4 * Copyright (C) 2006 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
20 #include "expression.h"
26 unsigned long long uvalue
;
34 #define STATE(_x) static struct smatch_state _x = { .name = #_x }
35 extern struct smatch_state undefined
;
36 extern struct smatch_state merged
;
37 extern struct smatch_state true_state
;
38 extern struct smatch_state false_state
;
39 DECLARE_ALLOCATOR(smatch_state
);
41 static inline void *INT_PTR(int i
)
43 return (void *)(long)i
;
46 static inline int PTR_INT(void *p
)
53 unsigned short merged
:1;
54 unsigned short implied
:1;
55 unsigned int nr_children
;
59 struct smatch_state
*state
;
60 struct state_list
*pool
;
61 struct sm_state
*left
;
62 struct sm_state
*right
;
63 struct state_list
*possible
;
70 DECLARE_ALLOCATOR(var_sym
);
71 DECLARE_PTR_LIST(var_sym_list
, struct var_sym
);
78 DECLARE_ALLOCATOR(tracker
);
79 DECLARE_PTR_LIST(tracker_list
, struct tracker
);
89 GLOBAL_ASSIGNMENT_HOOK
,
96 CALL_HOOK_AFTER_INLINE
,
98 MACRO_ASSIGNMENT_HOOK
,
122 void add_hook(void *func
, enum hook_type type
);
123 typedef struct smatch_state
*(merge_func_t
)(struct smatch_state
*s1
, struct smatch_state
*s2
);
124 typedef struct smatch_state
*(unmatched_func_t
)(struct sm_state
*state
);
125 void add_merge_hook(int client_id
, merge_func_t
*func
);
126 void add_unmatched_state_hook(int client_id
, unmatched_func_t
*func
);
127 typedef void (scope_hook
)(void *data
);
128 void add_scope_hook(scope_hook
*hook
, void *data
);
129 typedef void (func_hook
)(const char *fn
, struct expression
*expr
, void *data
);
130 typedef void (implication_hook
)(const char *fn
, struct expression
*call_expr
,
131 struct expression
*assign_expr
, void *data
);
132 typedef void (return_implies_hook
)(struct expression
*call_expr
,
133 int param
, char *key
, char *value
);
134 typedef int (implied_return_hook
)(struct expression
*call_expr
, void *info
, struct range_list
**rl
);
135 void add_function_hook(const char *look_for
, func_hook
*call_back
, void *data
);
137 void add_function_assign_hook(const char *look_for
, func_hook
*call_back
,
139 void add_implied_return_hook(const char *look_for
,
140 implied_return_hook
*call_back
,
142 void add_macro_assign_hook(const char *look_for
, func_hook
*call_back
,
144 void add_macro_assign_hook_extra(const char *look_for
, func_hook
*call_back
,
146 void return_implies_state(const char *look_for
, long long start
, long long end
,
147 implication_hook
*call_back
, void *info
);
148 void select_return_states_hook(int type
, return_implies_hook
*callback
);
149 void select_return_states_before(void (*fn
)(void));
150 void select_return_states_after(void (*fn
)(void));
151 int get_implied_return(struct expression
*expr
, struct range_list
**rl
);
153 typedef void (modification_hook
)(struct sm_state
*sm
, struct expression
*mod_expr
);
154 void add_modification_hook(int owner
, modification_hook
*call_back
);
155 void add_indirect_modification_hook(int owner
, modification_hook
*call_back
);
157 int outside_of_function(void);
158 const char *get_filename(void);
159 const char *get_base_file(void);
160 char *get_function(void);
161 int get_lineno(void);
162 extern int final_pass
;
163 extern struct symbol
*cur_func_sym
;
164 extern int option_debug
;
165 extern int local_debug
;
167 extern FILE *sm_outfd
;
168 #define sm_printf(msg...) do { if (final_pass || option_debug) fprintf(sm_outfd, msg); } while (0)
170 static inline void sm_prefix(void)
172 sm_printf("%s:%d %s() ", get_filename(), get_lineno(), get_function());
175 static inline void print_implied_debug_msg();
177 #define sm_msg(msg...) \
179 print_implied_debug_msg(); \
180 if (!option_debug && !final_pass) \
187 #define local_debug(msg...) \
193 extern char *implied_debug_msg
;
194 static inline void print_implied_debug_msg()
