Bug Summary

File:dev/pci/drm/drm_crtc.c
Warning:line 530, column 29
Access to field 'rotation' results in a dereference of a null pointer (loaded from field 'state')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name drm_crtc.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/pci/drm/drm_crtc.c
1/*
2 * Copyright (c) 2006-2008 Intel Corporation
3 * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
4 * Copyright (c) 2008 Red Hat Inc.
5 *
6 * DRM core CRTC related functions
7 *
8 * Permission to use, copy, modify, distribute, and sell this software and its
9 * documentation for any purpose is hereby granted without fee, provided that
10 * the above copyright notice appear in all copies and that both that copyright
11 * notice and this permission notice appear in supporting documentation, and
12 * that the name of the copyright holders not be used in advertising or
13 * publicity pertaining to distribution of the software without specific,
14 * written prior permission. The copyright holders make no representations
15 * about the suitability of this software for any purpose. It is provided "as
16 * is" without express or implied warranty.
17 *
18 * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
19 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
20 * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
21 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
22 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
23 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24 * OF THIS SOFTWARE.
25 *
26 * Authors:
27 * Keith Packard
28 * Eric Anholt <eric@anholt.net>
29 * Dave Airlie <airlied@linux.ie>
30 * Jesse Barnes <jesse.barnes@intel.com>
31 */
32#include <linux/ctype.h>
33#include <linux/list.h>
34#include <linux/slab.h>
35#include <linux/export.h>
36#include <linux/dma-fence.h>
37#include <linux/uaccess.h>
38#include <drm/drm_crtc.h>
39#include <drm/drm_edid.h>
40#include <drm/drm_fourcc.h>
41#include <drm/drm_modeset_lock.h>
42#include <drm/drm_atomic.h>
43#include <drm/drm_auth.h>
44#include <drm/drm_debugfs_crc.h>
45#include <drm/drm_drv.h>
46#include <drm/drm_print.h>
47#include <drm/drm_file.h>
48
49#include "drm_crtc_internal.h"
50#include "drm_internal.h"
51
52/**
53 * DOC: overview
54 *
55 * A CRTC represents the overall display pipeline. It receives pixel data from
56 * &drm_plane and blends them together. The &drm_display_mode is also attached
57 * to the CRTC, specifying display timings. On the output side the data is fed
58 * to one or more &drm_encoder, which are then each connected to one
59 * &drm_connector.
60 *
61 * To create a CRTC, a KMS drivers allocates and zeroes an instances of
62 * &struct drm_crtc (possibly as part of a larger structure) and registers it
63 * with a call to drm_crtc_init_with_planes().
64 *
65 * The CRTC is also the entry point for legacy modeset operations, see
66 * &drm_crtc_funcs.set_config, legacy plane operations, see
67 * &drm_crtc_funcs.page_flip and &drm_crtc_funcs.cursor_set2, and other legacy
68 * operations like &drm_crtc_funcs.gamma_set. For atomic drivers all these
69 * features are controlled through &drm_property and
70 * &drm_mode_config_funcs.atomic_check and &drm_mode_config_funcs.atomic_check.
71 */
72
73/**
74 * drm_crtc_from_index - find the registered CRTC at an index
75 * @dev: DRM device
76 * @idx: index of registered CRTC to find for
77 *
78 * Given a CRTC index, return the registered CRTC from DRM device's
79 * list of CRTCs with matching index. This is the inverse of drm_crtc_index().
80 * It's useful in the vblank callbacks (like &drm_driver.enable_vblank or
81 * &drm_driver.disable_vblank), since that still deals with indices instead
82 * of pointers to &struct drm_crtc."
