2 * Copyright (C) 2009 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
20 #include "smatch_extra.h"
21 #include "smatch_slist.h"
23 ALLOCATOR(data_info
, "smatch extra data");
24 ALLOCATOR(data_range
, "data range");
25 __DO_ALLOCATOR(struct data_range
, sizeof(struct data_range
), __alignof__(struct data_range
),
26 "permanent ranges", perm_data_range
);
27 __DECLARE_ALLOCATOR(struct ptr_list
, rl_ptrlist
);
29 bool is_err_ptr(sval_t sval
)
31 if (option_project
!= PROJ_KERNEL
)
33 if (!type_is_ptr(sval
.type
))
35 if (sval
.uvalue
< -4095ULL)
40 bool is_err_or_null(struct range_list
*rl
)
42 struct range_list
*no_null
;
47 if (rl_min(rl
).value
== 0 && rl_max(rl
).value
== 0)
50 if (rl_min(rl
).value
!= 0)
53 no_null
= remove_range(rl
, rl_min(rl
), rl_min(rl
));
55 return is_err_ptr(rl_min(no_null
)) && is_err_ptr(rl_max(no_null
));
58 static bool is_oxdead(struct range_list
*rl
)
62 /* check for 0xdead000000000000 */
63 if (!rl_to_sval(rl
, &sval
))
65 if ((sval
.uvalue
>> (bits_in_pointer
- 16)) == 0xdead)
71 bool is_noderef_ptr_rl(struct range_list
*rl
)
76 if (rl_min(rl
).value
== 0 && rl_max(rl
).value
== 0)
78 if (is_err_or_null(rl
))
85 bool rl_is_zero(struct range_list
*rl
)
89 if (rl_min(rl
).value
== 0 && rl_max(rl
).value
== 0)
94 static char *get_err_pointer_str(struct data_range
*drange
)
99 * The kernel has error pointers where you do essentially:
101 * return (void *)(unsigned long)-12;
103 * But what I want here is to print -12 instead of the unsigned version
107 if (!is_err_ptr(drange
->min
))
110 if (drange
->min
.value
== drange
->max
.value
)
111 snprintf(buf
, sizeof(buf
), "(%lld)", drange
->min
.value
);
113 snprintf(buf
, sizeof(buf
), "(%lld)-(%lld)", drange
->min
.value
, drange
->max
.value
);
117 char *show_rl(struct range_list
*list
)
119 struct data_range
*prev_drange
= NULL
;
120 struct data_range
*tmp
;
130 FOR_EACH_PTR(list
, tmp
) {
131 remain
= full
+ sizeof(full
) - p
;
133 snprintf(prev
, full
+ sizeof(full
) - prev
, ",%s-%s",
134 sval_to_str(prev_drange
->min
),
135 sval_to_str(sval_type_max(prev_drange
->min
.type
)));
141 err_ptr
= get_err_pointer_str(tmp
);
143 p
+= snprintf(p
, remain
, "%s%s", i
++ ? "," : "", err_ptr
);
144 } else if (sval_cmp(tmp
->min
, tmp
->max
) == 0) {
145 p
+= snprintf(p
, remain
, "%s%s", i
++ ? "," : "",
146 sval_to_str(tmp
->min
));
148 p
+= snprintf(p
, remain
, "%s%s-%s", i
++ ? "," : "",
149 sval_to_str(tmp
->min
),
150 sval_to_str(tmp
->max
));
152 } END_FOR_EACH_PTR(tmp
);
154 return alloc_sname(full
);
157 void free_all_rl(void)
159 clear_rl_ptrlist_alloc();
162 static int sval_too_big(struct symbol
*type
, sval_t sval
)
164 if (type_bits(type
) >= 32 &&
165 type_bits(sval
.type
) <= type_bits(type
))
167 if (sval
.uvalue
<= ((1ULL << type_bits(type
)) - 1))
169 if (type_signed(sval
.type
)) {
170 if (type_unsigned(type
)) {
171 unsigned long long neg
= ~sval
.uvalue
;
172 if (neg
<= sval_type_max(type
).uvalue
)
175 if (sval
.value
< sval_type_min(type
).value
)
177 if (sval
.value
> sval_type_max(type
).value
)
181 if (sval
.uvalue
> sval_type_max(type
).uvalue
)
186 static int truncates_nicely(struct symbol
*type
, sval_t min
, sval_t max
)
188 unsigned long long mask
;
189 int bits
= type_bits(type
);
191 if (type_is_fp(min
.type
) && !type_is_fp(type
))
194 if (bits
>= type_bits(min
.type
))
197 mask
= -1ULL << bits
;
198 return (min
.uvalue
& mask
) == (max
.uvalue
& mask
);
201 static void add_range_t(struct symbol
*type
, struct range_list
**rl
, sval_t min
, sval_t max
)
203 /* If we're just adding a number, cast it and add it */
204 if (sval_cmp(min
, max
) == 0) {
205 add_range(rl
, sval_cast(type
, min
), sval_cast(type
, max
));
209 /* If the range is within the type range then add it */
210 if (sval_fits(type
, min
) && sval_fits(type
, max
)) {
211 add_range(rl
, sval_cast(type
, min
), sval_cast(type
, max
));
215 if (truncates_nicely(type
, min
, max
)) {
216 add_range(rl
, sval_cast(type
, min
), sval_cast(type
, max
));
221 * If the range we are adding has more bits than the range type then
222 * add the whole range type. Eg:
223 * 0x8000000000000000 - 0xf000000000000000 -> cast to int
226 if (sval_too_big(type
, min
) || sval_too_big(type
, max
)) {
227 add_range(rl
, sval_type_min(type
), sval_type_max(type
));
231 /* Cast negative values to high positive values */
232 if (sval_is_negative(min
) && type_unsigned(type
)) {
233 if (sval_is_positive(max
)) {
234 if (sval_too_high(type
, max
)) {
235 add_range(rl
, sval_type_min(type
), sval_type_max(type
));
238 add_range(rl
, sval_type_val(type
, 0), sval_cast(type
, max
));
239 max
= sval_type_max(type
);
241 max
= sval_cast(type
, max
);
243 min
= sval_cast(type
, min
);
244 add_range(rl
, min
, max
);
247 /* Cast high positive numbers to negative */
248 if (sval_unsigned(max
) && sval_is_negative(sval_cast(type
, max
))) {
249 if (!sval_is_negative(sval_cast(type
, min
))) {
250 add_range(rl
, sval_cast(type
, min
), sval_type_max(type
));
251 min
= sval_type_min(type
);
253 min
= sval_cast(type
, min
);
255 max
= sval_cast(type
, max
);
256 add_range(rl
, min
, max
);
259 add_range(rl
, sval_cast(type
, min
), sval_cast(type
, max
));
263 static int str_to_comparison_arg_helper(const char *str
,
264 struct expression
*call
, int *comparison
,
265 struct expression
**arg
, const char **endp
)
277 *comparison
= SPECIAL_LTE
;
282 } else if (*c
== '=') {
285 *comparison
= SPECIAL_EQUAL
;
286 } else if (*c
== '>') {
289 *comparison
= SPECIAL_GTE
;
294 } else if (*c
== '!') {
297 *comparison
= SPECIAL_NOTEQUAL
;
298 } else if (*c
== '$') {
299 *comparison
= SPECIAL_EQUAL
;
308 param
= strtoll(c
, (char **)&c
, 10);
310 * FIXME: handle parameter math. [==$1 + 100]
316 if (*c
== ',' || *c
== ']')
317 c
++; /* skip the ']' character */
323 *arg
= get_argument_from_call_expr(call
->args
