smatch_extra.c

   1 /*
   2  * sparse/smatch_extra.c
   3  *
   4  * Copyright (C) 2008 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * smatch_extra.c is supposed to track the value of every variable.
  12  *
  13  */
  14
  15 #include <stdlib.h>
  16 #include <errno.h>
  17 #ifndef __USE_ISOC99
  18 #define __USE_ISOC99
  19 #endif
  20 #include <limits.h>
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24 #include "smatch_extra.h"
  25
  26 static int my_id;
  27
  28 struct string_list *__ignored_macros = NULL;
  29 static int in_warn_on_macro()
  30 {
  31         struct statement *stmt;
  32         char *tmp;
  33         char *macro;
  34
  35         stmt = last_ptr_list((struct ptr_list *)big_statement_stack);
  36         macro = get_macro_name(&stmt->pos);
  37         if (!macro)
  38                 return 0;
  39
  40         FOR_EACH_PTR(__ignored_macros, tmp) {
  41                 if (!strcmp(tmp, macro))
  42                         return 1;
  43         } END_FOR_EACH_PTR(tmp);
  44         return 0;
  45 }
  46
  47 struct sm_state *set_extra_mod(const char *name, struct symbol *sym, struct smatch_state *state)
  48 {
  49         if (in_warn_on_macro())
  50                 return NULL;
  51         remove_from_equiv(name, sym);
  52         return set_state(SMATCH_EXTRA, name, sym, state);
  53 }
  54
  55 struct sm_state *set_extra_expr_mod(struct expression *expr, struct smatch_state *state)
  56 {
  57         if (in_warn_on_macro())
  58                 return NULL;
  59         remove_from_equiv_expr(expr);
  60         return set_state_expr(SMATCH_EXTRA, expr, state);
  61 }
  62
  63 /*
  64  * This is for return_implies_state() hooks which modify a SMATCH_EXTRA state
  65  */
  66 void set_extra_expr_nomod(struct expression *expr, struct smatch_state *state)
  67 {
  68         struct relation *rel;
  69         struct smatch_state *orig_state;
  70
  71         orig_state = get_state_expr(SMATCH_EXTRA, expr);
  72
  73         if (!orig_state || !get_dinfo(orig_state)->related) {
  74                 set_state_expr(SMATCH_EXTRA, expr, state);
  75                 return;
  76         }
  77
  78         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
  79                 sm_msg("setting %s to %s", rel->name, state->name);
  80                 set_state(SMATCH_EXTRA, rel->name, rel->sym, state);
  81                 add_equiv(state, rel->name, rel->sym);
  82         } END_FOR_EACH_PTR(rel);
  83 }
  84
  85 void set_extra_true_false(const char *name, struct symbol *sym,
  86                         struct smatch_state *true_state,
  87                         struct smatch_state *false_state)
  88 {
  89         struct relation *rel;
  90         struct smatch_state *orig_state;
  91
  92         if (in_warn_on_macro())
  93                 return;
  94
  95         orig_state = get_state(SMATCH_EXTRA, name, sym);
  96
  97         if (!orig_state || !get_dinfo(orig_state)->related) {
  98                 set_true_false_states(SMATCH_EXTRA, name, sym, true_state, false_state);
  99                 return;
 100         }
 101
 102         // FIXME!!!!  equiv => related
 103         FOR_EACH_PTR(get_dinfo(orig_state)->related, rel) {
 104                 set_true_false_states(SMATCH_EXTRA, rel->name, rel->sym,
 105                                 true_state, false_state);
 106                 if (true_state)
 107                         add_equiv(true_state, rel->name, rel->sym);
 108                 if (false_state)
 109                         add_equiv(false_state, rel->name, rel->sym);
 110         } END_FOR_EACH_PTR(rel);
 111 }
 112
 113 struct data_info *get_dinfo(struct smatch_state *state)
 114 {
 115         if (!state)
 116                 return NULL;
 117         return (struct data_info *)state->data;
 118
 119 }
 120
 121 struct smatch_state *filter_range(struct smatch_state *orig,
 122                                  long long filter_min, long long filter_max)
 123 {
 124         struct smatch_state *ret;
 125         struct data_info *orig_info;
 126         struct data_info *ret_info;
 127
 128         if (!orig)
 129                 orig = extra_undefined();
 130         orig_info = get_dinfo(orig);
 131         ret = alloc_extra_state_empty();
 132         ret_info = get_dinfo(ret);
 133         ret_info->value_ranges = remove_range(orig_info->value_ranges, filter_min, filter_max);
 134         ret->name = show_ranges(ret_info->value_ranges);
 135         return ret;
 136 }
 137
 138 struct smatch_state *add_filter(struct smatch_state *orig, long long num)
 139 {
 140         return filter_range(orig, num, num);
 141 }
 142
 143 static struct smatch_state *merge_func(const char *name, struct symbol *sym,
