	struct drm_framebuffer *fb =
+			container_of(kref, struct drm_framebuffer, refcount);
+	fb->funcs->destroy(fb);
+}
+static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
+							uint32_t id)
+{
+	struct drm_mode_object *obj = NULL;
+	struct drm_framebuffer *fb;
+	mutex_lock(&dev->mode_config.idr_mutex);
+	obj = idr_find(&dev->mode_config.crtc_idr, id);
+	if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
+		fb = NULL;
+	else
+		fb = obj_to_fb(obj);
+	mutex_unlock(&dev->mode_config.idr_mutex);
+	return fb;
+}
+/**
+ * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
+ * @dev: drm device
+ * @id: id of the fb object
+ *
+ * If successful, this grabs an additional reference to the framebuffer -
+ * callers need to make sure to eventually unreference the returned framebuffer
+ * again.
+ */
+struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
+					       uint32_t id)
+{
+	struct drm_framebuffer *fb;
+	mutex_lock(&dev->mode_config.fb_lock);
+	fb = __drm_framebuffer_lookup(dev, id);
+	if (fb)
+		kref_get(&fb->refcount);
+	mutex_unlock(&dev->mode_config.fb_lock);
+	return fb;
+}
+EXPORT_SYMBOL(drm_framebuffer_lookup);
+/**
+ * drm_framebuffer_unreference - unref a framebuffer
+ * @fb: framebuffer to unref
+ *
+ * This functions decrements the fb's refcount and frees it if it drops to zero.
+ */
+void drm_framebuffer_unreference(struct drm_framebuffer *fb)
+{
+	DRM_DEBUG("FB ID: %d\n", fb->base.id);
+	kref_put(&fb->refcount, drm_framebuffer_free);
+}
+EXPORT_SYMBOL(drm_framebuffer_unreference);
+/**
+ * drm_framebuffer_reference - incr the fb refcnt
+ * @fb: framebuffer
+ */
+void drm_framebuffer_reference(struct drm_framebuffer *fb)
+{
+	DRM_DEBUG("FB ID: %d\n", fb->base.id);
+	kref_get(&fb->refcount);
+}
+EXPORT_SYMBOL(drm_framebuffer_reference);
+static void drm_framebuffer_free_bug(struct kref *kref)
+{
+	BUG();
+}
+static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+{
+	DRM_DEBUG("FB ID: %d\n", fb->base.id);
+	kref_put(&fb->refcount, drm_framebuffer_free_bug);
+}
+/* dev->mode_config.fb_lock must be held! */
+static void __drm_framebuffer_unregister(struct drm_device *dev,
+					 struct drm_framebuffer *fb)
+{
+	mutex_lock(&dev->mode_config.idr_mutex);
+	idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
+	mutex_unlock(&dev->mode_config.idr_mutex);
+	fb->base.id = 0;
+	__drm_framebuffer_unreference(fb);
+}
+/**
+ * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+ * @fb: fb to unregister
+ *
+ * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
+ * those used for fbdev. Note that the caller must hold a reference of it's own,
+ * i.e. the object may not be destroyed through this call (since it'll lead to a
+ * locking inversion).
+ */
+void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
+{
+	struct drm_device *dev = fb->dev;
+	mutex_lock(&dev->mode_config.fb_lock);
+	/* Mark fb as reaped and drop idr ref. */
 	__drm_framebuffer_unregister(dev, fb);
-	return 0;
+	mutex_unlock(&dev->mode_config.fb_lock);
+}
-EXPORT_SYMBOL(drm_framebuffer_init);
+EXPORT_SYMBOL(drm_framebuffer_unregister_private);
 /**
  * drm_framebuffer_cleanup - remove a framebuffer object
  * @fb: framebuffer to remove
+ *
+ * Cleanup references to a user-created framebuffer. This function is intended
+ * to be used from the drivers ->destroy callback.
+ *
+ * Note that this function does not remove the fb from active usuage - if it is
+ * still used anywhere, hilarity can ensue since userspace could call getfb on
- *
+ * the id and get back -EINVAL. Obviously no concern at driver unload time.
  * LOCKING:
- * Caller must hold mode config lock.
+ * Also, the framebuffer will not be removed from the lookup idr - for
  * user-created framebuffers this will happen in in the rmfb ioctl. For
- * Scans all the CRTCs in @dev's mode_config.  If they're using @fb, removes
+ * driver-private objects (e.g. for fbdev) drivers need to explicitly call
- * it, setting it to NULL.
+ * drm_framebuffer_unregister_private.
- */
-void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
-{
-	struct drm_device *dev = fb->dev;
-	/*
-	 * This could be moved to drm_framebuffer_remove(), but for
-	 * debugging is nice to keep around the list of fb's that are
+ */
-	 * no longer associated w/ a drm_file but are not unreferenced
+void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 	 * yet.  (i915 and omapdrm have debugfs files which will show
+	struct drm_device *dev = fb->dev;
 	 * this.)
