estate: rename estate_ranges() to estate_rl()
[smatch.git] / smatch_db.c
blobc0dd4400b4e7e41315bce70a3e28abb6fdfddee8
1 /*
2 * smatch/smatch_db.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
10 #include <string.h>
11 #include <errno.h>
12 #include <sqlite3.h>
13 #include "smatch.h"
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
17 static sqlite3 *db;
19 struct def_callback {
20 int hook_type;
21 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
23 ALLOCATOR(def_callback, "definition db hook callbacks");
24 DECLARE_PTR_LIST(callback_list, struct def_callback);
25 static struct callback_list *callbacks;
27 struct member_info_callback {
28 int owner;
29 void (*callback)(char *fn, char *global_static, int param, char *printed_name, struct smatch_state *state);
31 ALLOCATOR(member_info_callback, "caller_info callbacks");
32 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
33 static struct member_info_cb_list *member_callbacks;
35 struct returned_state_callback {
36 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr, struct state_list *slist);
38 ALLOCATOR(returned_state_callback, "returned state callbacks");
39 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
40 static struct returned_state_cb_list *returned_state_callbacks;
42 struct returned_member_callback {
43 int owner;
44 void (*callback)(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state);
46 ALLOCATOR(returned_member_callback, "returned member callbacks");
47 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
48 static struct returned_member_cb_list *returned_member_callbacks;
50 struct call_implies_callback {
51 int type;
52 void (*callback)(struct expression *arg, char *value);
54 ALLOCATOR(call_implies_callback, "call_implies callbacks");
55 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
56 static struct call_implies_cb_list *call_implies_cb_list;
58 void sql_exec(int (*callback)(void*, int, char**, char**), const char *sql)
60 char *err = NULL;
61 int rc;
63 if (option_no_db || !db)
64 return;
66 rc = sqlite3_exec(db, sql, callback, 0, &err);
67 if (rc != SQLITE_OK) {
68 fprintf(stderr, "SQL error #2: %s\n", err);
69 fprintf(stderr, "SQL: '%s'\n", sql);
73 void add_definition_db_callback(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
75 struct def_callback *def_callback = __alloc_def_callback(0);
77 def_callback->hook_type = type;
78 def_callback->callback = callback;
79 add_ptr_list(&callbacks, def_callback);
83 * These call backs are used when the --info option is turned on to print struct
84 * member information. For example foo->bar could have a state in
85 * smatch_extra.c and also check_user.c.
87 void add_member_info_callback(int owner, void (*callback)(char *fn, char *global_static, int param, char *printed_name, struct smatch_state *state))
89 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
91 member_callback->owner = owner;
92 member_callback->callback = callback;
93 add_ptr_list(&member_callbacks, member_callback);
96 void add_returned_state_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr, struct state_list *slist))
98 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
100 callback->callback = fn;
101 add_ptr_list(&returned_state_callbacks, callback);
104 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state))
106 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
108 member_callback->owner = owner;
109 member_callback->callback = callback;
110 add_ptr_list(&returned_member_callbacks, member_callback);
113 void add_db_fn_call_callback(int type, void (*callback)(struct expression *arg, char *value))
115 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
117 cb->type = type;
118 cb->callback = callback;
119 add_ptr_list(&call_implies_cb_list, cb);
122 static struct symbol *return_type;
123 static struct range_list *return_range_list;
124 static int db_return_callback(void *unused, int argc, char **argv, char **azColName)
126 if (argc != 1)
127 return 0;
128 if (option_debug)
129 sm_msg("return type %d", type_positive_bits(return_type));
130 str_to_rl(return_type, argv[0], &return_range_list);
131 return 0;
134 struct range_list *db_return_vals(struct expression *expr)
136 struct symbol *sym;
137 static char sql_filter[1024];
139 if (expr->type != EXPR_CALL)
140 return NULL;
141 if (expr->fn->type != EXPR_SYMBOL)
142 return NULL;
143 return_type = get_type(expr);
144 if (!return_type)
145 return NULL;
146 sym = expr->fn->symbol;
147 if (!sym)
148 return NULL;
150 if (sym->ctype.modifiers & MOD_STATIC) {
151 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
152 get_filename(), sym->ident->name);
153 } else {
154 snprintf(sql_filter, 1024, "function = '%s' and static = 0;",
155 sym->ident->name);
158 return_range_list = NULL;
159 run_sql(db_return_callback, "select return from return_values where %s",
160 sql_filter);
161 return return_range_list;
164 static void match_call_hack(struct expression *expr)
166 char *name;
169 * we just want to record something in the database so that if we have
170 * two calls like: frob(4); frob(some_unkown); then on the receiving
171 * side we know that sometimes frob is called with unknown parameters.
