smatch_extra.c

   1 /*
   2  * sparse/smatch_extra.c
   3  *
   4  * Copyright (C) 2008 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * smatch_extra.c is supposed to track the value of every variable.
  12  *
  13  */
  14
  15 #include <stdlib.h>
  16 #include <errno.h>
  17 #ifndef __USE_ISOC99
  18 #define __USE_ISOC99
  19 #endif
  20 #include <limits.h>
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24 #include "smatch_extra.h"
  25
  26 static int my_id;
  27
  28 struct string_list *__ignored_macros = NULL;
  29 static int in_warn_on_macro()
  30 {
  31         struct statement *stmt;
  32         char *tmp;
  33         char *macro;
  34
  35         stmt = last_ptr_list((struct ptr_list *)big_statement_stack);
  36         macro = get_macro_name(&stmt->pos);
  37         if (!macro)
  38                 return 0;
  39
  40         FOR_EACH_PTR(__ignored_macros, tmp) {
  41                 if (!strcmp(tmp, macro))
  42                         return 1;
  43         } END_FOR_EACH_PTR(tmp);
  44         return 0;
  45 }
  46
  47 struct sm_state *set_extra_mod(const char *name, struct symbol *sym, struct smatch_state *state)
  48 {
  49         if (in_warn_on_macro())
  50                 return NULL;
  51         remove_from_equiv(name, sym);
  52         return set_state(SMATCH_EXTRA, name, sym, state);
  53 }
  54
  55 struct sm_state *set_extra_expr_mod(struct expression *expr, struct smatch_state *state)
  56 {
  57         if (in_warn_on_macro())
  58                 return NULL;
  59         remove_from_equiv_expr(expr);
  60         return set_state_expr(SMATCH_EXTRA, expr, state);
  61 }
  62
  63 /*
  64  * This is for return_implies_state() hooks which modify a SMATCH_EXTRA state
  65  */
  66 void set_extra_expr_nomod(struct expression *expr, struct smatch_state *state)
  67 {
  68         struct relation *rel;
  69         struct smatch_state *orig_state;
  70
  71         orig_state = get_state_expr(SMATCH_EXTRA, expr);
  72
  73         if (!orig_state || !get_dinfo(orig_state)->related) {
  74                 set_state_expr(SMATCH_EXTRA, expr, state);
  75                 return;
  76         }
  77
  78         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
  79                 sm_msg("setting %s to %s", rel->name, state->name);
  80                 set_state(SMATCH_EXTRA, rel->name, rel->sym, state);
  81                 add_equiv(state, rel->name, rel->sym);
  82         } END_FOR_EACH_PTR(rel);
  83 }
  84
  85 void set_extra_true_false(const char *name, struct symbol *sym,
  86                         struct smatch_state *true_state,
  87                         struct smatch_state *false_state)
  88 {
  89         struct relation *rel;
  90         struct smatch_state *orig_state;
  91
  92         if (in_warn_on_macro())
  93                 return;
  94
  95         orig_state = get_state(SMATCH_EXTRA, name, sym);
  96
  97         if (!orig_state || !get_dinfo(orig_state)->related) {
  98                 set_true_false_states(SMATCH_EXTRA, name, sym, true_state, false_state);
  99                 return;
 100         }
 101
 102         // FIXME!!!!  equiv => related
 103         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
 104                 set_true_false_states(SMATCH_EXTRA, rel->name, rel->sym,
 105                                 true_state, false_state);
 106                 if (true_state)
 107                         add_equiv(true_state, rel->name, rel->sym);
 108                 if (false_state)
 109                         add_equiv(false_state, rel->name, rel->sym);
 110         } END_FOR_EACH_PTR(rel);
 111 }
 112
 113 struct data_info *get_dinfo(struct smatch_state *state)
 114 {
 115         if (!state)
 116                 return NULL;
 117         return (struct data_info *)state->data;
 118
 119 }
 120
 121 struct smatch_state *filter_range(struct smatch_state *orig,
 122                                  long long filter_min, long long filter_max)
 123 {
 124         struct smatch_state *ret;
 125         struct data_info *orig_info;
 126         struct data_info *ret_info;
 127
 128         if (!orig)
 129                 orig = extra_undefined();
 130         orig_info = get_dinfo(orig);
 131         ret = alloc_extra_state_empty();
 132         ret_info = get_dinfo(ret);
 133         ret_info->value_ranges = remove_range(orig_info->value_ranges, filter_min, filter_max);
 134         ret->name = show_ranges(ret_info->value_ranges);
 135         return ret;
 136 }
 137
 138 struct smatch_state *add_filter(struct smatch_state *orig, long long num)
 139 {
 140         return filter_range(orig, num, num);
 141 }
 142
 143 static struct smatch_state *merge_func(const char *name, struct symbol *sym,
 144                                        struct smatch_state *s1,
