smatch_type_val.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * The plan here is to save all the possible values store to a given struct
  20  * member.
  21  *
  22  * We will load all the values in to the function_type_val table first then
  23  * run a script on that and load all the resulting values into the type_val
  24  * table.
  25  *
  26  * So in this file we want to take the union of everything assigned to the
  27  * struct member and insert it into the function_type_val at the end.
  28  *
  29  * You would think that we could use smatch_modification_hooks.c or
  30  * extra_modification_hook() here to get the information here but in the end we
  31  * need to code everything again a third time.
  32  *
  33  */
  34
  35 #include "smatch.h"
  36 #include "smatch_slist.h"
  37 #include "smatch_extra.h"
  38
  39 static int my_id;
  40
  41 struct stree_stack *fn_type_val_stack;
  42 struct stree *fn_type_val;
  43 struct stree *global_type_val;
  44
  45 static char *db_vals;
  46 static int get_vals(void *unused, int argc, char **argv, char **azColName)
  47 {
  48         db_vals = alloc_string(argv[0]);
  49         return 0;
  50 }
  51
  52 static void match_inline_start(struct expression *expr)
  53 {
  54         push_stree(&fn_type_val_stack, fn_type_val);
  55         fn_type_val = NULL;
  56 }
  57
  58 static void match_inline_end(struct expression *expr)
  59 {
  60         fn_type_val = pop_stree(&fn_type_val_stack);
  61 }
  62
  63 int get_db_type_rl(struct expression *expr, struct range_list **rl)
  64 {
  65         char *member;
  66         struct range_list *tmp;
  67
  68         member = get_member_name(expr);
  69         if (!member)
  70                 return 0;
  71
  72         db_vals = NULL;
  73         run_sql(get_vals,
  74                 "select value from type_value where type = '%s';", member);
  75         free_string(member);
  76         if (!db_vals)
  77                 return 0;
  78         str_to_rl(&llong_ctype, db_vals, &tmp);
  79         tmp = cast_rl(get_type(expr), tmp);
  80         if (is_whole_rl(tmp))
  81                 return 0;
  82         *rl = tmp;
  83         free_string(db_vals);
  84
  85         return 1;
  86 }
  87
  88 /*
  89  * One of the complications is that smatch tries to free a bunch of data at the
  90  * end of every function.
  91  */
  92 static struct data_info *clone_dinfo_perm(struct data_info *dinfo)
  93 {
  94         struct data_info *ret;
  95
  96         ret = malloc(sizeof(*ret));
  97         ret->related = NULL;
  98         ret->value_ranges = clone_rl_permanent(dinfo->value_ranges);
  99         ret->hard_max = 0;
 100         ret->fuzzy_max = dinfo->fuzzy_max;
 101         return ret;
 102 }
 103
 104 static struct smatch_state *clone_estate_perm(struct smatch_state *state)
 105 {
 106         struct smatch_state *ret;
 107
 108         ret = malloc(sizeof(*ret));
 109         ret->name = alloc_string(state->name);
 110         ret->data = clone_dinfo_perm(get_dinfo(state));
 111         return ret;
 112 }
 113
 114 static void set_state_stree_perm(struct stree **stree, int owner, const char *name,
 115                      struct symbol *sym, struct smatch_state *state)
 116 {
 117         struct sm_state *sm;
 118
 119         sm = malloc(sizeof(*sm));
 120         memset(sm, 0, sizeof(*sm));
 121         sm->owner = owner;
 122         sm->name = name;
 123         sm->sym = sym;
 124         sm->state = state;
 125
 126         overwrite_sm_state_stree(stree, sm);
 127 }
 128
 129 static void add_type_val(char *member, struct range_list *rl)
 130 {
 131         struct smatch_state *old, *add, *new;
 132
 133         member = alloc_string(member);
 134         old = get_state_stree(fn_type_val, my_id, member, NULL);
 135         add = alloc_estate_rl(rl);
 136         if (old)
 137                 new = merge_estates(old, add);
 138         else
 139                 new = add;
 140         set_state_stree(&fn_type_val, my_id, member, NULL, new);
 141 }
 142
 143 static void add_global_type_val(char *member, struct range_list *rl)
 144 {
 145         struct smatch_state *old, *add, *new;
 146
 147         member = alloc_string(member);
 148         old = get_state_stree(global_type_val, my_id, member, NULL);
 149         add = alloc_estate_rl(rl);
 150         if (old)
 151                 new = merge_estates(old, add);
 152         else
 153                 new = add;
 154         new = clone_estate_perm(new);
 155         set_state_stree_perm(&global_type_val, my_id, member, NULL, new);
 156 }
 157
 158 static void match_assign_value(struct expression *expr)
 159 {
 160         char *member, *right_member;
 161         struct range_list *rl;
 162         struct symbol *type;
 163
 164         type = get_type(expr->left);
 165         if (type && type->type == SYM_STRUCT)
 166                 return;
 167
 168         member = get_member_name(expr->left);
 169         if (!member)
 170                 return;
 171
 172         /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
 173         right_member = get_member_name(expr->right);
 174         if (right_member && strcmp(right_member, member) == 0)
 175                 goto free;
 176
 177         if (expr->op != '=') {
 178                 add_type_val(member, alloc_whole_rl(get_type(expr->left)));
 179                 goto free;
 180         }
 181         get_absolute_rl(expr->right, &rl);
 182         rl = cast_rl(type, rl);
 183         add_type_val(member, rl);
 184 free:
 185         free_string(right_member);
 186         free_string(member);
 187 }
 188
 189 /*
 190  * If we too:  int *p = &my_struct->member then abandon all hope of tracking
 191  * my_struct->member.
