// os\kernelhwsrv\kernel\eka\drivers\display\display.cpp  

const TUint8  KMutexOrder             = 0x3f;

static const char KDisplayLddPanic[]  ="DISPLAY/GCE LDD";

_LIT(KClientRequestMutex, "ClientRequestMutex");

    iThreadOpenCount    = 0;

    iAsyncReqCount		= 0;

    iClientRequestMutex = 0;	

     // cancel outstanding requests and destroy the queue of TClientRequest objects

		for(TInt i = 0; i < KMaxQueuedRequests; i++)

			{

			//Method IsReady() returns true if the client’s request SetStatus method has been called but the 

			//coresponding QueueRequestComplete method hasn't.			

			if(iPendingReq[k][i].iTClientReq)        

				{

				if(iPendingReq[k][i].iTClientReq->IsReady() )

					{

					CompleteRequest(iPendingReq[k][i].iOwningThread,iPendingReq[k][i].iTClientReq,KErrCancel);        	

					}     		

				}			

			Kern::DestroyClientRequest(iClientRequest[k][i]);

			}

		}

    if (iClientRequestMutex != NULL)

         {

         iClientRequestMutex->Close(NULL);

         }

    __ASSERT_DEBUG(iThreadOpenCount == 0,Kern::Fault(KDisplayLddPanic,__LINE__));

    __ASSERT_DEBUG(iAsyncReqCount   == 0,Kern::Fault(KDisplayLddPanic,__LINE__));  

#ifdef _DEBUG

	// Close the UDEB user mode chunk, if it exists

	if (iChunk)

		Kern::ChunkClose(iChunk);

#endif // _DEBUG

		|| !Kern::CurrentThreadHasCapability(ECapabilityReadDeviceData, __PLATSEC_DIAGNOSTIC_STRING("Checked by DISPLAY.LDD (GCE Driver)") )

		|| !Kern::CurrentThreadHasCapability(ECapabilityWriteDeviceData,__PLATSEC_DIAGNOSTIC_STRING("Checked by DISPLAY.LDD (GCE Driver)") )

		|| !Kern::CurrentThreadHasCapability(ECapabilityProtServ,       __PLATSEC_DIAGNOSTIC_STRING("Checked by DISPLAY.LDD (GCE Driver)") ) )

	iUnit=aUnit;

    //Initialise pending queue for asynchronous requests and queue of TClientRequests

    for(TInt k = 0; k < KPendingReqArraySize; k++) 

    	iPendingIndex[k]=0;

		for(TInt i = 0; i < KMaxQueuedRequests; i++)

			{

			iPendingReq[k][i].iTClientReq   = 0;

			iPendingReq[k][i].iOwningThread = 0;

			r = Kern::CreateClientRequest(iClientRequest[k][i]);

			if (r != KErrNone)

				{

				return r;      	

				}

			}	

    	} 

    r = Kern::MutexCreate(iClientRequestMutex, KClientRequestMutex, KMutexOrder);	

	if (r != KErrNone)

		{

		return r;

		}	

Override DLogicalChannel::SendMsg to process a client message before and after sending the message 

to the DFC thread for processing by HandleMsg().

This function is called in the context of the client thread.

The function is used to pin client data in the context of the client thread, so that data can be safely

accessed from kernel threads without the possibility of taking page faults.

@param aMsg  The message to process.

             The iValue member of this distinguishes the message type:

			 iValue==ECloseMsg, channel close message

			 iValue==KMaxTInt, a 'DoCancel' message

			 iValue>=0, a 'DoControl' message with function number equal to iValue

			 iValue<0, a 'DoRequest' message with function number equal to ~iValue

 @return KErrNone if the message was send successfully, otherwise one of the other system-wide error

        codes.

 */ 

TInt DDisplayLdd::SendMsg(TMessageBase* aMsg)

	{

	TThreadMessage& m=*(TThreadMessage*)aMsg;

    TInt id = m.iValue;

	TInt r = KErrNone;	

	 // close msg or cancel

	if (id == (TInt)ECloseMsg || id == KMaxTInt)

		{

		r = DLogicalChannel::SendMsg(aMsg);

		}

	//asynchronous request

	else if (id < 0)

		{

		TRequestStatus* pS=(TRequestStatus*)m.Ptr0();

		r = SendRequest(aMsg);

		if (r != KErrNone)

			Kern::RequestComplete(pS,r);

		}

	 // synchronous request

	else{

		r = SendControl(aMsg);

		}

	return r;

	}

/**

Validate, pre-process, send and post-process data for an asynchronous client request, so that data can be safely

accessed from kernel threads without the possibility of taking page faults. 

This function is called in the context of the client thread.

@param aMsg  The message to process.

             The iValue member of this distinguishes the message type:

			 iValue==ECloseMsg, channel close message

			 iValue==KMaxTInt, a 'DoCancel' message

			 iValue>=0, a 'DoControl' message with function number equal to iValue

			 iValue<0, a 'DoRequest' message with function number equal to ~iValue

 @return KErrNone if the message was send successfully, otherwise one of the other system-wide error

        codes.

