smatch_extra.c

   1 /*
   2  * sparse/smatch_extra.c
   3  *
   4  * Copyright (C) 2008 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * smatch_extra.c is supposed to track the value of every variable.
  12  *
  13  */
  14
  15 #include <stdlib.h>
  16 #include <errno.h>
  17 #ifndef __USE_ISOC99
  18 #define __USE_ISOC99
  19 #endif
  20 #include <limits.h>
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24 #include "smatch_extra.h"
  25
  26 static int my_id;
  27
  28 struct string_list *__ignored_macros = NULL;
  29 static int in_warn_on_macro()
  30 {
  31         struct statement *stmt;
  32         char *tmp;
  33         char *macro;
  34
  35         stmt = last_ptr_list((struct ptr_list *)big_statement_stack);
  36         macro = get_macro_name(&stmt->pos);
  37         if (!macro)
  38                 return 0;
  39
  40         FOR_EACH_PTR(__ignored_macros, tmp) {
  41                 if (!strcmp(tmp, macro))
  42                         return 1;
  43         } END_FOR_EACH_PTR(tmp);
  44         return 0;
  45 }
  46
  47 struct sm_state *set_extra_mod(const char *name, struct symbol *sym, struct smatch_state *state)
  48 {
  49         if (in_warn_on_macro())
  50                 return NULL;
  51         remove_from_equiv(name, sym);
  52         return set_state(SMATCH_EXTRA, name, sym, state);
  53 }
  54
  55 struct sm_state *set_extra_expr_mod(struct expression *expr, struct smatch_state *state)
  56 {
  57         if (in_warn_on_macro())
  58                 return NULL;
  59         remove_from_equiv_expr(expr);
  60         return set_state_expr(SMATCH_EXTRA, expr, state);
  61 }
  62
  63 /*
  64  * This is for return_implies_state() hooks which modify a SMATCH_EXTRA state
  65  */
  66 void set_extra_expr_nomod(struct expression *expr, struct smatch_state *state)
  67 {
  68         struct relation *rel;
  69         struct smatch_state *orig_state;
  70
  71         orig_state = get_state_expr(SMATCH_EXTRA, expr);
  72
  73         if (!orig_state || !get_dinfo(orig_state)->related) {
  74                 set_state_expr(SMATCH_EXTRA, expr, state);
  75                 return;
  76         }
  77
  78         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
  79                 sm_msg("setting %s to %s", rel->name, state->name);
  80                 set_state(SMATCH_EXTRA, rel->name, rel->sym, state);
  81                 add_equiv(state, rel->name, rel->sym);
  82         } END_FOR_EACH_PTR(rel);
  83 }
  84
  85 void set_extra_true_false(const char *name, struct symbol *sym,
  86                         struct smatch_state *true_state,
  87                         struct smatch_state *false_state)
  88 {
  89         struct relation *rel;
  90         struct smatch_state *orig_state;
  91
  92         if (in_warn_on_macro())
  93                 return;
  94
  95         orig_state = get_state(SMATCH_EXTRA, name, sym);
  96
  97         if (!orig_state || !get_dinfo(orig_state)->related) {
  98                 set_true_false_states(SMATCH_EXTRA, name, sym, true_state, false_state);
  99                 return;
 100         }
 101
 102         // FIXME!!!!  equiv => related
 103         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
 104                 set_true_false_states(SMATCH_EXTRA, rel->name, rel->sym,
 105                                 true_state, false_state);
 106                 if (true_state)
 107                         add_equiv(true_state, rel->name, rel->sym);
 108                 if (false_state)
 109                         add_equiv(false_state, rel->name, rel->sym);
 110         } END_FOR_EACH_PTR(rel);
 111 }
 112
 113 struct data_info *get_dinfo(struct smatch_state *state)
 114 {
 115         if (!state)
 116                 return NULL;
 117         return (struct data_info *)state->data;
 118
 119 }
 120
 121 struct smatch_state *filter_range(struct smatch_state *orig,
 122                                  long long filter_min, long long filter_max)
 123 {
 124         struct smatch_state *ret;
 125         struct data_info *orig_info;
 126         struct data_info *ret_info;
 127
 128         if (!orig)
 129                 orig = extra_undefined();
 130         orig_info = get_dinfo(orig);
 131         ret = alloc_extra_state_empty();
 132         ret_info = get_dinfo(ret);
 133         ret_info->value_ranges = remove_range(orig_info->value_ranges, filter_min, filter_max);
 134         ret->name = show_ranges(ret_info->value_ranges);
 135         return ret;
 136 }
 137
 138 struct smatch_state *add_filter(struct smatch_state *orig, long long num)
 139 {
 140         return filter_range(orig, num, num);
 141 }
 142
 143 static struct smatch_state *merge_func(const char *name, struct symbol *sym,
 144                                        struct smatch_state *s1,