-	 */
+	mutex_lock(&dev->mode_config.fb_lock);
+	list_del(&fb->head);
+	dev->mode_config.num_fb--;
+	mutex_unlock(&dev->mode_config.fb_lock);
+}
+EXPORT_SYMBOL(drm_framebuffer_cleanup);
+/**
+ * drm_framebuffer_remove - remove and unreference a framebuffer object
+ * @fb: framebuffer to remove
+ *
+ * Scans all the CRTCs and planes in @dev's mode_config.  If they're
+ * using @fb, removes it, setting it to NULL. Then drops the reference to the
+ * passed-in framebuffer. Might take the modeset locks.
+ *
+ * Note that this function optimizes the cleanup away if the caller holds the
+ * last reference to the framebuffer. It is also guaranteed to not take the
+ * modeset locks in this case.
+ */
+void drm_framebuffer_remove(struct drm_framebuffer *fb)
+{
+	struct drm_device *dev = fb->dev;
+	struct drm_crtc *crtc;
+	struct drm_plane *plane;
+	struct drm_mode_set set;
+	int ret;
+	WARN_ON(!list_empty(&fb->filp_head));
+	/*
+	 * drm ABI mandates that we remove any deleted framebuffers from active
+	 * useage. But since most sane clients only remove framebuffers they no
+	 * longer need, try to optimize this away.
+	 *
+	 * Since we're holding a reference ourselves, observing a refcount of 1
+	 * means that we're the last holder and can skip it. Also, the refcount
+	 * can never increase from 1 again, so we don't need any barriers or
+	 * locks.
+	 *
+	 * Note that userspace could try to race with use and instate a new
+	 * usage _after_ we've cleared all current ones. End result will be an
+	 * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
+	 * in this manner.
+	 */
+	if (atomic_read(&fb->refcount.refcount) > 1) {
+		drm_modeset_lock_all(dev);
+		/* remove from any CRTC */
+		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+			if (crtc->fb == fb) {
+				/* should turn off the crtc */
+				memset(&set, 0, sizeof(struct drm_mode_set));
+				set.crtc = crtc;
+				set.fb = NULL;
+				ret = drm_mode_set_config_internal(&set);
+				if (ret)
+					DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+			}
+		}
+		list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
+			if (plane->fb == fb) {
+				/* should turn off the crtc */
+				ret = plane->funcs->disable_plane(plane);
+				if (ret)
+					DRM_ERROR("failed to disable plane with busy fb\n");
+				/* disconnect the plane from the fb and crtc: */
+				__drm_framebuffer_unreference(plane->fb);
+				plane->fb = NULL;
-	drm_mode_object_put(dev, &fb->base);
+				plane->crtc = NULL;
 	list_del(&fb->head);
 	dev->mode_config.num_fb--;
 		drm_modeset_unlock_all(dev);
 EXPORT_SYMBOL(drm_framebuffer_cleanup);
 	drm_framebuffer_unreference(fb);
 /**
- * drm_crtc_init - Initialise a new CRTC object
+EXPORT_SYMBOL(drm_framebuffer_remove);
  * @dev: DRM device
- * @crtc: CRTC object to init
+/**
 	crtc->dev = dev;
 	crtc->funcs = funcs;
+	crtc->invert_dimensions = false;
-	crtc->invert_dimensions = false;
+	drm_modeset_lock_all(dev);
 	mutex_init(&crtc->mutex);
-	mutex_lock(&dev->mode_config.mutex);
+	mutex_lock_nest_lock(&crtc->mutex, &dev->mode_config.mutex);
 	list_add_tail(&crtc->head, &dev->mode_config.crtc_list);
 	dev->mode_config.num_crtc++;
  out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 EXPORT_SYMBOL(drm_crtc_init);
-/**
- * drm_crtc_cleanup - Cleans up the core crtc usage.
- * @crtc: CRTC to cleanup
 /**
- * LOCKING:
+ * drm_crtc_cleanup - Cleans up the core crtc usage.
- * Caller must hold mode config lock.
+ * @crtc: CRTC to cleanup
+ *
  * Cleanup @crtc. Removes from drm modesetting space
 /**
  * drm_mode_probed_add - add a mode to a connector's probed mode list
  * @connector: connector the new mode
  * @mode: mode data
+ *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Add @mode to @connector's mode list for later use.
  */
 void drm_mode_probed_add(struct drm_connector *connector,
 			 struct drm_display_mode *mode)
+{
 /**
  * drm_mode_remove - remove and free a mode
  * @connector: connector list to modify
  * @mode: mode to remove
+ *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Remove @mode from @connector's mode list, then free it.
  */
 void drm_mode_remove(struct drm_connector *connector,
 		     struct drm_display_mode *mode)
+{
 /**
  * drm_connector_init - Init a preallocated connector
  * @dev: DRM device
  * @connector: the connector to init
  * @funcs: callbacks for this connector
- * @name: user visible name of the connector
+ * @connector_type: user visible type of the connector
- *
- * LOCKING:
- * Takes mode config lock.
+ *
  * Initialises a preallocated connector. Connectors should be
  * subclassed as part of driver connector objects.
