Merge remote-tracking branch 'origin/caheckman_pushvalue' into

caheckman_loadguard

Ghidra/Features/Decompiler/src/decompile/cpp/address.cc

@@ -696,6 +696,34 @@ int4 mostsigbit_set(uintb val)
   return res;
 }
 
+/// Count the number of more significant zero bits before the most significant
+/// one bit in the representation of the given value;
+/// \param val is the given value
+/// \return the number of zero bits
+int4 count_leading_zeros(uintb val)
+
+{
+  if (val == 0)
+    return 8*sizeof(uintb);
+  uintb mask = ~((uintb)0);
+  int4 maskSize = 4*sizeof(uintb);
+  mask &= (mask << maskSize);
+  int4 bit = 0;
+
+  do {
+    if ((mask & val)==0) {
+      bit += maskSize;
+      maskSize >>= 1;
+      mask |= (mask >> maskSize);
+    }
+    else {
+      maskSize >>= 1;
+      mask &= (mask << maskSize);
+    }
+  } while(maskSize != 0);
+  return bit;
+}
+
 /// Return smallest number of form 2^n-1, bigger or equal to the given value
 /// \param val is the given value
 /// \return the mask

Ghidra/Features/Decompiler/src/decompile/cpp/address.hh

@@ -482,7 +482,7 @@ inline uintb pcode_left(uintb val,int4 sa) {
   return val << sa;
 }
 
-extern bool signbit_negative(uintb val,int4 size);	///< Return true if the sign-big is set
+extern bool signbit_negative(uintb val,int4 size);	///< Return true if the sign-bit is set
 extern uintb calc_mask(int4 size);			///< Calculate a mask for a given byte size
 extern uintb uintb_negate(uintb in,int4 size);		///< Negate the \e sized value
 extern uintb sign_extend(uintb in,int4 sizein,int4 sizeout);	///< Sign-extend a value between two byte sizes
@@ -493,7 +493,8 @@ extern void byte_swap(intb &val,int4 size);		///< Swap bytes in the given value
 
 extern uintb byte_swap(uintb val,int4 size);		///< Return the given value with bytes swapped
 extern int4 leastsigbit_set(uintb val);			///< Return index of least significant bit set in given value
-extern int4 mostsigbit_set(uintb val);			///< Return index of most significant bit set in given val
+extern int4 mostsigbit_set(uintb val);			///< Return index of most significant bit set in given value
+extern int4 count_leading_zeros(uintb val);		///< Return the number of leading zero bits in the given value
 
 extern uintb coveringmask(uintb val);			///< Return a mask that \e covers the given value
 extern int4 bit_transitions(uintb val,int4 sz);		///< Calculate the number of bit transitions in the sized value

Ghidra/Features/Decompiler/src/decompile/cpp/block.cc

@@ -369,6 +369,31 @@ bool FlowBlock::dominates(const FlowBlock *subBlock) const
   return false;
 }
 
+/// \brief Check if the condition from the given block holds for \b this block
+///
+/// We assume the given block has 2 out-edges and that \b this block is immediately reached by
+/// one of these two edges. Some condition holds when traversing the out-edge to \b this, and the complement
+/// of the condition holds for traversing the other out-edge. We verify that the condition holds for
+/// this entire block.  More specifically, we check that that there is no path to \b this through the
+/// sibling edge, where the complement of the condition holds (unless we loop back through the conditional block).
+/// \param cond is the conditional block with 2 out-edges
+/// \return \b true if the condition holds for this block
+bool FlowBlock::restrictedByConditional(const FlowBlock *cond) const
+
+{
+  if (sizeIn() == 1) return true;	// Its impossible for any path to come through sibling to this
+  if (getImmedDom() != cond) return false;	// This is not dominated by conditional block at all
+  for(int4 i=0;i<sizeIn();++i) {
+    const FlowBlock *inBlock = getIn(i);
+    if (inBlock == cond) continue;	// The unique edge from cond to this
+    while(inBlock != this) {
+      if (inBlock == cond) return false;	// Must have come through sibling
+      inBlock = inBlock->getImmedDom();
+    }
+  }
+  return true;
+}
+
 /// \return \b true if \b this is the top of a loop
 bool FlowBlock::hasLoopIn(void) const
 

Ghidra/Features/Decompiler/src/decompile/cpp/block.hh

@@ -215,6 +215,7 @@ public:
   FlowBlock *getFrontLeaf(void);					///< Get the first leaf FlowBlock
   int4 calcDepth(const FlowBlock *leaf) const;		///< Get the depth of the given component FlowBlock
   bool dominates(const FlowBlock *subBlock) const;	///< Does \b this block dominate the given block
+  bool restrictedByConditional(const FlowBlock *cond) const;
   int4 sizeOut(void) const { return outofthis.size(); }	///< Get the number of out edges
   int4 sizeIn(void) const { return intothis.size(); }	///< Get the number of in edges
   bool hasLoopIn(void) const;				///< Is there a looping edge coming into \b this block

Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.cc

@@ -3246,7 +3246,7 @@ int4 ActionConditionalConst::apply(Funcdata &data)
     if (flipEdge)
       constEdge = 1 - constEdge;
     FlowBlock *constBlock = bl->getOut(constEdge);
-    if (constBlock->sizeIn() != 1) continue;	// Must only be one path to constant block directly through CBRANCH
+    if (!constBlock->restrictedByConditional(bl)) continue;	// Make sure condition holds
     propagateConstant(varVn,constVn,constBlock,data);
   }
   return 0;

Ghidra/Features/Decompiler/src/decompile/cpp/ifacedecomp.cc

@@ -129,6 +129,7 @@ void IfaceDecompCapability::registerCommands(IfaceStatus *status)
   status->registerCom(new IfcVolatile(),"volatile");
   status->registerCom(new IfcPreferSplit(),"prefersplit");
   status->registerCom(new IfcStructureBlocks(),"structure","blocks");
+  status->registerCom(new IfcAnalyzeRange(), "analyze","range");
 #ifdef CPUI_RULECOMPILE
   status->registerCom(new IfcParseRule(),"parse","rule");
   status->registerCom(new IfcExperimentalRules(),"experimental","rules");
@@ -2474,6 +2475,56 @@ void IfcCountPcode::execute(istream &s)
   *status->optr << "Count - pcode = " << dec << count << endl;
 }
 
+void IfcAnalyzeRange::execute(istream &s)
+
+{
+  if (dcp->conf == (Architecture *)0)
+    throw IfaceExecutionError("Image not loaded");
+  if (dcp->fd == (Funcdata *)0)
+    throw IfaceExecutionError("No function selected");
+
+  bool useFullWidener;
+  string token;
+  s >> ws >> token;
+  if (token == "full")
+    useFullWidener = true;
+  else if (token == "partial") {
+    useFullWidener = false;
+  }
+  else
+    throw IfaceParseError("Must specify \"full\" or \"partial\" widening");
+  Varnode *vn = iface_read_varnode(dcp,s);
+  vector<Varnode *> sinks;
+  vector<PcodeOp *> reads;
+  sinks.push_back(vn);
+  for(list<PcodeOp *>::const_iterator iter=vn->beginDescend();iter!=vn->endDescend();++iter) {
+    PcodeOp *op = *iter;
+    if (op->code() == CPUI_LOAD || op->code() == CPUI_STORE)
+      reads.push_back(op);
+  }
+  Varnode *stackReg = dcp->fd->findSpacebaseInput(dcp->conf->getStackSpace());
+  ValueSetSolver vsSolver;
+  vsSolver.establishValueSets(sinks, reads, stackReg, false);
+  if (useFullWidener) {
+    WidenerFull widener;
+    vsSolver.solve(10000,widener);
+  }
+  else {
+    WidenerNone widener;
+    vsSolver.solve(10000,widener);
+  }
+  list<ValueSet>::const_iterator iter;
+  for(iter=vsSolver.beginValueSets();iter!=vsSolver.endValueSets();++iter) {
+    (*iter).printRaw(*status->optr);
+    *status->optr << endl;
+  }
+  map<SeqNum,ValueSetRead>::const_iterator riter;
+  for(riter=vsSolver.beginValueSetReads();riter!=vsSolver.endValueSetReads();++riter) {
+    (*riter).second.printRaw(*status->optr);
+    *status->optr << endl;
+  }
+}
+
 #ifdef OPACTION_DEBUG
 
 void IfcDebugAction::execute(istream &s)

Ghidra/Features/Decompiler/src/decompile/cpp/ifacedecomp.hh

@@ -541,6 +541,11 @@ public:
   virtual void execute(istream &s);
 };
 
+class IfcAnalyzeRange : public IfaceDecompCommand {
+public:
+  virtual void execute(istream &s);
+};
+
 #ifdef CPUI_RULECOMPILE
 class IfcParseRule : public IfaceDecompCommand {
 public:

Ghidra/Features/Decompiler/src/decompile/cpp/jumptable.cc

@@ -231,11 +231,19 @@ void EmulateFunction::collectLoadPoints(vector<LoadTable> &res) const
   }
 }
 
+/// The starting value for the range and the step is preserved.  The
+/// ending value is set so there are exactly the given number of elements
+/// in the range.
+/// \param nm is the given number
 void JumpValuesRange::truncate(int4 nm)
 