, param
);
326 if (*c
== '-' && *(c
+ 1) == '>') {
330 n
= snprintf(buf
, sizeof(buf
), "$%s", c
);
331 if (n
>= sizeof(buf
))
333 if (buf
[n
- 1] == ']')
335 *arg
= gen_expression_from_key(*arg
, buf
);
336 while (*c
&& *c
!= ']')
342 int str_to_comparison_arg(const char *str
, struct expression
*call
, int *comparison
, struct expression
**arg
)
351 return str_to_comparison_arg_helper(str
, call
, comparison
, arg
, NULL
);
354 static int get_val_from_key(int use_max
, struct symbol
*type
, const char *c
, struct expression
*call
, const char **endp
, sval_t
*sval
)
356 struct expression
*arg
;
361 ret
= sval_type_max(type
);
363 ret
= sval_type_min(type
);
365 if (!str_to_comparison_arg_helper(c
, call
, &comparison
, &arg
, endp
)) {
370 if (use_max
&& get_implied_max(arg
, &tmp
)) {
372 if (comparison
== '<') {
374 ret
= sval_binop(ret
, '-', tmp
);
377 if (!use_max
&& get_implied_min(arg
, &tmp
)) {
379 if (comparison
== '>') {
381 ret
= sval_binop(ret
, '+', tmp
);
389 static sval_t
add_one(sval_t sval
)
395 static sval_t
sub_one(sval_t sval
)
401 void filter_by_comparison(struct range_list
**rl
, int comparison
, struct range_list
*right
)
403 struct range_list
*left_orig
= *rl
;
404 struct range_list
*right_orig
= right
;
405 struct range_list
*ret_rl
= *rl
;
406 struct symbol
*cast_type
;
409 if (comparison
== UNKNOWN_COMPARISON
)
412 cast_type
= rl_type(left_orig
);
413 if (sval_type_max(rl_type(left_orig
)).uvalue
< sval_type_max(rl_type(right_orig
)).uvalue
)
414 cast_type
= rl_type(right_orig
);
415 if (sval_type_max(cast_type
).uvalue
< INT_MAX
)
416 cast_type
= &int_ctype
;
418 min
= sval_type_min(cast_type
);
419 max
= sval_type_max(cast_type
);
420 left_orig
= cast_rl(cast_type
, left_orig
);
421 right_orig
= cast_rl(cast_type
, right_orig
);
423 switch (comparison
) {
425 case SPECIAL_UNSIGNED_LT
:
426 ret_rl
= remove_range(left_orig
, rl_max(right_orig
), max
);
429 case SPECIAL_UNSIGNED_LTE
:
430 if (!sval_is_max(rl_max(right_orig
)))
431 ret_rl
= remove_range(left_orig
, add_one(rl_max(right_orig
)), max
);
434 ret_rl
= rl_intersection(left_orig
, right_orig
);
437 case SPECIAL_UNSIGNED_GTE
:
438 if (!sval_is_min(rl_min(right_orig
)))
439 ret_rl
= remove_range(left_orig
, min
, sub_one(rl_min(right_orig
)));
442 case SPECIAL_UNSIGNED_GT
:
443 ret_rl
= remove_range(left_orig
, min
, rl_min(right_orig
));
445 case SPECIAL_NOTEQUAL
:
446 if (sval_cmp(rl_min(right_orig
), rl_max(right_orig
)) == 0)
447 ret_rl
= remove_range(left_orig
, rl_min(right_orig
), rl_min(right_orig
));
450 sm_perror("unhandled comparison %s", show_special(comparison
));
454 *rl
= cast_rl(rl_type(*rl
), ret_rl
);
457 static struct range_list
*filter_by_comparison_call(const char *c
, struct expression
*call
, const char **endp
, struct range_list
*start_rl
)
460 struct expression
*arg
;
461 struct range_list
*casted_start
, *right_orig
;
464 /* For when we have a function that takes a function pointer. */
465 if (!call
|| call
->type
!= EXPR_CALL
)
468 if (!str_to_comparison_arg_helper(c
, call
, &comparison
, &arg
, endp
))
471 if (!get_implied_rl(arg
, &right_orig
))
475 if (type_positive_bits(rl_type(start_rl
)) > type_positive_bits(type
))
476 type
= rl_type(start_rl
);
477 if (type_positive_bits(rl_type(right_orig
)) > type_positive_bits(type
))
478 type
= rl_type(right_orig
);
480 casted_start
= cast_rl(type
, start_rl
);
481 right_orig
= cast_rl(type
, right_orig
);
483 filter_by_comparison(&casted_start
, comparison
, right_orig
);
484 return cast_rl(rl_type(start_rl
), casted_start
);
487 static sval_t
parse_val(int use_max
, struct expression
*call
, struct symbol
*type
, const char *c
, const char **endp
)
489 const char *start
= c
;
492 if (type
== &float_ctype
)
493 return sval_type_fval(type
, strtof(start
, (char **)endp
));
494 else if (type
== &double_ctype
)
495 return sval_type_fval(type
, strtod(start
, (char **)endp
));
496 else if (type
== &ldouble_ctype
)
497 return sval_type_fval(type
, strtold(start
, (char **)endp
));
499 if (!strncmp(start
, "max", 3)) {
500 ret
= sval_type_max(type
);
502 } else if (!strncmp(start
, "u64max", 6)) {
503 ret
= sval_type_val(type
, ULLONG_MAX
);
505 } else if (!strncmp(start
, "s64max", 6)) {
506 ret
= sval_type_val(type
, LLONG_MAX
);
508 } else if (!strncmp(start
, "u32max", 6)) {
509 ret
= sval_type_val(type
, UINT_MAX
);
511 } else if (!strncmp(start
, "s32max", 6)) {
512 ret
= sval_type_val(type
, INT_MAX
);
514 } else if (!strncmp(start
, "u16max", 6)) {
515 ret
= sval_type_val(type
, USHRT_MAX
);
517 } else if (!strncmp(start
, "s16max", 6)) {
518 ret
= sval_type_val(type
, SHRT_MAX
);
520 } else if (!strncmp(start
, "min", 3)) {
521 ret
= sval_type_min(type
);
523 } else if (!strncmp(start
, "s64min", 6)) {
524 ret
= sval_type_val(type
, LLONG_MIN
);
526 } else if (!strncmp(start
, "s32min", 6)) {
527 ret
= sval_type_val(type
, INT_MIN
);
529 } else if (!strncmp(start
, "s16min", 6)) {
530 ret
= sval_type_val(type
, SHRT_MIN
);
532 } else if (!strncmp(start
, "long_min", 8)) {
533 ret
= sval_type_val(type
, LONG_MIN
);
535 } else if (!strncmp(start
, "long_max", 8)) {
536 ret
= sval_type_val(type
, LONG_MAX
);
538 } else if (!strncmp(start
, "ulong_max", 9)) {
539 ret
= sval_type_val(type
, ULONG_MAX
);
541 } else if (!strncmp(start
, "ptr_max", 7)) {
542 ret
= sval_type_val(type
, valid_ptr_max
);
544 } else if (start
[0] == '[') {
545 /* this parses [==p0] comparisons */
546 get_val_from_key(1, type
, start
, call
, &c
, &ret
);
547 } else if (type_positive_bits(type
) == 64) {
548 ret
= sval_type_val(type
, strtoull(start
, (char **)&c
, 0));
550 ret
= sval_type_val(type
, strtoll(start
, (char **)&c
, 0));
556 static const char *jump_to_call_math(const char *value
)
558 const char *c
= value
;
560 while (*c
&& *c
!= '[')
566 if (*c
== '<' || *c
== '=' || *c
== '>' || *c
== '!')