196 static struct symbol
*last_printed
= NULL
;
198 if (!implied_debug_msg
)
200 if (last_printed
== cur_func_sym
)
202 last_printed
= cur_func_sym
;
203 sm_msg("%s", implied_debug_msg
);
206 #define sm_debug(msg...) do { if (option_debug) sm_printf(msg); } while (0)
208 #define sm_info(msg...) do { \
209 if (option_debug || (option_info && final_pass)) { \
211 sm_printf("info: "); \
217 struct smatch_state
*get_state(int owner
, const char *name
, struct symbol
*sym
);
218 struct smatch_state
*get_state_expr(int owner
, struct expression
*expr
);
219 struct state_list
*get_possible_states(int owner
, const char *name
,
221 struct state_list
*get_possible_states_expr(int owner
, struct expression
*expr
);
222 struct sm_state
*set_state(int owner
, const char *name
, struct symbol
*sym
,
223 struct smatch_state
*state
);
224 struct sm_state
*set_state_expr(int owner
, struct expression
*expr
,
225 struct smatch_state
*state
);
226 void delete_state(int owner
, const char *name
, struct symbol
*sym
);
227 void delete_state_expr(int owner
, struct expression
*expr
);
228 void set_true_false_states(int owner
, const char *name
, struct symbol
*sym
,
229 struct smatch_state
*true_state
,
230 struct smatch_state
*false_state
);
231 void set_true_false_states_expr(int owner
, struct expression
*expr
,
232 struct smatch_state
*true_state
,
233 struct smatch_state
*false_state
);
235 struct state_list
*get_all_states_slist(int owner
, struct state_list
*source
);
236 struct state_list
*get_all_states(int id
);
237 int is_reachable(void);
239 /* smatch_helper.c */
240 char *alloc_string(const char *str
);
241 void free_string(char *str
);
242 void append(char *dest
, const char *data
, int buff_len
);
243 void remove_parens(char *str
);
244 struct smatch_state
*alloc_state_num(int num
);
245 struct expression
*get_argument_from_call_expr(struct expression_list
*args
,
248 char *expr_to_var(struct expression
*expr
);
249 char *expr_to_str(struct expression
*expr
);
250 char *expr_to_str_sym(struct expression
*expr
,
251 struct symbol
**sym_ptr
);
252 char *expr_to_var_sym(struct expression
*expr
,
253 struct symbol
**sym_ptr
);
255 int sym_name_is(const char *name
, struct expression
*expr
);
256 int get_const_value(struct expression
*expr
, sval_t
*sval
);
257 int get_value(struct expression
*expr
, sval_t
*val
);
258 int get_implied_value(struct expression
*expr
, sval_t
*val
);
259 int get_implied_min(struct expression
*expr
, sval_t
*sval
);
260 int get_implied_max(struct expression
*expr
, sval_t
*val
);
261 int get_hard_max(struct expression
*expr
, sval_t
*sval
);
262 int get_fuzzy_min(struct expression
*expr
, sval_t
*min
);
263 int get_fuzzy_max(struct expression
*expr
, sval_t
*max
);
264 int get_absolute_min(struct expression
*expr
, sval_t
*sval
);
265 int get_absolute_max(struct expression
*expr
, sval_t
*sval
);
266 int parse_call_math(struct expression
*expr
, char *math
, sval_t
*val
);
267 int is_zero(struct expression
*expr
);
268 int known_condition_true(struct expression
*expr
);
269 int known_condition_false(struct expression
*expr
);
270 int implied_condition_true(struct expression
*expr
);
271 int implied_condition_false(struct expression
*expr
);
273 int is_array(struct expression
*expr
);
274 struct expression
*get_array_name(struct expression
*expr
);
275 struct expression
*get_array_offset(struct expression
*expr
);
276 const char *show_state(struct smatch_state
*state
);
277 struct statement
*get_expression_statement(struct expression
*expr
);
278 struct expression
*strip_parens(struct expression
*expr
);
279 struct expression
*strip_expr(struct expression
*expr
);
280 void scoped_state(int my_id
, const char *name
, struct symbol
*sym
);
281 int is_error_return(struct expression
*expr
);
282 int getting_address(void);