83 */
84struct drm_crtc *drm_crtc_from_index(struct drm_device *dev, int idx)
85{
86 struct drm_crtc *crtc;
87
88 drm_for_each_crtc(crtc, dev)for (crtc = ({ const __typeof( ((__typeof(*crtc) *)0)->head
) *__mptr = ((&(dev)->mode_config.crtc_list)->next
); (__typeof(*crtc) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*crtc), head) );}); &crtc->head != (&(dev)->mode_config
.crtc_list); crtc = ({ const __typeof( ((__typeof(*crtc) *)0)
->head ) *__mptr = (crtc->head.next); (__typeof(*crtc) *
)( (char *)__mptr - __builtin_offsetof(__typeof(*crtc), head)
);}))
89 if (idx == crtc->index)
90 return crtc;
91
92 return NULL((void *)0);
93}
94EXPORT_SYMBOL(drm_crtc_from_index);
95
96int drm_crtc_force_disable(struct drm_crtc *crtc)
97{
98 struct drm_mode_set set = {
99 .crtc = crtc,
100 };
101
102 WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev))({ int __ret = !!(drm_drv_uses_atomic_modeset(crtc->dev));
if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(crtc->dev)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 102); __builtin_expect
(!!(__ret), 0); });
103
104 return drm_mode_set_config_internal(&set);
105}
106
107static unsigned int drm_num_crtcs(struct drm_device *dev)
108{
109 unsigned int num = 0;
110 struct drm_crtc *tmp;
111
112 drm_for_each_crtc(tmp, dev)for (tmp = ({ const __typeof( ((__typeof(*tmp) *)0)->head )
*__mptr = ((&(dev)->mode_config.crtc_list)->next);
(__typeof(*tmp) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*tmp), head) );}); &tmp->head != (&(dev)->mode_config
.crtc_list); tmp = ({ const __typeof( ((__typeof(*tmp) *)0)->
head ) *__mptr = (tmp->head.next); (__typeof(*tmp) *)( (char
*)__mptr - __builtin_offsetof(__typeof(*tmp), head) );})) {
113 num++;
114 }
115
116 return num;
117}
118
119int drm_crtc_register_all(struct drm_device *dev)
120{
121 struct drm_crtc *crtc;
122 int ret = 0;
123
124 drm_for_each_crtc(crtc, dev)for (crtc = ({ const __typeof( ((__typeof(*crtc) *)0)->head
) *__mptr = ((&(dev)->mode_config.crtc_list)->next
); (__typeof(*crtc) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*crtc), head) );}); &crtc->head != (&(dev)->mode_config
.crtc_list); crtc = ({ const __typeof( ((__typeof(*crtc) *)0)
->head ) *__mptr = (crtc->head.next); (__typeof(*crtc) *
)( (char *)__mptr - __builtin_offsetof(__typeof(*crtc), head)
);})) {
125 drm_debugfs_crtc_add(crtc);
126
127 if (crtc->funcs->late_register)
128 ret = crtc->funcs->late_register(crtc);
129 if (ret)
130 return ret;
131 }
132
133 return 0;
134}
135
136void drm_crtc_unregister_all(struct drm_device *dev)
137{
138 struct drm_crtc *crtc;
139
140 drm_for_each_crtc(crtc, dev)for (crtc = ({ const __typeof( ((__typeof(*crtc) *)0)->head
) *__mptr = ((&(dev)->mode_config.crtc_list)->next
); (__typeof(*crtc) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*crtc), head) );}); &crtc->head != (&(dev)->mode_config
.crtc_list); crtc = ({ const __typeof( ((__typeof(*crtc) *)0)
->head ) *__mptr = (crtc->head.next); (__typeof(*crtc) *
)( (char *)__mptr - __builtin_offsetof(__typeof(*crtc), head)
);})) {
141 if (crtc->funcs->early_unregister)
142 crtc->funcs->early_unregister(crtc);
143 drm_debugfs_crtc_remove(crtc);
144 }
145}
146
147static int drm_crtc_crc_init(struct drm_crtc *crtc)
148{
149#ifdef CONFIG_DEBUG_FS
150 mtx_init(&crtc->crc.lock, IPL_NONE)do { (void)(((void *)0)); (void)(0); __mtx_init((&crtc->
crc.lock), ((((0x0)) > 0x0 && ((0x0)) < 0x9) ? 0x9
: ((0x0)))); } while (0);
151 init_waitqueue_head(&crtc->crc.wq);
152 crtc->crc.source = kstrdup("auto", GFP_KERNEL(0x0001 | 0x0004));
153 if (!crtc->crc.source)
154 return -ENOMEM12;
155#endif
156 return 0;
157}
158
159static void drm_crtc_crc_fini(struct drm_crtc *crtc)
160{
161#ifdef CONFIG_DEBUG_FS
162 kfree(crtc->crc.source);
163#endif
164}
165
166static const struct dma_fence_ops drm_crtc_fence_ops;
167
168static struct drm_crtc *fence_to_crtc(struct dma_fence *fence)
169{
170 BUG_ON(fence->ops != &drm_crtc_fence_ops)((!(fence->ops != &drm_crtc_fence_ops)) ? (void)0 : __assert
("diagnostic ", "/usr/src/sys/dev/pci/drm/drm_crtc.c", 170, "!(fence->ops != &drm_crtc_fence_ops)"
));
171 return container_of(fence->lock, struct drm_crtc, fence_lock)({ const __typeof( ((struct drm_crtc *)0)->fence_lock ) *__mptr
= (fence->lock); (struct drm_crtc *)( (char *)__mptr - __builtin_offsetof
(struct drm_crtc, fence_lock) );});
172}
173
174static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence)
175{
176 struct drm_crtc *crtc = fence_to_crtc(fence);
177
178 return crtc->dev->driver->name;
179}
180
181static const char *drm_crtc_fence_get_timeline_name(struct dma_fence *fence)
182{
183 struct drm_crtc *crtc = fence_to_crtc(fence);
184
185 return crtc->timeline_name;
186}
187
188static const struct dma_fence_ops drm_crtc_fence_ops = {
189 .get_driver_name = drm_crtc_fence_get_driver_name,
190 .get_timeline_name = drm_crtc_fence_get_timeline_name,
191};
192
193struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc)
194{
195 struct dma_fence *fence;
196
197 fence = kzalloc(sizeof(*fence), GFP_KERNEL(0x0001 | 0x0004));
198 if (!fence)
199 return NULL((void *)0);
200
201 dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock,
202 crtc->fence_context, ++crtc->fence_seqno);
203
204 return fence;
205}
206
207/**
208 * DOC: standard CRTC properties
209 *
210 * DRM CRTCs have a few standardized properties:
211 *
212 * ACTIVE:
213 * Atomic property for setting the power state of the CRTC. When set to 1
214 * the CRTC will actively display content. When set to 0 the CRTC will be
215 * powered off. There is no expectation that user-space will reset CRTC
216 * resources like the mode and planes when setting ACTIVE to 0.
