[sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Dan Carpenter]

tree:   git://linuxtv.org/sailus/media_tree.git master
head:   7336c54a562b479866d2de2abc61487a4e07b0b9
commit: 153e4ad44d605cbff3530013b393c01462c54cef [17/47] media: i2c: Add driver for ST VGXY61 camera sensor
config: microblaze-randconfig-m041-20221109
compiler: microblaze-linux-gcc (GCC) 12.1.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>

smatch warnings:
drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'
drivers/media/i2c/st-vgxy61.c:1037 vgxy61_update_exposure() error: uninitialized symbol 'expo_long_max'.
drivers/media/i2c/st-vgxy61.c:1190 vgxy61_stream_enable() warn: pm_runtime_get_sync() also returns 1 on success
drivers/media/i2c/st-vgxy61.c:1579 vgxy61_configure() warn: impossible condition '(line_length < 0) => (0-u16max < 0)'
drivers/media/i2c/st-vgxy61.c:1626 vgxy61_patch() warn: impossible condition '(patch < 0) => (0-u16max < 0)'
drivers/media/i2c/st-vgxy61.c:1651 vgxy61_detect_cut_version() warn: impossible condition '(device_rev < 0) => (0-u16max < 0)'
drivers/media/i2c/st-vgxy61.c:1679 vgxy61_detect() warn: impossible condition '(id < 0) => (0-u16max < 0)'
drivers/media/i2c/st-vgxy61.c:1694 vgxy61_detect() warn: impossible condition '(st < 0) => (0-255 < 0)'

vim +891 drivers/media/i2c/st-vgxy61.c

153e4ad44d605c Benjamin Mugnier 2022-10-11   883  static int vgxy61_apply_gpiox_strobe_mode(struct vgxy61_dev *sensor,
153e4ad44d605c Benjamin Mugnier 2022-10-11   884  					  enum vgxy61_strobe_mode mode,
153e4ad44d605c Benjamin Mugnier 2022-10-11   885  					  unsigned int idx)
153e4ad44d605c Benjamin Mugnier 2022-10-11   886  {
153e4ad44d605c Benjamin Mugnier 2022-10-11   887  	static const u8 index2val[] = {0x0, 0x1, 0x3};
153e4ad44d605c Benjamin Mugnier 2022-10-11   888  	u16 reg;
153e4ad44d605c Benjamin Mugnier 2022-10-11   889  
153e4ad44d605c Benjamin Mugnier 2022-10-11   890  	reg = vgxy61_read_reg(sensor, VGXY61_REG_SIGNALS_CTRL);
153e4ad44d605c Benjamin Mugnier 2022-10-11  @891  	if (reg < 0)
153e4ad44d605c Benjamin Mugnier 2022-10-11   892  		return reg;

"reg" should be an int.

153e4ad44d605c Benjamin Mugnier 2022-10-11   893  	reg &= ~(0xf << (idx * VGXY61_SIGNALS_GPIO_ID_SHIFT));
153e4ad44d605c Benjamin Mugnier 2022-10-11   894  	reg |= index2val[mode] << (idx * VGXY61_SIGNALS_GPIO_ID_SHIFT);
153e4ad44d605c Benjamin Mugnier 2022-10-11   895  
153e4ad44d605c Benjamin Mugnier 2022-10-11   896  	return vgxy61_write_reg(sensor, VGXY61_REG_SIGNALS_CTRL, reg, NULL);
153e4ad44d605c Benjamin Mugnier 2022-10-11   897  }

[ snip ]

