Clang and infer warning reports

reports/v415/clang-5.0/ReportStructure.md

@@ -0,0 +1,18 @@
+# Structure of Reports and Explanation of Report Sections #
+### Report Name & Number ### 
+Every report has an unique number. Every report name should follow this convention:  
+{subsystem_name}:{file_name}:{file_extension}:{warning_type}:{unique_report_number}.md  
+### General ###
+General part contains:  
+**Warning Type:** Clang warning type.  
+**Warning Explanation:** Full clang warning message.  
+**File Location:** Full path of file, that causes warning.  
+### History ###
+History part is about when and which commit introduced this warning and if it is already resolved or still exists.  
+**Introduced By:** Commit id and one-line commit message, that caused this warning.  
+**Reported Since:** Commit which makes this warning is observable through clang output.  
+**Resolved By:** Commit which resolves warning.
+### Manuel Assesment ###
+**Classification:** Warnings are classifed into different subclasses. Current subclasses can be found at [WarningTypeClassifications](WarningTypeClassifications.md)  
+**Rationale:** A summary of manual examination of warning.
+

reports/v415/clang-5.0/WarningTypeClassifications.md

@@ -0,0 +1,17 @@
+# Warning Type Classifications #
+
+Clang compiler creates a lot of warning while compiling Linux-Kernel. Some of them are false-positive , or they don't cause any problem right now, but in future, after a commit, they may create runtime problems. In here we try to classify clang warnings.
+
+### Mathematically Impossible ###
+This classifier contains cases , that are impossible in mathematic operations, they are definitly false-positive warnings created by Clang compiler
+
+Such as :  integer x : x < 10 && x > 9  
+
+### Tool can detect during compile time ###
+In this subclass of Warnings, we have some code, that is not problematic right now but in the future with some new commits they may become problematic.  
+Such as : setting an array size to bigger than ```INT_MAX```. 
+
+If we use a more-smarter tool, during runtime we can get information about these suspicious code lines will create a warning or not  more accurately.
+
+
+

reports/v415/clang-5.0/drm:i915:i915_debugfs:c:sign-comparison:0007.md

@@ -0,0 +1,66 @@
+# Analysis Report 0007 #
+
+## General ##
+**Warning Type:** Wsign-compare  
+**Warning Explanation:**```drivers/gpu/drm/i915/i915_debugfs.c:4740:16: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare]
+        for (i = 0; i < ARRAY_SIZE(i915_debugfs_files); i++) {```  
+**File Location:** drivers/gpu/drm/i915/i915_debugfs.c
+## History ##
+**Introduced By:** 34b9674c786c ("drm/i915: convert debugfs creation/destruction to table")  
+**Reported Since:** TODO  
+**Resolved By:** --
+
+## Manuel Assesment ##
+**Classification:** [Tool can detect during runtime](WarningTypeClassifications.md)
+### Rationale ###
+If we look at ```i915_debugfs_files``` array more carefully, we see that it is a static array, and at most it's size is 20.
+So in this case ```ARRAY_SIZE(i915_debugfs_files)``` macro can't return value which is bigger than ```INT_MAX```
+```C
+static const struct i915_debugfs_files {
+	const char *name;
+	const struct file_operations *fops;
+} i915_debugfs_files[] = {
+	{"i915_wedged", &i915_wedged_fops},
+	{"i915_max_freq", &i915_max_freq_fops},
+	{"i915_min_freq", &i915_min_freq_fops},
+	{"i915_cache_sharing", &i915_cache_sharing_fops},
+	{"i915_ring_missed_irq", &i915_ring_missed_irq_fops},
+	{"i915_ring_test_irq", &i915_ring_test_irq_fops},
+	{"i915_gem_drop_caches", &i915_drop_caches_fops},
+#if IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR)
+	{"i915_error_state", &i915_error_state_fops},
+	{"i915_gpu_info", &i915_gpu_info_fops},
+#endif
+	{"i915_next_seqno", &i915_next_seqno_fops},
+	{"i915_display_crc_ctl", &i915_display_crc_ctl_fops},
+	{"i915_pri_wm_latency", &i915_pri_wm_latency_fops},
+	{"i915_spr_wm_latency", &i915_spr_wm_latency_fops},
+	{"i915_cur_wm_latency", &i915_cur_wm_latency_fops},
+	{"i915_fbc_false_color", &i915_fbc_false_color_fops},
+	{"i915_dp_test_data", &i915_displayport_test_data_fops},
+	{"i915_dp_test_type", &i915_displayport_test_type_fops},
+	{"i915_dp_test_active", &i915_displayport_test_active_fops},
+	{"i915_guc_log_control", &i915_guc_log_control_fops},
+	{"i915_hpd_storm_ctl", &i915_hpd_storm_ctl_fops},
+	{"i915_ipc_status", &i915_ipc_status_fops},
+	{"i915_drrs_ctl", &i915_drrs_ctl_fops}
+};
+
+int i915_debugfs_register(struct drm_i915_private *dev_priv)
+{
+  //...
+  int ret, i;
+	//...
+	for (i = 0; i < ARRAY_SIZE(i915_debugfs_files); i++) {
+		ent = debugfs_create_file(i915_debugfs_files[i].name,
+					  S_IRUGO | S_IWUSR,
+					  minor->debugfs_root,
+					  to_i915(minor->dev),
+					  i915_debugfs_files[i].fops);
+		if (!ent)
+			return -ENOMEM;
+	}
+  //...
+}
+```
+Clang couldn't evaulates this array size is not bigger than ```INT_MAX``` and creates a warning about it. Even if developer adds many elements to this list with another commit and list size become larger than ```INT_MAX```, a smart-tool can detect it during compile time.