 144                                        struct smatch_state *s1,
 145                                        struct smatch_state *s2)
 146 {
 147         struct data_info *info1 = get_dinfo(s1);
 148         struct data_info *info2 = get_dinfo(s2);
 149         struct data_info *ret_info;
 150         struct smatch_state *tmp;
 151         struct range_list *value_ranges;
 152         struct relation *rel;
 153         struct relation *new;
 154
 155         value_ranges = range_list_union(info1->value_ranges, info2->value_ranges);
 156         tmp = alloc_extra_state_empty();
 157         ret_info = get_dinfo(tmp);
 158         ret_info->value_ranges = value_ranges;
 159         tmp->name = show_ranges(ret_info->value_ranges);
 160         FOR_EACH_PTR(info1->related, rel) {
 161                 new = get_common_relationship(info2, rel->op, rel->name, rel->sym);
 162                 if (new)
 163                         add_related(tmp, new->op, new->name, new->sym);
 164         } END_FOR_EACH_PTR(rel);
 165         return tmp;
 166 }
 167
 168 static struct sm_state *handle_canonical_while_count_down(struct statement *loop)
 169 {
 170         struct expression *iter_var;
 171         struct expression *condition;
 172         struct sm_state *sm;
 173         long long start;
 174
 175         condition = strip_expr(loop->iterator_pre_condition);
 176         if (!condition)
 177                 return NULL;
 178         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 179                 return NULL;
 180         if (condition->op != SPECIAL_DECREMENT)
 181                 return NULL;
 182
 183         iter_var = condition->unop;
 184         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 185         if (!sm)
 186                 return NULL;
 187         if (get_dinfo_min(get_dinfo(sm->state)) < 0)
 188                 return NULL;
 189         start = get_dinfo_max(get_dinfo(sm->state));
 190         if  (start <= 0)
 191                 return NULL;
 192         if (start != whole_range.max)
 193                 start--;
 194
 195         if (condition->type == EXPR_PREOP)
 196                 set_extra_expr_mod(iter_var, alloc_extra_state_range(1, start));
 197         if (condition->type == EXPR_POSTOP)
 198                 set_extra_expr_mod(iter_var, alloc_extra_state_range(0, start));
 199         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 200 }
 201
 202 static struct sm_state *handle_canonical_for_inc(struct expression *iter_expr,
 203                                                 struct expression *condition)
 204 {
 205         struct expression *iter_var;
 206         struct sm_state *sm;
 207         long long start;
 208         long long end;
 209
 210         iter_var = iter_expr->unop;
 211         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 212         if (!sm)
 213                 return NULL;
 214         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 215                 return NULL;
 216         if (!get_implied_value(condition->right, &end))
 217                 end = whole_range.max;
 218         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 219                 return NULL;
 220
 221         switch (condition->op) {
 222         case SPECIAL_NOTEQUAL:
 223         case '<':
 224                 if (end != whole_range.max)
 225                         end--;
 226                 break;
 227         case SPECIAL_LTE:
 228                 break;
 229         default:
 230                 return NULL;
 231         }
 232         if (end < start)
 233                 return NULL;
 234         set_extra_expr_mod(iter_var, alloc_extra_state_range(start, end));
 235         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 236 }
 237
 238 static struct sm_state *handle_canonical_for_dec(struct expression *iter_expr,
 239                                                 struct expression *condition)
 240 {
 241         struct expression *iter_var;
 242         struct sm_state *sm;
 243         long long start;
 244         long long end;
 245
 246         iter_var = iter_expr->unop;
 247         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 248         if (!sm)
 249                 return NULL;
 250         if (!get_single_value_from_dinfo(get_dinfo(sm->state), &start))
 251                 return NULL;
 252         if (!get_implied_value(condition->right, &end))
 253                 end = whole_range.max;
 254         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 255                 return NULL;
 256
 257         switch (condition->op) {
 258         case SPECIAL_NOTEQUAL:
 259         case '>':
 260                 if (end != whole_range.min)