 {
-  // FIXME: This doesn't work if there is a stride
-  range = CircleRange(range.getMin(),range.getMin() + (nm-1),range.getMask());
+  int4 rangeSize = 8*sizeof(uintb) - count_leading_zeros(range.getMask());
+  rangeSize >>= 3;
+  uintb left = range.getMin();
+  int4 step = range.getStep();
+  uintb right = (left + step * nm) & range.getMask();
+  range.setRange(left, right, rangeSize, step);
 }
 
 uintb JumpValuesRange::getSize(void) const
@@ -403,18 +411,21 @@ bool JumpBasic::ispoint(Varnode *vn)
   return true;
 }
 
-void JumpBasic::setStride(Varnode *vn,CircleRange &rng)
+/// If the some of the least significant bits of the given Varnode are known to
+/// be zero, translate this into a stride for the jumptable range.
+/// \param vn is the given Varnode
+/// \return the calculated stride = 1,2,4,...
+int4 JumpBasic::getStride(Varnode *vn)
 
 {
   uintb mask = vn->getNZMask();
-  int4 stride = 0;
+  int4 stride = 1;
   while((mask&1)==0) {
     mask >>= 1;
-    stride += 1;
+    stride <<= 1;
   }
-  if (stride==0) return;
-  if (stride > 6) return;
-  rng.setStride(stride);
+  if (stride > 32) return 1;
+  return stride;
 }
 
 uintb JumpBasic::backup2Switch(Funcdata *fd,uintb output,Varnode *outvn,Varnode *invn)
@@ -915,23 +926,25 @@ void JumpBasic::calcRange(Varnode *vn,CircleRange &rng) const
   // by using the precalculated guard ranges.
 
   // Get an initial range, based on the size/type of -vn-
+  int4 stride = 1;
   if (vn->isConstant())
     rng = CircleRange(vn->getOffset(),vn->getSize());
   else if (vn->isWritten() && vn->getDef()->isBoolOutput())
-    rng = CircleRange(0,1,1);	// Only 0 or 1 possible
+    rng = CircleRange(0,2,1,1);	// Only 0 or 1 possible
   else {			// Should we go ahead and use nzmask in all cases?
-    uintb mask = calc_mask(vn->getSize());
+    uintb maxValue = 0;		// Every possible value
     if (vn->isWritten()) {
       PcodeOp *andop = vn->getDef();
       if (andop->code() == CPUI_INT_AND) {
 	Varnode *constvn = andop->getIn(1);
 	if (constvn->isConstant()) {
-	  mask = coveringmask( constvn->getOffset() );
+	  maxValue = coveringmask( constvn->getOffset() );
+	  maxValue = (maxValue + 1) & calc_mask(vn->getSize());
 	}
       }
     }
-    rng = CircleRange(0,mask,mask);
-    setStride(vn,rng);
+    stride = getStride(vn);
+    rng = CircleRange(0,maxValue,vn->getSize(),stride);
   }
 
   // Intersect any guard ranges which apply to -vn-
@@ -950,7 +963,7 @@ void JumpBasic::calcRange(Varnode *vn,CircleRange &rng) const
   // in which case the guard might not check for it. If the
   // size is too big, we try only positive values
   if (rng.getSize() > 0x10000) {
-    CircleRange positive(0,rng.getMask()>>1,rng.getMask());
+    CircleRange positive(0,(rng.getMask()>>1)+1,vn->getSize(),stride);
     positive.intersect(rng);
     if (!positive.isEmpty())
       rng = positive;

Ghidra/Features/Decompiler/src/decompile/cpp/jumptable.hh

@@ -145,7 +145,7 @@ public:
   void setRange(const CircleRange &rng) { range = rng; }
   void setStartVn(Varnode *vn) { normqvn = vn; }
   void setStartOp(PcodeOp *op) { startop = op; }
-  virtual void truncate(int4 nm);
+  virtual void truncate(int4 nm);		///< Truncate the number of values to the given number
   virtual uintb getSize(void) const;
   virtual bool contains(uintb val) const;
   virtual bool initializeForReading(void) const;
@@ -233,7 +233,7 @@ protected:
   Varnode *switchvn;			// The unnormalized switch varnode
   static bool isprune(Varnode *vn);
   static bool ispoint(Varnode *vn);
-  static void setStride(Varnode *vn,CircleRange &rng);
+  static int4 getStride(Varnode *vn);	///< Get the step/stride associated with the Varnode
   static uintb backup2Switch(Funcdata *fd,uintb output,Varnode *outvn,Varnode *invn);
   void findDeterminingVarnodes(PcodeOp *op,int4 slot);
   void analyzeGuards(BlockBasic *bl,int4 pathout);