153e4ad44d605c Benjamin Mugnier 2022-10-11   984  static int vgxy61_update_exposure(struct vgxy61_dev *sensor, u16 new_expo_long,
153e4ad44d605c Benjamin Mugnier 2022-10-11   985  				  enum vgxy61_hdr_mode hdr)
153e4ad44d605c Benjamin Mugnier 2022-10-11   986  {
153e4ad44d605c Benjamin Mugnier 2022-10-11   987  	struct i2c_client *client = sensor->i2c_client;
153e4ad44d605c Benjamin Mugnier 2022-10-11   988  	u16 new_expo_short = 0;
153e4ad44d605c Benjamin Mugnier 2022-10-11   989  	u16 expo_short_max = 0;
153e4ad44d605c Benjamin Mugnier 2022-10-11   990  	u16 expo_long_min = VGXY61_MIN_EXPOSURE;
153e4ad44d605c Benjamin Mugnier 2022-10-11   991  	u16 expo_long_max;
153e4ad44d605c Benjamin Mugnier 2022-10-11   992  
153e4ad44d605c Benjamin Mugnier 2022-10-11   993  	/* Compute short exposure according to hdr mode and long exposure */
153e4ad44d605c Benjamin Mugnier 2022-10-11   994  	switch (hdr) {
153e4ad44d605c Benjamin Mugnier 2022-10-11   995  	case VGXY61_HDR_LINEAR:
153e4ad44d605c Benjamin Mugnier 2022-10-11   996  		/*
153e4ad44d605c Benjamin Mugnier 2022-10-11   997  		 * Take ratio into account for minimal exposures in
153e4ad44d605c Benjamin Mugnier 2022-10-11   998  		 * VGXY61_HDR_LINEAR
153e4ad44d605c Benjamin Mugnier 2022-10-11   999  		 */
153e4ad44d605c Benjamin Mugnier 2022-10-11  1000  		expo_long_min = VGXY61_MIN_EXPOSURE * VGXY61_HDR_LINEAR_RATIO;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1001  		new_expo_long = max(expo_long_min, new_expo_long);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1002  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1003  		expo_long_max =
153e4ad44d605c Benjamin Mugnier 2022-10-11  1004  			vgxy61_get_expo_long_max(sensor,
153e4ad44d605c Benjamin Mugnier 2022-10-11  1005  						 VGXY61_HDR_LINEAR_RATIO);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1006  		expo_short_max = (expo_long_max +
153e4ad44d605c Benjamin Mugnier 2022-10-11  1007  				 (VGXY61_HDR_LINEAR_RATIO / 2)) /
153e4ad44d605c Benjamin Mugnier 2022-10-11  1008  				 VGXY61_HDR_LINEAR_RATIO;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1009  		new_expo_short = (new_expo_long +
153e4ad44d605c Benjamin Mugnier 2022-10-11  1010  				 (VGXY61_HDR_LINEAR_RATIO / 2)) /
153e4ad44d605c Benjamin Mugnier 2022-10-11  1011  				 VGXY61_HDR_LINEAR_RATIO;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1012  		break;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1013  	case VGXY61_HDR_SUB:
153e4ad44d605c Benjamin Mugnier 2022-10-11  1014  		new_expo_long = max(expo_long_min, new_expo_long);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1015  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1016  		expo_long_max = vgxy61_get_expo_long_max(sensor, 1);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1017  		/* Short and long are the same in VGXY61_HDR_SUB */
153e4ad44d605c Benjamin Mugnier 2022-10-11  1018  		expo_short_max = expo_long_max;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1019  		new_expo_short = new_expo_long;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1020  		break;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1021  	case VGXY61_NO_HDR:
153e4ad44d605c Benjamin Mugnier 2022-10-11  1022  		new_expo_long = max(expo_long_min, new_expo_long);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1023  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1024  		/*
153e4ad44d605c Benjamin Mugnier 2022-10-11  1025  		 * As short expo is 0 here, only the second rule of thumb
153e4ad44d605c Benjamin Mugnier 2022-10-11  1026  		 * applies, see vgxy61_get_expo_long_max for more
153e4ad44d605c Benjamin Mugnier 2022-10-11  1027  		 */
153e4ad44d605c Benjamin Mugnier 2022-10-11  1028  		expo_long_max = sensor->frame_length - VGXY61_EXPOS_ROT_TERM;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1029  		break;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1030  	default:
153e4ad44d605c Benjamin Mugnier 2022-10-11  1031  		/* Should never happen */
153e4ad44d605c Benjamin Mugnier 2022-10-11  1032  		WARN_ON(true);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1033  		break;

This is what upsets the static checker.