 261                         end++;
 262                 break;
 263         case SPECIAL_GTE:
 264                 break;
 265         default:
 266                 return NULL;
 267         }
 268         if (end > start)
 269                 return NULL;
 270         set_extra_expr_mod(iter_var, alloc_extra_state_range(end, start));
 271         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 272 }
 273
 274 static struct sm_state *handle_canonical_for_loops(struct statement *loop)
 275 {
 276         struct expression *iter_expr;
 277         struct expression *condition;
 278
 279         if (!loop->iterator_post_statement)
 280                 return NULL;
 281         if (loop->iterator_post_statement->type != STMT_EXPRESSION)
 282                 return NULL;
 283         iter_expr = loop->iterator_post_statement->expression;
 284         if (!loop->iterator_pre_condition)
 285                 return NULL;
 286         if (loop->iterator_pre_condition->type != EXPR_COMPARE)
 287                 return NULL;
 288         condition = loop->iterator_pre_condition;
 289
 290         if (iter_expr->op == SPECIAL_INCREMENT)
 291                 return handle_canonical_for_inc(iter_expr, condition);
 292         if (iter_expr->op == SPECIAL_DECREMENT)
 293                 return handle_canonical_for_dec(iter_expr, condition);
 294         return NULL;
 295 }
 296
 297 struct sm_state *__extra_handle_canonical_loops(struct statement *loop, struct state_list **slist)
 298 {
 299         struct sm_state *ret;
 300
 301         __push_fake_cur_slist();;
 302         if (!loop->iterator_post_statement)
 303                 ret = handle_canonical_while_count_down(loop);
 304         else
 305                 ret = handle_canonical_for_loops(loop);
 306         *slist = __pop_fake_cur_slist();
 307         return ret;
 308 }
 309
 310 int __iterator_unchanged(struct sm_state *sm)
 311 {
 312         if (!sm)
 313                 return 0;
 314         if (get_sm_state(my_id, sm->name, sm->sym) == sm)
 315                 return 1;
 316         return 0;
 317 }
 318
 319 static void while_count_down_after(struct sm_state *sm, struct expression *condition)
 320 {
 321         long long after_value;
 322
 323         /* paranoid checking.  prolly not needed */
 324         condition = strip_expr(condition);
 325         if (!condition)
 326                 return;
 327         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 328                 return;
 329         if (condition->op != SPECIAL_DECREMENT)
 330                 return;
 331         after_value = get_dinfo_min(get_dinfo(sm->state));
 332         after_value--;
 333         set_extra_mod(sm->name, sm->sym, alloc_extra_state(after_value));
 334 }
 335
 336 void __extra_pre_loop_hook_after(struct sm_state *sm,
 337                                 struct statement *iterator,
 338                                 struct expression *condition)
 339 {
 340         struct expression *iter_expr;
 341         char *name;
 342         struct symbol *sym;
 343         long long value;
 344         int left = 0;
 345         struct smatch_state *state;
 346         struct data_info *dinfo;
 347         long long min, max;
 348
 349         if (!iterator) {
 350                 while_count_down_after(sm, condition);
 351                 return;
 352         }
 353
 354         iter_expr = iterator->expression;
 355
 356         if (condition->type != EXPR_COMPARE)
 357                 return;
 358         if (!get_value(condition->left, &value)) {
 359                 if (!get_value(condition->right, &value))
 360                         return;
 361                 left = 1;
 362         }
 363         if (left)
 364                 name = get_variable_from_expr(condition->left, &sym);
 365         else
 366                 name = get_variable_from_expr(condition->right, &sym);
 367         if (!name || !sym)
 368                 goto free;
 369         if (sym != sm->sym || strcmp(name, sm->name))
 370                 goto free;
 371         state = get_state(my_id, name, sym);
 372         dinfo = get_dinfo(state);
 373         min = get_dinfo_min(dinfo);
 374         max = get_dinfo_max(dinfo);
 375         if (iter_expr->op == SPECIAL_INCREMENT &&
 376                 min != whole_range.min &&
 377                 max == whole_range.max) {
 378                 set_extra_mod(name, sym, alloc_extra_state(min));
 379         } else if (min == whole_range.min && max != whole_range.max) {
 380                 set_extra_mod(name, sym, alloc_extra_state(max));
 381         }
 382 free:
 383         free_string(name);
 384         return;
 385 }
 386
 387 static struct smatch_state *unmatched_state(struct sm_state *sm)
 388 {