Ghidra/Features/Decompiler/src/decompile/cpp/rangeutil.hh

@@ -51,35 +51,269 @@ class CircleRange {
   uintb mask;			///< Bit mask defining the size (modulus) and stop of the range
   bool isempty;			///< \b true if set is empty
   int4 step;			///< Explicit step size
-  int4 shift;			///< Number of bits in step.  Equal to log2(step)
   static const char arrange[];	///< Map from raw overlaps to normalized overlap code
-  void calcStepShift(void);	///< Calculate explicit \b step and \b skip from \b mask
+  void normalize(void);		///< Normalize the representation of full sets
   void complement(void);	///< Set \b this to the complement of itself
-  void convertToBoolean(void);	///< Convert \b this to boolean.
-  static bool newStride(uintb newmask,uintb &myleft,uintb &myright);	///< Recalculate range based on new size and stride
+  bool convertToBoolean(void);	///< Convert \b this to boolean.
+  static bool newStride(uintb mask,int4 step,int4 oldStep,uint4 rem,uintb &myleft,uintb &myright);
+  static bool newDomain(uintb newMask,int4 newStep,uintb &myleft,uintb &myright);
   static char encodeRangeOverlaps(uintb op1left,uintb op1right,uintb op2left,uintb op2right);	///< Calculate overlap code
 public:
   CircleRange(void) { isempty=true; }		///< Construct an empty range
-  CircleRange(uintb mn,uintb mx,uintb m);	///< Construct given specific boundaries.
+  CircleRange(uintb lft,uintb rgt,int4 size,int4 stp);	///< Construct given specific boundaries.
   CircleRange(bool val);			///< Construct a boolean range
   CircleRange(uintb val,int4 size);		///< Construct range with single value
+  void setRange(uintb lft,uintb rgt,int4 size,int4 step);	///< Set directly to a specific range
+  void setRange(uintb val,int4 size);		///< Set range with a single value
+  void setFull(int4 size);			///< Set a completely full range
   bool isEmpty(void) const { return isempty; }	///< Return \b true if \b this range is empty
+  bool isFull(void) const { return ((!isempty) && (step == 1) && (left == right)); }	///< Return \b true if \b this contains all possible values
+  bool isSingle(void) const { return (!isempty) && (right == ((left + step)& mask)); }	///< Return \b true if \b this contains single value
   uintb getMin(void) const { return left; }	///< Get the left boundary of the range
   uintb getMax(void) const { return (right-step)&mask; }	///< Get the right-most integer contained in the range
   uintb getEnd(void) const { return right; }	///< Get the right boundary of the range
   uintb getMask(void) const { return mask; }	///< Get the mask
   uintb getSize(void) const;			///< Get the size of this range
+  int4 getStep(void) const { return step; }	///< Get the step for \b this range
+  int4 getMaxInfo(void) const;			///< Get maximum information content of range
+  bool operator==(const CircleRange &op2) const;	///< Equals operator
   bool getNext(uintb &val) const { val = (val+step)&mask; return (val!=right); }	///< Advance an integer within the range
   bool contains(const CircleRange &op2) const;	///< Check containment of another range in \b this.
   bool contains(uintb val) const;		///< Check containment of a specific integer.
   int4 intersect(const CircleRange &op2);	///< Intersect \b this with another range
   bool setNZMask(uintb nzmask,int4 size);	///< Set the range based on a putative mask.
   int4 circleUnion(const CircleRange &op2);	///< Union two ranges.
-  void setStride(int4 newshift);		///< Set a new stride on \b this range.
+  bool minimalContainer(const CircleRange &op2,int4 maxStep);	///< Construct minimal range that contains both \b this and another range
+  int4 invert(void);				///< Convert to complementary range
+  void setStride(int4 newStep,uintb rem);	///< Set a new step on \b this range.
+  bool pullBackUnary(OpCode opc,int4 inSize,int4 outSize);	///< Pull-back \b this through the given unary operator
+  bool pullBackBinary(OpCode opc,uintb val,int4 slot,int4 inSize,int4 outSize);	///< Pull-back \b this thru binary operator
   Varnode *pullBack(PcodeOp *op,Varnode **constMarkup,bool usenzmask);	///< Pull-back \b this range through given PcodeOp.
+  bool pushForwardUnary(OpCode opc,const CircleRange &in1,int4 inSize,int4 outSize);	///< Push-forward thru given unary operator
+  bool pushForwardBinary(OpCode opc,const CircleRange &in1,const CircleRange &in2,int4 inSize,int4 outSize,int4 maxStep);
+  bool pushForwardTrinary(OpCode opc,const CircleRange &in1,const CircleRange &in2,const CircleRange &in3,
+			  int4 inSize,int4 outSize,int4 maxStep);
+  void widen(const CircleRange &op2,bool leftIsStable);	///< Widen the unstable bound to match containing range
   int4 translate2Op(OpCode &opc,uintb &c,int4 &cslot) const;	///< Translate range to a comparison op
+  void printRaw(ostream &s) const;		///< Write a text representation of \b this to stream
 };
 