153e4ad44d605c Benjamin Mugnier 2022-10-11  1034  	}
153e4ad44d605c Benjamin Mugnier 2022-10-11  1035  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1036  	/* If this happens, something is wrong with formulas */
153e4ad44d605c Benjamin Mugnier 2022-10-11 @1037  	WARN_ON(expo_long_min > expo_long_max);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1038  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1039  	if (new_expo_long > expo_long_max) {
153e4ad44d605c Benjamin Mugnier 2022-10-11  1040  		dev_warn(&client->dev, "Exposure %d too high, clamping to %d\n",
153e4ad44d605c Benjamin Mugnier 2022-10-11  1041  			 new_expo_long, expo_long_max);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1042  		new_expo_long = expo_long_max;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1043  		new_expo_short = expo_short_max;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1044  	}
153e4ad44d605c Benjamin Mugnier 2022-10-11  1045  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1046  	sensor->expo_long = new_expo_long;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1047  	sensor->expo_short = new_expo_short;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1048  	sensor->expo_max = expo_long_max;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1049  	sensor->expo_min = expo_long_min;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1050  
153e4ad44d605c Benjamin Mugnier 2022-10-11  1051  	if (sensor->streaming)
153e4ad44d605c Benjamin Mugnier 2022-10-11  1052  		return vgxy61_apply_exposure(sensor);
153e4ad44d605c Benjamin Mugnier 2022-10-11  1053  	return 0;
153e4ad44d605c Benjamin Mugnier 2022-10-11  1054  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Benjamin MUGNIER]

Hi Dan,

On 11/9/22 06:19, Dan Carpenter wrote:
> tree:   git://linuxtv.org/sailus/media_tree.git master
> head:   7336c54a562b479866d2de2abc61487a4e07b0b9
> commit: 153e4ad44d605cbff3530013b393c01462c54cef [17/47] media: i2c: Add driver for ST VGXY61 camera sensor
> config: microblaze-randconfig-m041-20221109
> compiler: microblaze-linux-gcc (GCC) 12.1.0
> 
> If you fix the issue, kindly add following tag where applicable
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <error27@gmail.com>
> 
> smatch warnings:
> drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'
> drivers/media/i2c/st-vgxy61.c:1037 vgxy61_update_exposure() error: uninitialized symbol 'expo_long_max'.
> drivers/media/i2c/st-vgxy61.c:1190 vgxy61_stream_enable() warn: pm_runtime_get_sync() also returns 1 on success
> drivers/media/i2c/st-vgxy61.c:1579 vgxy61_configure() warn: impossible condition '(line_length < 0) => (0-u16max < 0)'
> drivers/media/i2c/st-vgxy61.c:1626 vgxy61_patch() warn: impossible condition '(patch < 0) => (0-u16max < 0)'
> drivers/media/i2c/st-vgxy61.c:1651 vgxy61_detect_cut_version() warn: impossible condition '(device_rev < 0) => (0-u16max < 0)'
> drivers/media/i2c/st-vgxy61.c:1679 vgxy61_detect() warn: impossible condition '(id < 0) => (0-u16max < 0)'
> drivers/media/i2c/st-vgxy61.c:1694 vgxy61_detect() warn: impossible condition '(st < 0) => (0-255 < 0)'
> 
> [ snip ]

I fixed smatch warnings and will send a patch soon. Thank you.
I was not aware of smatch. This is a great tool.

After running smatch on my tree I couldn't reproduce this warning:
  warn: pm_runtime_get_sync() also returns 1 on success
I'm using the latest smatch cloned from github. Do you append some
options to kchecker to get this output ?

Anyway the warning should be fixed by my patch.

-- 
Regards,

Benjamin

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Dan Carpenter]

On Thu, Nov 10, 2022 at 12:43:30PM +0100, Benjamin MUGNIER wrote:
> After running smatch on my tree I couldn't reproduce this warning:
>   warn: pm_runtime_get_sync() also returns 1 on success
> I'm using the latest smatch cloned from github. Do you append some
> options to kchecker to get this output ?

TL;DR: Thanks for the report!  I will fix it later this week.

It's not really supposed to warn at all...  The pm_runtime_get_sync()
returns negatives on error so testing for "if (ret < 0) {" is correct
as a general case.  In this case it is wrong but normally it would be
the correct check.

This is an interaction with the check for uninitialized variables,
check_uninitialized.c.  A common false positive was caused by mismatches
where a function checks for if (ret) but the caller checks for
if (ret < 0) {.

int function(...)
{
	ret = frob();
	if (ret)
        ^^^^^^^^
		return ret;
	return 0;
}

int caller(...)
{
	ret = function();
	if (ret < 0) {
        ^^^^^^^^^^^^

How should positives be treated?  So what the check_uninitialized.c
check does is that it says, "let's assume that "ret >= 0" and "!ret"
are equivalent".  It creates a fake environment to test what !ret means
for uninitialized variables.  The check_pm_runtime_get_sync.c check sees
the "!ret" condition and says, "Nope.  That's supposed to be "ret < 0"".