 145                                        struct smatch_state *s2)
 146 {
 147         struct data_info *info1 = get_dinfo(s1);
 148         struct data_info *info2 = get_dinfo(s2);
 149         struct data_info *ret_info;
 150         struct smatch_state *tmp;
 151         struct range_list *value_ranges;
 152         struct relation *rel;
 153         struct relation *new;
 154
 155         value_ranges = range_list_union(info1->value_ranges, info2->value_ranges);
 156         tmp = alloc_extra_state_empty();
 157         ret_info = get_dinfo(tmp);
 158         ret_info->value_ranges = value_ranges;
 159         tmp->name = show_ranges(ret_info->value_ranges);
 160         FOR_EACH_PTR(info1->related, rel) {
 161                 new = get_common_relationship(info2, rel->op, rel->name, rel->sym);
 162                 if (new)
 163                         add_related(tmp, new->op, new->name, new->sym);
 164         } END_FOR_EACH_PTR(rel);
 165         return tmp;
 166 }
 167
 168 static struct sm_state *handle_canonical_while_count_down(struct statement *loop)
 169 {
 170         struct expression *iter_var;
 171         struct expression *condition;
 172         struct sm_state *sm;
 173         long long start;
 174
 175         condition = strip_expr(loop->iterator_pre_condition);
 176         if (!condition)
 177                 return NULL;
 178         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 179                 return NULL;
 180         if (condition->op != SPECIAL_DECREMENT)
 181                 return NULL;
 182
 183         iter_var = condition->unop;
 184         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 185         if (!sm)
 186                 return NULL;
 187         if (get_dinfo_min(get_dinfo(sm->state)) < 0)
 188                 return NULL;
 189         start = get_dinfo_max(get_dinfo(sm->state));
 190         if  (start <= 0)
 191                 return NULL;
 192         if (start != whole_range.max)
 193                 start--;
 194
 195         if (condition->type == EXPR_PREOP)
 196                 set_extra_expr_mod(iter_var, alloc_extra_state_range(1, start));
 197         if (condition->type == EXPR_POSTOP)
 198                 set_extra_expr_mod(iter_var, alloc_extra_state_range(0, start));
 199         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 200 }
 201
 202 static struct sm_state *handle_canonical_for_inc(struct expression *iter_expr,
 203                                                 struct expression *condition)
 204 {
 205         struct expression *iter_var;
 206         struct sm_state *sm;
 207         long long start;
 208         long long end;
 209
 210         iter_var = iter_expr->unop;
 211         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 212         if (!sm)
 213                 return NULL;
 214         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 215                 return NULL;
 216         if (!get_implied_value(condition->right, &end))
 217                 end = whole_range.max;
 218         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 219                 return NULL;
 220
 221         switch (condition->op) {
 222         case SPECIAL_NOTEQUAL:
 223         case '<':
 224                 if (end != whole_range.max)
 225                         end--;
 226                 break;
 227         case SPECIAL_LTE:
 228                 break;
 229         default:
 230                 return NULL;
 231         }
 232         if (end < start)
 233                 return NULL;
 234         set_extra_expr_mod(iter_var, alloc_extra_state_range(start, end));
 235         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 236 }
 237
 238 static struct sm_state *handle_canonical_for_dec(struct expression *iter_expr,
 239                                                 struct expression *condition)
 240 {
 241         struct expression *iter_var;
 242         struct sm_state *sm;
 243         long long start;
 244         long long end;
 245
 246         iter_var = iter_expr->unop;
 247         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 248         if (!sm)
 249                 return NULL;
 250         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 251                 return NULL;
 252         if (!get_implied_value(condition->right, &end))
 253                 end = whole_range.max;
 254         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 255                 return NULL;
 256
 257         switch (condition->op) {
 258         case SPECIAL_NOTEQUAL:
 259         case '>':
 260                 if (end != whole_range.min)
 261                         end++;
 262                 break;
 263         case SPECIAL_GTE:
 264                 break;
 265         default:
 266                 return NULL;
 267         }
 268         if (end > start)
 269                 return NULL;