572 static struct range_list
*get_param_return_rl(struct expression
*call
, const char *call_math
)
574 struct expression
*arg
;
578 param
= atoi(call_math
);
580 arg
= get_argument_from_call_expr(call
->args
, param
);
584 return db_return_vals_no_args(arg
);
587 static void str_to_rl_helper(struct expression
*call
, struct symbol
*type
, const char *str
, const char **endp
, struct range_list
**rl
)
589 struct range_list
*rl_tmp
= NULL
;
590 sval_t prev_min
, min
, max
;
593 prev_min
= sval_type_min(type
);
594 min
= sval_type_min(type
);
595 max
= sval_type_max(type
);
597 while (*c
!= '\0' && *c
!= '[') {
599 if (sval_cmp(min
, sval_type_min(type
)) != 0)
601 max
= sval_type_max(type
);
602 add_range_t(type
, &rl_tmp
, min
, max
);
607 min
= parse_val(0, call
, type
, c
, &c
);
608 if (!sval_fits(type
, min
))
609 min
= sval_type_min(type
);
613 if (*c
== '\0' || *c
== '[') {
614 add_range_t(type
, &rl_tmp
, min
, min
);
618 add_range_t(type
, &rl_tmp
, min
, min
);
624 max
= sval_type_max(type
);
625 add_range_t(type
, &rl_tmp
, min
, max
);
627 if (*c
== '[' || *c
== '\0')
631 sm_msg("debug XXX: trouble parsing %s c = %s", str
, c
);
637 max
= parse_val(1, call
, type
, c
, &c
);
638 if (!sval_fits(type
, max
))
639 max
= sval_type_max(type
);
641 max
= sval_type_max(type
);
642 add_range_t(type
, &rl_tmp
, min
, max
);
644 if (*c
== '[' || *c
== '\0')
648 add_range_t(type
, &rl_tmp
, min
, max
);
659 static void str_to_dinfo(struct expression
*call
, struct symbol
*type
, const char *value
, struct data_info
*dinfo
)
661 struct range_list
*math_rl
;
662 const char *call_math
;
664 struct range_list
*rl
= NULL
;
669 if (strcmp(value
, "empty") == 0)
672 if (strncmp(value
, "[==$", 4) == 0) {
673 struct expression
*arg
;
676 if (!str_to_comparison_arg(value
, call
, &comparison
, &arg
))
678 if (!get_implied_rl(arg
, &rl
))
683 str_to_rl_helper(call
, type
, value
, &c
, &rl
);
687 call_math
= jump_to_call_math(value
);
688 if (call_math
&& call_math
[0] == 'r') {
689 math_rl
= get_param_return_rl(call
, call_math
);
691 rl
= rl_intersection(rl
, math_rl
);
694 if (call_math
&& parse_call_math_rl(call
, call_math
, &math_rl
)) {
695 rl
= rl_intersection(rl
, math_rl
);
700 * For now if we already tried to handle the call math and couldn't
701 * figure it out then bail.
703 if (jump_to_call_math(c
) == c
+ 1)
706 rl
= filter_by_comparison_call(c
, call
, &c
, rl
);
709 rl
= cast_rl(type
, rl
);
710 dinfo
->value_ranges
= rl
;
713 static int rl_is_sane(struct range_list
*rl
)
715 struct data_range
*tmp
;
719 FOR_EACH_PTR(rl
, tmp
) {
720 if (!sval_fits(type
, tmp
->min
))
722 if (!sval_fits(type
, tmp
->max
))
724 if (sval_cmp(tmp
->min
, tmp
->max
) > 0)
726 } END_FOR_EACH_PTR(tmp
);
731 void str_to_rl(struct symbol
*type
, char *value
, struct range_list
**rl
)
733 struct data_info dinfo
= {};
735 str_to_dinfo(NULL
, type
, value
, &dinfo
);
736 if (!rl_is_sane(dinfo
.value_ranges
))
737 dinfo
.value_ranges
= alloc_whole_rl(type
);
738 *rl
= dinfo
.value_ranges
;
741 void call_results_to_rl(struct expression
*expr
, struct symbol
*type
, const char *value
, struct range_list
**rl
)
743 struct data_info dinfo
= {};
745 str_to_dinfo(strip_expr(expr
), type
, value
, &dinfo
);
746 *rl
= dinfo
.value_ranges
;
749 int is_whole_rl(struct range_list
*rl
)
751 struct data_range
*drange
;
753 if (ptr_list_empty((struct ptr_list
*)rl
))
755 drange
= first_ptr_list((struct ptr_list
*)rl
);
756 if (sval_is_min(drange
->min
) && sval_is_max(drange
->max
))
761 int is_unknown_ptr(struct range_list
*rl
)
763 struct data_range
*drange
;
769 FOR_EACH_PTR(rl
, drange
) {
772 if (sval_cmp(drange
->min
, valid_ptr_min_sval
) == 0 &&
773 sval_cmp(drange
->max
, valid_ptr_max_sval
) == 0)
775 } END_FOR_EACH_PTR(drange
);
780 int is_whole_rl_non_zero(struct range_list
*rl
)
782 struct data_range
*drange
;
784 if (ptr_list_empty((struct ptr_list
*)rl
))
786 drange
= first_ptr_list((struct ptr_list
*)rl
);
787 if (sval_unsigned(drange
->min
) &&
788 drange
->min
.value
== 1 &&
789 sval_is_max(drange
->max
))
791 if (!sval_is_min(drange
->min
) || drange
->max
.value
!= -1)
793 drange
= last_ptr_list((struct ptr_list
*)rl
);
794 if (drange
->min
.value
!= 1 || !sval_is_max(drange
->max
))
799 sval_t
rl_min(struct range_list
*rl
)
801 struct data_range
*drange
;
804 ret
.type
= &llong_ctype
;
805 ret
.value
= LLONG_MIN
;
806 if (ptr_list_empty((struct ptr_list
*)rl
))
808 drange
= first_ptr_list((struct ptr_list
*)rl
);
812 sval_t
rl_max(struct range_list
*rl
)
814 struct data_range
*drange
;
817 ret
.type
= &llong_ctype
;
818 ret
.value
= LLONG_MAX
;
819 if (ptr_list_empty((struct ptr_list
*)rl
))
821 drange
= last_ptr_list((struct ptr_list
*)rl
);
825 int rl_to_sval(struct range_list
*rl
, sval_t
*sval
)
834 if (sval_cmp(min
, max
) != 0)
840 struct symbol
*rl_type(struct range_list
*rl
)
844 return rl_min(rl
).type
;
847 static struct data_range
*alloc_range_helper_sval(sval_t min
, sval_t max
, int perm
)
849 struct data_range
*ret
;
852 ret
= __alloc_perm_data_range(0);
854 ret
= __alloc_data_range(0);
860 struct data_range
*alloc_range(sval_t min
, sval_t max
)
862 return alloc_range_helper_sval(min
, max
, 0);
865 struct data_range
*alloc_range_perm(sval_t min
, sval_t max
)
867 return alloc_range_helper_sval(min
, max
, 1);
870 struct range_list
*alloc_rl(sval_t min
, sval_t max
)
872 struct range_list
*rl
= NULL
;
874 if (sval_cmp(min
, max
) > 0)
875 return alloc_whole_rl(min
.type
);
877 add_range(&rl
, min
, max
);
881 struct range_list
*alloc_whole_rl(struct symbol
*type
)
883 if (!type
|| type_positive_bits(type
) < 0)
885 if (type
->type
== SYM_ARRAY
)
888 return alloc_rl(sval_type_min(type
), sval_type_max(type
));
891 static bool collapse_pointer_rl(struct range_list
**rl
, sval_t min
, sval_t max
)
893 struct range_list
*new_rl
= NULL
;
894 struct data_range
*tmp
;
900 * With the mtag work, then we end up getting huge lists of mtags.
901 * That seems cool, but the problem is that we can only store about
902 * 8-10 mtags in the DB before we truncate the list. Also the mtags
903 * aren't really used at all so it's a waste of resources for now...
904 * In the future, we maybe will revisit this code.
911 if (!type_is_ptr(min
.type
))
914 if (ptr_list_size((struct ptr_list
*)*rl
) < 8)
916 FOR_EACH_PTR(*rl
, tmp
) {
917 if (!is_err_ptr(tmp
->min
))
919 } END_FOR_EACH_PTR(tmp
);
923 FOR_EACH_PTR(*rl
, tmp
) {
924 if (sval_cmp(tmp
->min
, valid_ptr_min_sval
) >= 0 &&
925 sval_cmp(tmp
->max
, valid_ptr_max_sval
) <= 0)
926 add_range(&new_rl
, valid_ptr_min_sval
, valid_ptr_max_sval
);
928 add_range(&new_rl
, tmp
->min
, tmp
->max
);
929 } END_FOR_EACH_PTR(tmp
);
931 add_range(&new_rl
, min
, max
);
940 extern int rl_ptrlist_hack
;
941 void add_range(struct range_list
**list
, sval_t min
, sval_t max
)
943 struct data_range
*tmp
;
944 struct data_range
*new = NULL
;
948 * There is at least on valid reason why the types might be confusing
949 * and that's when you have a void pointer and on some paths you treat
950 * it as a u8 pointer and on other paths you treat it as a u16 pointer.
951 * This case is hard to deal with.
953 * There are other cases where we probably should be more specific about
954 * the types than we are. For example, we end up merging a lot of ulong
955 * with pointers and I have not figured out why we do that.
957 * But this hack works for both cases, I think. We cast it to pointers
958 * or we use the bigger size.