reports/v415/clang-5.0/drm:i915:i915_drv:c:sign-comparison:0006.md

@@ -0,0 +1,45 @@
+# Analysis Report 0006 #
+## General ##
+**Warning Type:** Wsign-compare  
+**Warning Explanation:** ```drivers/gpu/drm/i915/i915_drv.c:2234:16: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare]  
+        for (i = 0; i < ARRAY_SIZE(s->lra_limits); i++) ```   
+**File Location:** drivers/gpu/drm/i915/intel_pm.c
+
+## History ##
+**Introduced By:** ddeea5b0c36f ("drm/i915: vlv: add runtime PM support")  
+**Reported Since:** TODO  
+**Resolved By:** --
+## Manuel Assesment ##
+**Classification:** [Tool can detect during compile time](WarningTypeClassifications.md)
+### Rationale ###
+Clang compiler creates a warning about:  
+```C
+static void vlv_save_gunit_s0ix_state(struct drm_i915_private *dev_priv)
+{
+	struct vlv_s0ix_state *s = &dev_priv->vlv_s0ix_state;
+	int i;
+//...
+  for (i = 0; i < ARRAY_SIZE(s->lra_limits); i++)
+//...
+};
+```
+In the for loop, there is a comparision between Array size of ```s->lra_limits``` and ```int i``` and Clang compiler finds it suspicious.
+
+To understand this ,we must look at ```struct vlv_s0ix_state``` which defined inside **drivers/gpu/drm/i915/i915_drv.h**:  
+```C
+struct vlv_s0ix_state {
+	/* GAM */
+	u32 wr_watermark;
+	u32 gfx_prio_ctrl;
+	u32 arb_mode;
+	u32 gfx_pend_tlb0;
+	u32 gfx_pend_tlb1;
+	u32 lra_limits[GEN7_LRA_LIMITS_REG_NUM];
+}; 
+```
+Developer defined lra_limits size as ```GEN_7_LRA_LIMITS_REG_NUM``` which is a static constant defined in **drivers/gpu/drm/i915/i915_reg.h** as following:
+```C
+#define GEN7_LRA_LIMITS_REG_NUM	13
+```
+As long as ```GEN7_LRA_LIMITS_REG_NUM``` is inside ```int``` limits, there won't be any problem theoratically. Even if developer increase ```GEN7_LRA_LIMITS_REG_NUM``` value to a problematic value, smart-tool can detect it during runtime.
+