 270         set_extra_expr_mod(iter_var, alloc_extra_state_range(end, start));
 271         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 272 }
 273
 274 static struct sm_state *handle_canonical_for_loops(struct statement *loop)
 275 {
 276         struct expression *iter_expr;
 277         struct expression *condition;
 278
 279         if (!loop->iterator_post_statement)
 280                 return NULL;
 281         if (loop->iterator_post_statement->type != STMT_EXPRESSION)
 282                 return NULL;
 283         iter_expr = loop->iterator_post_statement->expression;
 284         if (!loop->iterator_pre_condition)
 285                 return NULL;
 286         if (loop->iterator_pre_condition->type != EXPR_COMPARE)
 287                 return NULL;
 288         condition = loop->iterator_pre_condition;
 289
 290         if (iter_expr->op == SPECIAL_INCREMENT)
 291                 return handle_canonical_for_inc(iter_expr, condition);
 292         if (iter_expr->op == SPECIAL_DECREMENT)
 293                 return handle_canonical_for_dec(iter_expr, condition);
 294         return NULL;
 295 }
 296
 297 struct sm_state *__extra_handle_canonical_loops(struct statement *loop, struct state_list **slist)
 298 {
 299         struct sm_state *ret;
 300
 301         __push_fake_cur_slist();
 302         if (!loop->iterator_post_statement)
 303                 ret = handle_canonical_while_count_down(loop);
 304         else
 305                 ret = handle_canonical_for_loops(loop);
 306         *slist = __pop_fake_cur_slist();
 307         return ret;
 308 }
 309
 310 int __iterator_unchanged(struct sm_state *sm)
 311 {
 312         if (!sm)
 313                 return 0;
 314         if (get_sm_state(my_id, sm->name, sm->sym) == sm)
 315                 return 1;
 316         return 0;
 317 }
 318
 319 static void while_count_down_after(struct sm_state *sm, struct expression *condition)
 320 {
 321         long long after_value;
 322
 323         /* paranoid checking.  prolly not needed */
 324         condition = strip_expr(condition);
 325         if (!condition)
 326                 return;
 327         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 328                 return;
 329         if (condition->op != SPECIAL_DECREMENT)
 330                 return;
 331         after_value = get_dinfo_min(get_dinfo(sm->state));
 332         after_value--;
 333         set_extra_mod(sm->name, sm->sym, alloc_extra_state(after_value));
 334 }
 335
 336 void __extra_pre_loop_hook_after(struct sm_state *sm,
 337                                 struct statement *iterator,
 338                                 struct expression *condition)
 339 {
 340         struct expression *iter_expr;
 341         char *name;
 342         struct symbol *sym;
 343         long long value;
 344         int left = 0;
 345         struct smatch_state *state;
 346         struct data_info *dinfo;
 347         long long min, max;
 348
 349         if (!iterator) {
 350                 while_count_down_after(sm, condition);
 351                 return;
 352         }
 353
 354         iter_expr = iterator->expression;
 355
 356         if (condition->type != EXPR_COMPARE)
 357                 return;
 358         if (!get_value(condition->left, &value)) {
 359                 if (!get_value(condition->right, &value))
 360                         return;
 361                 left = 1;
 362         }
 363         if (left)
 364                 name = get_variable_from_expr(condition->left, &sym);
 365         else
 366                 name = get_variable_from_expr(condition->right, &sym);
 367         if (!name || !sym)
 368                 goto free;
 369         if (sym != sm->sym || strcmp(name, sm->name))
 370                 goto free;
 371         state = get_state(my_id, name, sym);
 372         dinfo = get_dinfo(state);
 373         min = get_dinfo_min(dinfo);
 374         max = get_dinfo_max(dinfo);
 375         if (iter_expr->op == SPECIAL_INCREMENT &&
 376                 min != whole_range.min &&
 377                 max == whole_range.max) {
 378                 set_extra_mod(name, sym, alloc_extra_state(min));
 379         } else if (min == whole_range.min && max != whole_range.max) {
 380                 set_extra_mod(name, sym, alloc_extra_state(max));
 381         }
 382 free:
 383         free_string(name);
 384         return;
 385 }
 386
 387 static struct smatch_state *unmatched_state(struct sm_state *sm)
 388 {
 389         return extra_undefined();
 390 }
 391
 392 static void match_function_call(struct expression *expr)
 393 {
 394         struct expression *tmp;
 395
 396         FOR_EACH_PTR(expr->args, tmp) {
 397                 if (tmp->type == EXPR_PREOP && tmp->op == '&') {
 398                         remove_from_equiv_expr(tmp->unop);