 389         return extra_undefined();
 390 }
 391
 392 static void match_function_call(struct expression *expr)
 393 {
 394         struct expression *tmp;
 395
 396         FOR_EACH_PTR(expr->args, tmp) {
 397                 if (tmp->type == EXPR_PREOP && tmp->op == '&') {
 398                         remove_from_equiv_expr(tmp->unop);
 399                         set_state_expr(SMATCH_EXTRA, tmp->unop, extra_undefined());
 400                 }
 401         } END_FOR_EACH_PTR(tmp);
 402 }
 403
 404 static void set_equiv(struct sm_state *right_sm, struct expression *left)
 405 {
 406         struct smatch_state *state;
 407         struct data_info *dinfo;
 408         struct relation *rel;
 409         char *name;
 410         struct symbol *sym;
 411
 412         name = get_variable_from_expr(left, &sym);
 413         if (!name || !sym)
 414                 goto free;
 415
 416         remove_from_equiv(name, sym);
 417
 418         state = clone_extra_state(right_sm->state);
 419         dinfo = get_dinfo(state);
 420         if (!dinfo->related)
 421                 add_equiv(state, right_sm->name, right_sm->sym);
 422         add_equiv(state, name, sym);
 423
 424         FOR_EACH_PTR(dinfo->related, rel) {
 425                 struct sm_state *new_sm;
 426
 427                 new_sm = clone_sm(right_sm);
 428                 new_sm->name = rel->name;
 429                 new_sm->sym = rel->sym;
 430                 new_sm->state = state;
 431                 __set_sm(new_sm);
 432         } END_FOR_EACH_PTR(rel);
 433 free:
 434         free_string(name);
 435 }
 436
 437 static void match_assign(struct expression *expr)
 438 {
 439         struct expression *left;
 440         struct expression *right;
 441         struct sm_state *right_sm;
 442         struct symbol *sym;
 443         char *name;
 444         long long value;
 445         int known;
 446         long long min = whole_range.min;
 447         long long max = whole_range.max;
 448         long long tmp;
 449
 450         if (__is_condition_assign(expr))
 451                 return;
 452         left = strip_expr(expr->left);
 453         name = get_variable_from_expr(left, &sym);
 454         if (!name)
 455                 return;
 456         right = strip_expr(expr->right);
 457         while (right->type == EXPR_ASSIGNMENT && right->op == '=')
 458                 right = strip_expr(right->left);
 459
 460         right_sm = get_sm_state_expr(SMATCH_EXTRA, right);
 461         if (expr->op == '=' && right_sm) {
 462                 set_equiv(right_sm, left);
 463                 goto free;
 464         }
 465
 466         if (expr->op == '=') {
 467                 struct range_list *rl = NULL;
 468
 469                 if (get_implied_range_list(right, &rl)) {
 470                         set_extra_mod(name, sym, alloc_extra_state_range_list(rl));
 471                 } else {
 472                         struct symbol *type = get_type(right);
 473
 474                         if (type && type_unsigned(type))
 475                                 min = 0;
 476                         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 477                 }
 478                 goto free;
 479         }
 480
 481         known = get_implied_value(right, &value);
 482         if (expr->op == SPECIAL_ADD_ASSIGN) {
 483                 if (get_implied_min(left, &tmp)) {
 484                         if (known)
 485                                 min = tmp + value;
 486                         else
 487                                 min = tmp;
 488                 }
 489                 if (!inside_loop() && known && get_implied_max(left, &tmp))
 490                                 max = tmp + value;
 491         }
 492         if (expr->op == SPECIAL_SUB_ASSIGN) {
 493                 if (get_implied_max(left, &tmp)) {
 494                         if (known)
 495                                 max = tmp - value;
 496                         else
 497                                 max = tmp;
 498                 }
 499                 if (!inside_loop() && known && get_implied_min(left, &tmp))
 500                                 min = tmp - value;
 501         }
 502         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 503 free:
 504         free_string(name);
 505 }
 506
 507 static void unop_expr(struct expression *expr)
 508 {
 509         struct symbol *sym;
 510         char *name;
 511         long long min = whole_range.min;
 512         long long max = whole_range.max;
 513         long long val;
 514
 515         if (expr->op == '*')
 516                 return;
 517         if (expr->op == '(')
 518                 return;
 519         if (expr->op == '!')