+class Partition;		// Forward declaration
+class Widener;			// Forward declaration
+
+/// \brief A range of values attached to a Varnode within a data-flow subsystem
+///
+/// This class acts as both the set of values for the Varnode and as a node in a
+/// sub-graph overlaying the full data-flow of the function containing the Varnode.
+/// The values are stored in the CircleRange field and can be interpreted either as
+/// absolute values (if \b typeCode is 0) or as values relative to a stack pointer
+/// or some other register (if \b typeCode is non-zero).
+class ValueSet {
+public:
+  static const int4 MAX_STEP;	///< Maximum step inferred for a value set
+  /// \brief An external that can be applied to a ValueSet
+  ///
+  /// An Equation is attached to a particular ValueSet and its underlying Varnode
+  /// providing additional restriction on the ValueSet of an input parameter of the
+  /// operation producing the Varnode.
+  class Equation {
+    friend class ValueSet;
+    int4 slot;			///< The input parameter slot to which the constraint is attached
+    int4 typeCode;		///< The constraint characteristic 0=absolute 1=relative to a spacebase register
+    CircleRange range;		///< The range constraint
+  public:
+    Equation(int4 s,int4 tc,const CircleRange &rng) { slot=s; typeCode = tc; range = rng; }	///< Constructor
+  };
+private:
+  friend class ValueSetSolver;
+  int4 typeCode;	///< 0=pure constant 1=stack relative
+  int4 numParams;	///< Number of input parameters to defining operation
+  int4 count;		///< Depth first numbering / widening count
+  OpCode opCode;	///< Op-code defining Varnode
+  bool leftIsStable;	///< Set to \b true if left boundary of range didn't change (last iteration)
+  bool rightIsStable;	///< Set to \b true if right boundary of range didn't change (last iteration)
+  Varnode *vn;		///< Varnode whose set this represents
+  CircleRange range;	///< Range of values or offsets in this set
+  vector<Equation> equations;	///< Any equations associated with this value set
+  Partition *partHead;	///< If Varnode is a component head, pointer to corresponding Partition
+  ValueSet *next;	///< Next ValueSet to iterate
+  bool doesEquationApply(int4 num,int4 slot) const;	///< Does the indicated equation apply for the given input slot
+  void setFull(void) { range.setFull(vn->getSize()); typeCode = 0; }	///< Mark value set as possibly containing any value
+  void setVarnode(Varnode *v,int4 tCode);	///< Attach \b this to given Varnode and set initial values
+  void addEquation(int4 slot,int4 type,const CircleRange &constraint);	///< Insert an equation restricting \b this value set
+  void addLandmark(int4 type,const CircleRange &constraint) { addEquation(numParams,type,constraint); }	///< Add a widening landmark
+  bool computeTypeCode(void);	///< Figure out if \b this value set is absolute or relative
+  bool iterate(Widener &widener);	///< Regenerate \b this value set from operator inputs
+public:
+  int4 getCount(void) const { return count; }		///< Get the current iteration count
+  const CircleRange *getLandMark(void) const;		///< Get any \e landmark range
+  int4 getTypeCode(void) const { return typeCode; }	///< Return '0' for normal constant, '1' for spacebase relative
+  Varnode *getVarnode(void) const { return vn; }	///< Get the Varnode attached to \b this ValueSet
+  const CircleRange &getRange(void) const { return range; }	///< Get the actual range of values
+  bool isLeftStable(void) const { return leftIsStable; }
+  bool isRightStable(void) const { return rightIsStable; }
+  void printRaw(ostream &s) const;		///< Write a text description of \b to the given stream
+};
+
+/// \brief A range of nodes (within the weak topological ordering) that are iterated together
+class Partition {
+  friend class ValueSetSolver;
+  ValueSet *startNode;		///< Starting node of component
+  ValueSet *stopNode;		///< Ending node of component
+  bool isDirty;			///< Set to \b true if a node in \b this component has changed this iteration
+public:
+  Partition(void) {
+    startNode = (ValueSet *)0; stopNode = (ValueSet *)0; isDirty = false;
+  }				///< Construct empty partition
+};
+
+/// \brief A special form of ValueSet associated with the \e read \e point of a Varnode
+///
+/// When a Varnode is read, it may have a more restricted range at the point of the read
+/// compared to the full scope. This class officially stores the value set at the point
+/// of the read (specified by PcodeOp and slot).  It is computed as a final step after
+/// the main iteration has completed.
+class ValueSetRead {
+  friend class ValueSetSolver;
+  int4 typeCode;	///< 0=pure constant 1=stack relative
+  int4 slot;		///< The slot being read
+  PcodeOp *op;		///< The PcodeOp at the point of the value set read
+  CircleRange range;	///< Range of values or offsets in this set
+  CircleRange equationConstraint;	///< Constraint associated with the equation
+  int4 equationTypeCode;	///< Type code of the associated equation
+  bool leftIsStable;	///< Set to \b true if left boundary of range didn't change (last iteration)
+  bool rightIsStable;	///< Set to \b true if right boundary of range didn't change (last iteration)
+  void setPcodeOp(PcodeOp *o,int4 slt);	///< Establish \e read this value set corresponds to
+  void addEquation(int4 slt,int4 type,const CircleRange &constraint);	///< Insert an equation restricting \b this value set
+public:
+  int4 getTypeCode(void) const { return typeCode; }	///< Return '0' for normal constant, '1' for spacebase relative
+  const CircleRange &getRange(void) const { return range; }	///< Get the actual range of values
+  bool isLeftStable(void) const { return leftIsStable; }
+  bool isRightStable(void) const { return rightIsStable; }
+  void compute(void);			///< Compute \b this value set
+  void printRaw(ostream &s) const;	///< Write a text description of \b to the given stream
+};
+
+class Widener {
+public:
+  virtual ~Widener(void) {}	///< Destructor
+
+  /// \brief Upon entering a fresh partition, determine how the given ValueSet count should be reset
+  ///
+  /// \param valueSet is the given value set
+  /// \return the value of the iteration counter to reset to
+  virtual int4 determineIterationReset(const ValueSet &valueSet)=0;
+
+  /// \brief Check if the given value set has been frozen for the remainder of the iteration process
+  ///
+  /// \param valueSet is the given value set
+  /// \return \b true if the valueSet will no longer change
+  virtual bool checkFreeze(const ValueSet &valueSet)=0;
+
+  /// \brief For an iteration that isn't stabilizing attempt to widen the given ValueSet
+  ///
+  /// Change the given range based on its previous iteration so that it stabilizes more
+  /// rapidly on future iterations.
+  /// \param valueSet is the given value set
+  /// \param range is the previous form of the given range (and storage for the widening result)