961 if (*list
&& rl_type(*list
) != min
.type
) {
962 if (rl_type(*list
)->type
== SYM_PTR
) {
963 min
= sval_cast(rl_type(*list
), min
);
964 max
= sval_cast(rl_type(*list
), max
);
965 } else if (min
.type
->type
== SYM_PTR
) {
966 *list
= cast_rl(min
.type
, *list
);
967 } else if (type_bits(rl_type(*list
)) >= type_bits(min
.type
)) {
968 min
= sval_cast(rl_type(*list
), min
);
969 max
= sval_cast(rl_type(*list
), max
);
971 *list
= cast_rl(min
.type
, *list
);
975 if (sval_cmp(min
, max
) > 0) {
976 min
= sval_type_min(min
.type
);
977 max
= sval_type_max(min
.type
);
980 if (collapse_pointer_rl(list
, min
, max
))
984 * FIXME: This has a problem merging a range_list like: min-0,3-max
985 * with a range like 1-2. You end up with min-2,3-max instead of
988 FOR_EACH_PTR(*list
, tmp
) {
990 /* Sometimes we overlap with more than one range
991 so we have to delete or modify the next range. */
992 if (!sval_is_max(max
) && max
.value
+ 1 == tmp
->min
.value
) {
993 /* join 2 ranges here */
995 DELETE_CURRENT_PTR(tmp
);
999 /* Doesn't overlap with the next one. */
1000 if (sval_cmp(max
, tmp
->min
) < 0)
1003 if (sval_cmp(max
, tmp
->max
) <= 0) {
1004 /* Partially overlaps the next one. */
1005 new->max
= tmp
->max
;
1006 DELETE_CURRENT_PTR(tmp
);
1009 /* Completely overlaps the next one. */
1010 DELETE_CURRENT_PTR(tmp
);
1011 /* there could be more ranges to delete */
1015 if (!sval_is_max(max
) && max
.value
+ 1 == tmp
->min
.value
) {
1016 /* join 2 ranges into a big range */
1017 new = alloc_range(min
, tmp
->max
);
1018 REPLACE_CURRENT_PTR(tmp
, new);
1021 if (sval_cmp(max
, tmp
->min
) < 0) { /* new range entirely below */
1022 new = alloc_range(min
, max
);
1023 INSERT_CURRENT(new, tmp
);
1026 if (sval_cmp(min
, tmp
->min
) < 0) { /* new range partially below */
1027 if (sval_cmp(max
, tmp
->max
) < 0)
1031 new = alloc_range(min
, max
);
1032 REPLACE_CURRENT_PTR(tmp
, new);
1037 if (sval_cmp(max
, tmp
->max
) <= 0) /* new range already included */
1039 if (sval_cmp(min
, tmp
->max
) <= 0) { /* new range partially above */
1041 new = alloc_range(min
, max
);
1042 REPLACE_CURRENT_PTR(tmp
, new);
1046 if (!sval_is_min(min
) && min
.value
- 1 == tmp
->max
.value
) {
1047 /* join 2 ranges into a big range */
1048 new = alloc_range(tmp
->min
, max
);
1049 REPLACE_CURRENT_PTR(tmp
, new);
1053 /* the new range is entirely above the existing ranges */
1054 } END_FOR_EACH_PTR(tmp
);
1057 new = alloc_range(min
, max
);
1059 rl_ptrlist_hack
= 1;
1060 add_ptr_list(list
, new);
1061 rl_ptrlist_hack
= 0;
1064 struct range_list
*clone_rl(struct range_list
*list
)
1066 struct data_range
*tmp
;
1067 struct range_list
*ret
= NULL
;
1069 FOR_EACH_PTR(list
, tmp
) {
1070 add_ptr_list(&ret
, tmp
);
1071 } END_FOR_EACH_PTR(tmp
);
1075 struct range_list
*clone_rl_permanent(struct range_list
*list
)
1077 struct data_range
*tmp
;
1078 struct data_range
*new;
1079 struct range_list
*ret
= NULL
;
1081 FOR_EACH_PTR(list
, tmp
) {
1082 new = alloc_range_perm(tmp
->min
, tmp
->max
);
1083 add_ptr_list(&ret
, new);
1084 } END_FOR_EACH_PTR(tmp
);
1088 struct range_list
*rl_union(struct range_list
*one
, struct range_list
*two
)
1090 struct data_range
*tmp
;
1091 struct range_list
*ret
= NULL
;
1093 FOR_EACH_PTR(one
, tmp
) {
1094 add_range(&ret
, tmp
->min
, tmp
->max
);
1095 } END_FOR_EACH_PTR(tmp
);
1096 FOR_EACH_PTR(two
, tmp
) {
1097 add_range(&ret
, tmp
->min
, tmp
->max
);
1098 } END_FOR_EACH_PTR(tmp
);
1102 struct range_list
*remove_range(struct range_list
*list
, sval_t min
, sval_t max
)
1104 struct data_range
*tmp
;
1105 struct range_list
*ret
= NULL
;
1110 min
= sval_cast(rl_type(list
), min
);
1111 max
= sval_cast(rl_type(list
), max
);
1112 if (sval_cmp(min
, max
) > 0) {
1118 FOR_EACH_PTR(list
, tmp
) {
1119 if (sval_cmp(tmp
->max
, min
) < 0) {
1120 add_range(&ret
, tmp
->min
, tmp
->max
);
1123 if (sval_cmp(tmp
->min
, max
) > 0) {
1124 add_range(&ret
, tmp
->min
, tmp
->max
);
1127 if (sval_cmp(tmp
->min
, min
) >= 0 && sval_cmp(tmp
->max
, max
) <= 0)
1129 if (sval_cmp(tmp
->min
, min
) >= 0) {
1131 add_range(&ret
, max
, tmp
->max
);
1132 } else if (sval_cmp(tmp
->max
, max
) <= 0) {
1134 add_range(&ret
, tmp
->min
, min
);
1138 add_range(&ret
, tmp
->min
, min
);
1139 add_range(&ret
, max
, tmp
->max
);
1141 } END_FOR_EACH_PTR(tmp
);
1145 int ranges_equiv(struct data_range
*one
, struct data_range
*two
)
1151 if (sval_cmp(one
->min
, two
->min
) != 0)
1153 if (sval_cmp(one
->max
, two
->max
) != 0)
1158 int rl_equiv(struct range_list
*one
, struct range_list
*two
)
1160 struct data_range
*one_range
;
1161 struct data_range
*two_range
;
1166 PREPARE_PTR_LIST(one
, one_range
);
1167 PREPARE_PTR_LIST(two
, two_range
);
1169 if (!one_range
&& !two_range
)
1171 if (!ranges_equiv(one_range
, two_range
))
1173 NEXT_PTR_LIST(one_range
);
1174 NEXT_PTR_LIST(two_range
);
1176 FINISH_PTR_LIST(two_range
);
1177 FINISH_PTR_LIST(one_range
);
1182 int true_comparison_range(struct data_range
*left
, int comparison
, struct data_range
*right
)
1184 switch (comparison
) {
1186 case SPECIAL_UNSIGNED_LT
:
1187 if (sval_cmp(left
->min
, right
->max
) < 0)
1190 case SPECIAL_UNSIGNED_LTE
:
1192 if (sval_cmp(left
->min
, right
->max
) <= 0)
1196 if (sval_cmp(left
->max
, right
->min
) < 0)
1198 if (sval_cmp(left
->min
, right
->max
) > 0)
1201 case SPECIAL_UNSIGNED_GTE
:
1203 if (sval_cmp(left
->max
, right
->min
) >= 0)
1207 case SPECIAL_UNSIGNED_GT
:
1208 if (sval_cmp(left
->max
, right
->min
) > 0)
1211 case SPECIAL_NOTEQUAL
:
1212 if (sval_cmp(left
->min
, left
->max
) != 0)
1214 if (sval_cmp(right
->min
, right
->max
) != 0)
1216 if (sval_cmp(left
->min
, right
->min
) != 0)
1220 sm_perror("unhandled comparison %d", comparison
);
1226 int true_comparison_range_LR(int comparison
, struct data_range
*var
, struct data_range
*val
, int left
)
1229 return true_comparison_range(var
, comparison
, val
);
1231 return true_comparison_range(val
, comparison
, var
);
1234 static int false_comparison_range_sval(struct data_range
*left
, int comparison
, struct data_range
*right
)
1236 switch (comparison
) {
1238 case SPECIAL_UNSIGNED_LT
:
1239 if (sval_cmp(left
->max
, right
->min
) >= 0)
1242 case SPECIAL_UNSIGNED_LTE
:
1244 if (sval_cmp(left
->max
, right
->min
) > 0)
1248 if (sval_cmp(left