+ *
  * RETURNS:
 		     const struct drm_connector_funcs *funcs,
 		     int connector_type)
+{
 	int ret;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	ret = drm_mode_object_get(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR);
 	drm_object_attach_property(&connector->base,
 				      dev->mode_config.dpms_property, 0);
  out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 EXPORT_SYMBOL(drm_connector_init);
-/**
- * drm_connector_cleanup - cleans up an initialised connector
- * @connector: connector to cleanup
 /**
- * LOCKING:
+ * drm_connector_cleanup - cleans up an initialised connector
- * Takes mode config lock.
+ * @connector: connector to cleanup
+ *
  * Cleans up the connector but doesn't free the object.
 		drm_mode_remove(connector, mode);
 	list_for_each_entry_safe(mode, t, &connector->user_modes, head)
-		drm_mode_remove(connector, mode);
 		drm_mode_remove(connector, mode);
 	mutex_lock(&dev->mode_config.mutex);
 	drm_mode_object_put(dev, &connector->base);
-	list_del(&connector->head);
-	dev->mode_config.num_connector--;
+	list_del(&connector->head);
-	mutex_unlock(&dev->mode_config.mutex);
+	dev->mode_config.num_connector--;
+}
 EXPORT_SYMBOL(drm_connector_cleanup);
 		      const struct drm_encoder_funcs *funcs,
 		      int encoder_type)
+{
 	int ret;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
 	list_add_tail(&encoder->head, &dev->mode_config.encoder_list);
 	dev->mode_config.num_encoder++;
  out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 EXPORT_SYMBOL(drm_encoder_init);
 void drm_encoder_cleanup(struct drm_encoder *encoder)
+{
 	struct drm_device *dev = encoder->dev;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	drm_mode_object_put(dev, &encoder->base);
 	list_del(&encoder->head);
 	dev->mode_config.num_encoder--;
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 		   const uint32_t *formats, uint32_t format_count,
 		   bool priv)
+{
 	int ret;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
 	} else {
 		INIT_LIST_HEAD(&plane->head);
+	}
  out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 EXPORT_SYMBOL(drm_plane_init);
 void drm_plane_cleanup(struct drm_plane *plane)
+{
 	struct drm_device *dev = plane->dev;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	kfree(plane->format_types);
 	drm_mode_object_put(dev, &plane->base);
 	/* if not added to a list, it must be a private plane */
 	if (!list_empty(&plane->head)) {
 		list_del(&plane->head);
 		dev->mode_config.num_plane--;
+	}
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
+}
 EXPORT_SYMBOL(drm_plane_cleanup);
-/**
- * drm_mode_create - create a new display mode
  * @dev: DRM device
 /**
- * LOCKING:
+ * drm_mode_create - create a new display mode
- * Caller must hold DRM mode_config lock.
+ * @dev: DRM device
+ *
 /**
  * drm_mode_destroy - remove a mode
  * @dev: DRM device
  * @mode: mode to remove
+ *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Free @mode's unique identifier, then free it.
  */
 void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode)
+{
 	if (!mode)
 /**
  * drm_mode_config_init - initialize DRM mode_configuration structure
  * @dev: DRM device
- *
- * LOCKING:
- * None, should happen single threaded at init time.
+ *
  * Initialize @dev's mode_config structure, used for tracking the graphics
+ * configuration of @dev.
+ *
+ * Since this initializes the modeset locks, no locking is possible. Which is no
+ * problem, since this should happen single threaded at init time. It is the
+ * driver's problem to ensure this guarantee.
  * configuration of @dev.
  */
 void drm_mode_config_init(struct drm_device *dev)
+{
 	mutex_init(&dev->mode_config.mutex);
+	mutex_init(&dev->mode_config.idr_mutex);
-	mutex_init(&dev->mode_config.idr_mutex);
+	mutex_init(&dev->mode_config.fb_lock);
 	INIT_LIST_HEAD(&dev->mode_config.fb_list);
 	INIT_LIST_HEAD(&dev->mode_config.crtc_list);
 	INIT_LIST_HEAD(&dev->mode_config.connector_list);
 	INIT_LIST_HEAD(&dev->mode_config.encoder_list);
 	INIT_LIST_HEAD(&dev->mode_config.property_list);
 	INIT_LIST_HEAD(&dev->mode_config.property_blob_list);
 	INIT_LIST_HEAD(&dev->mode_config.plane_list);
 	idr_init(&dev->mode_config.crtc_idr);
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	drm_mode_create_standard_connector_properties(dev);
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	/* Just to be sure */
 /**
  * drm_mode_config_cleanup - free up DRM mode_config info
  * @dev: DRM device
- *
- * LOCKING:
- * Caller must hold mode config lock.
+ *
  * Free up all the connectors and CRTCs associated with this DRM device, then
  * free up the framebuffers and associated buffer objects.
+ *
+ * Note that since this /should/ happen single-threaded at driver/device
+ * teardown time, no locking is required. It's the driver's job to ensure that
+ * this guarantee actually holds true.