+  /// \param newRange is the current iteration of the given range
+  /// \return \b true if widening succeeded
+  virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange)=0;
+};
+
+/// \brief Class for doing normal widening
+///
+/// Widening is attempted at a specific iteration. If a landmark is available, it is used
+/// to do a controlled widening, holding the stable range boundary constant. Otherwise a
+/// full range is produced.  At a later iteration, a full range is produced automatically.
+class WidenerFull : public Widener {
+  int4 widenIteration;		///< The iteration at which widening is attempted
+  int4 fullIteration;		///< The iteration at which a full range is produced
+public:
+  WidenerFull(void) { widenIteration = 2; fullIteration = 5; }	///< Constructor with default iterations
+  WidenerFull(int4 wide,int4 full) { widenIteration = wide; fullIteration = full; }	///< Constructor specifying iterations
+  virtual int4 determineIterationReset(const ValueSet &valueSet);
+  virtual bool checkFreeze(const ValueSet &valueSet);
+  virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange);
+};
+
+class WidenerNone : public Widener {
+  int4 freezeIteration;		///< The iteration at which all change ceases
+public:
+  WidenerNone(void) { freezeIteration = 3; }
+  virtual int4 determineIterationReset(const ValueSet &valueSet);
+  virtual bool checkFreeze(const ValueSet &valueSet);
+  virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange);
+};
+
+/// \brief Class the determines a ValueSet for each Varnode in a data-flow system
+///
+/// This class uses \e value \e set \e analysis to calculate (an overestimation of)
+/// the range of values that can reach each Varnode.  The system is formed by providing
+/// a set of Varnodes for which the range is desired (the sinks) via establishValueSets().
+/// This creates a system of Varnodes (within the single function) that can flow to the sinks.
+/// Running the method solve() does the analysis, and the caller can examine the results
+/// by examining the ValueSet attached to any of the Varnodes in the system (via Varnode::getValueSet()).
+class ValueSetSolver {
+  /// \brief An iterator over out-bound edges for a single ValueSet node in a data-flow system
+  ///
+  /// This is a helper class for walking a collection of ValueSets as a graph.
+  /// Mostly the graph mirrors the data-flow of the Varnodes underlying the ValueSets, but
+  /// there is support for a simulated root node. This class acts as an iterator over the outgoing
+  /// edges of a particular ValueSet in the graph.
+  class ValueSetEdge {
+    const vector<ValueSet *> *rootEdges;		///< The list of nodes attached to the simulated root node (or NULL)
+    int4 rootPos;					///< The iterator position for the simulated root node
+    Varnode *vn;					///< The Varnode attached to a normal ValueSet node (or NULL)
+    list<PcodeOp *>::const_iterator iter;		///< The iterator position for a normal ValueSet node
+  public:
+    ValueSetEdge(ValueSet *node,const vector<ValueSet *> &roots);
+    ValueSet *getNext(void);
+  };
+
+  list<ValueSet> valueNodes;		///< Storage for all the current value sets
+  map<SeqNum,ValueSetRead> readNodes;	///< Additional, after iteration, add-on value sets
+  Partition orderPartition;		///< Value sets in iteration order
+  list<Partition> recordStorage;	///< Storage for the Partitions establishing components
+  vector<ValueSet *> rootNodes;		///< Values treated as inputs
+  vector<ValueSet *> nodeStack;		///< Stack used to generate the topological ordering
+  int4 depthFirstIndex;			///< (Global) depth first numbering for topological ordering
+  int4 numIterations;			///< Count of individual ValueSet iterations
+  int4 maxIterations;			///< Maximum number of iterations before forcing termination
+  void newValueSet(Varnode *vn,int4 tCode);		///< Allocate storage for a new ValueSet
+  static void partitionPrepend(ValueSet *vertex,Partition &part);	///< Prepend a vertex to a partition
+  static void partitionPrepend(const Partition &head,Partition &part);	///< Prepend full Partition to given Partition
+  void partitionSurround(Partition &part);				///< Create a full partition component
+  void component(ValueSet *vertex,Partition &part);		///< Generate a partition component given its head
+  int4 visit(ValueSet *vertex,Partition &part);			///< Recursively walk the data-flow graph finding partitions
+  void establishTopologicalOrder(void);				///< Find the optimal order for iterating through the ValueSets
+  void applyConstraints(Varnode *vn,int4 type,const CircleRange &range,PcodeOp *cbranch);
+  void constraintsFromPath(int4 type,CircleRange &lift,Varnode *startVn,Varnode *endVn,PcodeOp *cbranch);
+  void constraintsFromCBranch(PcodeOp *cbranch);		///< Generate constraints arising from the given branch
+  void generateConstraints(const vector<Varnode *> &worklist,const vector<PcodeOp *> &reads);	///< Generate constraints given a system of Varnodes
+  bool checkRelativeConstant(Varnode *vn,int4 &typeCode,uintb &value) const;	///< Check if the given Varnode is a \e relative constant
+  void generateRelativeConstraint(PcodeOp *compOp,PcodeOp *cbranch);	///< Try to find a \e relative constraint
+public:
+  void establishValueSets(const vector<Varnode *> &sinks,const vector<PcodeOp *> &reads,Varnode *stackReg,bool indirectAsCopy);
+  int4 getNumIterations(void) const { return numIterations; }	///< Get the current number of iterations
+  void solve(int4 max,Widener &widener);			///< Iterate the ValueSet system until it stabilizes
+  list<ValueSet>::const_iterator beginValueSets(void) const { return valueNodes.begin(); }	///< Start of all ValueSets in the system
+  list<ValueSet>::const_iterator endValueSets(void) const { return valueNodes.end(); }	///< End of all ValueSets in the system
+  map<SeqNum,ValueSetRead>::const_iterator beginValueSetReads(void) const { return readNodes.begin(); }	///< Start of ValueSetReads
+  map<SeqNum,ValueSetRead>::const_iterator endValueSetReads(void) const { return readNodes.end(); }	///< End of ValueSetReads
+  const ValueSetRead &getValueSetRead(const SeqNum &seq) { return (*readNodes.find(seq)).second; }	///< Get ValueSetRead by SeqNum
+};
+
+/// \param op2 is the range to compare \b this to
+/// \return \b true if the two ranges are equal
+inline bool CircleRange::operator==(const CircleRange &op2) const
+
+{
+  if (isempty != op2.isempty) return false;
+  if (isempty) return true;
+  return (left == op2.left) && (right == op2.right) && (mask == op2.mask) && (step == op2.step);
+}
+
 /// If two ranges are labeled [l , r) and  [op2.l, op2.r), the
 /// overlap of the ranges can be characterized by listing the four boundary
 /// values  in order, as the circle is traversed in a clock-wise direction.  This characterization can be
@@ -111,4 +345,43 @@ inline char CircleRange::encodeRangeOverlaps(uintb op1left, uintb op1right, uint
   return arrange[val];
 }
 