Smatch shouldn't be printing warnings from inside the fake environment.

regards,
dan carpenter

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Dan Carpenter]

On Thu, Nov 10, 2022 at 04:11:59PM +0300, Dan Carpenter wrote:
> On Thu, Nov 10, 2022 at 12:43:30PM +0100, Benjamin MUGNIER wrote:
> > After running smatch on my tree I couldn't reproduce this warning:
> >   warn: pm_runtime_get_sync() also returns 1 on success
> > I'm using the latest smatch cloned from github. Do you append some
> > options to kchecker to get this output ?
> 
> TL;DR: Thanks for the report!  I will fix it later this week.
>

[ snip ]

> It creates a fake environment to test what !ret means
> for uninitialized variables.  The check_pm_runtime_get_sync.c check sees
> the "!ret" condition and says, "Nope.  That's supposed to be "ret < 0"".
> 
> Smatch shouldn't be printing warnings from inside the fake environment.

Nope.  That's not it...  It already has code to not print from a fake
environment (unless you're in debug mode).  It's a mystery how the
kbuild bot triggered this warning.

:(

regards,
dan carpenter

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Dan Carpenter]

On Thu, Nov 10, 2022 at 05:03:27PM +0300, Dan Carpenter wrote:
> On Thu, Nov 10, 2022 at 04:11:59PM +0300, Dan Carpenter wrote:
> > On Thu, Nov 10, 2022 at 12:43:30PM +0100, Benjamin MUGNIER wrote:
> > > After running smatch on my tree I couldn't reproduce this warning:
> > >   warn: pm_runtime_get_sync() also returns 1 on success
> > > I'm using the latest smatch cloned from github. Do you append some
> > > options to kchecker to get this output ?
> > 
> > TL;DR: Thanks for the report!  I will fix it later this week.
> >
> 
> [ snip ]
> 
> > It creates a fake environment to test what !ret means
> > for uninitialized variables.  The check_pm_runtime_get_sync.c check sees
> > the "!ret" condition and says, "Nope.  That's supposed to be "ret < 0"".
> > 
> > Smatch shouldn't be printing warnings from inside the fake environment.
> 
> Nope.  That's not it...  It already has code to not print from a fake
> environment (unless you're in debug mode).  It's a mystery how the
> kbuild bot triggered this warning.
> 
> :(

Ah...  Seeing your patch helped me figure it out.  The kbuild bot does
not have the cross function db built so when it sees:

	vgxy61_write_reg(sensor, VGXY61_REG_ROI0_START_V, crop->top, &ret);

Then it doesn't see that "ret" is modified.  On my system I have the
DB so I don't see the warning.

regards,
dan carpenter

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Benjamin MUGNIER]

On 11/10/22 15:06, Dan Carpenter wrote:
> On Thu, Nov 10, 2022 at 05:03:27PM +0300, Dan Carpenter wrote:
>> On Thu, Nov 10, 2022 at 04:11:59PM +0300, Dan Carpenter wrote:
>>> On Thu, Nov 10, 2022 at 12:43:30PM +0100, Benjamin MUGNIER wrote:
>>>> After running smatch on my tree I couldn't reproduce this warning:
>>>>   warn: pm_runtime_get_sync() also returns 1 on success
>>>> I'm using the latest smatch cloned from github. Do you append some
>>>> options to kchecker to get this output ?
>>>
>>> TL;DR: Thanks for the report!  I will fix it later this week.
>>>
>>
>> [ snip ]
>>
>>> It creates a fake environment to test what !ret means
>>> for uninitialized variables.  The check_pm_runtime_get_sync.c check sees
>>> the "!ret" condition and says, "Nope.  That's supposed to be "ret < 0"".
>>>
>>> Smatch shouldn't be printing warnings from inside the fake environment.
>>
>> Nope.  That's not it...  It already has code to not print from a fake
>> environment (unless you're in debug mode).  It's a mystery how the
>> kbuild bot triggered this warning.
>>
>> :(
> 
> Ah...  Seeing your patch helped me figure it out.  The kbuild bot does
> not have the cross function db built so when it sees:
> 
> 	vgxy61_write_reg(sensor, VGXY61_REG_ROI0_START_V, crop->top, &ret);
> 
> Then it doesn't see that "ret" is modified.  On my system I have the
> DB so I don't see the warning.