 145                                        struct smatch_state *s2)
 146 {
 147         struct data_info *info1 = get_dinfo(s1);
 148         struct data_info *info2 = get_dinfo(s2);
 149         struct data_info *ret_info;
 150         struct smatch_state *tmp;
 151         struct range_list *value_ranges;
 152         struct relation *rel;
 153         struct relation *new;
 154
 155         value_ranges = range_list_union(info1->value_ranges, info2->value_ranges);
 156         tmp = alloc_extra_state_empty();
 157         ret_info = get_dinfo(tmp);
 158         ret_info->value_ranges = value_ranges;
 159         tmp->name = show_ranges(ret_info->value_ranges);
 160         FOR_EACH_PTR(info1->related, rel) {
 161                 new = get_common_relationship(info2, rel->op, rel->name, rel->sym);
 162                 if (new)
 163                         add_related(tmp, new->op, new->name, new->sym);
 164         } END_FOR_EACH_PTR(rel);
 165         return tmp;
 166 }
 167
 168 static struct sm_state *handle_canonical_while_count_down(struct statement *loop)
 169 {
 170         struct expression *iter_var;
 171         struct expression *condition;
 172         struct sm_state *sm;
 173         long long start;
 174
 175         condition = strip_expr(loop->iterator_pre_condition);
 176         if (!condition)
 177                 return NULL;
 178         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 179                 return NULL;
 180         if (condition->op != SPECIAL_DECREMENT)
 181                 return NULL;
 182
 183         iter_var = condition->unop;
 184         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 185         if (!sm)
 186                 return NULL;
 187         if (get_dinfo_min(get_dinfo(sm->state)) < 0)
 188                 return NULL;
 189         start = get_dinfo_max(get_dinfo(sm->state));
 190         if  (start <= 0)
 191                 return NULL;
 192         if (start != whole_range.max)
 193                 start--;
 194
 195         if (condition->type == EXPR_PREOP)
 196                 set_extra_expr_mod(iter_var, alloc_extra_state_range(1, start));
 197         if (condition->type == EXPR_POSTOP)
 198                 set_extra_expr_mod(iter_var, alloc_extra_state_range(0, start));
 199         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 200 }
 201
 202 static struct sm_state *handle_canonical_for_inc(struct expression *iter_expr,
 203                                                 struct expression *condition)
 204 {
 205         struct expression *iter_var;
 206         struct sm_state *sm;
 207         long long start;
 208         long long end;
 209
 210         iter_var = iter_expr->unop;
 211         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 212         if (!sm)
 213                 return NULL;
 214         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 215                 return NULL;
 216         if (!get_implied_value(condition->right, &end))
 217                 end = whole_range.max;
 218         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 219                 return NULL;
 220
 221         switch (condition->op) {
 222         case SPECIAL_NOTEQUAL:
 223         case '<':
 224                 if (end != whole_range.max)
 225                         end--;
 226                 break;
 227         case SPECIAL_LTE:
 228                 break;
 229         default:
 230                 return NULL;
 231         }
 232         if (end < start)
 233                 return NULL;
 234         set_extra_expr_mod(iter_var, alloc_extra_state_range(start, end));
 235         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 236 }
 237
 238 static struct sm_state *handle_canonical_for_dec(struct expression *iter_expr,
 239                                                 struct expression *condition)
 240 {
 241         struct expression *iter_var;
 242         struct sm_state *sm;
 243         long long start;
 244         long long end;
 245
 246         iter_var = iter_expr->unop;
 247         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 248         if (!sm)
 249                 return NULL;
 250         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 251                 return NULL;
 252         if (!get_implied_value(condition->right, &end))
 253                 end = whole_range.max;
 254         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 255                 return NULL;
 256
 257         switch (condition->op) {
 258         case SPECIAL_NOTEQUAL:
 259         case '>':
 260                 if (end != whole_range.min)
 261                         end++;
 262                 break;
 263         case SPECIAL_GTE:
 264                 break;
 265         default:
 266                 return NULL;
 267         }
 268         if (end > start)
 269                 return NULL;