217 *
218 * User-space can rely on an ACTIVE change to 1 to never fail an atomic
219 * test as long as no other property has changed. If a change to ACTIVE
220 * fails an atomic test, this is a driver bug. For this reason setting
221 * ACTIVE to 0 must not release internal resources (like reserved memory
222 * bandwidth or clock generators).
223 *
224 * Note that the legacy DPMS property on connectors is internally routed
225 * to control this property for atomic drivers.
226 * MODE_ID:
227 * Atomic property for setting the CRTC display timings. The value is the
228 * ID of a blob containing the DRM mode info. To disable the CRTC,
229 * user-space must set this property to 0.
230 *
231 * Setting MODE_ID to 0 will release reserved resources for the CRTC.
232 */
233
234/**
235 * drm_crtc_init_with_planes - Initialise a new CRTC object with
236 * specified primary and cursor planes.
237 * @dev: DRM device
238 * @crtc: CRTC object to init
239 * @primary: Primary plane for CRTC
240 * @cursor: Cursor plane for CRTC
241 * @funcs: callbacks for the new CRTC
242 * @name: printf style format string for the CRTC name, or NULL for default name
243 *
244 * Inits a new object created as base part of a driver crtc object. Drivers
245 * should use this function instead of drm_crtc_init(), which is only provided
246 * for backwards compatibility with drivers which do not yet support universal
247 * planes). For really simple hardware which has only 1 plane look at
248 * drm_simple_display_pipe_init() instead.
249 *
250 * Returns:
251 * Zero on success, error code on failure.
252 */
253int drm_crtc_init_with_planes(struct drm_device *dev, struct drm_crtc *crtc,
254 struct drm_plane *primary,
255 struct drm_plane *cursor,
256 const struct drm_crtc_funcs *funcs,
257 const char *name, ...)
258{
259 struct drm_mode_config *config = &dev->mode_config;
260 int ret;
261
262 WARN_ON(primary && primary->type != DRM_PLANE_TYPE_PRIMARY)({ int __ret = !!(primary && primary->type != DRM_PLANE_TYPE_PRIMARY
); if (__ret) printf("WARNING %s failed at %s:%d\n", "primary && primary->type != DRM_PLANE_TYPE_PRIMARY"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 262); __builtin_expect
(!!(__ret), 0); });
263 WARN_ON(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR)({ int __ret = !!(cursor && cursor->type != DRM_PLANE_TYPE_CURSOR
); if (__ret) printf("WARNING %s failed at %s:%d\n", "cursor && cursor->type != DRM_PLANE_TYPE_CURSOR"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 263); __builtin_expect
(!!(__ret), 0); });
264
265 /* crtc index is used with 32bit bitmasks */
266 if (WARN_ON(config->num_crtc >= 32)({ int __ret = !!(config->num_crtc >= 32); if (__ret) printf
("WARNING %s failed at %s:%d\n", "config->num_crtc >= 32"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 266); __builtin_expect
(!!(__ret), 0); }))
267 return -EINVAL22;
268
269 WARN_ON(drm_drv_uses_atomic_modeset(dev) &&({ int __ret = !!(drm_drv_uses_atomic_modeset(dev) &&
(!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state
)); if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 271); __builtin_expect
(!!(__ret), 0); })
270 (!funcs->atomic_destroy_state ||({ int __ret = !!(drm_drv_uses_atomic_modeset(dev) &&
(!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state
)); if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 271); __builtin_expect
(!!(__ret), 0); })
271 !funcs->atomic_duplicate_state))({ int __ret = !!(drm_drv_uses_atomic_modeset(dev) &&
(!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state
)); if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 271); __builtin_expect
(!!(__ret), 0); });
272
273 crtc->dev = dev;
274 crtc->funcs = funcs;
275
276 INIT_LIST_HEAD(&crtc->commit_list);
277 mtx_init(&crtc->commit_lock, IPL_NONE)do { (void)(((void *)0)); (void)(0); __mtx_init((&crtc->
commit_lock), ((((0x0)) > 0x0 && ((0x0)) < 0x9)
? 0x9 : ((0x0)))); } while (0);
278
279 drm_modeset_lock_init(&crtc->mutex);
280 ret = drm_mode_object_add(dev, &crtc->base, DRM_MODE_OBJECT_CRTC0xcccccccc);
281 if (ret)
282 return ret;
283
284 if (name) {
285 va_list ap;
286
287 va_start(ap, name)__builtin_va_start((ap), name);
288 crtc->name = kvasprintf(GFP_KERNEL(0x0001 | 0x0004), name, ap);
289 va_end(ap)__builtin_va_end((ap));
290 } else {
291 crtc->name = kasprintf(GFP_KERNEL(0x0001 | 0x0004), "crtc-%d",
292 drm_num_crtcs(dev));
293 }
294 if (!crtc->name) {
295 drm_mode_object_unregister(dev, &crtc->base);
296 return -ENOMEM12;
297 }
298
299 crtc->fence_context = dma_fence_context_alloc(1);
300 mtx_init(&crtc->fence_lock, IPL_TTY)do { (void)(((void *)0)); (void)(0); __mtx_init((&crtc->
fence_lock), ((((0x9)) > 0x0 && ((0x9)) < 0x9) ?