I also have the DB, so that explains why.

However, 'vgxy61_write_reg' does not always modify 'ret'. In fact it's
worse, at the beginning it checks if it not 0 in 'vgxy61_write_multiple'
and returns if it's not:
  if (err && *err)
    return *err;
with 'err' being an alias to 'ret'.

I did this to avoid checking all my i2c writes. I just send a bunch of
them and check the return code at the end. But if one i2c write fails,
'err' is filled and all following writes are aborted due to the code above.

To summarize: if 'pm_runtime_get_sync' ever returned 1, no i2c write was
performed. That's why I needed to set 'ret' to 0 in my patch.


The warning spared me from debugging this, thanks a lot.
Could this warning be produced even with having the DB?

> 
> regards,
> dan carpenter
> 

-- 
Regards,

Benjamin

Re: [sailus-media-tree:master 17/47] drivers/media/i2c/st-vgxy61.c:891 vgxy61_apply_gpiox_strobe_mode() warn: impossible condition '(reg < 0) => (0-u16max < 0)'

[Dan Carpenter]

On Thu, Nov 10, 2022 at 04:04:34PM +0100, Benjamin MUGNIER wrote:
> On 11/10/22 15:06, Dan Carpenter wrote:
> > On Thu, Nov 10, 2022 at 05:03:27PM +0300, Dan Carpenter wrote:
> >> On Thu, Nov 10, 2022 at 04:11:59PM +0300, Dan Carpenter wrote:
> >>> On Thu, Nov 10, 2022 at 12:43:30PM +0100, Benjamin MUGNIER wrote:
> >>>> After running smatch on my tree I couldn't reproduce this warning:
> >>>>   warn: pm_runtime_get_sync() also returns 1 on success
> >>>> I'm using the latest smatch cloned from github. Do you append some
> >>>> options to kchecker to get this output ?
> >>>
> >>> TL;DR: Thanks for the report!  I will fix it later this week.
> >>>
> >>
> >> [ snip ]
> >>
> >>> It creates a fake environment to test what !ret means
> >>> for uninitialized variables.  The check_pm_runtime_get_sync.c check sees
> >>> the "!ret" condition and says, "Nope.  That's supposed to be "ret < 0"".
> >>>
> >>> Smatch shouldn't be printing warnings from inside the fake environment.
> >>
> >> Nope.  That's not it...  It already has code to not print from a fake
> >> environment (unless you're in debug mode).  It's a mystery how the
> >> kbuild bot triggered this warning.
> >>
> >> :(
> > 
> > Ah...  Seeing your patch helped me figure it out.  The kbuild bot does
> > not have the cross function db built so when it sees:
> > 
> > 	vgxy61_write_reg(sensor, VGXY61_REG_ROI0_START_V, crop->top, &ret);
> > 
> > Then it doesn't see that "ret" is modified.  On my system I have the
> > DB so I don't see the warning.
> 
> I also have the DB, so that explains why.
> 
> However, 'vgxy61_write_reg' does not always modify 'ret'. In fact it's
> worse, at the beginning it checks if it not 0 in 'vgxy61_write_multiple'
> and returns if it's not:
>   if (err && *err)
>     return *err;
> with 'err' being an alias to 'ret'.
> 
> I did this to avoid checking all my i2c writes. I just send a bunch of
> them and check the return code at the end. But if one i2c write fails,
> 'err' is filled and all following writes are aborted due to the code above.

Yeah.  I could have written the way you are saying but the way it's
working now is the Correct Way[tm].  ;)

> 
> To summarize: if 'pm_runtime_get_sync' ever returned 1, no i2c write was
> performed. That's why I needed to set 'ret' to 0 in my patch.
> 
> 
> The warning spared me from debugging this, thanks a lot.

Yep.  It's like a stopped watch which is correct by mistake.

> Could this warning be produced even with having the DB?

The problem is that there isn't a way to tell whether "if (ret < 0) " is
intentional or not.  I've actually modified it now to warn about that so
I'll look at those tomorrow and hand audit them.  But I'm not optimistic
that there is a way to tell bugs from features in this case.

regards,
dan carpenter