->min
, left
->max
) != 0)
1250 if (sval_cmp(right
->min
, right
->max
) != 0)
1252 if (sval_cmp(left
->min
, right
->min
) != 0)
1255 case SPECIAL_UNSIGNED_GTE
:
1257 if (sval_cmp(left
->min
, right
->max
) < 0)
1261 case SPECIAL_UNSIGNED_GT
:
1262 if (sval_cmp(left
->min
, right
->max
) <= 0)
1265 case SPECIAL_NOTEQUAL
:
1266 if (sval_cmp(left
->max
, right
->min
) < 0)
1268 if (sval_cmp(left
->min
, right
->max
) > 0)
1272 sm_perror("unhandled comparison %d", comparison
);
1278 int false_comparison_range_LR(int comparison
, struct data_range
*var
, struct data_range
*val
, int left
)
1281 return false_comparison_range_sval(var
, comparison
, val
);
1283 return false_comparison_range_sval(val
, comparison
, var
);
1286 int possibly_true(struct expression
*left
, int comparison
, struct expression
*right
)
1288 struct range_list
*rl_left
, *rl_right
;
1289 struct data_range
*tmp_left
, *tmp_right
;
1290 struct symbol
*type
;
1292 if (comparison
== UNKNOWN_COMPARISON
)
1294 if (!get_implied_rl(left
, &rl_left
))
1296 if (!get_implied_rl(right
, &rl_right
))
1299 type
= rl_type(rl_left
);
1300 if (type_positive_bits(type
) < type_positive_bits(rl_type(rl_right
)))
1301 type
= rl_type(rl_right
);
1302 if (type_positive_bits(type
) < 31)
1305 rl_left
= cast_rl(type
, rl_left
);
1306 rl_right
= cast_rl(type
, rl_right
);
1308 FOR_EACH_PTR(rl_left
, tmp_left
) {
1309 FOR_EACH_PTR(rl_right
, tmp_right
) {
1310 if (true_comparison_range(tmp_left
, comparison
, tmp_right
))
1312 } END_FOR_EACH_PTR(tmp_right
);
1313 } END_FOR_EACH_PTR(tmp_left
);
1317 int possibly_false(struct expression
*left
, int comparison
, struct expression
*right
)
1319 struct range_list
*rl_left
, *rl_right
;
1320 struct data_range
*tmp_left
, *tmp_right
;
1321 struct symbol
*type
;
1323 if (!get_implied_rl(left
, &rl_left
))
1325 if (!get_implied_rl(right
, &rl_right
))
1328 type
= rl_type(rl_left
);
1329 if (type_positive_bits(type
) < type_positive_bits(rl_type(rl_right
)))
1330 type
= rl_type(rl_right
);
1331 if (type_positive_bits(type
) < 31)
1334 rl_left
= cast_rl(type
, rl_left
);
1335 rl_right
= cast_rl(type
, rl_right
);
1337 FOR_EACH_PTR(rl_left
, tmp_left
) {
1338 FOR_EACH_PTR(rl_right
, tmp_right
) {
1339 if (false_comparison_range_sval(tmp_left
, comparison
, tmp_right
))
1341 } END_FOR_EACH_PTR(tmp_right
);
1342 } END_FOR_EACH_PTR(tmp_left
);
1346 int possibly_true_rl(struct range_list
*left_ranges
, int comparison
, struct range_list
*right_ranges
)
1348 struct data_range
*left_tmp
, *right_tmp
;
1349 struct symbol
*type
;
1351 if (!left_ranges
|| !right_ranges
|| comparison
== UNKNOWN_COMPARISON
)
1354 type
= rl_type(left_ranges
);
1355 if (type_positive_bits(type
) < type_positive_bits(rl_type(right_ranges
)))
1356 type
= rl_type(right_ranges
);
1357 if (type_positive_bits(type
) < 31)
1360 left_ranges
= cast_rl(type
, left_ranges
);
1361 right_ranges
= cast_rl(type
, right_ranges
);
1363 FOR_EACH_PTR(left_ranges
, left_tmp
) {
1364 FOR_EACH_PTR(right_ranges
, right_tmp
) {
1365 if (true_comparison_range(left_tmp
, comparison
, right_tmp
))
1367 } END_FOR_EACH_PTR(right_tmp
);
1368 } END_FOR_EACH_PTR(left_tmp
);
1372 int possibly_false_rl(struct range_list
*left_ranges
, int comparison
, struct range_list
*right_ranges
)
1374 struct data_range
*left_tmp
, *right_tmp
;
1375 struct symbol
*type
;
1377 if (!left_ranges
|| !right_ranges
|| comparison
== UNKNOWN_COMPARISON
)
1380 type
= rl_type(left_ranges
);
1381 if (type_positive_bits(type
) < type_positive_bits(rl_type(right_ranges
)))
1382 type
= rl_type(right_ranges
);
1383 if (type_positive_bits(type
) < 31)
1386 left_ranges
= cast_rl(type
, left_ranges
);
1387 right_ranges
= cast_rl(type
, right_ranges
);
1389 FOR_EACH_PTR(left_ranges
, left_tmp
) {
1390 FOR_EACH_PTR(right_ranges
, right_tmp
) {
1391 if (false_comparison_range_sval(left_tmp
, comparison
, right_tmp
))
1393 } END_FOR_EACH_PTR(right_tmp
);
1394 } END_FOR_EACH_PTR(left_tmp
);
1398 /* FIXME: the _rl here stands for right left so really it should be _lr */
1399 int possibly_true_rl_LR(int comparison
, struct range_list
*a
, struct range_list
*b
, int left
)
1402 return possibly_true_rl(a
, comparison
, b
);
1404 return possibly_true_rl(b
, comparison
, a
);
1407 int possibly_false_rl_LR(int comparison
, struct range_list
*a
, struct range_list
*b
, int left
)
1410 return possibly_false_rl(a
, comparison
, b
);
1412 return possibly_false_rl(b
, comparison
, a
);
1415 int rl_has_sval(struct range_list
*rl
, sval_t sval
)
1417 struct data_range
*tmp
;
1419 FOR_EACH_PTR(rl
, tmp
) {
1420 if (sval_cmp(tmp
->min
, sval
) <= 0 &&
1421 sval_cmp(tmp
->max
, sval
) >= 0)
1423 } END_FOR_EACH_PTR(tmp
);
1427 void tack_on(struct range_list
**list
, struct data_range
*drange
)
1429 add_ptr_list(list
, drange
);
1432 void push_rl(struct range_list_stack
**rl_stack
, struct range_list
*rl
)
1434 add_ptr_list(rl_stack
, rl
);
1437 struct range_list
*pop_rl(struct range_list_stack
**rl_stack
)
1439 struct range_list
*rl
;
1441 rl
= last_ptr_list((struct ptr_list
*)*rl_stack
);
1442 delete_ptr_list_last((struct ptr_list
**)rl_stack
);
1446 struct range_list
*top_rl(struct range_list_stack
*rl_stack
)
1448 struct range_list
*rl
;
1450 rl
= last_ptr_list((struct ptr_list
*)rl_stack
);
1454 void filter_top_rl(struct range_list_stack
**rl_stack
, struct range_list
*filter
)
1456 struct range_list
*rl
;
1458 rl
= pop_rl(rl_stack
);
1459 rl
= rl_filter(rl
, filter
);
1460 push_rl(rl_stack
, rl
);
1463 struct range_list
*rl_truncate_cast(struct symbol
*type
, struct range_list
*rl
)
1465 struct data_range
*tmp
;
1466 struct range_list
*ret
= NULL
;
1472 if (!type
|| type
== rl_type(rl
))
1475 FOR_EACH_PTR(rl
, tmp
) {
1478 if (type_bits(type
) < type_bits(rl_type(rl
))) {
1479 min
.uvalue
= tmp
->min
.uvalue
& ((1ULL << type_bits(type
)) - 1);
1480 max
.uvalue
= tmp
->max
.uvalue
& ((1ULL << type_bits(type
)) - 1);
1482 if (sval_cmp(min
, max
) > 0) {
1483 min
= sval_cast(type
, min
);
1484 max
= sval_cast(type
, max
);
1486 add_range_t(type
, &ret
, min
, max
);
1487 } END_FOR_EACH_PTR(tmp
);
1492 int rl_fits_in_type(struct range_list
*rl
, struct symbol
*type
)
1494 if (type_bits(rl_type(rl
)) <= type_bits(type
))
1496 if (sval_cmp(rl_max(rl
), sval_type_max(type
)) > 0)