0x9 : ((0x9)))); } while (0);
301 snprintf(crtc->timeline_name, sizeof(crtc->timeline_name),
302 "CRTC:%d-%s", crtc->base.id, crtc->name);
303
304 crtc->base.properties = &crtc->properties;
305
306 list_add_tail(&crtc->head, &config->crtc_list);
307 crtc->index = config->num_crtc++;
308
309 crtc->primary = primary;
310 crtc->cursor = cursor;
311 if (primary && !primary->possible_crtcs)
312 primary->possible_crtcs = drm_crtc_mask(crtc);
313 if (cursor && !cursor->possible_crtcs)
314 cursor->possible_crtcs = drm_crtc_mask(crtc);
315
316 ret = drm_crtc_crc_init(crtc);
317 if (ret) {
318 drm_mode_object_unregister(dev, &crtc->base);
319 return ret;
320 }
321
322 if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
323 drm_object_attach_property(&crtc->base, config->prop_active, 0);
324 drm_object_attach_property(&crtc->base, config->prop_mode_id, 0);
325 drm_object_attach_property(&crtc->base,
326 config->prop_out_fence_ptr, 0);
327 drm_object_attach_property(&crtc->base,
328 config->prop_vrr_enabled, 0);
329 }
330
331 return 0;
332}
333EXPORT_SYMBOL(drm_crtc_init_with_planes);
334
335/**
336 * drm_crtc_cleanup - Clean up the core crtc usage
337 * @crtc: CRTC to cleanup
338 *
339 * This function cleans up @crtc and removes it from the DRM mode setting
340 * core. Note that the function does *not* free the crtc structure itself,
341 * this is the responsibility of the caller.
342 */
343void drm_crtc_cleanup(struct drm_crtc *crtc)
344{
345 struct drm_device *dev = crtc->dev;
346
347 /* Note that the crtc_list is considered to be static; should we
348 * remove the drm_crtc at runtime we would have to decrement all
349 * the indices on the drm_crtc after us in the crtc_list.
350 */
351
352 drm_crtc_crc_fini(crtc);
353
354 kfree(crtc->gamma_store);
355 crtc->gamma_store = NULL((void *)0);
356
357 drm_modeset_lock_fini(&crtc->mutex);
358
359 drm_mode_object_unregister(dev, &crtc->base);
360 list_del(&crtc->head);
361 dev->mode_config.num_crtc--;
362
363 WARN_ON(crtc->state && !crtc->funcs->atomic_destroy_state)({ int __ret = !!(crtc->state && !crtc->funcs->
atomic_destroy_state); if (__ret) printf("WARNING %s failed at %s:%d\n"
, "crtc->state && !crtc->funcs->atomic_destroy_state"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 363); __builtin_expect
(!!(__ret), 0); });
364 if (crtc->state && crtc->funcs->atomic_destroy_state)
365 crtc->funcs->atomic_destroy_state(crtc, crtc->state);
366
367 kfree(crtc->name);
368
369 memset(crtc, 0, sizeof(*crtc))__builtin_memset((crtc), (0), (sizeof(*crtc)));
370}
371EXPORT_SYMBOL(drm_crtc_cleanup);
372
373/**
374 * drm_mode_getcrtc - get CRTC configuration
375 * @dev: drm device for the ioctl
376 * @data: data pointer for the ioctl
377 * @file_priv: drm file for the ioctl call
378 *
379 * Construct a CRTC configuration structure to return to the user.
380 *
381 * Called by the user via ioctl.
382 *
383 * Returns:
384 * Zero on success, negative errno on failure.