 399                         set_state_expr(SMATCH_EXTRA, tmp->unop, extra_undefined());
 400                 }
 401         } END_FOR_EACH_PTR(tmp);
 402 }
 403
 404 static void set_equiv(struct sm_state *right_sm, struct expression *left)
 405 {
 406         struct smatch_state *state;
 407         struct data_info *dinfo;
 408         struct relation *rel;
 409         char *name;
 410         struct symbol *sym;
 411
 412         name = get_variable_from_expr(left, &sym);
 413         if (!name || !sym)
 414                 goto free;
 415
 416         remove_from_equiv(name, sym);
 417
 418         state = clone_extra_state(right_sm->state);
 419         dinfo = get_dinfo(state);
 420         if (!dinfo->related)
 421                 add_equiv(state, right_sm->name, right_sm->sym);
 422         add_equiv(state, name, sym);
 423
 424         FOR_EACH_PTR(dinfo->related, rel) {
 425                 struct sm_state *new_sm;
 426
 427                 new_sm = clone_sm(right_sm);
 428                 new_sm->name = rel->name;
 429                 new_sm->sym = rel->sym;
 430                 new_sm->state = state;
 431                 __set_sm(new_sm);
 432         } END_FOR_EACH_PTR(rel);
 433 free:
 434         free_string(name);
 435 }
 436
 437 static void match_assign(struct expression *expr)
 438 {
 439         struct expression *left;
 440         struct expression *right;
 441         struct sm_state *right_sm;
 442         struct symbol *right_sym;
 443         char *right_name;
 444         struct symbol *sym;
 445         char *name;
 446         long long value;
 447         int known;
 448         long long min = whole_range.min;
 449         long long max = whole_range.max;
 450         long long tmp;
 451
 452         if (__is_condition_assign(expr))
 453                 return;
 454         left = strip_expr(expr->left);
 455         name = get_variable_from_expr(left, &sym);
 456         if (!name)
 457                 return;
 458         right = strip_parens(expr->right);
 459         while (right->type == EXPR_ASSIGNMENT && right->op == '=')
 460                 right = strip_parens(right->left);
 461
 462         right_name = get_variable_from_expr(right, &right_sym);
 463         if (expr->op == '=' && right_name && right_sym) {
 464                 right_sm = get_sm_state_expr(SMATCH_EXTRA, right);
 465                 if (!right_sm)
 466                         right_sm = set_state_expr(SMATCH_EXTRA, right, extra_undefined());
 467                 if (!right_sm)
 468                         goto free;
 469                 set_equiv(right_sm, left);
 470                 goto free;
 471         }
 472
 473         known = get_implied_value(right, &value);
 474         switch (expr->op) {
 475         case '=': {
 476                 struct range_list *rl = NULL;
 477
 478                 if (get_implied_range_list(right, &rl)) {
 479                         set_extra_mod(name, sym, alloc_extra_state_range_list(rl));
 480                         goto free;
 481                 }
 482
 483                 if (expr_unsigned(right))
 484                         min = 0;
 485                 break;
 486         }
 487         case SPECIAL_ADD_ASSIGN:
 488                 if (get_implied_min(left, &tmp)) {
 489                         if (known)
 490                                 min = tmp + value;
 491                         else
 492                                 min = tmp;
 493                 }
 494                 if (!inside_loop() && known && get_implied_max(left, &tmp))
 495                                 max = tmp + value;
 496                 break;
 497         case SPECIAL_SUB_ASSIGN:
 498                 if (get_implied_max(left, &tmp)) {
 499                         if (known)
 500                                 max = tmp - value;
 501                         else
 502                                 max = tmp;
 503                 }
 504                 if (!inside_loop() && known && get_implied_min(left, &tmp))
 505                                 min = tmp - value;
 506                 break;
 507         }
 508         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 509 free:
 510         free_string(right_name);
 511         free_string(name);
 512 }
 513
 514 static void reset_struct_members(const char *name, struct symbol *sym, struct expression *expr, void *unused)
 515 {
 516         struct state_list *slist;
 517         struct sm_state *tmp;
 518         int len;
 519
 520         len = strlen(name);
 521         slist = get_all_states(SMATCH_EXTRA);
 522         FOR_EACH_PTR(slist, tmp) {
 523                 if (sym != tmp->sym)
 524                         continue;
 525                 if (strncmp(name, tmp->name, len))
 526                         continue;
 527                 if (tmp->name[len] != '-' && tmp->name[len] != '.')