 520                 return;
 521
 522         name = get_variable_from_expr(expr->unop, &sym);
 523         if (!name)
 524                 goto free;
 525         if (expr->op == SPECIAL_INCREMENT) {
 526                 if (get_implied_min(expr->unop, &val))
 527                         min = val + 1;
 528                 if (!inside_loop() && get_implied_max(expr->unop, &val))
 529                         max = val + 1;
 530         }
 531         if (expr->op == SPECIAL_DECREMENT) {
 532                 if (get_implied_max(expr->unop, &val))
 533                         max = val - 1;
 534                 if (!inside_loop() && get_implied_min(expr->unop, &val))
 535                         min = val - 1;
 536         }
 537         set_extra_mod(name, sym, alloc_extra_state_range(min, max));
 538 free:
 539         free_string(name);
 540 }
 541
 542 static void delete_state_tracker(struct tracker *t)
 543 {
 544         remove_from_equiv(t->name, t->sym);
 545         delete_state(t->owner, t->name, t->sym);
 546 }
 547
 548 static void scoped_state_extra(const char *name, struct symbol *sym)
 549 {
 550         struct tracker *t;
 551
 552         t = alloc_tracker(SMATCH_EXTRA, name, sym);
 553         add_scope_hook((scope_hook *)&delete_state_tracker, t);
 554 }
 555
 556 static void match_declarations(struct symbol *sym)
 557 {
 558         const char *name;
 559
 560         if (sym->ident) {
 561                 name = sym->ident->name;
 562                 if (!sym->initializer) {
 563                         set_state(SMATCH_EXTRA, name, sym, extra_undefined());
 564                         scoped_state_extra(name, sym);
 565                 }
 566         }
 567 }
 568
 569 static void match_function_def(struct symbol *sym)
 570 {
 571         struct symbol *arg;
 572
 573         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
 574                 if (!arg->ident) {
 575                         continue;
 576                 }
 577                 set_state(my_id, arg->ident->name, arg, extra_undefined());
 578         } END_FOR_EACH_PTR(arg);
 579 }
 580
 581 static int last_stmt_val(struct statement *stmt, long long *val)
 582 {
 583         struct expression *expr;
 584
 585         if (!stmt)
 586                 return 0;
 587
 588         stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 589         if (stmt->type != STMT_EXPRESSION)
 590                 return 0;
 591         expr = stmt->expression;
 592         return get_value(expr, val);
 593 }
 594
 595 static void match_comparison(struct expression *expr)
 596 {
 597         long long fixed;
 598         char *name = NULL;
 599         struct symbol *sym;
 600         struct smatch_state *true_state;
 601         struct smatch_state *false_state;
 602         struct smatch_state *orig;
 603         int left = 0;
 604         int comparison = expr->op;
 605         struct expression *varies;
 606
 607
 608         varies = strip_expr(expr->right);
 609         if (!get_implied_value(expr->left, &fixed)) {
 610                 if (!get_implied_value(expr->right, &fixed))
 611                         return;
 612                 varies = strip_expr(expr->left);
 613                 left = 1;
 614         }
 615
 616         if (varies->op == SPECIAL_INCREMENT || varies->op == SPECIAL_DECREMENT)
 617                 varies = varies->unop;
 618         if (varies->type == EXPR_CALL) {
 619                 function_comparison(comparison, varies, fixed, left);
 620                 return;
 621         }
 622
 623         name = get_variable_from_expr(varies, &sym);
 624         if (!name || !sym)
 625                 goto free;
 626
 627         orig = get_state(my_id, name, sym);
 628         if (!orig)
 629                 orig = extra_undefined();
 630
 631         switch (comparison) {
 632         case '<':
 633         case SPECIAL_UNSIGNED_LT:
 634                 if (left) {
 635                         true_state = filter_range(orig, fixed, whole_range.max);
 636                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 637                 } else {
 638                         true_state = filter_range(orig, whole_range.min, fixed);
 639                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 640                 }
 641                 break;
 642         case SPECIAL_UNSIGNED_LTE:
 643         case SPECIAL_LTE:
 644                 if (left) {
 645                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 646                         false_state = filter_range(orig, whole_range.min, fixed);
 647                 } else {
 648                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 649                         false_state = filter_range(orig, fixed, whole_range.max);
 650                 }
 651                 break;
 652         case SPECIAL_EQUAL:
 653                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 654                         true_state = alloc_extra_state(fixed);
 655                 else
 656                         true_state = alloc_extra_state_empty();