385 */
386int drm_mode_getcrtc(struct drm_device *dev,
387 void *data, struct drm_file *file_priv)
388{
389 struct drm_mode_crtc *crtc_resp = data;
390 struct drm_crtc *crtc;
391 struct drm_plane *plane;
392
393 if (!drm_core_check_feature(dev, DRIVER_MODESET))
394 return -EOPNOTSUPP45;
395
396 crtc = drm_crtc_find(dev, file_priv, crtc_resp->crtc_id);
397 if (!crtc)
398 return -ENOENT2;
399
400 plane = crtc->primary;
401
402 crtc_resp->gamma_size = crtc->gamma_size;
403
404 drm_modeset_lock(&plane->mutex, NULL((void *)0));
405 if (plane->state && plane->state->fb)
406 crtc_resp->fb_id = plane->state->fb->base.id;
407 else if (!plane->state && plane->fb)
408 crtc_resp->fb_id = plane->fb->base.id;
409 else
410 crtc_resp->fb_id = 0;
411
412 if (plane->state) {
413 crtc_resp->x = plane->state->src_x >> 16;
414 crtc_resp->y = plane->state->src_y >> 16;
415 }
416 drm_modeset_unlock(&plane->mutex);
417
418 drm_modeset_lock(&crtc->mutex, NULL((void *)0));
419 if (crtc->state) {
420 if (crtc->state->enable) {
421 drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->state->mode);
422 crtc_resp->mode_valid = 1;
423 } else {
424 crtc_resp->mode_valid = 0;
425 }
426 } else {
427 crtc_resp->x = crtc->x;
428 crtc_resp->y = crtc->y;
429
430 if (crtc->enabled) {
431 drm_mode_convert_to_umode(&crtc_resp->mode, &crtc->mode);
432 crtc_resp->mode_valid = 1;
433
434 } else {
435 crtc_resp->mode_valid = 0;
436 }
437 }
438 if (!file_priv->aspect_ratio_allowed)
439 crtc_resp->mode.flags &= ~DRM_MODE_FLAG_PIC_AR_MASK(0x0F<<19);
440 drm_modeset_unlock(&crtc->mutex);
441
442 return 0;
443}
444
445static int __drm_mode_set_config_internal(struct drm_mode_set *set,
446 struct drm_modeset_acquire_ctx *ctx)
447{
448 struct drm_crtc *crtc = set->crtc;
449 struct drm_framebuffer *fb;
450 struct drm_crtc *tmp;
451 int ret;
452
453 WARN_ON(drm_drv_uses_atomic_modeset(crtc->dev))({ int __ret = !!(drm_drv_uses_atomic_modeset(crtc->dev));
if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(crtc->dev)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 453); __builtin_expect
(!!(__ret), 0); });
454
455 /*
456 * NOTE: ->set_config can also disable other crtcs (if we steal all
457 * connectors from it), hence we need to refcount the fbs across all
458 * crtcs. Atomic modeset will have saner semantics ...
459 */
460 drm_for_each_crtc(tmp, crtc->dev)for (tmp = ({ const __typeof( ((__typeof(*tmp) *)0)->head )
*__mptr = ((&(crtc->dev)->mode_config.crtc_list)->
next); (__typeof(*tmp) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*tmp), head) );}); &tmp->head != (&(crtc
->dev)->mode_config.crtc_list); tmp = ({ const __typeof
( ((__typeof(*tmp) *)0)->head ) *__mptr = (tmp->head.next
); (__typeof(*tmp) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*tmp), head) );})) {
461 struct drm_plane *plane = tmp->primary;
462
463 plane->old_fb = plane->fb;
464 }
465
466 fb = set->fb;
467
468 ret = crtc->funcs->set_config(set, ctx);
469 if (ret == 0) {
470 struct drm_plane *plane = crtc->primary;
471
472 plane->crtc = fb ? crtc : NULL((void *)0);
473 plane->fb = fb;
474 }
475
476 drm_for_each_crtc(tmp, crtc->dev)for (tmp = ({ const __typeof( ((__typeof(*tmp) *)0)->head )
*__mptr = ((&(crtc->dev)->mode_config.crtc_list)->
next); (__typeof(*tmp) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*tmp), head) );}); &tmp->head != (&(crtc
->dev)->mode_config.crtc_list); tmp = ({ const __typeof
( ((__typeof(*tmp) *)0)->head ) *__mptr = (tmp->head.next
); (__typeof(*tmp) *)( (char *)__mptr - __builtin_offsetof(__typeof
(*tmp), head) );})) {
477 struct drm_plane *plane = tmp->primary;
478
479 if (plane->fb)
480 drm_framebuffer_get(plane->fb);
481 if (plane->old_fb)
482 drm_framebuffer_put(plane->old_fb);
483 plane->old_fb = NULL((void *)0);
484 }
485
486 return ret;
487}
488
489/**
490 * drm_mode_set_config_internal - helper to call &drm_mode_config_funcs.set_config
491 * @set: modeset config to set
492 *
493 * This is a little helper to wrap internal calls to the
494 * &drm_mode_config_funcs.set_config driver interface. The only thing it adds is
495 * correct refcounting dance.
496 *
497 * This should only be used by non-atomic legacy drivers.
498 *
499 * Returns:
500 * Zero on success, negative errno on failure.