 528                         continue;
 529                 set_extra_mod(tmp->name, tmp->sym, extra_undefined());
 530         } END_FOR_EACH_PTR(tmp);
 531 }
 532
 533 static void unop_expr(struct expression *expr)
 534 {
 535         struct symbol *sym;
 536         char *name;
 537         long long min = whole_range.min;
 538         long long max = whole_range.max;
 539         long long val;
 540
 541         switch (expr->op) {
 542         case SPECIAL_INCREMENT:
 543         case SPECIAL_DECREMENT:
 544                 break;
 545         default:
 546                 return;
 547         }
 548
 549         name = get_variable_from_expr(expr->unop, &sym);
 550         if (!name)
 551                 goto free;
 552         if (expr->op == SPECIAL_INCREMENT) {
 553                 if (get_implied_min(expr->unop, &val))
 554                         min = val + 1;
 555                 if (!inside_loop() && get_implied_max(expr->unop, &val))
 556                         max = val + 1;
 557         }
 558         if (expr->op == SPECIAL_DECREMENT) {
 559                 if (get_implied_max(expr->unop, &val))
 560                         max = val - 1;
 561                 if (!inside_loop() && get_implied_min(expr->unop, &val))
 562                         min = val - 1;
 563         }
 564         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 565 free:
 566         free_string(name);
 567 }
 568
 569 static void delete_state_tracker(struct tracker *t)
 570 {
 571         remove_from_equiv(t->name, t->sym);
 572         delete_state(t->owner, t->name, t->sym);
 573 }
 574
 575 static void scoped_state_extra(const char *name, struct symbol *sym)
 576 {
 577         struct tracker *t;
 578
 579         t = alloc_tracker(SMATCH_EXTRA, name, sym);
 580         add_scope_hook((scope_hook *)&delete_state_tracker, t);
 581 }
 582
 583 static void match_declarations(struct symbol *sym)
 584 {
 585         const char *name;
 586
 587         if (sym->ident) {
 588                 name = sym->ident->name;
 589                 if (!sym->initializer) {
 590                         set_state(SMATCH_EXTRA, name, sym, extra_undefined());
 591                         scoped_state_extra(name, sym);
 592                 }
 593         }
 594 }
 595
 596 static void match_function_def(struct symbol *sym)
 597 {
 598         struct symbol *arg;
 599
 600         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
 601                 if (!arg->ident)
 602                         continue;
 603                 set_state(my_id, arg->ident->name, arg, extra_undefined());
 604         } END_FOR_EACH_PTR(arg);
 605 }
 606
 607 static int last_stmt_val(struct statement *stmt, long long *val)
 608 {
 609         struct expression *expr;
 610
 611         if (!stmt)
 612                 return 0;
 613
 614         stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 615         if (stmt->type != STMT_EXPRESSION)
 616                 return 0;
 617         expr = stmt->expression;
 618         return get_value(expr, val);
 619 }
 620
 621 static void match_comparison(struct expression *expr)
 622 {
 623         long long fixed;
 624         char *name = NULL;
 625         struct symbol *sym;
 626         struct smatch_state *true_state;
 627         struct smatch_state *false_state;
 628         struct smatch_state *orig;
 629         int left = 0;
 630         int comparison = expr->op;
 631         struct expression *varies;
 632
 633         varies = strip_expr(expr->right);
 634         if (!get_implied_value(expr->left, &fixed)) {
 635                 if (!get_implied_value(expr->right, &fixed))
 636                         return;
 637                 varies = strip_expr(expr->left);
 638                 left = 1;
 639         }
 640
 641         if (varies->op == SPECIAL_INCREMENT || varies->op == SPECIAL_DECREMENT)
 642                 varies = varies->unop;
 643         if (varies->type == EXPR_CALL) {
 644                 function_comparison(comparison, varies, fixed, left);
 645                 return;
 646         }
 647
 648         name = get_variable_from_expr(varies, &sym);
 649         if (!name || !sym)
 650                 goto free;
 651
 652         orig = get_state(my_id, name, sym);
 653         if (!orig)
 654                 orig = extra_undefined();
 655
 656         switch (comparison) {
 657         case '<':
 658         case SPECIAL_UNSIGNED_LT:
 659                 if (left) {
 660                         true_state = filter_range(orig, fixed, whole_range.max);
 661                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 662                 } else {
 663                         true_state = filter_range(orig, whole_range.min, fixed);
 664                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 665                 }
 666                 break;
 667         case SPECIAL_UNSIGNED_LTE:
 668         case SPECIAL_LTE:
 669                 if (left) {
 670                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 671                         false_state = filter_range(orig, whole_range.min, fixed);
 672                 } else {
 673                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 674                         false_state = filter_range(orig, fixed, whole_range.max);
 675                 }
 676                 break;
 677         case SPECIAL_EQUAL:
 678                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 679                         true_state = alloc_extra_state(fixed);