 657                 false_state = filter_range(orig, fixed, fixed);
 658                 break;
 659         case SPECIAL_UNSIGNED_GTE:
 660         case SPECIAL_GTE:
 661                 if (left) {
 662                         true_state = filter_range(orig, whole_range.min, fixed - 1);
 663                         false_state = filter_range(orig, fixed, whole_range.max);
 664                 } else {
 665                         true_state = filter_range(orig, fixed + 1, whole_range.max);
 666                         false_state = filter_range(orig, whole_range.min, fixed);
 667                 }
 668                 break;
 669         case '>':
 670         case SPECIAL_UNSIGNED_GT:
 671                 if (left) {
 672                         true_state = filter_range(orig, whole_range.min, fixed);
 673                         false_state = filter_range(orig, fixed + 1, whole_range.max);
 674                 } else {
 675                         true_state = filter_range(orig, fixed, whole_range.max);
 676                         false_state = filter_range(orig, whole_range.min, fixed - 1);
 677                 }
 678                 break;
 679         case SPECIAL_NOTEQUAL:
 680                 true_state = filter_range(orig, fixed, fixed);
 681                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(orig), fixed, fixed))
 682                         false_state = alloc_extra_state(fixed);
 683                 else
 684                         false_state = alloc_extra_state_empty();
 685                 break;
 686         default:
 687                 sm_msg("unhandled comparison %d\n", comparison);
 688                 goto free;
 689         }
 690         set_extra_true_false(name, sym, true_state, false_state);
 691 free:
 692         free_string(name);
 693 }
 694
 695 /* this is actually hooked from smatch_implied.c...  it's hacky, yes */
 696 void __extra_match_condition(struct expression *expr)
 697 {
 698         struct symbol *sym;
 699         char *name;
 700         struct smatch_state *pre_state;
 701         struct smatch_state *true_state;
 702         struct smatch_state *false_state;
 703
 704         expr = strip_expr(expr);
 705         switch (expr->type) {
 706         case EXPR_CALL:
 707                 function_comparison(SPECIAL_NOTEQUAL, expr, 0, 1);
 708                 return;
 709         case EXPR_PREOP:
 710         case EXPR_SYMBOL:
 711         case EXPR_DEREF:
 712                 name = get_variable_from_expr(expr, &sym);
 713                 if (!name)
 714                         return;
 715                 pre_state = get_state(my_id, name, sym);
 716                 true_state = add_filter(pre_state, 0);
 717                 if (possibly_true(SPECIAL_EQUAL, get_dinfo(pre_state), 0, 0))
 718                         false_state = alloc_extra_state(0);
 719                 else
 720                         false_state = alloc_extra_state_empty();
 721                 set_extra_true_false(name, sym, true_state, false_state);
 722                 free_string(name);
 723                 return;
 724         case EXPR_COMPARE:
 725                 match_comparison(expr);
 726                 return;
 727         case EXPR_ASSIGNMENT:
 728                 __extra_match_condition(expr->left);
 729                 return;
 730         }
 731 }
 732
 733 /* returns 1 if it is not possible for expr to be value, otherwise returns 0 */
 734 int implied_not_equal(struct expression *expr, long long val)
 735 {
 736         char *name;
 737         struct symbol *sym;
 738         struct smatch_state *state;
 739         long long expr_val;
 740         int ret = 0;
 741
 742         if (get_value(expr, &expr_val)) {
 743                 return expr_val != val;
 744         }
 745         name = get_variable_from_expr(expr, &sym);
 746         if (!name || !sym)
 747                 goto exit;
 748         state = get_state(my_id, name, sym);
 749         if (!state || !state->data)
 750                 goto exit;
 751         ret = !possibly_false(SPECIAL_NOTEQUAL, get_dinfo(state), val, 1);
 752 exit:
 753         free_string(name);
 754         return ret;
 755 }
 756
 757 int known_condition_true(struct expression *expr)
 758 {
 759         long long tmp;
 760         struct statement *stmt;
 761
 762         if (!expr)
 763                 return 0;
 764
 765         if (get_value(expr, &tmp) && tmp)
 766                 return 1;
 767
 768         expr = strip_expr(expr);
 769         switch (expr->type) {
 770         case EXPR_PREOP:
 771                 if (expr->op == '!') {
 772                         if (known_condition_false(expr->unop))
 773                                 return 1;
 774                         break;
 775                 }
 776                 stmt = get_expression_statement(expr);
 777                 if (last_stmt_val(stmt, &tmp) && tmp == 1)
 778                         return 1;
 779                 break;
 780         default:
 781                 break;
 782         }
 783         return 0;
 784 }
 785