 270         set_extra_expr_mod(iter_var, alloc_extra_state_range(end, start));
 271         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 272 }
 273
 274 static struct sm_state *handle_canonical_for_loops(struct statement *loop)
 275 {
 276         struct expression *iter_expr;
 277         struct expression *condition;
 278
 279         if (!loop->iterator_post_statement)
 280                 return NULL;
 281         if (loop->iterator_post_statement->type != STMT_EXPRESSION)
 282                 return NULL;
 283         iter_expr = loop->iterator_post_statement->expression;
 284         if (!loop->iterator_pre_condition)
 285                 return NULL;
 286         if (loop->iterator_pre_condition->type != EXPR_COMPARE)
 287                 return NULL;
 288         condition = loop->iterator_pre_condition;
 289
 290         if (iter_expr->op == SPECIAL_INCREMENT)
 291                 return handle_canonical_for_inc(iter_expr, condition);
 292         if (iter_expr->op == SPECIAL_DECREMENT)
 293                 return handle_canonical_for_dec(iter_expr, condition);
 294         return NULL;
 295 }
 296
 297 struct sm_state *__extra_handle_canonical_loops(struct statement *loop, struct state_list **slist)
 298 {
 299         struct sm_state *ret;
 300
 301         __push_fake_cur_slist();;
 302         if (!loop->iterator_post_statement)
 303                 ret = handle_canonical_while_count_down(loop);
 304         else
 305                 ret = handle_canonical_for_loops(loop);
 306         *slist = __pop_fake_cur_slist();
 307         return ret;
 308 }
 309
 310 int __iterator_unchanged(struct sm_state *sm)
 311 {
 312         if (!sm)
 313                 return 0;
 314         if (get_sm_state(my_id, sm->name, sm->sym) == sm)
 315                 return 1;
 316         return 0;
 317 }
 318
 319 static void while_count_down_after(struct sm_state *sm, struct expression *condition)
 320 {
 321         long long after_value;
 322
 323         /* paranoid checking.  prolly not needed */
 324         condition = strip_expr(condition);
 325         if (!condition)
 326                 return;
 327         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 328                 return;
 329         if (condition->op != SPECIAL_DECREMENT)
 330                 return;
 331         after_value = get_dinfo_min(get_dinfo(sm->state));
 332         after_value--;
 333         set_extra_mod(sm->name, sm->sym, alloc_extra_state(after_value));
 334 }
 335
 336 void __extra_pre_loop_hook_after(struct sm_state *sm,
 337                                 struct statement *iterator,
 338                                 struct expression *condition)
 339 {
 340         struct expression *iter_expr;
 341         char *name;
 342         struct symbol *sym;
 343         long long value;
 344         int left = 0;
 345         struct smatch_state *state;
 346         struct data_info *dinfo;
 347         long long min, max;
 348
 349         if (!iterator) {
 350                 while_count_down_after(sm, condition);
 351                 return;
 352         }
 353
 354         iter_expr = iterator->expression;
 355
 356         if (condition->type != EXPR_COMPARE)
 357                 return;
 358         if (!get_value(condition->left, &value)) {
 359                 if (!get_value(condition->right, &value))
 360                         return;
 361                 left = 1;
 362         }
 363         if (left)
 364                 name = get_variable_from_expr(condition->left, &sym);
 365         else
 366                 name = get_variable_from_expr(condition->right, &sym);
 367         if (!name || !sym)
 368                 goto free;
 369         if (sym != sm->sym || strcmp(name, sm->name))
 370                 goto free;
 371         state = get_state(my_id, name, sym);
 372         dinfo = get_dinfo(state);
 373         min = get_dinfo_min(dinfo);
 374         max = get_dinfo_max(dinfo);
 375         if (iter_expr->op == SPECIAL_INCREMENT &&
 376                 min != whole_range.min &&
 377                 max == whole_range.max) {
 378                 set_extra_mod(name, sym, alloc_extra_state(min));
 379         } else if (min == whole_range.min && max != whole_range.max) {
 380                 set_extra_mod(name, sym, alloc_extra_state(max));
 381         }
 382 free:
 383         free_string(name);
 384         return;
 385 }
 386
 387 static struct smatch_state *unmatched_state(struct sm_state *sm)
 388 {
 389         return extra_undefined();
 390 }
 391
 392 static void match_function_call(struct expression *expr)
 393 {
 394         struct expression *tmp;
 395
 396         FOR_EACH_PTR(expr->args, tmp) {
 397                 if (tmp->type == EXPR_PREOP && tmp->op == '&') {
 398                         remove_from_equiv_expr(tmp->unop);