283 char *get_member_name(struct expression
*expr
);
284 char *get_fnptr_name(struct expression
*expr
);
285 int positions_eq(struct position pos1
, struct position pos2
);
286 struct statement
*get_current_statement(void);
287 int get_param_num_from_sym(struct symbol
*sym
);
288 int ms_since(struct timeval
*start
);
291 struct symbol
*get_real_base_type(struct symbol
*sym
);
292 int type_bits(struct symbol
*type
);
293 int type_positive_bits(struct symbol
*type
);
294 struct symbol
*get_pointer_type(struct expression
*expr
);
295 struct symbol
*get_type(struct expression
*expr
);
296 int type_unsigned(struct symbol
*base_type
);
297 int type_signed(struct symbol
*base_type
);
298 int expr_unsigned(struct expression
*expr
);
299 int returns_unsigned(struct symbol
*base_type
);
300 int is_pointer(struct expression
*expr
);
301 int returns_pointer(struct symbol
*base_type
);
302 sval_t
sval_type_max(struct symbol
*base_type
);
303 sval_t
sval_type_min(struct symbol
*base_type
);
304 int nr_bits(struct expression
*expr
);
305 int is_void_pointer(struct expression
*expr
);
306 int is_char_pointer(struct expression
*expr
);
307 int is_static(struct expression
*expr
);
308 int types_equiv(struct symbol
*one
, struct symbol
*two
);
310 const char *global_static();
311 struct symbol
*cur_func_return_type(void);
312 struct symbol
*get_arg_type(struct expression
*fn
, int arg
);
313 struct symbol
*get_member_type_from_key(struct expression
*expr
, char *key
);
315 /* smatch_ignore.c */
316 void add_ignore(int owner
, const char *name
, struct symbol
*sym
);
317 int is_ignored(int owner
, const char *name
, struct symbol
*sym
);
320 struct var_sym
*alloc_var_sym(const char *var
, struct symbol
*sym
);
321 struct var_sym_list
*expr_to_vsl(struct expression
*expr
);
322 void add_var_sym(struct var_sym_list
**list
, const char *var
, struct symbol
*sym
);
323 void add_var_sym_expr(struct var_sym_list
**list
, struct expression
*expr
);
324 void del_var_sym(struct var_sym_list
**list
, const char *var
, struct symbol
*sym
);
325 int in_var_sym_list(struct var_sym_list
*list
, const char *var
, struct symbol
*sym
);
326 struct var_sym_list
*clone_var_sym_list(struct var_sym_list
*from_vsl
);
327 void merge_var_sym_list(struct var_sym_list
**dest
, struct var_sym_list
*src
);
328 struct var_sym_list
*combine_var_sym_lists(struct var_sym_list
*one
, struct var_sym_list
*two
);
329 void free_var_sym_list(struct var_sym_list
**list
);
330 void free_var_syms_and_list(struct var_sym_list
**list
);
333 struct tracker
*alloc_tracker(int owner
, const char *name
, struct symbol
*sym
);
334 void add_tracker(struct tracker_list
**list
, int owner
, const char *name
,
336 void add_tracker_expr(struct tracker_list
**list
, int owner
, struct expression
*expr
);
337 void del_tracker(struct tracker_list
**list
, int owner
, const char *name
,
339 int in_tracker_list(struct tracker_list
*list
, int owner
, const char *name
,
341 void free_tracker_list(struct tracker_list
**list
);
342 void free_trackers_and_list(struct tracker_list
**list
);
344 /* smatch_conditions */
345 int in_condition(void);
349 void smatch (int argc
, char **argv
);
350 int inside_loop(void);
351 struct expression
*get_switch_expr(void);
352 int in_expression_statement(void);
353 void __process_post_op_stack(void);
354 void __split_expr(struct expression
*expr
);
355 void __split_stmt(struct statement
*stmt
);
356 extern int option_assume_loops
;
357 extern int option_known_conditions
;
358 extern int option_two_passes
;
359 extern int option_no_db
;
360 extern int option_file_output
;
361 extern int option_time
;
362 extern struct expression_list
*big_expression_stack
;
363 extern struct statement_list
*big_statement_stack
;
364 int inlinable(struct expression
*expr
);
365 extern int __inline_call
;
366 extern struct expression