501 */
502int drm_mode_set_config_internal(struct drm_mode_set *set)
503{
504 WARN_ON(drm_drv_uses_atomic_modeset(set->crtc->dev))({ int __ret = !!(drm_drv_uses_atomic_modeset(set->crtc->
dev)); if (__ret) printf("WARNING %s failed at %s:%d\n", "drm_drv_uses_atomic_modeset(set->crtc->dev)"
, "/usr/src/sys/dev/pci/drm/drm_crtc.c", 504); __builtin_expect
(!!(__ret), 0); });
505
506 return __drm_mode_set_config_internal(set, NULL((void *)0));
507}
508EXPORT_SYMBOL(drm_mode_set_config_internal);
509
510/**
511 * drm_crtc_check_viewport - Checks that a framebuffer is big enough for the
512 * CRTC viewport
513 * @crtc: CRTC that framebuffer will be displayed on
514 * @x: x panning
515 * @y: y panning
516 * @mode: mode that framebuffer will be displayed under
517 * @fb: framebuffer to check size of
518 */
519int drm_crtc_check_viewport(const struct drm_crtc *crtc,
520 int x, int y,
521 const struct drm_display_mode *mode,
522 const struct drm_framebuffer *fb)
523
524{
525 int hdisplay, vdisplay;
526
527 drm_mode_get_hv_timing(mode, &hdisplay, &vdisplay);
528
529 if (crtc->state &&
26
←
Assuming field 'state' is non-null
→
530 drm_rotation_90_or_270(crtc->primary->state->rotation))
27
←
Access to field 'rotation' results in a dereference of a null pointer (loaded from field 'state')
531 swap(hdisplay, vdisplay)do { __typeof(hdisplay) __tmp = (hdisplay); (hdisplay) = (vdisplay
); (vdisplay) = __tmp; } while(0);
532
533 return drm_framebuffer_check_src_coords(x << 16, y << 16,
534 hdisplay << 16, vdisplay << 16,
535 fb);
536}
537EXPORT_SYMBOL(drm_crtc_check_viewport);
538
539/**
540 * drm_mode_setcrtc - set CRTC configuration
541 * @dev: drm device for the ioctl
542 * @data: data pointer for the ioctl
543 * @file_priv: drm file for the ioctl call
544 *
545 * Build a new CRTC configuration based on user request.
546 *
547 * Called by the user via ioctl.
548 *
549 * Returns:
550 * Zero on success, negative errno on failure.
551 */
552int drm_mode_setcrtc(struct drm_device *dev, void *data,
553 struct drm_file *file_priv)
554{
555 struct drm_mode_config *config = &dev->mode_config;
556 struct drm_mode_crtc *crtc_req = data;
557 struct drm_crtc *crtc;
558 struct drm_plane *plane;
559 struct drm_connector **connector_set = NULL((void *)0), *connector;
560 struct drm_framebuffer *fb = NULL((void *)0);
561 struct drm_display_mode *mode = NULL((void *)0);
562 struct drm_mode_set set;
563 uint32_t __user *set_connectors_ptr;
564 struct drm_modeset_acquire_ctx ctx;
565 int ret;
566 int i;
567
568 if (!drm_core_check_feature(dev, DRIVER_MODESET))
1
Taking false branch
→
569 return -EOPNOTSUPP45;
570
571 /*
572 * Universal plane src offsets are only 16.16, prevent havoc for
573 * drivers using universal plane code internally.
574 */
575 if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
2
←
Assuming the condition is false
→
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
576 return -ERANGE34;
577
578 crtc = drm_crtc_find(dev, file_priv, crtc_req->crtc_id);
579 if (!crtc
4.1
'crtc' is non-null
) {
5
←
Taking false branch
→
580 DRM_DEBUG_KMS("Unknown CRTC ID %d\n", crtc_req->crtc_id)__drm_dbg(DRM_UT_KMS, "Unknown CRTC ID %d\n", crtc_req->crtc_id
);
581 return -ENOENT2;
582 }
583 DRM_DEBUG_KMS("[CRTC:%d:%s]\n", crtc->base.id, crtc->name)__drm_dbg(DRM_UT_KMS, "[CRTC:%d:%s]\n", crtc->base.id, crtc
->name);
584
585 plane = crtc->primary;