+ *
  * FIXME: cleanup any dangling user buffer objects too
  */
 void drm_mode_config_cleanup(struct drm_device *dev)
+{
 	list_for_each_entry_safe(property, pt, &dev->mode_config.property_list,
 				 head) {
 		drm_property_destroy(dev, property);
+	}
+	/*
+	 * Single-threaded teardown context, so it's not required to grab the
+	 * fb_lock to protect against concurrent fb_list access. Contrary, it
+	 * would actually deadlock with the drm_framebuffer_cleanup function.
+	 *
+	 * Also, if there are any framebuffers left, that's a driver leak now,
+	 * so politely WARN about this.
+	 */
+	WARN_ON(!list_empty(&dev->mode_config.fb_list));
+	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
+		drm_framebuffer_remove(fb);
+	}
 	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list,
 				 head) {
 		plane->funcs->destroy(plane);
+	}
 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
-		crtc->funcs->destroy(crtc);
 		crtc->funcs->destroy(crtc);
+	}
 	idr_remove_all(&dev->mode_config.crtc_idr);
 	idr_destroy(&dev->mode_config.crtc_idr);
+}
 EXPORT_SYMBOL(drm_mode_config_cleanup);
 /**
- * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
- * @out: drm_mode_modeinfo struct to return to the user
- * @in: drm_display_mode to use
  * drm_crtc_convert_to_umode - convert a drm_display_mode into a modeinfo
- * LOCKING:
+ * @out: drm_mode_modeinfo struct to return to the user
- * None.
+ * @in: drm_display_mode to use
+ *
  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
 /**
  * drm_crtc_convert_to_umode - convert a modeinfo into a drm_display_mode
  * @out: drm_display_mode to return to the user
  * @in: drm_mode_modeinfo to use
+ *
- * LOCKING:
- * None.
- *
  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
  * the caller.
+ *
  * RETURNS:
  * Zero on success, errno on failure.
 #if 0
 /**
  * drm_mode_getresources - get graphics configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
+ * @dev: drm device for the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
+ * @data: data pointer for the ioctl
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
+ *
  * Construct a set of configuration description structures and return
  * them to the user, including CRTC, connector and framebuffer configuration.
 	struct drm_mode_group *mode_group;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-		return -EINVAL;
+		return -EINVAL;
 	mutex_lock(&dev->mode_config.mutex);
 	mutex_lock(&file_priv->fbs_lock);
 	/*
 	 * For the non-control nodes we need to limit the list of resources
 	 * by IDs in the group list for this node
+	 */
+	list_for_each(lh, &file_priv->fbs)
+		fb_count++;
+	/* handle this in 4 parts */
+	/* FBs */
+	if (card_res->count_fbs >= fb_count) {
+		copied = 0;
+		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
+		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
+			if (put_user(fb->base.id, fb_id + copied)) {
+				mutex_unlock(&file_priv->fbs_lock);
+				return -EFAULT;
+			}
+			copied++;
+		}
+	}
-	 */
+	card_res->count_fbs = fb_count;
-	list_for_each(lh, &file_priv->fbs)
+	mutex_unlock(&file_priv->fbs_lock);
 		fb_count++;
 	drm_modeset_lock_all(dev);
 	card_res->max_height = dev->mode_config.max_height;
 	card_res->min_height = dev->mode_config.min_height;
 	card_res->max_width = dev->mode_config.max_width;
 	card_res->min_width = dev->mode_config.min_width;
-	/* handle this in 4 parts */
-	/* FBs */
-	if (card_res->count_fbs >= fb_count) {
-		copied = 0;
-		fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
-		list_for_each_entry(fb, &file_priv->fbs, filp_head) {
-			if (put_user(fb->base.id, fb_id + copied)) {
-				ret = -EFAULT;
-				goto out;
-			}
-			copied++;
-		}
-	}
-	card_res->count_fbs = fb_count;
 	/* CRTCs */
 	if (card_res->count_crtcs >= crtc_count) {
 		copied = 0;
 		crtc_id = (uint32_t __user *)(unsigned long)card_res->crtc_id_ptr;
 	DRM_DEBUG_KMS("CRTC[%d] CONNECTORS[%d] ENCODERS[%d]\n", card_res->count_crtcs,
 		  card_res->count_connectors, card_res->count_encoders);
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
- * drm_mode_getcrtc - get CRTC configuration
- * @inode: inode from the ioctl
+ * drm_mode_getcrtc - get CRTC configuration
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
  * @dev: drm device for the ioctl
- * LOCKING:
+ * @data: data pointer for the ioctl
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
+ *
  * Construct a CRTC configuration structure to return to the user.
 	int ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, crtc_resp->crtc_id,
 	} else {
 		crtc_resp->mode_valid = 0;
+	}
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
  * drm_mode_getconnector - get connector configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
+ * @dev: drm device for the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
+ * @data: data pointer for the ioctl
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
+ *
  * Construct a connector configuration structure to return to the user.