*__inline_fn
;
367 extern int __in_pre_condition
;
368 extern int __bail_on_rest_of_function
;
370 /* smatch_conditions */
371 void __split_whole_condition(struct expression
*expr
);
372 void __handle_logic(struct expression
*expr
);
373 int is_condition(struct expression
*expr
);
374 int __handle_condition_assigns(struct expression
*expr
);
375 int __handle_select_assigns(struct expression
*expr
);
376 int __handle_expr_statement_assigns(struct expression
*expr
);
378 /* smatch_implied.c */
379 extern int option_debug_implied
;
380 extern int option_debug_related
;
381 extern int option_no_implied
;
382 struct range_list_stack
;
383 struct state_list
*__implied_case_slist(struct expression
*switch_expr
,
384 struct expression
*case_expr
,
385 struct range_list_stack
**remaining_cases
,
386 struct state_list
**raw_slist
);
387 struct range_list
*__get_implied_values(struct expression
*switch_expr
);
388 void overwrite_states_using_pool(struct sm_state
*sm
);
390 /* smatch_extras.c */
391 #define SMATCH_EXTRA 1 /* this is my_id from smatch extra set in smatch.c */
398 static const long long valid_ptr_max
= LONG_MAX
;
399 static const long long valid_ptr_min
= 4096;
400 static const sval_t valid_ptr_max_sval
= {
404 static const sval_t valid_ptr_min_sval
= {
409 /* smatch_absolute.c */
410 int get_absolute_min_helper(struct expression
*expr
, sval_t
*sval
);
411 int get_absolute_max_helper(struct expression
*expr
, sval_t
*sval
);
413 /* smatch_local_values.c */
414 int get_local_rl(struct expression
*expr
, struct range_list
**rl
);
415 int get_local_max_helper(struct expression
*expr
, sval_t
*sval
);
416 int get_local_min_helper(struct expression
*expr
, sval_t
*sval
);
418 /* smatch_states.c */
419 void __push_fake_cur_slist();
420 struct state_list
*__pop_fake_cur_slist();
421 void __free_fake_cur_slist();
422 void __set_fake_cur_slist_fast(struct state_list
*slist
);
423 void __pop_fake_cur_slist_fast(void);
424 void __merge_slist_into_cur(struct state_list
*slist
);
426 int unreachable(void);
427 void __set_sm(struct sm_state
*sm
);
428 struct state_list
*__get_cur_slist(void);
429 void __set_true_false_sm(struct sm_state
*true_state
,
430 struct sm_state
*false_state
);
431 void nullify_path(void);
432 void __match_nullify_path_hook(const char *fn
, struct expression
*expr
,
434 void __unnullify_path(void);
435 int __path_is_null(void);
436 void save_all_states(void);
437 void nullify_all_states(void);
438 void restore_all_states(void);
439 void clear_all_states(void);
441 struct sm_state
*get_sm_state(int owner
, const char *name
,
443 struct sm_state
*get_sm_state_expr(int owner
, struct expression
*expr
);
444 void __push_true_states(void);
445 void __use_false_states(void);
446 void __discard_false_states(void);
447 void __merge_false_states(void);
448 void __merge_true_states(void);
450 void __negate_cond_stacks(void);
451 void __use_pre_cond_states(void);
452 void __use_cond_true_states(void);
453 void __use_cond_false_states(void);
454 void __push_cond_stacks(void);
455 struct state_list
*__copy_cond_true_states(void);
456 struct state_list
*__copy_cond_false_states(void);
457 struct state_list
*__pop_cond_true_stack(void);
458 struct state_list
*__pop_cond_false_stack(void);
459 void __and_cond_states(void);
460 void __or_cond_states(void);
461 void __save_pre_cond_states(void);
462 void __discard_pre_cond_states(void);
463 void __use_cond_states(void);
464 extern struct state_list
*__last_base_slist
;
466 void __warn_on_silly_pre_loops(void);
468 void __push_continues(void);
469 void __discard_continues(void);
470 void __process_continues(void);
471 void __merge_continues(void);
473 void __push_breaks(void);
474 void __process_breaks(void);
475 int __has_breaks(void);
476 void __merge_breaks(void);
477 void __use_breaks(void);