586
587 /* allow disabling with the primary plane leased */
588 if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id)(1))
6
←
Assuming field 'mode_valid' is not equal to 0
→
7
←
Taking false branch
→
589 return -EACCES13;
590
591 DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx,if (!drm_drv_uses_atomic_modeset(dev)) rw_enter_write(&dev
->mode_config.mutex); drm_modeset_acquire_init(&ctx, (
1UL << (0))); modeset_lock_retry: ret = drm_modeset_lock_all_ctx
(dev, &ctx); if (ret) goto modeset_lock_fail;
8
←
Taking false branch
→
9
←
Assuming 'ret' is 0
→
10
←
Taking false branch
→
592 DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret)if (!drm_drv_uses_atomic_modeset(dev)) rw_enter_write(&dev
->mode_config.mutex); drm_modeset_acquire_init(&ctx, (
1UL << (0))); modeset_lock_retry: ret = drm_modeset_lock_all_ctx
(dev, &ctx); if (ret) goto modeset_lock_fail;;
593
594 if (crtc_req->mode_valid
10.1
Field 'mode_valid' is not equal to 0
) {
11
←
Taking true branch
→
595 /* If we have a mode we need a framebuffer. */
596 /* If we pass -1, set the mode with the currently bound fb */
597 if (crtc_req->fb_id == -1) {
12
←
Assuming the condition is true
→
13
←
Taking true branch
→
598 struct drm_framebuffer *old_fb;
599
600 if (plane->state)
14
←
Assuming field 'state' is null
→
15
←
Taking false branch
→
601 old_fb = plane->state->fb;
602 else
603 old_fb = plane->fb;
604
605 if (!old_fb) {
16
←
Assuming 'old_fb' is non-null
→
17
←
Taking false branch
→
606 DRM_DEBUG_KMS("CRTC doesn't have current FB\n")__drm_dbg(DRM_UT_KMS, "CRTC doesn't have current FB\n");
607 ret = -EINVAL22;
608 goto out;
609 }
610
611 fb = old_fb;
612 /* Make refcounting symmetric with the lookup path. */
613 drm_framebuffer_get(fb);
614 } else {
615 fb = drm_framebuffer_lookup(dev, file_priv, crtc_req->fb_id);
616 if (!fb) {
617 DRM_DEBUG_KMS("Unknown FB ID%d\n",__drm_dbg(DRM_UT_KMS, "Unknown FB ID%d\n", crtc_req->fb_id
)
618 crtc_req->fb_id)__drm_dbg(DRM_UT_KMS, "Unknown FB ID%d\n", crtc_req->fb_id
);
619 ret = -ENOENT2;
620 goto out;
621 }
622 }
623
624 mode = drm_mode_create(dev);
625 if (!mode) {
18
←
Assuming 'mode' is non-null
→
19
←
Taking false branch
→
626 ret = -ENOMEM12;
627 goto out;
628 }
629 if (!file_priv->aspect_ratio_allowed &&
20
←
Assuming field 'aspect_ratio_allowed' is true
→
630 (crtc_req->mode.flags & DRM_MODE_FLAG_PIC_AR_MASK(0x0F<<19)) != DRM_MODE_FLAG_PIC_AR_NONE(0<<19)) {
631 DRM_DEBUG_KMS("Unexpected aspect-ratio flag bits\n")__drm_dbg(DRM_UT_KMS, "Unexpected aspect-ratio flag bits\n");
632 ret = -EINVAL22;
633 goto out;
634 }
635
636
637 ret = drm_mode_convert_umode(dev, mode, &crtc_req->mode);
638 if (ret) {
21
←
Assuming 'ret' is 0
→
22
←
Taking false branch
→
639 DRM_DEBUG_KMS("Invalid mode (ret=%d, status=%s)\n",__drm_dbg(DRM_UT_KMS, "Invalid mode (ret=%d, status=%s)\n", ret
, drm_get_mode_status_name(mode->status))
640 ret, drm_get_mode_status_name(mode->status))__drm_dbg(DRM_UT_KMS, "Invalid mode (ret=%d, status=%s)\n", ret
, drm_get_mode_status_name(mode->status));
641 drm_mode_debug_printmodeline(mode);
642 goto out;
643 }
644
645 /*
646 * Check whether the primary plane supports the fb pixel format.
647 * Drivers not implementing the universal planes API use a
648 * default formats list provided by the DRM core which doesn't
649 * match real hardware capabilities. Skip the check in that
650 * case.