1498 if (sval_is_negative(rl_min(rl
)) &&
1499 sval_cmp(rl_min(rl
), sval_type_min(type
)) < 0)
1504 static int rl_type_consistent(struct range_list
*rl
)
1506 struct data_range
*tmp
;
1507 struct symbol
*type
;
1510 FOR_EACH_PTR(rl
, tmp
) {
1511 if (type
!= tmp
->min
.type
|| type
!= tmp
->max
.type
)
1513 } END_FOR_EACH_PTR(tmp
);
1517 static struct range_list
*cast_to_bool(struct range_list
*rl
)
1519 struct data_range
*tmp
;
1520 struct range_list
*ret
= NULL
;
1523 sval_t min
= { .type
= &bool_ctype
};
1524 sval_t max
= { .type
= &bool_ctype
};
1526 FOR_EACH_PTR(rl
, tmp
) {
1527 if (tmp
->min
.value
|| tmp
->max
.value
)
1529 if (sval_is_negative(tmp
->min
) &&
1530 sval_is_negative(tmp
->max
))
1532 if (tmp
->min
.value
== 0 ||
1533 tmp
->max
.value
== 0)
1535 if (sval_is_negative(tmp
->min
) &&
1538 } END_FOR_EACH_PTR(tmp
);
1545 add_range(&ret
, min
, max
);
1549 struct range_list
*cast_rl(struct symbol
*type
, struct range_list
*rl
)
1551 struct data_range
*tmp
;
1552 struct range_list
*ret
= NULL
;
1559 if (!rl_is_sane(rl
))
1560 return alloc_whole_rl(type
);
1561 if (type
== rl_type(rl
) && rl_type_consistent(rl
))
1564 if (type
== &bool_ctype
)
1565 return cast_to_bool(rl
);
1567 FOR_EACH_PTR(rl
, tmp
) {
1568 add_range_t(type
, &ret
, tmp
->min
, tmp
->max
);
1569 } END_FOR_EACH_PTR(tmp
);
1572 return alloc_whole_rl(type
);
1577 struct range_list
*rl_filter(struct range_list
*rl
, struct range_list
*filter
)
1579 struct data_range
*tmp
;
1581 FOR_EACH_PTR(filter
, tmp
) {
1582 rl
= remove_range(rl
, tmp
->min
, tmp
->max
);
1583 } END_FOR_EACH_PTR(tmp
);
1588 struct range_list
*do_intersection(struct range_list
*one_rl
, struct range_list
*two_rl
)
1590 struct data_range
*one
, *two
;
1591 struct range_list
*ret
= NULL
;
1594 PREPARE_PTR_LIST(one_rl
, one
);
1595 PREPARE_PTR_LIST(two_rl
, two
);
1600 if (sval_cmp(one
->max
, two
->min
) < 0) {
1604 if (sval_cmp(one
->min
, two
->min
) < 0 && sval_cmp(one
->max
, two
->max
) <= 0) {
1605 add_range(&ret
, two
->min
, one
->max
);
1609 if (sval_cmp(one
->min
, two
->min
) >= 0 && sval_cmp(one
->max
, two
->max
) <= 0) {
1610 add_range(&ret
, one
->min
, one
->max
);
1614 if (sval_cmp(one
->min
, two
->min
) < 0 && sval_cmp(one
->max
, two
->max
) > 0) {
1615 add_range(&ret
, two
->min
, two
->max
);
1619 if (sval_cmp(one
->min
, two
->max
) <= 0 && sval_cmp(one
->max
, two
->max
) > 0) {
1620 add_range(&ret
, one
->min
, two
->max
);
1624 if (sval_cmp(one
->min
, two
->max
) <= 0) {
1625 sm_fatal("error calculating intersection of '%s' and '%s'", show_rl(one_rl
), show_rl(two_rl
));
1631 FINISH_PTR_LIST(two
);
1632 FINISH_PTR_LIST(one
);
1637 struct range_list
*rl_intersection(struct range_list
*one
, struct range_list
*two
)
1639 struct range_list
*ret
;
1640 struct symbol
*ret_type
;
1641 struct symbol
*small_type
;
1642 struct symbol
*large_type
;
1647 ret_type
= rl_type(one
);
1648 small_type
= rl_type(one
);
1649 large_type
= rl_type(two
);
1651 if (type_bits(rl_type(two
)) < type_bits(small_type
)) {
1652 small_type
= rl_type(two
);
1653 large_type
= rl_type(one
);
1656 one
= cast_rl(large_type
, one
);
1657 two
= cast_rl(large_type
, two
);
1659 ret
= do_intersection(one
, two
);
1660 return cast_rl(ret_type
, ret
);
1663 static struct range_list
*handle_mod_rl(struct range_list
*left
, struct range_list
*right
)
1668 max
= rl_max(right
);
1669 if (sval_is_max(max
))
1674 if (sval_is_negative(max
))
1676 if (sval_cmp(rl_max(left
), max
) < 0)
1680 return alloc_rl(zero
, max
);
1683 static struct range_list
*get_neg_rl(struct range_list
*rl
)
1685 struct data_range
*tmp
;
1686 struct data_range
*new;
1687 struct range_list
*ret
= NULL
;
1691 if (sval_is_positive(rl_min(rl
)))
1694 FOR_EACH_PTR(rl
, tmp
) {
1695 if (sval_is_positive(tmp
->min
))
1697 if (sval_is_positive(tmp
->max
)) {
1698 new = alloc_range(tmp
->min
, tmp
->max
);
1699 new->max
.value
= -1;
1700 add_range(&ret
, new->min
, new->max
);
1703 add_range(&ret
, tmp
->min
, tmp
->max
);
1704 } END_FOR_EACH_PTR(tmp
);
1709 static struct range_list
*get_pos_rl(struct range_list
*rl
)
1711 struct data_range
*tmp
;
1712 struct data_range
*new;
1713 struct range_list
*ret
= NULL
;
1717 if (sval_is_negative(rl_max(rl
)))
1720 FOR_EACH_PTR(rl
, tmp
) {
1721 if (sval_is_negative(tmp
->max
))
1723 if (sval_is_positive(tmp
->min
)) {
1724 add_range(&ret
, tmp
->min
, tmp
->max
);
1727 new = alloc_range(tmp
->min
, tmp
->max
);
1729 add_range(&ret
, new->min
, new->max
);
1730 } END_FOR_EACH_PTR(tmp
);
1735 static struct range_list
*divide_rl_helper(struct range_list
*left
, struct range_list
*right
)
1737 sval_t right_min
, right_max
;
1740 if (!left
|| !right
)
1743 /* let's assume we never divide by zero */
1744 right_min
= rl_min(right
);
1745 right_max
= rl_max(right
);
1746 if (right_min
.value
== 0 && right_max
.value
== 0)
1748 if (right_min
.value
== 0)
1749 right_min
.value
= 1;
1750 if (right_max
.value
== 0)
1751 right_max
.value
= -1;
1753 max
= sval_binop(rl_max(left
), '/', right_min
);
1754 min
= sval_binop(rl_min(left
), '/', right_max
);
1756 return alloc_rl(min
, max
);
1759 static struct range_list
*handle_divide_rl(struct range_list
*left
, struct range_list
*right
)
1761 struct range_list
*left_neg
, *left_pos
, *right_neg
, *right_pos
;
1762 struct range_list
*neg_neg
, *neg_pos
, *pos_neg
, *pos_pos
;
1763 struct range_list
*ret
;
1765 if (is_whole_rl(right
))
1768 left_neg
= get_neg_rl(left
);
1769 left_pos
= get_pos_rl(left
);
1770 right_neg
= get_neg_rl(right
);
1771 right_pos
= get_pos_rl(right
);
1773 neg_neg
= divide_rl_helper(left_neg
, right_neg
);
1774 neg_pos
= divide_rl_helper(left_neg
, right_pos
);
1775 pos_neg
= divide_rl_helper(left_pos
, right_neg
);
1776 pos_pos
= divide_rl_helper(left_pos
, right_pos
);
1778 ret
= rl_union(neg_neg
, neg_pos
);
1779 ret
= rl_union(ret
, pos_neg
);
1780 return rl_union(ret
, pos_pos
);
1783 static struct range_list
*ptr_add_mult(struct range_list
*left
, int op
, struct range_list
*right
)
1785 struct range_list
*ret
;
1786 sval_t l_sval
, r_sval
, res
;
1789 * This function is sort of the wrong API because it takes two pointer
1790 * and adds them together. The caller is expected to figure out
1791 * alignment. Neither of those are the correct things to do.