479 void __save_switch_states(struct expression
*switch_expr
);
480 void __discard_switches(void);
481 void __merge_switches(struct expression
*switch_expr
, struct expression
*case_expr
);
482 void __push_default(void);
483 void __set_default(void);
484 int __pop_default(void);
486 void __push_conditions(void);
487 void __discard_conditions(void);
489 void __save_gotos(const char *name
);
490 void __merge_gotos(const char *name
);
492 void __print_cur_slist(void);
495 void __pass_to_client(void *data
, enum hook_type type
);
496 void __pass_to_client_no_data(enum hook_type type
);
497 void __pass_case_to_client(struct expression
*switch_expr
,
498 struct expression
*case_expr
);
499 int __has_merge_function(int client_id
);
500 struct smatch_state
*__client_merge_function(int owner
,
501 struct smatch_state
*s1
,
502 struct smatch_state
*s2
);
503 struct smatch_state
*__client_unmatched_state_function(struct sm_state
*sm
);
504 void __push_scope_hooks(void);
505 void __call_scope_hooks(void);
507 /* smatch_function_hooks.c */
508 void create_function_hook_hash(void);
509 void __match_initializer_call(struct symbol
*sym
);
523 ABSOLUTE_LIMITS
= 10,
530 void debug_sql(const char *sql
);
531 void select_caller_info_hook(void (*callback
)(const char *name
, struct symbol
*sym
, char *key
, char *value
), int type
);
532 void add_member_info_callback(int owner
, void (*callback
)(struct expression
*call
, int param
, char *printed_name
, struct smatch_state
*state
));
533 void add_split_return_callback(void (*fn
)(int return_id
, char *return_ranges
, struct expression
*returned_expr
));
534 void add_returned_member_callback(int owner
, void (*callback
)(int return_id
, char *return_ranges
, char *printed_name
, struct smatch_state
*state
));
535 void select_call_implies_hook(int type
, void (*callback
)(struct expression
*arg
, char *value
));
536 struct range_list
*db_return_vals(struct expression
*expr
);
537 char *return_state_to_var_sym(struct expression
*expr
, int param
, char *key
, struct symbol
**sym
);
538 char *get_variable_from_key(struct expression
*arg
, char *key
, struct symbol
**sym
);
539 const char *get_param_name(struct sm_state
*sm
);
541 #define run_sql(call_back, sql...) \
543 char sql_txt[1024]; \
546 snprintf(sql_txt, 1024, sql); \
547 debug_sql(sql_txt); \
548 sql_exec(call_back, sql_txt); \
551 /* like run_sql() but for the in-memory database */
552 #define mem_sql(call_back, sql...) \
554 char sql_txt[1024]; \
556 snprintf(sql_txt, sizeof(sql_txt), sql); \
557 sm_debug("in-mem: %s\n", sql_txt); \
558 sql_mem_exec(call_back, sql_txt); \
561 void sql_insert_return_states(int return_id
, const char *return_ranges
,
562 int type
, int param
, const char *key
, const char *value
);
563 void sql_insert_caller_info(struct expression
*call
, int type
, int param
,
564 const char *key
, const char *value
);
565 void sql_insert_function_ptr(const char *fn
, const char *struct_name
);
566 void sql_insert_return_values(const char *return_values
);
567 void sql_insert_call_implies(int type
, int param
, int value
);
568 void sql_insert_type_size(const char *member
, int size
);
569 void sql_insert_local_values(const char *name
, const char *value
);
571 void sql_select_return_states(const char *cols
, struct expression
*call
,
572 int (*callback
)(void*, int, char**, char**));
573 void sql_select_caller_info(const char *cols
, struct symbol
*sym
,
574 int (*callback
)(void*, int, char**, char**));
575 void sql_select_call_implies(const char *cols
, struct expression
*call
,
576 int (*callback
)(void*, int, char**, char**));
578 void sql_exec(int (*callback
)(void*, int, char**, char**), const char *sql
);
579 void sql_mem_exec(int (*callback
)(void*, int, char**, char**), const char *sql
);
581 void open_smatch_db(void);