 786 int known_condition_false(struct expression *expr)
 787 {
 788         long long tmp;
 789         struct statement *stmt;
 790
 791         if (!expr)
 792                 return 0;
 793
 794         if (is_zero(expr))
 795                 return 1;
 796
 797         switch (expr->type) {
 798         case EXPR_PREOP:
 799                 if (expr->op == '!') {
 800                         if (known_condition_true(expr->unop))
 801                                 return 1;
 802                         break;
 803                 }
 804                 stmt = get_expression_statement(expr);
 805                 if (last_stmt_val(stmt, &tmp) && tmp == 0)
 806                         return 1;
 807                 break;
 808         case EXPR_CALL:
 809                 if (sym_name_is("__builtin_constant_p", expr->fn))
 810                         return 1;
 811                 break;
 812         default:
 813                 break;
 814         }
 815         return 0;
 816 }
 817
 818 struct range_list *get_range_list(struct expression *expr)
 819 {
 820         long long min;
 821         long long max;
 822         struct range_list *ret = NULL;
 823         struct smatch_state *state;
 824
 825         state = get_state_expr(SMATCH_EXTRA, expr);
 826         if (state)
 827                 return clone_range_list(get_dinfo(state)->value_ranges);
 828         if (!get_absolute_min(expr, &min))
 829                 return NULL;
 830         if (!get_absolute_max(expr, &max))
 831                 return NULL;
 832         add_range(&ret, min, max);
 833         return ret;
 834 }
 835
 836 static int do_comparison(struct expression *expr)
 837 {
 838         struct range_list *left_ranges;
 839         struct range_list *right_ranges;
 840         int poss_true, poss_false;
 841
 842         left_ranges = get_range_list(expr->left);
 843         right_ranges = get_range_list(expr->right);
 844
 845         poss_true = possibly_true_range_lists(left_ranges, expr->op, right_ranges);
 846         poss_false = possibly_false_range_lists(left_ranges, expr->op, right_ranges);
 847
 848         free_range_list(&left_ranges);
 849         free_range_list(&right_ranges);
 850
 851         if (!poss_true && !poss_false)
 852                 return 0;
 853         if (poss_true && !poss_false)
 854                 return 1;
 855         if (!poss_true && poss_false)
 856                 return 2;
 857         return 3;
 858 }
 859
 860 int implied_condition_true(struct expression *expr)
 861 {
 862         struct statement *stmt;
 863         long long tmp;
 864         long long val;
 865
 866         if (!expr)
 867                 return 0;
 868
 869         if (get_implied_value(expr, &tmp) && tmp)
 870                 return 1;
 871
 872         if (expr->type == EXPR_POSTOP)
 873                 return implied_condition_true(expr->unop);
 874
 875         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_DECREMENT)
 876                 return implied_not_equal(expr->unop, 1);
 877         if (expr->type == EXPR_PREOP && expr->op == SPECIAL_INCREMENT)
 878                 return implied_not_equal(expr->unop, -1);
 879
 880         expr = strip_expr(expr);
 881         switch (expr->type) {
 882         case EXPR_COMPARE:
 883                 if (do_comparison(expr) == 1)
 884                         return 1;
 885                 break;
 886         case EXPR_PREOP:
 887                 if (expr->op == '!') {
 888                         if (implied_condition_false(expr->unop))
 889                                 return 1;
 890                         break;
 891                 }
 892                 stmt = get_expression_statement(expr);
 893                 if (last_stmt_val(stmt, &val) && val == 1)
 894                         return 1;
 895                 break;
 896         default:
 897                 if (implied_not_equal(expr, 0) == 1)
 898                         return 1;
 899                 break;
 900         }
 901         return 0;
 902 }
 903
 904 int implied_condition_false(struct expression *expr)
 905 {
 906         struct statement *stmt;
 907         struct expression *tmp;
 908         long long val;
 909
 910         if (!expr)
 911                 return 0;
 912
 913         if (is_zero(expr))
 914                 return 1;
 915
 916         switch (expr->type) {
 917         case EXPR_COMPARE:
 918                 if (do_comparison(expr) == 2)
 919                         return 1;
 920         case EXPR_PREOP:
 921                 if (expr->op == '!') {
 922                         if (implied_condition_true(expr->unop))
 923                                 return 1;
 924                         break;
 925                 }
 926                 stmt = get_expression_statement(expr);
 927                 if (last_stmt_val(stmt, &val) && val == 0)
 928                         return 1;
 929                 tmp = strip_expr(expr);
 930                 if (tmp != expr)
 931                         return implied_condition_false(tmp);
 932                 break;