+ *
+	}
 	out_resp->count_encoders = encoders_count;
 out:
+	mutex_unlock(&dev->mode_config.mutex);
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
+}
 	int ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, enc_resp->encoder_id,
 				   DRM_MODE_OBJECT_ENCODER);
 	if (!obj) {
 	enc_resp->encoder_id = encoder->base.id;
 	enc_resp->possible_crtcs = encoder->possible_crtcs;
 	enc_resp->possible_clones = encoder->possible_clones;
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
  * drm_mode_getplane_res - get plane info
  * @dev: DRM device
  * @data: ioctl data
- * @file_priv: DRM file info
- *
- * LOCKING:
- * Takes mode config lock.
+ * @file_priv: DRM file info
+ *
  * Return an plane count and set of IDs.
  */
 int drm_mode_getplane_res(struct drm_device *dev, void *data,
 	int copied = 0, ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	config = &dev->mode_config;
+		}
+	}
 	plane_resp->count_planes = config->num_plane;
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
  * drm_mode_getplane - get plane info
  * @dev: DRM device
  * @data: ioctl data
- * @file_priv: DRM file info
- *
- * LOCKING:
- * Takes mode config lock.
+ * @file_priv: DRM file info
+ *
  * Return plane info, including formats supported, gamma size, any
  * current fb, etc.
  */
 	int ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, plane_resp->plane_id,
 				   DRM_MODE_OBJECT_PLANE);
 	if (!obj) {
+		}
+	}
 	plane_resp->count_format_types = plane->format_count;
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
  * drm_mode_setplane - set up or tear down an plane
  * @dev: DRM device
- * @data: ioctl data*
- * @file_prive: DRM file info
- *
- * LOCKING:
+ * @data: ioctl data*
- * Takes mode config lock.
+ * @file_priv: DRM file info
+ *
  * Set plane info, including placement, fb, scaling, and other factors.
  * Or pass a NULL fb to disable.
+{
 	struct drm_mode_set_plane *plane_req = data;
 	struct drm_mode_object *obj;
 	struct drm_plane *plane;
 	struct drm_crtc *crtc;
-	struct drm_framebuffer *fb;
+	struct drm_framebuffer *fb = NULL, *old_fb = NULL;
 	int ret = 0;
 	unsigned int fb_width, fb_height;
 	int i;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+		return -EINVAL;
 	/*
 	 * First, find the plane, crtc, and fb objects.  If not available,
 	 * we don't bother to call the driver.
 	 */
 	obj = drm_mode_object_find(dev, plane_req->plane_id,
 				   DRM_MODE_OBJECT_PLANE);
 	if (!obj) {
 		DRM_DEBUG_KMS("Unknown plane ID %d\n",
-			      plane_req->plane_id);
-		ret = -ENOENT;
+			      plane_req->plane_id);
-		goto out;
+		return -ENOENT;
+	}
 	plane = obj_to_plane(obj);
+	/* No fb means shut it down */
 	if (!plane_req->fb_id) {
-	/* No fb means shut it down */
+		drm_modeset_lock_all(dev);
-	if (!plane_req->fb_id) {
+		old_fb = plane->fb;
+		plane->funcs->disable_plane(plane);
-		plane->funcs->disable_plane(plane);
+		plane->crtc = NULL;
-		plane->crtc = NULL;
+		plane->fb = NULL;
-		plane->fb = NULL;
+		drm_modeset_unlock_all(dev);
 		goto out;
 		ret = -ENOENT;
 		goto out;
+	}
 	crtc = obj_to_crtc(obj);
-	obj = drm_mode_object_find(dev, plane_req->fb_id,
-				   DRM_MODE_OBJECT_FB);
+	fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
-	if (!obj) {
+	if (!fb) {
 		DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
 			      plane_req->fb_id);
 		ret = -ENOENT;
 		goto out;
-	}
 	fb = obj_to_fb(obj);
 	/* Check whether this plane supports the fb pixel format. */
 	for (i = 0; i < plane->format_count; i++)
 			      plane_req->crtc_x, plane_req->crtc_y);
 		ret = -ERANGE;
 		goto out;
+	}
 	drm_modeset_lock_all(dev);
 	ret = plane->funcs->update_plane(plane, crtc, fb,
 					 plane_req->crtc_x, plane_req->crtc_y,
 					 plane_req->crtc_w, plane_req->crtc_h,
 					 plane_req->src_x, plane_req->src_y,
 					 plane_req->src_w, plane_req->src_h);
+	if (!ret) {
-	if (!ret) {
+		old_fb = plane->fb;
 		plane->crtc = crtc;
+		plane->fb = fb;
-		plane->fb = fb;
+		fb = NULL;
+	}
 	drm_modeset_unlock_all(dev);
+out:
+	if (fb)
+		drm_framebuffer_unreference(fb);
-out:
+	if (old_fb)
-	mutex_unlock(&dev->mode_config.mutex);
+		drm_framebuffer_unreference(old_fb);
 	return ret;
-	return ret;
+}
-}
+#endif
-/**
- * drm_mode_setcrtc - set CRTC configuration
  * @inode: inode from the ioctl
+/**
+ * drm_mode_set_config_internal - helper to call ->set_config
+ * @set: modeset config to set
+ *
+ * This is a little helper to wrap internal calls to the ->set_config driver
+ * interface. The only thing it adds is correct refcounting dance.