584 int open_data_file(const char *filename
);
585 struct token
*get_tokens_file(const char *filename
);
588 extern char *option_debug_check
;
589 extern char *option_project_str
;
590 extern char *data_dir
;
591 extern int option_no_data
;
592 extern int option_spammy
;
593 extern int option_full_path
;
594 extern int option_param_mapper
;
595 extern int option_info
;
596 extern int option_call_tree
;
597 extern int num_checks
;
604 extern enum project_type option_project
;
605 const char *check_name(unsigned short id
);
608 /* smatch_buf_size.c */
609 int get_array_size(struct expression
*expr
);
610 int get_array_size_bytes(struct expression
*expr
);
611 int get_array_size_bytes_min(struct expression
*expr
);
612 int get_real_array_size(struct expression
*expr
);
614 /* smatch_capped.c */
615 int is_capped(struct expression
*expr
);
616 int is_capped_var_sym(const char *name
, struct symbol
*sym
);
618 /* check_user_data.c */
619 int is_user_macro(struct expression
*expr
);
620 int is_user_data(struct expression
*expr
);
621 int is_capped_user_data(struct expression
*expr
);
623 /* check_locking.c */
624 void print_held_locks();
626 /* check_assigned_expr.c */
627 struct expression
*get_assigned_expr(struct expression
*expr
);
629 /* smatch_comparison.c */
630 int get_comparison(struct expression
*left
, struct expression
*right
);
631 void __add_comparison_info(struct expression
*expr
, struct expression
*call
, const char *range
);
632 char *expr_equal_to_param(struct expression
*expr
);
633 char *expr_lte_to_param(struct expression
*expr
);
636 sval_t
*sval_alloc(sval_t sval
);
637 sval_t
*sval_alloc_permanent(sval_t sval
);
638 sval_t
sval_blank(struct expression
*expr
);
639 sval_t
sval_type_val(struct symbol
*type
, long long val
);
640 sval_t
sval_from_val(struct expression
*expr
, long long val
);
641 int sval_unsigned(sval_t sval
);
642 int sval_signed(sval_t sval
);
643 int sval_bits(sval_t sval
);
644 int sval_positive_bits(sval_t sval
);
645 int sval_bits_used(sval_t sval
);
646 int sval_is_negative(sval_t sval
);
647 int sval_is_positive(sval_t sval
);
648 int sval_is_min(sval_t sval
);
649 int sval_is_max(sval_t sval
);
650 int sval_is_a_min(sval_t sval
);
651 int sval_is_a_max(sval_t sval
);
652 int sval_is_negative_min(sval_t sval
);
653 int sval_cmp(sval_t one
, sval_t two
);
654 int sval_cmp_t(struct symbol
*type
, sval_t one
, sval_t two
);
655 int sval_cmp_val(sval_t one
, long long val
);
656 sval_t
sval_min(sval_t one
, sval_t two
);
657 sval_t
sval_max(sval_t one
, sval_t two
);
658 int sval_too_low(struct symbol
*type
, sval_t sval
);
659 int sval_too_high(struct symbol
*type
, sval_t sval
);
660 int sval_fits(struct symbol
*type
, sval_t sval
);
661 sval_t
sval_cast(struct symbol
*type
, sval_t sval
);
662 sval_t
sval_preop(sval_t sval
, int op
);
663 sval_t
sval_binop(sval_t left
, int op
, sval_t right
);
664 int sval_binop_overflows(sval_t left
, int op
, sval_t right
);
665 const char *sval_to_str(sval_t sval
);
666 const char *sval_to_numstr(sval_t sval
);
667 sval_t
ll_to_sval(long long val
);
669 /* smatch_string_list.c */
670 int list_has_string(struct string_list
*str_list
, char *str
);
671 void insert_string(struct string_list
**str_list
, char *str
);
672 struct string_list
*clone_str_list(struct string_list
*orig
);
673 struct string_list
*combine_string_lists(struct string_list
*one
, struct string_list
*two
);
675 /* smatch_clear_buffer.c */
676 int is_uninitialized(struct expression
*expr
);
677 int has_uninitialized_members(struct expression
*expr
);
679 /* smatch_start_states.c */
680 struct state_list
*get_start_states(void);
682 /* smatch_recurse.c */
683 int has_symbol(struct expression
*expr
, struct symbol
*sym
);
684 int has_variable(struct expression
*expr
, struct expression
*var
);
686 #endif /* !SMATCH_H_ */