 192  */
 193 static void match_assign_pointer(struct expression *expr)
 194 {
 195         struct expression *right;
 196         char *member;
 197         struct range_list *rl;
 198         struct symbol *type;
 199
 200         right = strip_expr(expr->right);
 201         if (right->type != EXPR_PREOP || right->op != '&')
 202                 return;
 203         right = strip_expr(right->unop);
 204
 205         member = get_member_name(right);
 206         if (!member)
 207                 return;
 208         type = get_type(right);
 209         rl = alloc_whole_rl(type);
 210         add_type_val(member, rl);
 211         free_string(member);
 212 }
 213
 214 static void match_global_assign(struct expression *expr)
 215 {
 216         char *member;
 217         struct range_list *rl;
 218
 219         member = get_member_name(expr->left);
 220         if (!member)
 221                 return;
 222         get_absolute_rl(expr->right, &rl);
 223         add_global_type_val(member, rl);
 224         free_string(member);
 225 }
 226
 227 static void unop_expr(struct expression *expr)
 228 {
 229         struct range_list *rl;
 230         char *member;
 231
 232         if (expr->op != SPECIAL_DECREMENT && expr->op != SPECIAL_INCREMENT)
 233                 return;
 234
 235         expr = strip_expr(expr->unop);
 236         member = get_member_name(expr);
 237         if (!member)
 238                 return;
 239         rl = alloc_whole_rl(get_type(expr));
 240         add_type_val(member, rl);
 241         free_string(member);
 242 }
 243
 244 static void asm_expr(struct statement *stmt)
 245 {
 246         struct expression *expr;
 247         struct range_list *rl;
 248         char *member;
 249         int state = 0;
 250
 251         FOR_EACH_PTR(stmt->asm_outputs, expr) {
 252                 switch (state) {
 253                 case 0: /* identifier */
 254                 case 1: /* constraint */
 255                         state++;
 256                         continue;
 257                 case 2: /* expression */
 258                         state = 0;
 259                         member = get_member_name(expr);
 260                         if (!member)
 261                                 continue;
 262                         rl = alloc_whole_rl(get_type(expr));
 263                         add_type_val(member, rl);
 264                         free_string(member);
 265                         continue;
 266                 }
 267         } END_FOR_EACH_PTR(expr);
 268 }
 269
 270 static void db_param_add(struct expression *expr, int param, char *key, char *value)
 271 {
 272         struct expression *arg;
 273         struct symbol *type;
 274         struct range_list *rl;
 275         char *member;
 276
 277         if (strcmp(key, "*$$") != 0)
 278                 return;
 279
 280         while (expr->type == EXPR_ASSIGNMENT)
 281                 expr = strip_expr(expr->right);
 282         if (expr->type != EXPR_CALL)
 283                 return;
 284
 285         arg = get_argument_from_call_expr(expr->args, param);
 286         arg = strip_expr(arg);
 287         if (!arg)
 288                 return;
 289         type = get_member_type_from_key(arg, key);
 290         if (arg->type != EXPR_PREOP || arg->op != '&')
 291                 return;
 292         arg = strip_expr(arg->unop);
 293
 294         member = get_member_name(arg);
 295         if (!member)
 296                 return;
 297         call_results_to_rl(expr, type, value, &rl);
 298         add_type_val(member, rl);
 299         free_string(member);
 300 }
 301
 302 static void match_end_func_info(struct symbol *sym)
 303 {
 304         struct sm_state *sm;
 305
 306         FOR_EACH_SM(fn_type_val, sm) {
 307                 sql_insert_function_type_value(sm->name, sm->state->name);
 308         } END_FOR_EACH_SM(sm);
 309
 310         free_stree(&fn_type_val);
 311 }
 312
 313 static void match_end_file(struct symbol_list *sym_list)
 314 {
 315         struct sm_state *sm;
 316
 317         FOR_EACH_SM(global_type_val, sm) {
 318                 sql_insert_function_type_value(sm->name, sm->state->name);
 319         } END_FOR_EACH_SM(sm);
 320 }
 321
 322 void register_type_val(int id)
 323 {
 324         if (!option_info)
 325                 return;
 326
 327         my_id = id;
 328
 329         add_hook(&match_assign_value, ASSIGNMENT_HOOK);
 330         add_hook(&match_assign_pointer, ASSIGNMENT_HOOK);
 331         add_hook(&unop_expr, OP_HOOK);
 332         add_hook(&asm_expr, ASM_HOOK);
 333         select_return_states_hook(ADDED_VALUE, &db_param_add);
 334
 335         add_hook(&match_inline_start, INLINE_FN_START);
 336         add_hook(&match_inline_end, INLINE_FN_END);
 337
 338         add_hook(&match_end_func_info, END_FUNC_HOOK);
 339
 340         add_hook(&match_global_assign, GLOBAL_ASSIGNMENT_HOOK);
 341         add_hook(&match_end_file, END_FILE_HOOK);
 342
 343 }