 399                         set_state_expr(SMATCH_EXTRA, tmp->unop, extra_undefined());
 400                 }
 401         } END_FOR_EACH_PTR(tmp);
 402 }
 403
 404 static void set_equiv(struct sm_state *right_sm, struct expression *left)
 405 {
 406         struct smatch_state *state;
 407         struct data_info *dinfo;
 408         struct relation *rel;
 409         char *name;
 410         struct symbol *sym;
 411
 412         name = get_variable_from_expr(left, &sym);
 413         if (!name || !sym)
 414                 goto free;
 415
 416         remove_from_equiv(name, sym);
 417
 418         state = clone_extra_state(right_sm->state);
 419         dinfo = get_dinfo(state);
 420         if (!dinfo->related)
 421                 add_equiv(state, right_sm->name, right_sm->sym);
 422         add_equiv(state, name, sym);
 423
 424         FOR_EACH_PTR(dinfo->related, rel) {
 425                 struct sm_state *new_sm;
 426
 427                 new_sm = clone_sm(right_sm);
 428                 new_sm->name = rel->name;
 429                 new_sm->sym = rel->sym;
 430                 new_sm->state = state;
 431                 __set_sm(new_sm);
 432         } END_FOR_EACH_PTR(rel);
 433 free:
 434         free_string(name);
 435 }
 436
 437 static void match_assign(struct expression *expr)
 438 {
 439         struct expression *left;
 440         struct expression *right;
 441         struct sm_state *right_sm;
 442         struct symbol *right_sym;
 443         char *right_name;
 444         struct symbol *sym;
 445         char *name;
 446         long long value;
 447         int known;
 448         long long min = whole_range.min;
 449         long long max = whole_range.max;
 450         long long tmp;
 451
 452         if (__is_condition_assign(expr))
 453                 return;
 454         left = strip_expr(expr->left);
 455         name = get_variable_from_expr(left, &sym);
 456         if (!name)
 457                 return;
 458         right = strip_parens(expr->right);
 459         while (right->type == EXPR_ASSIGNMENT && right->op == '=')
 460                 right = strip_parens(right->left);
 461
 462         right_name = get_variable_from_expr(right, &right_sym);
 463         if (expr->op == '=' && right_name && right_sym) {
 464                 right_sm = get_sm_state_expr(SMATCH_EXTRA, right);
 465                 if (!right_sm)
 466                         right_sm = set_state_expr(SMATCH_EXTRA, right, extra_undefined());
 467                 if (!right_sm)
 468                         goto free;
 469                 set_equiv(right_sm, left);
 470                 goto free;
 471         }
 472
 473         known = get_implied_value(right, &value);
 474         switch (expr->op) {
 475         case '=': {
 476                 struct range_list *rl = NULL;
 477
 478                 if (get_implied_range_list(right, &rl)) {
 479                         set_extra_mod(name, sym, alloc_extra_state_range_list(rl));
 480                         goto free;
 481                 }
 482
 483                 if (expr_unsigned(right))
 484                         min = 0;
 485                 break;
 486         }
 487         case SPECIAL_ADD_ASSIGN:
 488                 if (get_implied_min(left, &tmp)) {
 489                         if (known)
 490                                 min = tmp + value;
 491                         else
 492                                 min = tmp;
 493                 }
 494                 if (!inside_loop() && known && get_implied_max(left, &tmp))
 495                                 max = tmp + value;
 496                 break;
 497         case SPECIAL_SUB_ASSIGN:
 498                 if (get_implied_max(left, &tmp)) {
 499                         if (known)
 500                                 max = tmp - value;
 501                         else
 502                                 max = tmp;
 503                 }
 504                 if (!inside_loop() && known && get_implied_min(left, &tmp))
 505                                 min = tmp - value;
 506                 break;
 507         }
 508         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 509 free:
 510         free_string(right_name);
 511         free_string(name);
 512 }
 513
 514 static void reset_struct_members(const char *name, struct symbol *sym, struct expression *expr, void *unused)
 515 {
 516         struct state_list *slist;
 517         struct sm_state *tmp;
 518         int len;
 519
 520         len = strlen(name);
 521         slist = get_all_states(SMATCH_EXTRA);
 522         FOR_EACH_PTR(slist, tmp) {
 523                 if (sym != tmp->sym)
 524                         continue;
 525                 if (strncmp(name, tmp->name, len))
 526                         continue;
 527                 if (tmp->name[len] != '-' && tmp->name[len] != '.')