 680                 else
 681                         true_state = alloc_extra_state_empty();
 682                 false_state = filter_range(orig, fixed, fixed);
 683                 break;
 684         case SPECIAL_UNSIGNED_GTE:
 685         case SPECIAL_GTE:
 686                 if (left) {
 687                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 688                         false_state = filter_range(orig, fixed, whole_range.max);
 689                 } else {
 690                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 691                         false_state = filter_range(orig, whole_range.min, fixed);
 692                 }
 693                 break;
 694         case '>':
 695         case SPECIAL_UNSIGNED_GT:
 696                 if (left) {
 697                         true_state = filter_range(orig, whole_range.min, fixed);
 698                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 699                 } else {
 700                         true_state = filter_range(orig, fixed, whole_range.max);
 701                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 702                 }
 703                 break;
 704         case SPECIAL_NOTEQUAL:
 705                 true_state = filter_range(orig, fixed, fixed);
 706                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 707                         false_state = alloc_extra_state(fixed);
 708                 else
 709                         false_state = alloc_extra_state_empty();
 710                 break;
 711         default:
 712                 sm_msg("unhandled comparison %d\n", comparison);
 713                 goto free;
 714         }
 715         set_extra_true_false(name, sym, true_state, false_state);
 716 free:
 717         free_string(name);
 718 }
 719
 720 /* this is actually hooked from smatch_implied.c...  it's hacky, yes */
 721 void __extra_match_condition(struct expression *expr)
 722 {
 723         struct symbol *sym;
 724         char *name;
 725         struct smatch_state *pre_state;
 726         struct smatch_state *true_state;
 727         struct smatch_state *false_state;
 728
 729         expr = strip_expr(expr);
 730         switch (expr->type) {
 731         case EXPR_CALL:
 732                 function_comparison(SPECIAL_NOTEQUAL, expr, 0, 1);
 733                 return;
 734         case EXPR_PREOP:
 735         case EXPR_SYMBOL:
 736         case EXPR_DEREF:
 737                 name = get_variable_from_expr(expr, &sym);
 738                 if (!name)
 739                         return;
 740                 pre_state = get_state(my_id, name, sym);
 741                 true_state = add_filter(pre_state, 0);
 742                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(pre_state), 0, 0))
 743                         false_state = alloc_extra_state(0);
 744                 else
 745                         false_state = alloc_extra_state_empty();
 746                 set_extra_true_false(name, sym, true_state, false_state);
 747                 free_string(name);
 748                 return;
 749         case EXPR_COMPARE:
 750                 match_comparison(expr);
 751                 return;
 752         case EXPR_ASSIGNMENT:
 753                 __extra_match_condition(expr->left);
 754                 return;
 755         }
 756 }
 757
 758 /* returns 1 if it is not possible for expr to be value, otherwise returns 0 */
 759 int implied_not_equal(struct expression *expr, long long val)
 760 {
 761         char *name;
 762         struct symbol *sym;
 763         struct smatch_state *state;
 764         long long expr_val;
 765         int ret = 0;
 766
 767         if (get_value(expr, &expr_val))
 768                 return expr_val != val;
 769
 770         name = get_variable_from_expr(expr, &sym);
 771         if (!name || !sym)
 772                 goto exit;
 773         state = get_state(my_id, name, sym);
 774         if (!state || !state->data)
 775                 goto exit;
 776         ret = !possibly_false(SPECIAL_NOTEQUAL, get_dinfo(state), val, 1);
 777 exit:
 778         free_string(name);
 779         return ret;
 780 }
 781
 782 int known_condition_true(struct expression *expr)
 783 {
 784         long long tmp;
 785         struct statement *stmt;
 786
 787         if (!expr)
 788                 return 0;
 789
 790         if (get_value(expr, &tmp) && tmp)
 791                 return 1;
 792
 793         expr = strip_expr(expr);
 794         switch (expr->type) {
 795         case EXPR_PREOP:
 796                 if (expr->op == '!') {
 797                         if (known_condition_false(expr->unop))
 798                                 return 1;
 799                         break;
 800                 }
 801                 stmt = get_expression_statement(expr);
 802                 if (last_stmt_val(stmt, &tmp) && tmp == 1)
 803                         return 1;
 804                 break;
 805         default:
 806                 break;
 807         }
 808         return 0;
 809 }
 810
 811 int known_condition_false(struct expression *expr)
 812 {
 813         long long tmp;
 814         struct statement *stmt;
 815
 816         if (!expr)
 817                 return 0;
 818
 819         if (is_zero(expr))
 820                 return 1;
 821
 822         switch (expr->type) {
 823         case EXPR_PREOP:
 824                 if (expr->op == '!') {
 825                         if (known_condition_true(expr->unop))
 826                                 return 1;