+ */
+int drm_mode_set_config_internal(struct drm_mode_set *set)
+{
+	struct drm_crtc *crtc = set->crtc;
- * @filp: file * from the ioctl
+	struct drm_framebuffer *fb, *old_fb;
+	int ret;
+	old_fb = crtc->fb;
+	fb = set->fb;
+	ret = crtc->funcs->set_config(set);
+	if (ret == 0) {
+		if (old_fb)
+			drm_framebuffer_unreference(old_fb);
+		if (fb)
+			drm_framebuffer_reference(fb);
+	}
+	return ret;
+}
+EXPORT_SYMBOL(drm_mode_set_config_internal);
- * @cmd: cmd from ioctl
+#if 0
+/**
- * @arg: arg from ioctl
+ * drm_mode_setcrtc - set CRTC configuration
  * @dev: drm device for the ioctl
- * LOCKING:
+ * @data: data pointer for the ioctl
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
+ *
 	/* For some reason crtc x/y offsets are signed internally. */
 	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
 		return -ERANGE;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, crtc_req->crtc_id,
 				   DRM_MODE_OBJECT_CRTC);
 	if (!obj) {
 				DRM_DEBUG_KMS("CRTC doesn't have current FB\n");
 				ret = -EINVAL;
 				goto out;
+			}
 					fb = crtc->fb;
+			/* Make refcounting symmetric with the lookup path. */
+			drm_framebuffer_reference(fb);
 		} else {
-			obj = drm_mode_object_find(dev, crtc_req->fb_id,
+			fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
-						   DRM_MODE_OBJECT_FB);
-			if (!obj) {
+			if (!fb) {
 				DRM_DEBUG_KMS("Unknown FB ID%d\n",
 						crtc_req->fb_id);
 				ret = -EINVAL;
 				goto out;
+			}
-			fb = obj_to_fb(obj);
+		}
 		mode = drm_mode_create(dev);
 		if (!mode) {
 	set.y = crtc_req->y;
 	set.mode = mode;
 	set.connectors = connector_set;
 	set.num_connectors = crtc_req->count_connectors;
 	set.fb = fb;
-	ret = crtc->funcs->set_config(&set);
+	ret = drm_mode_set_config_internal(&set);
+out:
+	if (fb)
+		drm_framebuffer_unreference(fb);
 out:
 	kfree(connector_set);
 	drm_mode_destroy(dev, mode);
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 		return -EINVAL;
 	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
-		return -EINVAL;
 		return -EINVAL;
 	mutex_lock(&dev->mode_config.mutex);
 	obj = drm_mode_object_find(dev, req->crtc_id, DRM_MODE_OBJECT_CRTC);
 	if (!obj) {
-		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
-		ret = -EINVAL;
+		DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
-		goto out;
+		return -EINVAL;
+	}
 	crtc = obj_to_crtc(obj);
 	crtc = obj_to_crtc(obj);
 	mutex_lock(&crtc->mutex);
 	if (req->flags & DRM_MODE_CURSOR_BO) {
 		if (!crtc->funcs->cursor_set) {
 			ret = -EFAULT;
 			goto out;
+		}
+	}
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	mutex_unlock(&crtc->mutex);
 	return ret;
+}
 #endif
 /* Original addfb only supported RGB formats, so figure out which one */
 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
+{
 	uint32_t fmt;
 	switch (bpp) {
 	case 8:
-		fmt = DRM_FORMAT_RGB332;
+		fmt = DRM_FORMAT_C8;
 		break;
 	case 16:
 		if (depth == 15)
 			fmt = DRM_FORMAT_XRGB1555;
+}
 EXPORT_SYMBOL(drm_mode_legacy_fb_format);
 #if 0
 /**
  * drm_mode_addfb - add an FB to the graphics configuration
- * @inode: inode from the ioctl
+ * @dev: drm device for the ioctl
- * @filp: file * from the ioctl
+ * @data: data pointer for the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
+ * @file_priv: drm file for the ioctl call
- *
- * LOCKING:
- * Takes mode config lock.
+ *
  * Add a new FB to the specified CRTC, given a user request.
+ *
  * Called by the user via ioctl.
+ *
 		return -EINVAL;
 	if ((config->min_height > r.height) || (r.height > config->max_height))
-		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
-	/* TODO check buffer is sufficiently large */
-	/* TODO setup destructor callback */
+		return -EINVAL;
 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, &r);
 	if (IS_ERR(fb)) {
-		DRM_DEBUG_KMS("could not create framebuffer\n");
-		ret = PTR_ERR(fb);
+		DRM_DEBUG_KMS("could not create framebuffer\n");
+		return PTR_ERR(fb);
 		goto out;
 	mutex_lock(&file_priv->fbs_lock);
+	or->fb_id = fb->base.id;
-	or->fb_id = fb->base.id;
-	list_add(&fb->filp_head, &file_priv->fbs);
-	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+	list_add(&fb->filp_head, &file_priv->fbs);
 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-out:
+	mutex_unlock(&file_priv->fbs_lock);
 	mutex_unlock(&dev->mode_config.mutex);
 	return 0;
+}
 /**
  * drm_mode_addfb2 - add an FB to the graphics configuration
- * @inode: inode from the ioctl
+ * @dev: drm device for the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
+ * @data: data pointer for the ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
+ *
  * Add a new FB to the specified CRTC, given a user request with format.