 528                         continue;
 529                 set_extra_mod(tmp->name, tmp->sym, extra_undefined());
 530         } END_FOR_EACH_PTR(tmp);
 531 }
 532
 533 static void unop_expr(struct expression *expr)
 534 {
 535         struct symbol *sym;
 536         char *name;
 537         long long min = whole_range.min;
 538         long long max = whole_range.max;
 539         long long val;
 540
 541         switch (expr->op) {
 542         case SPECIAL_INCREMENT:
 543         case SPECIAL_DECREMENT:
 544                 break;
 545         default:
 546                 return;
 547         }
 548
 549         name = get_variable_from_expr(expr->unop, &sym);
 550         if (!name)
 551                 goto free;
 552         if (expr->op == SPECIAL_INCREMENT) {
 553                 if (get_implied_min(expr->unop, &val))
 554                         min = val + 1;
 555                 if (!inside_loop() && get_implied_max(expr->unop, &val))
 556                         max = val + 1;
 557         }
 558         if (expr->op == SPECIAL_DECREMENT) {
 559                 if (get_implied_max(expr->unop, &val))
 560                         max = val - 1;
 561                 if (!inside_loop() && get_implied_min(expr->unop, &val))
 562                         min = val - 1;
 563         }
 564         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 565 free:
 566         free_string(name);
 567 }
 568
 569 static void delete_state_tracker(struct tracker *t)
 570 {
 571         remove_from_equiv(t->name, t->sym);
 572         delete_state(t->owner, t->name, t->sym);
 573 }
 574
 575 static void scoped_state_extra(const char *name, struct symbol *sym)
 576 {
 577         struct tracker *t;
 578
 579         t = alloc_tracker(SMATCH_EXTRA, name, sym);
 580         add_scope_hook((scope_hook *)&delete_state_tracker, t);
 581 }
 582
 583 static void match_declarations(struct symbol *sym)
 584 {
 585         const char *name;
 586
 587         if (sym->ident) {
 588                 name = sym->ident->name;
 589                 if (!sym->initializer) {
 590                         set_state(SMATCH_EXTRA, name, sym, extra_undefined());
 591                         scoped_state_extra(name, sym);
 592                 }
 593         }
 594 }
 595
 596 static void match_function_def(struct symbol *sym)
 597 {
 598         struct symbol *arg;
 599
 600         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
 601                 if (!arg->ident) {
 602                         continue;
 603                 }
 604                 set_state(my_id, arg->ident->name, arg, extra_undefined());
 605         } END_FOR_EACH_PTR(arg);
 606 }
 607
 608 static int last_stmt_val(struct statement *stmt, long long *val)
 609 {
 610         struct expression *expr;
 611
 612         if (!stmt)
 613                 return 0;
 614
 615         stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 616         if (stmt->type != STMT_EXPRESSION)
 617                 return 0;
 618         expr = stmt->expression;
 619         return get_value(expr, val);
 620 }
 621
 622 static void match_comparison(struct expression *expr)
 623 {
 624         long long fixed;
 625         char *name = NULL;
 626         struct symbol *sym;
 627         struct smatch_state *true_state;
 628         struct smatch_state *false_state;
 629         struct smatch_state *orig;
 630         int left = 0;
 631         int comparison = expr->op;
 632         struct expression *varies;
 633
 634
 635         varies = strip_expr(expr->right);
 636         if (!get_implied_value(expr->left, &fixed)) {
 637                 if (!get_implied_value(expr->right, &fixed))
 638                         return;
 639                 varies = strip_expr(expr->left);
 640                 left = 1;
 641         }
 642
 643         if (varies->op == SPECIAL_INCREMENT || varies->op == SPECIAL_DECREMENT)
 644                 varies = varies->unop;
 645         if (varies->type == EXPR_CALL) {
 646                 function_comparison(comparison, varies, fixed, left);
 647                 return;
 648         }
 649
 650         name = get_variable_from_expr(varies, &sym);
 651         if (!name || !sym)
 652                 goto free;
 653
 654         orig = get_state(my_id, name, sym);
 655         if (!orig)
 656                 orig = extra_undefined();
 657
 658         switch (comparison) {
 659         case '<':
 660         case SPECIAL_UNSIGNED_LT:
 661                 if (left) {
 662                         true_state = filter_range(orig, fixed, whole_range.max);
 663                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 664                 } else {
 665                         true_state = filter_range(orig, whole_range.min, fixed);
 666                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 667                 }
 668                 break;
 669         case SPECIAL_UNSIGNED_LTE:
 670         case SPECIAL_LTE:
 671                 if (left) {
 672                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 673                         false_state = filter_range(orig, whole_range.min, fixed);
 674                 } else {
 675                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 676                         false_state = filter_range(orig, fixed, whole_range.max);
 677                 }
 678                 break;
 679         case SPECIAL_EQUAL:
 680                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 681                         true_state = alloc_extra_state(fixed);