+/// Perform basic checks that the selected Equation exists and applies
+/// to the indicated input slot.
+/// \param num is the index selecting an Equation
+/// \param slot is the indicated slot
+/// \return \b true if the Equation exists and applies
+inline bool ValueSet::doesEquationApply(int4 num,int4 slot) const
+
+{
+  if (num < equations.size()) {
+    if (equations[num].slot == slot) {
+      if (equations[num].typeCode == typeCode)
+	return true;
+    }
+  }
+  return false;
+}
+
+/// \param vertex is the node that will be prepended
+/// \param part is the Partition being modified
+inline void ValueSetSolver::partitionPrepend(ValueSet *vertex,Partition &part)
+
+{
+  vertex->next = part.startNode;	// Attach new vertex to beginning of list
+  part.startNode = vertex;		// Change the first value set to be the new vertex
+  if (part.stopNode == (ValueSet *)0)
+    part.stopNode = vertex;
+}
+
+/// \param head is the partition to be prepended
+/// \param part is the given partition being modified (prepended to)
+inline void ValueSetSolver::partitionPrepend(const Partition &head,Partition &part)
+
+{
+  head.stopNode->next = part.startNode;
+  part.startNode = head.startNode;
+  if (part.stopNode == (ValueSet *)0)
+    part.stopNode = head.stopNode;
+}
+
 #endif