 827                         break;
 828                 }
 829                 stmt = get_expression_statement(expr);
 830                 if (last_stmt_val(stmt, &tmp) && tmp == 0)
 831                         return 1;
 832                 break;
 833         case EXPR_CALL:
 834                 if (sym_name_is("__builtin_constant_p", expr->fn))
 835                         return 1;
 836                 break;
 837         default:
 838                 break;
 839         }
 840         return 0;
 841 }
 842
 843 struct range_list *get_range_list(struct expression *expr)
 844 {
 845         long long min;
 846         long long max;
 847         struct range_list *ret = NULL;
 848         struct smatch_state *state;
 849
 850         state = get_state_expr(SMATCH_EXTRA, expr);
 851         if (state)
 852                 return clone_range_list(get_dinfo(state)->value_ranges);
 853         if (!get_absolute_min(expr, &min))
 854                 return NULL;
 855         if (!get_absolute_max(expr, &max))
 856                 return NULL;
 857         add_range(&ret, min, max);
 858         return ret;
 859 }
 860
 861 static int do_comparison(struct expression *expr)
 862 {
 863         struct range_list *left_ranges;
 864         struct range_list *right_ranges;
 865         int poss_true, poss_false;
 866
 867         left_ranges = get_range_list(expr->left);
 868         right_ranges = get_range_list(expr->right);
 869
 870         poss_true = possibly_true_range_lists(left_ranges, expr->op, right_ranges);
 871         poss_false = possibly_false_range_lists(left_ranges, expr->op, right_ranges);
 872
 873         free_range_list(&left_ranges);
 874         free_range_list(&right_ranges);
 875
 876         if (!poss_true && !poss_false)
 877                 return 0;
 878         if (poss_true && !poss_false)
 879                 return 1;
 880         if (!poss_true && poss_false)
 881                 return 2;
 882         return 3;
 883 }
 884
 885 int implied_condition_true(struct expression *expr)
 886 {
 887         struct statement *stmt;
 888         long long tmp;
 889         long long val;
 890
 891         if (!expr)
 892                 return 0;
 893
 894         if (get_implied_value(expr, &tmp) && tmp)
 895                 return 1;
 896
 897         if (expr->type == EXPR_POSTOP)
 898                 return implied_condition_true(expr->unop);
 899
 900         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_DECREMENT)
 901                 return implied_not_equal(expr->unop, 1);
 902         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_INCREMENT)
 903                 return implied_not_equal(expr->unop, -1);
 904
 905         expr = strip_expr(expr);
 906         switch (expr->type) {
 907         case EXPR_COMPARE:
 908                 if (do_comparison(expr) == 1)
 909                         return 1;
 910                 break;
 911         case EXPR_PREOP:
 912                 if (expr->op == '!') {
 913                         if (implied_condition_false(expr->unop))
 914                                 return 1;
 915                         break;
 916                 }
 917                 stmt = get_expression_statement(expr);
 918                 if (last_stmt_val(stmt, &val) && val == 1)
 919                         return 1;
 920                 break;
 921         default:
 922                 if (implied_not_equal(expr, 0) == 1)
 923                         return 1;
 924                 break;
 925         }
 926         return 0;
 927 }
 928
 929 int implied_condition_false(struct expression *expr)
 930 {
 931         struct statement *stmt;
 932         struct expression *tmp;
 933         long long val;
 934
 935         if (!expr)
 936                 return 0;
 937
 938         if (is_zero(expr))
 939                 return 1;
 940
 941         switch (expr->type) {
 942         case EXPR_COMPARE:
 943                 if (do_comparison(expr) == 2)
 944                         return 1;
 945         case EXPR_PREOP:
 946                 if (expr->op == '!') {
 947                         if (implied_condition_true(expr->unop))
 948                                 return 1;
 949                         break;
 950                 }
 951                 stmt = get_expression_statement(expr);
 952                 if (last_stmt_val(stmt, &val) && val == 0)
 953                         return 1;
 954                 tmp = strip_expr(expr);
 955                 if (tmp != expr)
 956                         return implied_condition_false(tmp);
 957                 break;
 958         default:
 959                 if (get_implied_value(expr, &val) && val == 0)
 960                         return 1;
 961                 break;
 962         }
 963         return 0;
 964 }
 965
 966 int get_implied_range_list(struct expression *expr, struct range_list **rl)
 967 {
 968         long long val;
 969         struct smatch_state *state;
 970         long long min;
 971         long long max;
 972
 973         expr = strip_parens(expr);
 974
 975         state = get_state_expr(my_id, expr);
 976         if (state) {
 977                 *rl = clone_range_list(get_dinfo(state)->value_ranges);
 978                 return 1;
 979         }
 980
 981         if (get_implied_value(expr, &val)) {
 982                 *rl = NULL;
 983                 add_range(rl, val, val);
 984                 return 1;
 985         }
 986
 987         if (expr->type != EXPR_BINOP)
 988                 return 0;