 */ 

TInt DDisplayLdd::SendRequest(TMessageBase* aMsg)

	{

	TThreadMessage& m	=*(TThreadMessage*)aMsg;

    TInt aReqNumber 	= ~m.iValue;

	TRequestStatus* pS	=(TRequestStatus*)m.Ptr0();

	#ifdef _GCE_DISPLAY_DEBUG

	DThread* client 	= m.Client();

	#endif		

	TInt r 				= KErrNotSupported;

	TInt pendingIndex;

	/*Use thread local copies of the configuration data that need to be exchanged between the client and DFC thread. 

	Using thread local copies is possible even for asynchronous requests, since the values to be returned are known 

	when processing the request( inside DoRequest ) and not at a later stage.*/

	TInt kernelCompBuffIdx;

	TInt kernelpack[2];	

	RDisplayChannel::TPostCount  kernelCount;

	//In asynchronous requests m.Ptr0 is used for the TRequestStatus object.

	TAny* userConfigData1 = m.Ptr1();

	TAny* userConfigData2 = m.Ptr2();

	/*

	If the client request needs to pass some data to the DFC thread then we copy these to a thread local

	copy(created in the thread supervisor stack) and then update the message to point to that local copy. 

	If the client will have to read a value updated in the DFC thread, then the message should just be 

	updated and point to the local copy. After the request has completed the updated data will be copied

	from the local copy to the client, in the context of the client thread. 

	*/

    switch (aReqNumber)

		{

	    case RDisplayChannel::EReqGetCompositionBuffer:	//Client should read data updated in the DFC thread.

				m.iArg[1] = &kernelCompBuffIdx;				

				break;

        case RDisplayChannel::EReqPostUserBuffer:    	//Both the client and DFC thread need to read data.

				umemget32(&kernelpack, userConfigData1, (sizeof(TInt)*2) );

				m.iArg[1] = &kernelpack;

				m.iArg[2] = &kernelCount;

				break;		

		case RDisplayChannel::EReqWaitForPost:			//Client data should be passed to the DFC thread.	

				umemget32(&kernelCount, userConfigData1, sizeof(RDisplayChannel::TPostCount) );

				m.iArg[1] = &kernelCount;							

				break;

		default:

				return KErrNotSupported; 

		}

	/* 		

	The TClientRequest objects associated with each asynchronous request need to be accessed by both the client and DFC

	threads. To resolve the potential synchronization problem we maintain two seperate pointers(iClientRequest and 

	iPendingReq.iClientReq )to the same TClientRequest object. iClientRequestMutex is used to synchronise access to 

	iClientRequest from different client threads. The first client thread that acquires the mutex will set the status

	of an available TClientRequest object and send the message(call SendMsg). Consequently method DoRequest is queued for 

	execution by the DFC thread. DoRequest initialy saves iClientRequest to iPendingReq.iClientReq and queues the request. 

	Only then, the mutex is signaled. Another client thread trying to access iClientRequest will block in the mutex until

	DoRequest has updated iPendingReq.iClientReq. Even more the DFC thread only accesses iClientRequest in DoRequest and 

	then iPendingReq.iClientReq is only used, so synchronizing access to iPendingReq.iClientReq is handled by the DFC queue.

	*/

	// Need to be in critical section whilst holding a DMutex

	NKern::ThreadEnterCS();

	Kern::MutexWait(*iClientRequestMutex);	

	//Save the TRequestStatus in any available TClientRequest object for that asynchronous request.

	for( TInt k=0; k< KMaxQueuedRequests; k++) 

		{

		//setStatus will return KErrInUse if a previous client request hasn't completed yet.

		r = iClientRequest[aReqNumber][k]->SetStatus(pS);

		if( r == KErrNone)

			{

			pendingIndex = k;

			//The current available index for this pending request will be passed as 

			//another message argument to the DFC thread.

			m.iArg[3] =  (TAny*) pendingIndex; 

			break;

			}		 			

		}

	if (r == KErrNone)

		{

		r = DLogicalChannel::SendMsg(aMsg);

		}

	else

		{

		__DEBUG_PRINT3("Client %08x trying to issue asynchronous request %d", client, aReqNumber);

		//Fail if there aren't any available TClientRequest object

		__ASSERT_DEBUG(r==KErrNone,Kern::Fault(KDisplayLddPanic,__LINE__));				

		}

	Kern::MutexSignal(*iClientRequestMutex);

    NKern::ThreadLeaveCS();

    //Copy config data from local copies to client, in context of client thread

    switch (aReqNumber)

		{

	    case RDisplayChannel::EReqGetCompositionBuffer:

	    		__DEBUG_PRINT2("EReqGetCompositionBuffer: kernelCompBuffIdx returned =%d",kernelCompBuffIdx);						

				umemput32(userConfigData1, &kernelCompBuffIdx, sizeof(TInt) );

				break;

        case RDisplayChannel::EReqPostUserBuffer:

        		__DEBUG_PRINT2("EReqPostUserBuffer: kernelCount returned = %d",kernelCount);

				umemput32(userConfigData2, &kernelCount, sizeof(RDisplayChannel::TPostCount) );	

				break;							

		}		 	

	return r;

	}

/**

Validate, pre-process, send and post-process data for a synchronous client request, so that data can be safely

accessed from kernel threads without the possibility of taking page faults. 