 933         default:
 934                 if (get_implied_value(expr, &val) && val == 0)
 935                         return 1;
 936                 break;
 937         }
 938         return 0;
 939 }
 940
 941 int get_implied_range_list(struct expression *expr, struct range_list **rl)
 942 {
 943         long long val;
 944         struct smatch_state *state;
 945
 946         expr = strip_expr(expr);
 947
 948         state = get_state_expr(my_id, expr);
 949         if (state) {
 950                 *rl = clone_range_list(get_dinfo(state)->value_ranges);
 951                 return 1;
 952         }
 953
 954         if (get_implied_value(expr, &val)) {
 955                 *rl = NULL;
 956                 add_range(rl, val, val);
 957                 return 1;
 958         }
 959
 960         if (expr->type == EXPR_BINOP && expr->op == '%') {
 961                 if (!get_implied_value(expr->right, &val))
 962                         return 0;
 963                 *rl = NULL;
 964                 add_range(rl, 0, val - 1);
 965                 return 1;
 966         }
 967
 968         return 0;
 969 }
 970
 971 int is_whole_range(struct smatch_state *state)
 972 {
 973         struct data_info *dinfo;
 974         struct data_range *drange;
 975
 976         if (!state)
 977                 return 1;
 978         dinfo = get_dinfo(state);
 979         if (!dinfo)
 980                 return 1;
 981         drange = first_ptr_list((struct ptr_list *)dinfo->value_ranges);
 982         if (drange->min == whole_range.min && drange->max == whole_range.max)
 983                 return 1;
 984         return 0;
 985 }
 986
 987 static void match_call_info(struct expression *expr)
 988 {
 989         struct expression *arg;
 990         char *name;
 991         int i = 0;
 992
 993         if (expr->fn->type != EXPR_SYMBOL)
 994                 return;
 995
 996         name = get_variable_from_expr(expr->fn, NULL);
 997         FOR_EACH_PTR(expr->args, arg) {
 998                 struct range_list *rl = NULL;
 999                 char *msg;
1000
1001                 if (!get_implied_range_list(arg, &rl))
1002                         goto next;
1003                 if (is_whole_range_rl(rl))
1004                         goto next;
1005
1006                 msg = show_ranges(rl);
1007                 sm_msg("info: passes param_value '%s' %d %s", name, i, msg);
1008  next:
1009                 i++;
1010         } END_FOR_EACH_PTR(arg);
1011         free_string(name);
1012 }
1013
1014 static void get_value_ranges(char *value, struct range_list **rl)
1015 {
1016         long long val1, val2;
1017         char *start;
1018         char *c;
1019
1020         c = value;
1021         start = c;
1022         while (*c) {
1023                 if (!strncmp(start, "min", 3)) {
1024                         val1 = LLONG_MIN;
1025                         c += 3;
1026                 } else {
1027                         while (*c && *c != ',' && *c != '-')
1028                                 c++;
1029                         val1 = strtoll(start, &c, 10);
1030                 }
1031                 if (!*c) {
1032                         add_range(rl, val1, val1);
1033                         break;
1034                 }
1035                 if (*c == ',') {
1036                         add_range(rl, val1, val1);
1037                         c++;
1038                         start = c;
1039                         continue;
1040                 }
1041                 c++;
1042                 start = c;
1043                 if (!strncmp(start, "max", 3)) {
1044                         val2 = LLONG_MAX;
1045                         c += 3;
1046                 } else {
1047                         while (*c && *c != ',' && *c != '-')
1048                                 c++;
1049                         val2 = strtoll(start, &c, 10);
1050                 }
1051                 add_range(rl, val1, val2);
1052                 if (!*c)
1053                         break;
1054                 c++;
1055                 start = c;
1056         }
1057
1058 }
1059
1060 void set_param_value(const char *name, struct symbol *sym, char *value)
1061 {
1062         struct range_list *rl = NULL;
1063         struct smatch_state *state;
1064
1065         get_value_ranges(value, &rl);
1066         state = alloc_extra_state_range_list(rl);
1067         set_state(SMATCH_EXTRA, name, sym, state);
1068 }
1069
1070 void register_smatch_extra(int id)
1071 {
1072         my_id = id;
1073         add_merge_hook(my_id, &merge_func);
1074         add_unmatched_state_hook(my_id, &unmatched_state);
1075         add_hook(&unop_expr, OP_HOOK);
1076         add_hook(&match_function_def, FUNC_DEF_HOOK);
1077         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
1078         add_hook(&match_assign, ASSIGNMENT_HOOK);
1079         add_hook(&match_declarations, DECLARATION_HOOK);
1080         if (option_info)
1081                 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1082         add_definition_db_callback(set_param_value, PARAM_VALUE);
1083 }