+ *
  * Called by the user via ioctl.
 	ret = framebuffer_check(r);
 	if (ret)
-		return ret;
-	mutex_lock(&dev->mode_config.mutex);
+		return ret;
 	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
 	if (IS_ERR(fb)) {
-		DRM_DEBUG_KMS("could not create framebuffer\n");
-		ret = PTR_ERR(fb);
+		DRM_DEBUG_KMS("could not create framebuffer\n");
+		return PTR_ERR(fb);
 		goto out;
 	mutex_lock(&file_priv->fbs_lock);
+	r->fb_id = fb->base.id;
+	list_add(&fb->filp_head, &file_priv->fbs);
-	r->fb_id = fb->base.id;
-	list_add(&fb->filp_head, &file_priv->fbs);
 	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
 	mutex_unlock(&file_priv->fbs_lock);
 out:
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
 }
-/**
- * drm_mode_rmfb - remove an FB from the configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
+/**
- * @arg: arg from ioctl
+ * drm_mode_rmfb - remove an FB from the configuration
  * @dev: drm device for the ioctl
- * LOCKING:
+ * @data: data pointer for the ioctl
- * Takes mode config lock.
+ * @file_priv: drm file for the ioctl call
  * Zero on success, errno on failure.
  */
 int drm_mode_rmfb(struct drm_device *dev,
 		   void *data, struct drm_file *file_priv)
+{
-	struct drm_mode_object *obj;
 	struct drm_framebuffer *fb = NULL;
 	struct drm_framebuffer *fbl = NULL;
 	uint32_t *id = data;
-	int ret = 0;
 	int found = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	mutex_lock(&file_priv->fbs_lock);
-	obj = drm_mode_object_find(dev, *id, DRM_MODE_OBJECT_FB);
+	mutex_lock(&dev->mode_config.fb_lock);
-	/* TODO check that we really get a framebuffer back. */
-	if (!obj) {
+	fb = __drm_framebuffer_lookup(dev, *id);
-		ret = -EINVAL;
-		goto out;
 	if (!fb)
-	fb = obj_to_fb(obj);
+		goto fail_lookup;
+	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
+		if (fb == fbl)
-	list_for_each_entry(fbl, &file_priv->fbs, filp_head)
+			found = 1;
-		if (fb == fbl)
+	if (!found)
-			found = 1;
+		goto fail_lookup;
+	/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
+	__drm_framebuffer_unregister(dev, fb);
 	if (!found) {
+	list_del_init(&fb->filp_head);
+	mutex_unlock(&dev->mode_config.fb_lock);
-		ret = -EINVAL;
+	mutex_unlock(&file_priv->fbs_lock);
-		goto out;
+	drm_framebuffer_remove(fb);
-	}
+	return 0;
-	drm_framebuffer_remove(fb);
+fail_lookup:
 	mutex_unlock(&dev->mode_config.fb_lock);
-out:
+	mutex_unlock(&file_priv->fbs_lock);
-	mutex_unlock(&dev->mode_config.mutex);
-	return ret;
-}
+	return -EINVAL;
-/**
- * drm_mode_getfb - get FB info
  * @inode: inode from the ioctl
  * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
+/**
- * @arg: arg from ioctl
+ * drm_mode_getfb - get FB info
  * @dev: drm device for the ioctl
  */
 int drm_mode_getfb(struct drm_device *dev,
 		   void *data, struct drm_file *file_priv)
+{
 	struct drm_mode_fb_cmd *r = data;
-	struct drm_mode_object *obj;
 	struct drm_framebuffer *fb;
-	int ret = 0;
+	int ret;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-		return -EINVAL;
+		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
-	obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
+	fb = drm_framebuffer_lookup(dev, r->fb_id);
-	if (!obj) {
-		ret = -EINVAL;
-		goto out;
 	if (!fb)
-	fb = obj_to_fb(obj);
+		return -EINVAL;
 	r->height = fb->height;
 	r->width = fb->width;
+	r->depth = fb->depth;
-	r->depth = fb->depth;
+	r->bpp = fb->bits_per_pixel;
+	r->pitch = fb->pitches[0];
+	if (fb->funcs->create_handle)
+		ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
+	else
-	r->bpp = fb->bits_per_pixel;
-	r->pitch = fb->pitches[0];
-	fb->funcs->create_handle(fb, file_priv, &r->handle);
+		ret = -ENODEV;
-out:
+	drm_framebuffer_unreference(fb);
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
+}
 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
-			   void *data, struct drm_file *file_priv)
 			   void *data, struct drm_file *file_priv)
 	struct drm_clip_rect __user *clips_ptr;
-	struct drm_clip_rect *clips = NULL;
+	struct drm_clip_rect __user *clips_ptr;
-	struct drm_mode_fb_dirty_cmd *r = data;
+	struct drm_clip_rect *clips = NULL;
-	struct drm_mode_object *obj;
+	struct drm_mode_fb_dirty_cmd *r = data;
 	struct drm_framebuffer *fb;
-	unsigned flags;
-	int num_clips;
+	unsigned flags;
-	int ret;
+	int num_clips;
+	int ret;
-	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-		return -EINVAL;
 	mutex_lock(&dev->mode_config.mutex);
-	obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
+	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-	if (!obj) {
+		return -EINVAL;
 			goto out_err2;
+	}
+	}
+	if (fb->funcs->dirty) {
-	if (fb->funcs->dirty) {
+		drm_modeset_lock_all(dev);
 		ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
+				       clips, num_clips);
-				       clips, num_clips);
+		drm_modeset_unlock_all(dev);
 	} else {
-		ret = -ENOSYS;
-		goto out_err2;
+		ret = -ENOSYS;
+	}
 out_err2:
 	kfree(clips);
+out_err1:
-out_err1:
+	drm_framebuffer_unreference(fb);
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
+}
-/**
- * drm_fb_release - remove and free the FBs on this file
  * @filp: file * from the ioctl
 /**
- * LOCKING:
+ * drm_fb_release - remove and free the FBs on this file
- * Takes mode config lock.