 682                 else
 683                         true_state = alloc_extra_state_empty();
 684                 false_state = filter_range(orig, fixed, fixed);
 685                 break;
 686         case SPECIAL_UNSIGNED_GTE:
 687         case SPECIAL_GTE:
 688                 if (left) {
 689                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 690                         false_state = filter_range(orig, fixed, whole_range.max);
 691                 } else {
 692                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 693                         false_state = filter_range(orig, whole_range.min, fixed);
 694                 }
 695                 break;
 696         case '>':
 697         case SPECIAL_UNSIGNED_GT:
 698                 if (left) {
 699                         true_state = filter_range(orig, whole_range.min, fixed);
 700                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 701                 } else {
 702                         true_state = filter_range(orig, fixed, whole_range.max);
 703                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 704                 }
 705                 break;
 706         case SPECIAL_NOTEQUAL:
 707                 true_state = filter_range(orig, fixed, fixed);
 708                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 709                         false_state = alloc_extra_state(fixed);
 710                 else
 711                         false_state = alloc_extra_state_empty();
 712                 break;
 713         default:
 714                 sm_msg("unhandled comparison %d\n", comparison);
 715                 goto free;
 716         }
 717         set_extra_true_false(name, sym, true_state, false_state);
 718 free:
 719         free_string(name);
 720 }
 721
 722 /* this is actually hooked from smatch_implied.c...  it's hacky, yes */
 723 void __extra_match_condition(struct expression *expr)
 724 {
 725         struct symbol *sym;
 726         char *name;
 727         struct smatch_state *pre_state;
 728         struct smatch_state *true_state;
 729         struct smatch_state *false_state;
 730
 731         expr = strip_expr(expr);
 732         switch (expr->type) {
 733         case EXPR_CALL:
 734                 function_comparison(SPECIAL_NOTEQUAL, expr, 0, 1);
 735                 return;
 736         case EXPR_PREOP:
 737         case EXPR_SYMBOL:
 738         case EXPR_DEREF:
 739                 name = get_variable_from_expr(expr, &sym);
 740                 if (!name)
 741                         return;
 742                 pre_state = get_state(my_id, name, sym);
 743                 true_state = add_filter(pre_state, 0);
 744                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(pre_state), 0, 0))
 745                         false_state = alloc_extra_state(0);
 746                 else
 747                         false_state = alloc_extra_state_empty();
 748                 set_extra_true_false(name, sym, true_state, false_state);
 749                 free_string(name);
 750                 return;
 751         case EXPR_COMPARE:
 752                 match_comparison(expr);
 753                 return;
 754         case EXPR_ASSIGNMENT:
 755                 __extra_match_condition(expr->left);
 756                 return;
 757         }
 758 }
 759
 760 /* returns 1 if it is not possible for expr to be value, otherwise returns 0 */
 761 int implied_not_equal(struct expression *expr, long long val)
 762 {
 763         char *name;
 764         struct symbol *sym;
 765         struct smatch_state *state;
 766         long long expr_val;
 767         int ret = 0;
 768
 769         if (get_value(expr, &expr_val)) {
 770                 return expr_val != val;
 771         }
 772         name = get_variable_from_expr(expr, &sym);
 773         if (!name || !sym)
 774                 goto exit;
 775         state = get_state(my_id, name, sym);
 776         if (!state || !state->data)
 777                 goto exit;
 778         ret = !possibly_false(SPECIAL_NOTEQUAL, get_dinfo(state), val, 1);
 779 exit:
 780         free_string(name);
 781         return ret;
 782 }
 783
 784 int known_condition_true(struct expression *expr)
 785 {
 786         long long tmp;
 787         struct statement *stmt;
 788
 789         if (!expr)
 790                 return 0;
 791
 792         if (get_value(expr, &tmp) && tmp)
 793                 return 1;
 794
 795         expr = strip_expr(expr);
 796         switch (expr->type) {
 797         case EXPR_PREOP:
 798                 if (expr->op == '!') {
 799                         if (known_condition_false(expr->unop))
 800                                 return 1;
 801                         break;
 802                 }
 803                 stmt = get_expression_statement(expr);
 804                 if (last_stmt_val(stmt, &tmp) && tmp == 1)
 805                         return 1;
 806                 break;
 807         default:
 808                 break;
 809         }
 810         return 0;
 811 }
 812
 813 int known_condition_false(struct expression *expr)
 814 {
 815         long long tmp;
 816         struct statement *stmt;
 817
 818         if (!expr)
 819                 return 0;
 820
 821         if (is_zero(expr))
 822                 return 1;
 823
 824         switch (expr->type) {
 825         case EXPR_PREOP:
 826                 if (expr->op == '!') {
 827                         if (known_condition_true(expr->unop))