Ghidra/Features/Decompiler/src/decompile/cpp/space.cc

@@ -308,10 +308,10 @@ uintb AddrSpace::read(const string &s,int4 &size) const
     offset = addressToByte(offset,wordsize);
     enddata = (const char *) tmpdata;
     if (enddata - s.c_str() == s.size()) { // If no size or offset override
-      size = getAddrSize();	// Return "natural" size
+      size = manage->getDefaultSize();	// Return "natural" size
       return offset;
     }
-    size = getAddrSize();
+    size = manage->getDefaultSize();
   }
   if (append != string::npos) {
     enddata = s.c_str()+append;

Ghidra/Features/Decompiler/src/decompile/cpp/varnode.hh

@@ -28,6 +28,7 @@ class VarnodeBank;
 class Merge;
 class Funcdata;
 class SymbolEntry;
+class ValueSet;
 
 /// \brief Compare two Varnode pointers by location then definition
 struct VarnodeCompareLocDef {
@@ -134,7 +135,10 @@ private:
   VarnodeDefSet::iterator defiter;	///< Iterator into VarnodeBank sorted by definition
   list<PcodeOp *> descend;		///< List of every op using this varnode as input
   mutable Cover *cover;		///< Addresses covered by the def->use of this Varnode
-  mutable Datatype *temptype;	///< For type propagate algorithm
+  mutable union {
+    Datatype *dataType;		///< For type propagate algorithm
+    ValueSet *valueSet;
+  } temp;
   uintb consumed;		///< What parts of this varnode are used
   uintb nzm;			///< Which bits do we know are zero
   friend class VarnodeBank;
@@ -167,8 +171,10 @@ public:
   SymbolEntry *getSymbolEntry(void) const { return mapentry; } ///< Get symbol and scope information associated with this Varnode
   uint4 getFlags(void) const { return flags; } ///< Get all the boolean attributes
   Datatype *getType(void) const { return type; } ///< Get the Datatype associated with this Varnode
-  void setTempType(Datatype *t) const { temptype = t; }	///< Set the temporary Datatype
-  Datatype *getTempType(void) const { return temptype; } ///< Get the temporary Datatype (used during type propagation)
+  void setTempType(Datatype *t) const { temp.dataType = t; }	///< Set the temporary Datatype
+  Datatype *getTempType(void) const { return temp.dataType; } ///< Get the temporary Datatype (used during type propagation)
+  void setValueSet(ValueSet *v) const { temp.valueSet = v; }	///< Set the temporary ValueSet record
+  ValueSet *getValueSet(void) const { return temp.valueSet; }	///< Get the temporary ValueSet record
   uint4 getCreateIndex(void) const { return create_index; } ///< Get the creation index
   Cover *getCover(void) const { updateCover(); return cover; } ///< Get Varnode coverage information
   list<PcodeOp *>::const_iterator beginDescend(void) const { return descend.begin(); } ///< Get iterator to list of syntax tree descendants (reads)