1793 * Really this function is quite bogus...
1796 if (rl_to_sval(left
, &l_sval
) && rl_to_sval(right
, &r_sval
)) {
1797 res
= sval_binop(l_sval
, op
, r_sval
);
1798 return alloc_rl(res
, res
);
1801 if (rl_min(left
).value
!= 0 || rl_max(right
).value
!= 0) {
1802 ret
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
1803 return cast_rl(rl_type(left
), ret
);
1806 return alloc_whole_rl(rl_type(left
));
1809 static struct range_list
*handle_add_mult_rl(struct range_list
*left
, int op
, struct range_list
*right
)
1813 if (type_is_ptr(rl_type(left
)) || type_is_ptr(rl_type(right
)))
1814 return ptr_add_mult(left
, op
, right
);
1816 if (sval_binop_overflows(rl_min(left
), op
, rl_min(right
)))
1818 min
= sval_binop(rl_min(left
), op
, rl_min(right
));
1820 if (sval_binop_overflows(rl_max(left
), op
, rl_max(right
)))
1822 max
= sval_binop(rl_max(left
), op
, rl_max(right
));
1824 return alloc_rl(min
, max
);
1827 static struct range_list
*handle_sub_rl(struct range_list
*left_orig
, struct range_list
*right_orig
)
1829 struct range_list
*left_rl
, *right_rl
;
1830 struct symbol
*type
;
1832 sval_t min_ll
, max_ll
, res_ll
;
1835 /* TODO: These things should totally be using dranges where possible */
1837 if (!left_orig
|| !right_orig
)
1841 if (type_positive_bits(rl_type(left_orig
)) > type_positive_bits(type
))
1842 type
= rl_type(left_orig
);
1843 if (type_positive_bits(rl_type(right_orig
)) > type_positive_bits(type
))
1844 type
= rl_type(right_orig
);
1846 left_rl
= cast_rl(type
, left_orig
);
1847 right_rl
= cast_rl(type
, right_orig
);
1849 max
= rl_max(left_rl
);
1850 min
= sval_type_min(type
);
1852 min_ll
= rl_min(left_rl
);
1853 min_ll
.type
= &llong_ctype
;
1854 max_ll
= rl_max(right_rl
);
1855 max_ll
.type
= &llong_ctype
;
1857 res_ll
.value
= min_ll
.value
- max_ll
.value
;
1859 if (!sval_binop_overflows(rl_min(left_rl
), '-', rl_max(right_rl
))) {
1860 tmp
= sval_binop(rl_min(left_rl
), '-', rl_max(right_rl
));
1861 if (sval_cmp(tmp
, min
) > 0)
1863 } else if (type_positive_bits(type
) < 63 &&
1864 !sval_binop_overflows(min_ll
, '-', max_ll
) &&
1865 (min
.value
!= 0 && sval_cmp(res_ll
, min
) >= 0)) {
1866 struct range_list
*left_casted
, *right_casted
, *result
;
1868 left_casted
= cast_rl(&llong_ctype
, left_orig
);
1869 right_casted
= cast_rl(&llong_ctype
, right_orig
);
1870 result
= handle_sub_rl(left_casted
, right_casted
);
1871 return cast_rl(type
, result
);
1874 if (!sval_is_max(rl_max(left_rl
))) {
1875 tmp
= sval_binop(rl_max(left_rl
), '-', rl_min(right_rl
));
1876 if (sval_cmp(tmp
, max
) < 0)
1880 if (sval_is_min(min
) && sval_is_max(max
))
1883 return alloc_rl(min
, max
);
1886 static unsigned long long rl_bits_always_set(struct range_list
*rl
)
1888 return sval_fls_mask(rl_min(rl
));
1891 static unsigned long long rl_bits_maybe_set(struct range_list
*rl
)
1893 return sval_fls_mask(rl_max(rl
));
1896 static struct range_list
*handle_OR_rl(struct range_list
*left
, struct range_list
*right
)
1898 unsigned long long left_min
, left_max
, right_min
, right_max
;
1902 if ((rl_to_sval(left
, &sval
) || rl_to_sval(right
, &sval
)) &&
1903 !sval_binop_overflows(rl_max(left
), '+', rl_max(right
)))
1904 return rl_binop(left
, '+', right
);
1906 left_min
= rl_bits_always_set(left
);
1907 left_max
= rl_bits_maybe_set(left
);
1908 right_min
= rl_bits_always_set(right
);
1909 right_max
= rl_bits_maybe_set(right
);
1911 min
.type
= max
.type
= &ullong_ctype
;
1912 min
.uvalue
= left_min
| right_min
;
1913 max
.uvalue
= left_max
| right_max
;
1915 return cast_rl(rl_type(left
), alloc_rl(min
, max
));
1918 static struct range_list
*handle_XOR_rl(struct range_list
*left
, struct range_list
*right
)
1920 unsigned long long left_set
, left_maybe
;
1921 unsigned long long right_set
, right_maybe
;
1924 left_set
= rl_bits_always_set(left
);
1925 left_maybe
= rl_bits_maybe_set(left
);
1927 right_set
= rl_bits_always_set(right
);
1928 right_maybe
= rl_bits_maybe_set(right
);
1930 zero
= max
= rl_min(left
);
1932 max
.uvalue
= fls_mask((left_maybe
| right_maybe
) ^ (left_set
& right_set
));
1934 return cast_rl(rl_type(left
), alloc_rl(zero
, max
));
1937 static sval_t
sval_lowest_set_bit(sval_t sval
)
1939 sval_t ret
= { .type
= sval
.type
};
1942 for (i
= 0; i
< 64; i
++) {
1943 if (sval
.uvalue
& 1ULL << i
) {
1944 ret
.uvalue
= (1ULL << i
);
1951 static struct range_list
*handle_AND_rl(struct range_list
*left
, struct range_list
*right
)
1953 struct bit_info
*one
, *two
;
1954 struct range_list
*rl
;
1955 sval_t min
, max
, zero
, bits_sval
;
1956 unsigned long long bits
;
1958 one
= rl_to_binfo(left
);
1959 two
= rl_to_binfo(right
);
1960 bits
= one
->possible
& two
->possible
;
1961 bits_sval
= rl_max(left
);
1962 bits_sval
.uvalue
= bits
;
1964 max
= sval_min_nonneg(rl_max(left
), rl_max(right
));
1965 min
= sval_lowest_set_bit(bits_sval
);
1967 rl
= alloc_rl(min
, max
);
1971 add_range(&rl
, zero
, zero
);
1976 static struct range_list
*handle_lshift(struct range_list
*left_orig
, struct range_list
*right_orig
)
1978 struct range_list
*left
;
1979 struct data_range
*tmp
;
1980 struct range_list
*ret
= NULL
;
1981 sval_t zero
= { .type
= rl_type(left_orig
), };
1982 sval_t shift
, min
, max
;
1983 bool add_zero
= false;
1985 if (!rl_to_sval(right_orig
, &shift
) || sval_is_negative(shift
))
1987 if (shift
.value
== 0)
1990 /* Cast to unsigned for easier left shift math */
1991 if (type_positive_bits(rl_type(left_orig
)) < 32)
1992 left
= cast_rl(&uint_ctype
, left_orig
);
1993 else if(type_positive_bits(rl_type(left_orig
)) == 63)
1994 left
= cast_rl(&ullong_ctype
, left_orig
);
1998 FOR_EACH_PTR(left
, tmp
) {
2002 if (min
.value
== 0 || max
.value
> sval_type_max(max
.type
).uvalue
>> shift
.uvalue
)
2004 if (min
.value
== 0 && max
.value
== 0)
2008 min
= sval_binop(min
, SPECIAL_LEFTSHIFT
, shift
);
2009 max
= sval_binop(max
, SPECIAL_LEFTSHIFT
, shift
);
2010 add_range(&ret
, min
, max
);
2011 } END_FOR_EACH_PTR(tmp
);
2013 if (!rl_fits_in_type(ret
, rl_type(left_orig
)))
2015 ret
= cast_rl(rl_type(left_orig
), ret
);
2017 add_range(&ret
, zero