 828                                 return 1;
 829                         break;
 830                 }
 831                 stmt = get_expression_statement(expr);
 832                 if (last_stmt_val(stmt, &tmp) && tmp == 0)
 833                         return 1;
 834                 break;
 835         case EXPR_CALL:
 836                 if (sym_name_is("__builtin_constant_p", expr->fn))
 837                         return 1;
 838                 break;
 839         default:
 840                 break;
 841         }
 842         return 0;
 843 }
 844
 845 struct range_list *get_range_list(struct expression *expr)
 846 {
 847         long long min;
 848         long long max;
 849         struct range_list *ret = NULL;
 850         struct smatch_state *state;
 851
 852         state = get_state_expr(SMATCH_EXTRA, expr);
 853         if (state)
 854                 return clone_range_list(get_dinfo(state)->value_ranges);
 855         if (!get_absolute_min(expr, &min))
 856                 return NULL;
 857         if (!get_absolute_max(expr, &max))
 858                 return NULL;
 859         add_range(&ret, min, max);
 860         return ret;
 861 }
 862
 863 static int do_comparison(struct expression *expr)
 864 {
 865         struct range_list *left_ranges;
 866         struct range_list *right_ranges;
 867         int poss_true, poss_false;
 868
 869         left_ranges = get_range_list(expr->left);
 870         right_ranges = get_range_list(expr->right);
 871
 872         poss_true = possibly_true_range_lists(left_ranges, expr->op, right_ranges);
 873         poss_false = possibly_false_range_lists(left_ranges, expr->op, right_ranges);
 874
 875         free_range_list(&left_ranges);
 876         free_range_list(&right_ranges);
 877
 878         if (!poss_true && !poss_false)
 879                 return 0;
 880         if (poss_true && !poss_false)
 881                 return 1;
 882         if (!poss_true && poss_false)
 883                 return 2;
 884         return 3;
 885 }
 886
 887 int implied_condition_true(struct expression *expr)
 888 {
 889         struct statement *stmt;
 890         long long tmp;
 891         long long val;
 892
 893         if (!expr)
 894                 return 0;
 895
 896         if (get_implied_value(expr, &tmp) && tmp)
 897                 return 1;
 898
 899         if (expr->type == EXPR_POSTOP)
 900                 return implied_condition_true(expr->unop);
 901
 902         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_DECREMENT)
 903                 return implied_not_equal(expr->unop, 1);
 904         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_INCREMENT)
 905                 return implied_not_equal(expr->unop, -1);
 906
 907         expr = strip_expr(expr);
 908         switch (expr->type) {
 909         case EXPR_COMPARE:
 910                 if (do_comparison(expr) == 1)
 911                         return 1;
 912                 break;
 913         case EXPR_PREOP:
 914                 if (expr->op == '!') {
 915                         if (implied_condition_false(expr->unop))
 916                                 return 1;
 917                         break;
 918                 }
 919                 stmt = get_expression_statement(expr);
 920                 if (last_stmt_val(stmt, &val) && val == 1)
 921                         return 1;
 922                 break;
 923         default:
 924                 if (implied_not_equal(expr, 0) == 1)
 925                         return 1;
 926                 break;
 927         }
 928         return 0;
 929 }
 930
 931 int implied_condition_false(struct expression *expr)
 932 {
 933         struct statement *stmt;
 934         struct expression *tmp;
 935         long long val;
 936
 937         if (!expr)
 938                 return 0;
 939
 940         if (is_zero(expr))
 941                 return 1;
 942
 943         switch (expr->type) {
 944         case EXPR_COMPARE:
 945                 if (do_comparison(expr) == 2)
 946                         return 1;
 947         case EXPR_PREOP:
 948                 if (expr->op == '!') {
 949                         if (implied_condition_true(expr->unop))
 950                                 return 1;
 951                         break;
 952                 }
 953                 stmt = get_expression_statement(expr);
 954                 if (last_stmt_val(stmt, &val) && val == 0)
 955                         return 1;
 956                 tmp = strip_expr(expr);
 957                 if (tmp != expr)
 958                         return implied_condition_false(tmp);
 959                 break;
 960         default:
 961                 if (get_implied_value(expr, &val) && val == 0)
 962                         return 1;
 963                 break;
 964         }
 965         return 0;
 966 }
 967
 968 int get_implied_range_list(struct expression *expr, struct range_list **rl)
 969 {
 970         long long val;
 971         struct smatch_state *state;
 972         long long min;
 973         long long max;
 974
 975         expr = strip_expr(expr);
 976
 977         state = get_state_expr(my_id, expr);
 978         if (state) {
 979                 *rl = clone_range_list(get_dinfo(state)->value_ranges);
 980                 return 1;
 981         }
 982
 983         if (get_implied_value(expr, &val)) {
 984                 *rl = NULL;
 985                 add_range(rl, val, val);
 986                 return 1;
 987         }
 988
 989         if (expr->type != EXPR_BINOP)
 990                 return 0;