+ * @priv: drm file for the ioctl
+ *
 void drm_fb_release(struct drm_file *priv)
+{
 	struct drm_device *dev = priv->minor->dev;
 	struct drm_framebuffer *fb, *tfb;
-	mutex_lock(&dev->mode_config.mutex);
+	mutex_lock(&priv->fbs_lock);
+	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
+		mutex_lock(&dev->mode_config.fb_lock);
+		/* Mark fb as reaped, we still have a ref from fpriv->fbs. */
+		__drm_framebuffer_unregister(dev, fb);
+		mutex_unlock(&dev->mode_config.fb_lock);
+		list_del_init(&fb->filp_head);
-	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
+		/* This will also drop the fpriv->fbs reference. */
 		drm_framebuffer_remove(fb);
 	}
-	mutex_unlock(&dev->mode_config.mutex);
+	mutex_unlock(&priv->fbs_lock);
+}
 #endif
 #if 0
 /**
  * drm_fb_attachmode - Attach a user mode to an connector
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
+ * @dev: drm device for the ioctl
- * @cmd: cmd from ioctl
+ * @data: data pointer for the ioctl
- * @arg: arg from ioctl
+ * @file_priv: drm file for the ioctl call
+ *
  * This attaches a user specified mode to an connector.
  * Called by the user via ioctl.
 	int ret;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
 		goto out;
+	}
 	drm_mode_attachmode(dev, connector, mode);
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 /**
- * drm_fb_detachmode - Detach a user specified mode from an connector
- * @inode: inode from the ioctl
+ * drm_fb_detachmode - Detach a user specified mode from an connector
- * @filp: file * from the ioctl
+ * @dev: drm device for the ioctl
- * @cmd: cmd from ioctl
+ * @data: data pointer for the ioctl
- * @arg: arg from ioctl
+ * @file_priv: drm file for the ioctl call
+ *
  * Called by the user via ioctl.
 	int ret;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
 		goto out;
+	}
 	ret = drm_mode_detachmode(dev, connector, &mode);
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 #endif
 	uint32_t __user *blob_length_ptr;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, out_resp->prop_id, DRM_MODE_OBJECT_PROPERTY);
 	if (!obj) {
 		ret = -EINVAL;
+			}
+		}
 		out_resp->count_enum_blobs = blob_count;
+	}
 done:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 #endif
 	void __user *blob_ptr;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, out_resp->blob_id, DRM_MODE_OBJECT_BLOB);
 	if (!obj) {
 		ret = -EINVAL;
+		}
+	}
 	out_resp->length = blob->length;
 done:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 #endif
 	uint64_t __user *prop_values_ptr;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
 			copied++;
+		}
+	}
 	arg->count_props = props_count;
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
 	int i;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
 		ret = drm_mode_plane_set_obj_prop(arg_obj, property, arg->value);
 				break;
+			}
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
 #endif
 	int ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
 	if (!obj) {
 		ret = -EINVAL;
+	}
 	crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
 	int ret = 0;
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
-	mutex_lock(&dev->mode_config.mutex);
+	drm_modeset_lock_all(dev);
 	obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
 	if (!obj) {
 		ret = -EINVAL;
 	if (copy_to_user((void __user *)(unsigned long)crtc_lut->blue, b_base, size)) {
 		ret = -EFAULT;
 		goto out;
+	}
 out:
-	mutex_unlock(&dev->mode_config.mutex);
+	drm_modeset_unlock_all(dev);
 	return ret;
+}
  */
 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
 			  int *bpp)
+{
 	switch (format) {
+	case DRM_FORMAT_C8:
 	case DRM_FORMAT_RGB332:
 	case DRM_FORMAT_BGR233:
 		*depth = 8;
 		*bpp = 8;
 		break;

Subversion Repositories Kolibri OS

(root)/drivers/video/drm/drm_crtc.c – Rev 3192 → 3480