reports/v415/clang-5.0/drm:i915:i915_gem_timeline:c:sign-comparison:0009.md

@@ -0,0 +1,43 @@
+# Analysis Report 0009 #
+## General ##
+**Warning Type:** Wsign-compare  
+**Warning Explanation:** ```drivers/gpu/drm/i915/i915_gem_timeline.c:124:17: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare] for (i = 0; i < ARRAY_SIZE(timeline->engine); i++) {```  
+**File Location:** gpu/drivers/drm/i915/i915_gem_timeline.c  
+## History ##
+**Introduced By:** d51dafaf07bf ("drm/i915: Assert all timeline requests are gone before fini")  
+**Reported Since:** TODO  
+**Resolved By:** --
+## Manuel Assesment ##
+**Classification:** [Tool can detect during compile time](WarningTypeClassifications.md)
+### Rationale ###
+Clang creates a warning about:
+```C
+void i915_gem_timeline_fini(struct i915_gem_timeline *timeline)
+{
+	int i;
+
+	lockdep_assert_held(&timeline->i915->drm.struct_mutex);
+
+	for (i = 0; i < ARRAY_SIZE(timeline->engine); i++)
+		__intel_timeline_fini(&timeline->engine[i]);
+
+	list_del(&timeline->link);
+	kfree(timeline->name);
+}
+```
+```struct i915_gem_timeline``` is defined in **gpu/drivers/gpu/drm/i915/i915_gem_timeline.h** as;
+```C
+struct i915_gem_timeline {
+	struct list_head link;
+
+	struct drm_i915_private *i915;
+	const char *name;
+
+	struct intel_timeline engine[I915_NUM_ENGINES];
+};
+```
+and value of ```I915_NUM_ENGINES``` defined in **gpu/drivers/gpu/drm/i915/i915_gem.h**;  
+```C  
+#define I915_NUM_ENGINES 5 
+```
+As long as I915_NUM_ENGINES value is lower than ```INT_MAX``` this function is safe. Even if it become a larger value, a smart-tool can detect during compile time.

reports/v415/clang-5.0/drm:i915:i915_gpu_error:c:sign-comparison:0004.md

@@ -0,0 +1,49 @@
+# Analysis Report 0004 #
+## General ##
+**Warning Type:** Wsign-compare  
+**Warning Explanation:** ``drivers/gpu/drm/i915/i915_gpu_error.c:488:16: warning: comparison of integers of different signs: 'int' and 'const unsigned int' [-Wsign-compare]
+for (n = 0; n < ee->num_ports; n++) {```  
+**File Location:** drivers/gpu/drm/i915/i915_gpu_error.c
+
+## History ##
+**Introduced By:** 76e70087d360 ("drm/i915: Make execlist port count variable")  
+**Reported Since:** TODO  
+**Resolved By:** --
+
+## Manuel Assesment ##
+**Classification:** [Tool can detect during compile time.](WarningTypeClassifications.md)
+### Rationale ### 
+```C
+//...
+int n;
+//...
+	for (n = 0; n < ee->num_ports; n++) {
+		err_printf(m, "  ELSP[%d]:", n);
+		error_print_request(m, " ", &ee->execlist[n]);
+	}
+```
+
+Clang Compiler states that there is a problem inside for loop, about comparing ```int``` and ```unsigned int```.   
+```struct drm_i915_error_engine``` is defined in **drivers/gpu/drm/i915/i915_drv.h:502:** file as following:
+```C
+struct drm_i915_error_engine {
+//...
+		struct drm_i915_error_request {
+			long jiffies;
+			pid_t pid;
+			u32 context;
+			int priority;
+			int ban_score;
+			u32 seqno;
+			u32 head;
+			u32 tail;
+		} *requests, execlist[EXECLIST_MAX_PORTS];
+		unsigned int num_ports;
+//..
+```
+Lastly ```EXECLIST_MAX_PORTS``` defined inside ***drivers/gpu/drm/i915/intel_ringbuffer.h***:
+```C
+#define EXECLIST_MAX_PORTS 2
+```
+As a summary, programmers defined EXECLIST_MAX_PORTS value by 2. Currently it is safe, and even if this value will be increased by a huge amount by a programmer in future, a smart-tool can detect it during compilation.
+