 989
 990         if (expr->op == '%') {
 991                 if (!get_implied_value(expr->right, &val))
 992                         return 0;
 993                 *rl = NULL;
 994                 add_range(rl, 0, val - 1);
 995                 return 1;
 996         }
 997
 998         if (!get_implied_min(expr, &min))
 999                 return 0;
1000         if (!get_implied_max(expr, &max))
1001                 return 0;
1002         add_range(rl, min, max);
1003         return 1;
1004 }
1005
1006 int is_whole_range(struct smatch_state *state)
1007 {
1008         struct data_info *dinfo;
1009         struct data_range *drange;
1010
1011         if (!state)
1012                 return 1;
1013         dinfo = get_dinfo(state);
1014         if (!dinfo || !dinfo->value_ranges)
1015                 return 1;
1016         drange = first_ptr_list((struct ptr_list *)dinfo->value_ranges);
1017         if (drange->min == whole_range.min && drange->max == whole_range.max)
1018                 return 1;
1019         return 0;
1020 }
1021
1022 static void struct_member_callback(char *fn, int param, char *printed_name, struct smatch_state *state)
1023 {
1024         if (is_whole_range(state))
1025                 return;
1026         sm_msg("info: passes param_value '%s' %d '%s' %s", fn, param, printed_name, state->name);
1027 }
1028
1029 static void match_call_info(struct expression *expr)
1030 {
1031         struct range_list *rl = NULL;
1032         struct expression *arg;
1033         char *name;
1034         int i = 0;
1035
1036         name = get_fnptr_name(expr->fn);
1037         if (!name)
1038                 return;
1039
1040         FOR_EACH_PTR(expr->args, arg) {
1041                 if (get_implied_range_list(arg, &rl) && !is_whole_range_rl(rl)) {
1042                         sm_msg("info: passes param_value '%s' %d '$$' %s",
1043                                name, i, show_ranges(rl));
1044                 }
1045                 i++;
1046         } END_FOR_EACH_PTR(arg);
1047
1048         free_string(name);
1049 }
1050
1051 static void get_value_ranges(char *value, struct range_list **rl)
1052 {
1053         long long val1, val2;
1054         char *start;
1055         char *c;
1056
1057         c = value;
1058         while (*c) {
1059                 if (*c == '(')
1060                         c++;
1061                 start = c;
1062                 if (!strncmp(start, "min", 3)) {
1063                         val1 = LLONG_MIN;
1064                         c += 3;
1065                 } else {
1066                         while (*c && *c != ',' && *c != '-')
1067                                 c++;
1068                         val1 = strtoll(start, &c, 10);
1069                 }
1070                 if (*c == ')')
1071                         c++;
1072                 if (!*c) {
1073                         add_range(rl, val1, val1);
1074                         break;
1075                 }
1076                 if (*c == ',') {
1077                         add_range(rl, val1, val1);
1078                         c++;
1079                         start = c;
1080                         continue;
1081                 }
1082                 c++; /* skip the dash in eg. 4-5 */
1083                 if (*c == '(')
1084                         c++;
1085                 start = c;
1086                 if (!strncmp(start, "max", 3)) {
1087                         val2 = LLONG_MAX;
1088                         c += 3;
1089                 } else {
1090
1091                         while (*c && *c != ',' && *c != '-')
1092                                 c++;
1093                         val2 = strtoll(start, &c, 10);
1094                 }
1095                 add_range(rl, val1, val2);
1096                 if (!*c)
1097                         break;
1098                 if (*c == ')')
1099                         c++;
1100                 c++; /* skip the comma in eg: 4-5,7 */
1101         }
1102
1103 }
1104
1105 void set_param_value(const char *name, struct symbol *sym, char *key, char *value)
1106 {
1107         struct range_list *rl = NULL;
1108         struct smatch_state *state;
1109         char fullname[256];
1110
1111         if (strncmp(key, "$$", 2))
1112                 return;
1113
1114         snprintf(fullname, 256, "%s%s", name, key + 2);
1115         get_value_ranges(value, &rl);
1116         char *tmp = show_ranges(rl);
1117         if (strcmp(tmp, value))
1118                 sm_msg("value = %s, ranges = %s", value, tmp);
1119         state = alloc_extra_state_range_list(rl);
1120         set_state(SMATCH_EXTRA, fullname, sym, state);
1121 }
1122
1123 void register_smatch_extra(int id)
1124 {
1125         my_id = id;
1126         add_merge_hook(my_id, &merge_func);
1127         add_unmatched_state_hook(my_id, &unmatched_state);
1128         add_hook(&unop_expr, OP_HOOK);
1129         add_hook(&match_function_def, FUNC_DEF_HOOK);
1130         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
1131         add_hook(&match_assign, ASSIGNMENT_HOOK);
1132         add_hook(&match_declarations, DECLARATION_HOOK);
1133         if (option_info) {
1134                 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1135                 add_member_info_callback(my_id, struct_member_callback);
1136         }
1137         add_definition_db_callback(set_param_value, PARAM_VALUE);
1138 }
1139
1140 void register_smatch_extra_late(int id)
1141 {
1142         set_default_modification_hook(SMATCH_EXTRA, reset_struct_members);
1143 }