, zero
);
2022 static struct range_list
*handle_rshift(struct range_list
*left_orig
, struct range_list
*right_orig
)
2024 struct data_range
*tmp
;
2025 struct range_list
*ret
= NULL
;
2026 sval_t shift
, min
, max
;
2028 if (!rl_to_sval(right_orig
, &shift
) || sval_is_negative(shift
))
2030 if (shift
.value
== 0)
2033 FOR_EACH_PTR(left_orig
, tmp
) {
2034 min
= sval_binop(tmp
->min
, SPECIAL_RIGHTSHIFT
, shift
);
2035 max
= sval_binop(tmp
->max
, SPECIAL_RIGHTSHIFT
, shift
);
2036 add_range(&ret
, min
, max
);
2037 } END_FOR_EACH_PTR(tmp
);
2042 struct range_list
*rl_binop(struct range_list
*left
, int op
, struct range_list
*right
)
2044 struct symbol
*cast_type
;
2045 sval_t left_sval
, right_sval
;
2046 struct range_list
*ret
= NULL
;
2048 cast_type
= rl_type(left
);
2049 if (sval_type_max(rl_type(left
)).uvalue
< sval_type_max(rl_type(right
)).uvalue
)
2050 cast_type
= rl_type(right
);
2051 if (sval_type_max(cast_type
).uvalue
< INT_MAX
)
2052 cast_type
= &int_ctype
;
2054 left
= cast_rl(cast_type
, left
);
2055 right
= cast_rl(cast_type
, right
);
2057 if (!left
&& !right
)
2060 if (rl_to_sval(left
, &left_sval
) && rl_to_sval(right
, &right_sval
)) {
2061 sval_t val
= sval_binop(left_sval
, op
, right_sval
);
2062 return alloc_rl(val
, val
);
2067 ret
= handle_mod_rl(left
, right
);
2070 ret
= handle_divide_rl(left
, right
);
2074 ret
= handle_add_mult_rl(left
, op
, right
);
2077 ret
= handle_OR_rl(left
, right
);
2080 ret
= handle_XOR_rl(left
, right
);
2083 ret
= handle_AND_rl(left
, right
);
2086 ret
= handle_sub_rl(left
, right
);
2088 case SPECIAL_RIGHTSHIFT
:
2089 return handle_rshift(left
, right
);
2090 case SPECIAL_LEFTSHIFT
:
2091 return handle_lshift(left
, right
);
2097 void free_data_info_allocs(void)
2099 struct allocator_struct
*desc
= &data_info_allocator
;
2100 struct allocation_blob
*blob
= desc
->blobs
;
2106 desc
->allocations
= 0;
2107 desc
->total_bytes
= 0;
2108 desc
->useful_bytes
= 0;
2109 desc
->freelist
= NULL
;
2111 struct allocation_blob
*next
= blob
->next
;
2112 blob_free(blob
, desc
->chunking
);
2115 clear_type_value_cache();
2116 clear_data_range_alloc();
2119 void split_comparison_rl(struct range_list
*left_orig
, int op
, struct range_list
*right_orig
,
2120 struct range_list
**left_true_rl
, struct range_list
**left_false_rl
,
2121 struct range_list
**right_true_rl
, struct range_list
**right_false_rl
)
2123 struct range_list
*left_true
, *left_false
;
2124 struct range_list
*right_true
, *right_false
;
2127 min
= sval_type_min(rl_type(left_orig
));
2128 max
= sval_type_max(rl_type(left_orig
));
2130 left_true
= clone_rl(left_orig
);
2131 left_false
= clone_rl(left_orig
);
2132 right_true
= clone_rl(right_orig
);
2133 right_false
= clone_rl(right_orig
);
2137 case SPECIAL_UNSIGNED_LT
:
2138 left_true
= remove_range(left_orig
, rl_max(right_orig
), max
);
2139 if (!sval_is_min(rl_min(right_orig
))) {
2140 left_false
= remove_range(left_orig
, min
, sub_one(rl_min(right_orig
)));
2143 right_true
= remove_range(right_orig
, min
, rl_min(left_orig
));
2144 if (!sval_is_max(rl_max(left_orig
)))
2145 right_false
= remove_range(right_orig
, add_one(rl_max(left_orig
)), max
);
2147 case SPECIAL_UNSIGNED_LTE
:
2149 if (!sval_is_max(rl_max(right_orig
)))
2150 left_true
= remove_range(left_orig
, add_one(rl_max(right_orig
)), max
);
2151 left_false
= remove_range(left_orig
, min
, rl_min(right_orig
));
2153 if (!sval_is_min(rl_min(left_orig
)))
2154 right_true
= remove_range(right_orig
, min
, sub_one(rl_min(left_orig
)));
2155 right_false
= remove_range(right_orig
, rl_max(left_orig
), max
);
2157 if (sval_cmp(rl_min(left_orig
), rl_min(right_orig
)) == 0)
2158 left_false
= remove_range(left_false
, rl_min(left_orig
), rl_min(left_orig
));
2159 if (sval_cmp(rl_max(left_orig
), rl_max(right_orig
)) == 0)
2160 right_false
= remove_range(right_false
, rl_max(left_orig
), rl_max(left_orig
));
2163 left_true
= rl_intersection(left_orig
, right_orig
);
2164 right_true
= clone_rl(left_true
);
2166 if (sval_cmp(rl_min(right_orig
), rl_max(right_orig
)) == 0)
2167 left_false
= remove_range(left_orig
, rl_min(right_orig
), rl_min(right_orig
));
2168 if (sval_cmp(rl_min(left_orig
), rl_max(left_orig
)) == 0)
2169 right_false
= remove_range(right_orig
, rl_min(left_orig
), rl_min(left_orig
));
2171 case SPECIAL_UNSIGNED_GTE
:
2173 if (!sval_is_min(rl_min(right_orig
)))
2174 left_true
= remove_range(left_orig
, min
, sub_one(rl_min(right_orig
)));
2175 left_false
= remove_range(left_orig
, rl_max(right_orig
), max
);
2177 if (!sval_is_max(rl_max(left_orig
)))
2178 right_true
= remove_range(right_orig
, add_one(rl_max(left_orig
)), max
);
2179 right_false
= remove_range(right_orig
, min
, rl_min(left_orig
));
2181 if (sval_cmp(rl_min(left_orig
), rl_min(right_orig
)) == 0)
2182 right_false
= remove_range(right_false
, rl_min(left_orig
), rl_min(left_orig
));
2183 if (sval_cmp(rl_max(left_orig
), rl_max(right_orig
)) == 0)
2184 left_false
= remove_range(left_false
, rl_max(left_orig
), rl_max(left_orig
));
2187 case SPECIAL_UNSIGNED_GT
:
2188 left_true
= remove_range(left_orig
, min
, rl_min(right_orig
));
2189 if (!sval_is_max(rl_max(right_orig
)))
2190 left_false
= remove_range(left_orig
, add_one(rl_max(right_orig
)), max
);
2192 right_true
= remove_range(right_orig
, rl_max(left_orig
), max
);
2193 if (!sval_is_min(rl_min(left_orig
)))
2194 right_false
= remove_range(right_orig
, min
, sub_one(rl_min(left_orig
)));
2196 case SPECIAL_NOTEQUAL
:
2197 left_false
= rl_intersection(left_orig
, right_orig
);
2198 right_false
= clone_rl(left_false
);
2200 if (sval_cmp(rl_min(right_orig
), rl_max(right_orig
)) == 0)
2201 left_true
= remove_range(left_orig
, rl_min(right_orig
), rl_min(right_orig
));
2202 if (sval_cmp(rl_min(left_orig
), rl_max(left_orig
)) == 0)
2203 right_true
= remove_range(right_orig
, rl_min(left_orig
), rl_min(left_orig
));
2206 sm_perror(" unhandled comparison %d", op
);
2210 *left_true_rl
= left_true
;
2211 *left_false_rl
= left_false
;
2213 if (right_true_rl
) {
2214 *right_true_rl
= right_true
;
2215 *right_false_rl
= right_false
;