 991
 992         if (expr->op == '%') {
 993                 if (!get_implied_value(expr->right, &val))
 994                         return 0;
 995                 *rl = NULL;
 996                 add_range(rl, 0, val - 1);
 997                 return 1;
 998         }
 999
1000         if (!get_implied_min(expr, &min))
1001                 return 0;
1002         if (!get_implied_max(expr, &max))
1003                 return 0;
1004         add_range(rl, min, max);
1005         return 1;
1006 }
1007
1008 int is_whole_range(struct smatch_state *state)
1009 {
1010         struct data_info *dinfo;
1011         struct data_range *drange;
1012
1013         if (!state)
1014                 return 1;
1015         dinfo = get_dinfo(state);
1016         if (!dinfo || !dinfo->value_ranges)
1017                 return 1;
1018         drange = first_ptr_list((struct ptr_list *)dinfo->value_ranges);
1019         if (drange->min == whole_range.min && drange->max == whole_range.max)
1020                 return 1;
1021         return 0;
1022 }
1023
1024 static void struct_member_callback(char *fn, int param, char *printed_name, struct smatch_state *state)
1025 {
1026         if (is_whole_range(state))
1027                 return;
1028         sm_msg("info: passes param_value '%s' %d '%s' %s", fn, param, printed_name, state->name);
1029 }
1030
1031 static void match_call_info(struct expression *expr)
1032 {
1033         struct range_list *rl = NULL;
1034         struct expression *arg;
1035         char *name;
1036         int i = 0;
1037
1038         name = get_fnptr_name(expr->fn);
1039         if (!name)
1040                 return;
1041
1042         FOR_EACH_PTR(expr->args, arg) {
1043                 if (get_implied_range_list(arg, &rl) && ! is_whole_range_rl(rl)) {
1044                         sm_msg("info: passes param_value '%s' %d '$$' %s",
1045                                name, i, show_ranges(rl));
1046                 }
1047                 i++;
1048         } END_FOR_EACH_PTR(arg);
1049
1050         free_string(name);
1051 }
1052
1053 static void get_value_ranges(char *value, struct range_list **rl)
1054 {
1055         long long val1, val2;
1056         char *start;
1057         char *c;
1058
1059         c = value;
1060         while (*c) {
1061                 if (*c == '(')
1062                         c++;
1063                 start = c;
1064                 if (!strncmp(start, "min", 3)) {
1065                         val1 = LLONG_MIN;
1066                         c += 3;
1067                 } else {
1068                         while (*c && *c != ',' && *c != '-')
1069                                 c++;
1070                         val1 = strtoll(start, &c, 10);
1071                 }
1072                 if (*c == ')')
1073                         c++;
1074                 if (!*c) {
1075                         add_range(rl, val1, val1);
1076                         break;
1077                 }
1078                 if (*c == ',') {
1079                         add_range(rl, val1, val1);
1080                         c++;
1081                         start = c;
1082                         continue;
1083                 }
1084                 c++; /* skip the dash in eg. 4-5 */
1085                 if (*c == '(')
1086                         c++;
1087                 start = c;
1088                 if (!strncmp(start, "max", 3)) {
1089                         val2 = LLONG_MAX;
1090                         c += 3;
1091                 } else {
1092
1093                         while (*c && *c != ',' && *c != '-')
1094                                 c++;
1095                         val2 = strtoll(start, &c, 10);
1096                 }
1097                 add_range(rl, val1, val2);
1098                 if (!*c)
1099                         break;
1100                 if (*c == ')')
1101                         c++;
1102                 c++; /* skip the comma in eg: 4-5,7 */
1103         }
1104
1105 }
1106
1107 void set_param_value(const char *name, struct symbol *sym, char *key, char *value)
1108 {
1109         struct range_list *rl = NULL;
1110         struct smatch_state *state;
1111         char fullname[256];
1112
1113         if (strncmp(key, "$$", 2))
1114                 return;
1115
1116         snprintf(fullname, 256, "%s%s", name, key + 2);
1117         get_value_ranges(value, &rl);
1118         char *tmp = show_ranges(rl);
1119         if (strcmp(tmp, value))
1120                 sm_msg("value = %s, ranges = %s", value, tmp);
1121         state = alloc_extra_state_range_list(rl);
1122         set_state(SMATCH_EXTRA, fullname, sym, state);
1123 }
1124
1125 void register_smatch_extra(int id)
1126 {
1127         my_id = id;
1128         add_merge_hook(my_id, &merge_func);
1129         add_unmatched_state_hook(my_id, &unmatched_state);
1130         add_hook(&unop_expr, OP_HOOK);
1131         add_hook(&match_function_def, FUNC_DEF_HOOK);
1132         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
1133         add_hook(&match_assign, ASSIGNMENT_HOOK);
1134         add_hook(&match_declarations, DECLARATION_HOOK);
1135         if (option_info) {
1136                 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1137                 add_member_info_callback(my_id, struct_member_callback);
1138         }
1139         add_definition_db_callback(set_param_value, PARAM_VALUE);
1140 }
1141
1142 void register_smatch_extra_late(int id)
1143 {
1144         set_default_modification_hook(SMATCH_EXTRA, reset_struct_members);
1145 }