651 */
652 if (!plane->format_default) {
23
←
Assuming field 'format_default' is true
→
24
←
Taking false branch
→
653 ret = drm_plane_check_pixel_format(plane,
654 fb->format->format,
655 fb->modifier);
656 if (ret) {
657 struct drm_format_name_buf format_name;
658
659 DRM_DEBUG_KMS("Invalid pixel format %s, modifier 0x%llx\n",__drm_dbg(DRM_UT_KMS, "Invalid pixel format %s, modifier 0x%llx\n"
, drm_get_format_name(fb->format->format, &format_name
), fb->modifier)
660 drm_get_format_name(fb->format->format,__drm_dbg(DRM_UT_KMS, "Invalid pixel format %s, modifier 0x%llx\n"
, drm_get_format_name(fb->format->format, &format_name
), fb->modifier)
661 &format_name),__drm_dbg(DRM_UT_KMS, "Invalid pixel format %s, modifier 0x%llx\n"
, drm_get_format_name(fb->format->format, &format_name
), fb->modifier)
662 fb->modifier)__drm_dbg(DRM_UT_KMS, "Invalid pixel format %s, modifier 0x%llx\n"
, drm_get_format_name(fb->format->format, &format_name
), fb->modifier);
663 goto out;
664 }
665 }
666
667 ret = drm_crtc_check_viewport(crtc, crtc_req->x, crtc_req->y,
25
←
Calling 'drm_crtc_check_viewport'
→
668 mode, fb);
669 if (ret)
670 goto out;
671
672 }
673
674 if (crtc_req->count_connectors == 0 && mode) {
675 DRM_DEBUG_KMS("Count connectors is 0 but mode set\n")__drm_dbg(DRM_UT_KMS, "Count connectors is 0 but mode set\n");
676 ret = -EINVAL22;
677 goto out;
678 }
679
680 if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
681 DRM_DEBUG_KMS("Count connectors is %d but no mode or fb set\n",__drm_dbg(DRM_UT_KMS, "Count connectors is %d but no mode or fb set\n"
, crtc_req->count_connectors)
682 crtc_req->count_connectors)__drm_dbg(DRM_UT_KMS, "Count connectors is %d but no mode or fb set\n"
, crtc_req->count_connectors);
683 ret = -EINVAL22;
684 goto out;
685 }
686
687 if (crtc_req->count_connectors > 0) {
688 u32 out_id;
689
690 /* Avoid unbounded kernel memory allocation */
691 if (crtc_req->count_connectors > config->num_connector) {
692 ret = -EINVAL22;
693 goto out;
694 }
695
696 connector_set = kmalloc_array(crtc_req->count_connectors,
697 sizeof(struct drm_connector *),
698 GFP_KERNEL(0x0001 | 0x0004));
699 if (!connector_set) {
700 ret = -ENOMEM12;
701 goto out;
702 }
703
704 for (i = 0; i < crtc_req->count_connectors; i++) {
705 connector_set[i] = NULL((void *)0);
706 set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
707 if (get_user(out_id, &set_connectors_ptr[i])-copyin(&set_connectors_ptr[i], &(out_id), sizeof(out_id
))) {
708 ret = -EFAULT14;
709 goto out;
710 }
711
712 connector = drm_connector_lookup(dev, file_priv, out_id);
713 if (!connector) {
714 DRM_DEBUG_KMS("Connector id %d unknown\n",__drm_dbg(DRM_UT_KMS, "Connector id %d unknown\n", out_id)
715 out_id)__drm_dbg(DRM_UT_KMS, "Connector id %d unknown\n", out_id);
716 ret = -ENOENT2;
717 goto out;
718 }
719 DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",__drm_dbg(DRM_UT_KMS, "[CONNECTOR:%d:%s]\n", connector->base
.id, connector->name)
720 connector->base.id,__drm_dbg(DRM_UT_KMS, "[CONNECTOR:%d:%s]\n", connector->base
.id, connector->name)
721 connector->name)__drm_dbg(DRM_UT_KMS, "[CONNECTOR:%d:%s]\n", connector->base
.id, connector->name);
722
723 connector_set[i] = connector;
724 }
725 }
726
727 set.crtc = crtc;
728 set.x = crtc_req->x;
729 set.y = crtc_req->y;
730 set.mode = mode;
731 set.connectors = connector_set;
732 set.num_connectors = crtc_req->count_connectors;
733 set.fb = fb;
734
735 if (drm_drv_uses_atomic_modeset(dev))
736 ret = crtc->funcs->set_config(&set, &ctx);
737 else
738 ret = __drm_mode_set_config_internal(&set, &ctx);
739
740out:
741 if (fb)
742 drm_framebuffer_put(fb);
743
744 if (connector_set) {
745 for (i = 0; i < crtc_req->count_connectors; i++) {
746 if (connector_set[i])
747 drm_connector_put(connector_set[i]);
748 }
749 }
750 kfree(connector_set);
751 drm_mode_destroy(dev, mode);
752
753 /* In case we need to retry... */
754 connector_set = NULL((void *)0);
755 fb = NULL((void *)0);
756 mode = NULL((void *)0);
757
758 DRM_MODESET_LOCK_ALL_END(dev, ctx, ret)modeset_lock_fail: if (ret == -11) { ret = drm_modeset_backoff
(&ctx); if (!ret) goto modeset_lock_retry; } drm_modeset_drop_locks
(&ctx); drm_modeset_acquire_fini(&ctx); if (!drm_drv_uses_atomic_modeset
(dev)) rw_exit_write(&dev->mode_config.mutex);;
759
760 return ret;
761}
762
763int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
764 struct drm_property *property,
765 uint64_t value)
766{
767 int ret = -EINVAL22;
768 struct drm_crtc *crtc = obj_to_crtc(obj)({ const __typeof( ((struct drm_crtc *)0)->base ) *__mptr =
(obj); (struct drm_crtc *)( (char *)__mptr - __builtin_offsetof
(struct drm_crtc, base) );});
769
770 if (crtc->funcs->set_property)
771 ret = crtc->funcs->set_property(crtc, property, value);
772 if (!ret)
773 drm_object_property_set_value(obj, property, value);
774
775 return ret;
776}