reports/v415/clang-5.0/drm:i915:intel_ddi:c:enum-conversion:0001.md

@@ -0,0 +1,110 @@
+# Analyis Report 0001 #
+
+## General ##
+**Warning Type:** Wenum-conversion  
+**Warning Explanation:** Implicit conversion from enumeration type 'enum port' to different enumeration type 'enum intel_dpll_id' [-Wenum-conversion]
+enum intel_dpll_id pll_id = port;  
+**File Location:** drivers/gpu/drm/i915/intel_ddi.c
+## History ##
+**Introduced By:** 2952cd6fb4cc ("drm/i915: Let's use more enum intel_dpll_id pll_id.")  
+**Reported Since:** 2952cd6fb4cc ("drm/i915: Let's use more enum intel_dpll_id pll_id.")  
+**Resolved By:** bb911536f07e ("drm/i915: Eliminate pll->state usage from bxt_calc_pll_link()").
+## Manuel Assesment ##
+**Classification:** [Tool can detect during compile time](WarningTypeClassifications.md)
+### Rational ###
+```C
+static void bxt_ddi_clock_get(struct intel_encoder *encoder,  
+                                struct intel_crtc_state *pipe_config)  
+{  
+	struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);  
+	enum port port = intel_ddi_get_encoder_port(encoder);  
+	enum intel_dpll_id pll_id = port; //This line creates warning  
+	pipe_config->port_clock = bxt_calc_pll_link(dev_priv, pll_id);   
+	ddi_dotclock_get(pipe_config);  
+}  
+```
+There is an implicit conversion problem between enum intel_dpll_id and enum port. To clearly understand this problem, we must look definitions of enum port and enum intel_dpll_id:
+
+**enum intel_dpll_id:**  
+File location: /drm/i915/intel_dpll_mgr.h:48
+```C
+enum intel_dpll_id {  
+	/**  
+	  * @DPLL_ID_PRIVATE: non-shared dpll in use   
+	 */ 
+	DPLL_ID_PRIVATE = -1,  
+	/**  
+	 * @DPLL_ID_PCH_PLL_A: DPLL A in ILK, SNB and IVB  
+	 */  
+	DPLL_ID_PCH_PLL_A = 0,  
+	/**  
+	 * @DPLL_ID_PCH_PLL_B: DPLL B in ILK, SNB and IVB  
+	 */  
+	DPLL_ID_PCH_PLL_B = 1,   
+	/**   
+	 * @DPLL_ID_WRPLL1: HSW and BDW WRPLL1   
+	 */   
+	DPLL_ID_WRPLL1 = 0,   
+	/**   
+	 * @DPLL_ID_WRPLL2: HSW and BDW WRPLL2   
+	 */     
+	DPLL_ID_WRPLL2 = 1,   
+	/**   
+	 * @DPLL_ID_SPLL: HSW and BDW SPLL   
+	 */   
+	DPLL_ID_SPLL = 2,   
+	/**  
+	 * @DPLL_ID_LCPLL_810: HSW and BDW 0.81 GHz LCPLL  
+	 */  
+	DPLL_ID_LCPLL_810 = 3,  
+	/**    
+	 * @DPLL_ID_LCPLL_1350: HSW and BDW 1.35 GHz LCPLL  
+	 */  
+	DPLL_ID_LCPLL_1350 = 4,  
+	/**  
+	 * @DPLL_ID_LCPLL_2700: HSW and BDW 2.7 GHz LCPLL  
+	 */  
+	DPLL_ID_LCPLL_2700 = 5,  
+	/**  
+	 * @DPLL_ID_SKL_DPLL0: SKL and later DPLL0  
+	 */  
+	DPLL_ID_SKL_DPLL0 = 0,  
+	/**  
+	 * @DPLL_ID_SKL_DPLL1: SKL and later DPLL1  
+	 */  
+	DPLL_ID_SKL_DPLL1 = 1,  
+	/**  
+	 * @DPLL_ID_SKL_DPLL2: SKL and later DPLL2  
+	 */  
+	DPLL_ID_SKL_DPLL2 = 2,  
+	/**  
+	 * @DPLL_ID_SKL_DPLL3: SKL and later DPLL3  
+	 */  
+	DPLL_ID_SKL_DPLL3 = 3,  
+};  
+```
+**enum port:**
+File location: /drm/i915/i915v\_drv.h:342   
+```C
+enum port {  
+	PORT_NONE = -1,  
+	PORT_A = 0,  
+	PORT_B,  
+	PORT_C,  
+	PORT_D,  
+	PORT_E,  
+	I915_MAX_PORTS  
+};  
+```
+
+**Investigation of solution commit:**
+Commit bb911536f07e modified the part of bxt_ddi_clock_get function , which was creating warning:  
+```diff
+-       struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);  
+-       enum port port = encoder->port;  
+-       enum intel_dpll_id pll_id = port;  
+-       pipe_config->port_clock = bxt_calc_pll_link(dev_priv, pll_id);  
++       pipe_config->port_clock = bxt_calc_pll_link(pipe_config);  
+```
+
+So, as a result o this commit, there isn't any conversion between port and intel_dpll_id , and the enum-conversion warning is  disappeared.