This function is called in the context of the client thread.

@param aMsg  The message to process.

             The iValue member of this distinguishes the message type:

			 iValue==ECloseMsg, channel close message

			 iValue==KMaxTInt, a 'DoCancel' message

			 iValue>=0, a 'DoControl' message with function number equal to iValue

			 iValue<0, a 'DoRequest' message with function number equal to ~iValue

@return KErrNone if the message was send successfully, otherwise one of the other system-wide error

        codes.

 */ 

TInt DDisplayLdd::SendControl(TMessageBase* aMsg)

	{	

	TThreadMessage& m	= *(TThreadMessage*)aMsg;

    TInt aReqNumber 	= m.iValue;

	//Use thread local copies of the configuration data that need to be exchanged between the client and DFC thread. 

	RDisplayChannel::TPostCount  			kernelPostCount;

	RDisplayChannel::TDisplayRotation 		kernelRotation;

	TPckgBuf<RDisplayChannel::TDisplayInfo> pckgInfo(iDisplayInfo);

	TInt  kernelpack[2];	

	TInt  kernelBufferId;

	TBool kernelRotChanged;

	TInt  kernelIndex;

	TAny* userConfigData0 = m.Ptr0();

	TAny* userConfigData1 = m.Ptr1();

	switch (aReqNumber)

		{

		//iDisplayInfo doesn't change after the driver initialisation so copy in client thread context

		case RDisplayChannel::ECtrlGetDisplayInfo:

			umemput32(userConfigData0, &pckgInfo, sizeof(TPckgBuf<RDisplayChannel::TDisplayInfo>) );	

			return KErrNone;

		case RDisplayChannel::ECtrlPostCompositionBuffer:  		//Client should read data updated in the DFC thread.

			m.iArg[1] = &kernelPostCount;

			break;

		case RDisplayChannel::ECtrlPostLegacyBuffer:			//Client should read data updated in the DFC thread.

			m.iArg[1] = &kernelPostCount;			

			break;	

		case RDisplayChannel::ECtrlRegisterUserBuffer:			//Both the client and DFC thread need to read data.

			umemget32(&kernelpack, userConfigData0, (sizeof(TInt)*2) );

			m.iArg[0] = &kernelpack;			

			m.iArg[1] = &kernelBufferId;	

			break;

		case RDisplayChannel::ECtrlDeregisterUserBuffer:		//Client data should be passed to the DFC thread.	

			umemget32(&kernelBufferId, userConfigData0, sizeof(TInt) );

			m.iArg[0] = &kernelBufferId;				

			break;	

	 	case RDisplayChannel::ECtrlSetRotation:					//Both the client and DFC thread need to read data.

			umemget32(&kernelRotation, userConfigData0, sizeof(RDisplayChannel::TDisplayRotation) );

			m.iArg[0] = &kernelRotation;

			m.iArg[1] = &kernelRotChanged;

			break;

		case RDisplayChannel::ECtrlCurrentRotation:				//Client should read data updated in the DFC thread.

			m.iArg[0] = &kernelRotation;

			break;

		case RDisplayChannel::ECtrlGetCompositionBufferInfo:	//Both the client and DFC thread need to read data.		

			umemget32(&kernelIndex, userConfigData0, sizeof(TInt) );

			m.iArg[0] = &kernelIndex;

			m.iArg[1] = &kernelpack;		

			break;

#ifdef _DEBUG

		case RDisplayChannel::ECtrlCreateUserBuffer:

		    m.iArg[0] = userConfigData0;

            m.iArg[1] = userConfigData1;

            break;

#endif // _DEBUG

		default:

			return KErrNotSupported; 

		}

	TInt r = DLogicalChannel::SendMsg(aMsg);	

	if (r != KErrNone)

		{

		return r;

		}

	 //Copy config data from local copies to client, in context of client thread

    switch (aReqNumber)

		{					

	    case RDisplayChannel::ECtrlPostCompositionBuffer:  				

			__DEBUG_PRINT2("ECtrlPostCompositionBuffer =%d", kernelPostCount );

			umemput32(userConfigData1, &kernelPostCount, sizeof(RDisplayChannel::TPostCount) );	

			break;

		case RDisplayChannel::ECtrlPostLegacyBuffer:

			__DEBUG_PRINT2("ECtrlPostLegacyBuffer=%d", kernelPostCount );	

			umemput32(userConfigData1, &kernelPostCount, sizeof(RDisplayChannel::TPostCount) );			

			break;	

		case RDisplayChannel::ECtrlRegisterUserBuffer:

			__DEBUG_PRINT2("ECtrlRegisterUserBuffer kernelBufferId=%d", kernelBufferId );	

			umemput32(userConfigData1, &kernelBufferId, sizeof(TInt) );

			break;

		case RDisplayChannel::ECtrlSetRotation:

			__DEBUG_PRINT2("ECtrlSetRotation  kernelRotChanged=%d", kernelRotChanged );

			umemput32(userConfigData1, &kernelRotChanged, sizeof(TBool) );

			break;