174 name = get_fnptr_name(expr->fn);
175 if (!name)
176 return;
177 sm_msg("info: call_marker '%s' %s", name, is_static(expr->fn) ? "static" : "global");
178 free_string(name);
181 static void print_struct_members(char *fn, char *global_static, struct expression *expr, int param, struct state_list *slist,
182 void (*callback)(char *fn, char *global_static, int param, char *printed_name, struct smatch_state *state))
184 struct sm_state *sm;
185 char *name;
186 struct symbol *sym;
187 int len;
188 char printed_name[256];
189 int is_address = 0;
191 expr = strip_expr(expr);
192 if (expr->type == EXPR_PREOP && expr->op == '&') {
193 expr = strip_expr(expr->unop);
194 is_address = 1;
197 name = get_variable_from_expr(expr, &sym);
198 if (!name || !sym)
199 goto free;
201 len = strlen(name);
202 FOR_EACH_PTR(slist, sm) {
203 if (sm->sym != sym)
204 continue;
205 if (strncmp(name, sm->name, len) || sm->name[len] == '\0')
206 continue;
207 if (is_address)
208 snprintf(printed_name, sizeof(printed_name), "$$->%s", sm->name + len + 1);
209 else
210 snprintf(printed_name, sizeof(printed_name), "$$%s", sm->name + len);
211 callback(fn, global_static, param, printed_name, sm->state);
212 } END_FOR_EACH_PTR(sm);
213 free:
214 free_string(name);
217 static void match_call_info(struct expression *expr)
219 struct member_info_callback *cb;
220 struct expression *arg;
221 struct state_list *slist;
222 char *name;
223 int i;
224 char *gs;
226 name = get_fnptr_name(expr->fn);
227 if (!name)
228 return;
230 if (is_static(expr->fn))
231 gs = (char *)"static";
232 else
233 gs = (char *)"global";
235 FOR_EACH_PTR(member_callbacks, cb) {
236 slist = get_all_states(cb->owner);
237 i = 0;
238 FOR_EACH_PTR(expr->args, arg) {
239 print_struct_members(name, gs, arg, i, slist, cb->callback);
240 i++;
241 } END_FOR_EACH_PTR(arg);
242 free_slist(&slist);
243 } END_FOR_EACH_PTR(cb);
245 free_string(name);
248 static int get_param(int param, char **name, struct symbol **sym)
250 struct symbol *arg;
251 int i;
253 i = 0;
254 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
256 * this is a temporary hack to work around a bug (I think in sparse?)
257 * 2.6.37-rc1:fs/reiserfs/journal.o
258 * If there is a function definition without parameter name found
259 * after a function implementation then it causes a crash.
260 * int foo() {}
261 * int bar(char *);
263 if (arg->ident->name < (char *)100)
264 continue;
265 if (i == param && arg->ident->name) {
266 *name = arg->ident->name;
267 *sym = arg;
268 return TRUE;
270 i++;
271 } END_FOR_EACH_PTR(arg);
273 return FALSE;
276 static struct state_list *final_states;
277 static int prev_func_id = -1;
278 static int db_callback(void *unused, int argc, char **argv, char **azColName)
280 int func_id;
281 long type;
282 long param;
283 char *name = NULL;
284 struct symbol *sym = NULL;
285 struct def_callback *def_callback;
287 if (argc != 5)
288 return 0;
290 func_id = atoi(argv[0]);
291 errno = 0;
292 type = strtol(argv[1], NULL, 10);
293 param = strtol(argv[2], NULL, 10);
294 if (errno)
295 return 0;
297 if (prev_func_id == -1)
298 prev_func_id = func_id;
299 if (func_id != prev_func_id) {
300 merge_slist(&final_states, __pop_fake_cur_slist());
301 __push_fake_cur_slist();
302 __unnullify_path();
303 prev_func_id = func_id;
306 if (type == INTERNAL)
307 return 0;
308 if (param >= 0 && !get_param(param, &name, &sym))
309 return 0;
311 FOR_EACH_PTR(callbacks, def_callback) {
312 if (def_callback->hook_type == type)
313 def_callback->callback(name, sym, argv[3], argv[4]);
314 } END_FOR_EACH_PTR(def_callback);
316 return 0;
319 static void get_direct_callers(struct symbol *sym)
321 char sql_filter[1024];
323 if (sym->ctype.modifiers & MOD_STATIC) {
324 snprintf(sql_filter, 1024,
325 "file = '%s' and function = '%s' order by function_id;",
326 get_filename(), sym->ident->name);
327 } else {
328 snprintf(sql_filter, 1024,
329 "function = '%s' and static = 0 order by function_id;",
330 sym->ident->name);
333 run_sql(db_callback, "select function_id, type, parameter, key, value from caller_info"
334 " where %s", sql_filter);
337 static char *ptr_name;
338 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
340 if (!ptr_name)
341 ptr_name = alloc_string(argv[0]);
342 return 0;
345 static void get_function_pointer_callers(struct symbol *sym)
347 ptr_name = NULL;
348 run_sql(get_ptr_name, "select ptr from function_ptr where function = '%s'",
349 sym->ident->name);
350 if (!ptr_name)
351 return;
353 run_sql(db_callback, "select function_id, type, parameter, key, value from caller_info"
354 " where function = '%s' order by function_id", ptr_name);
356 free_string(ptr_name);
359 static void match_data_from_db(struct symbol *sym)
361 struct sm_state *sm;
363 if (!sym || !sym->ident || !sym->ident->name)
364 return;
366 __push_fake_cur_slist();
367 __unnullify_path();
368 prev_func_id = -1;
370 get_direct_callers(sym);
371 get_function_pointer_callers(sym);
373 merge_slist(&final_states, __pop_fake_cur_slist());
375 FOR_EACH_PTR(final_states, sm) {
376 __set_sm(sm);
377 } END_FOR_EACH_PTR(sm);
379 free_slist(&final_states);
382 static void match_function_assign(struct expression *expr)
384 struct expression *right = expr->right;
385 struct symbol *sym;
386 char *fn_name;
387 char *ptr_name;
389 if (right->type == EXPR_PREOP && right->op == '&')
390 right = strip_expr(right->unop);
391 if (right->type != EXPR_SYMBOL)
392 return;
393 sym = get_type(right);
394 if (!sym || sym->type != SYM_FN)
395 return;
397 fn_name = get_variable_from_expr(right, NULL);
398 ptr_name = get_fnptr_name(expr->left);
399 if (!fn_name || !ptr_name)
400 goto free;
402 sm_msg("info: sets_fn_ptr '%s' '%s'", ptr_name, fn_name);
404 free:
405 free_string(fn_name);
406 free_string(ptr_name);
409 static struct expression *call_implies_call_expr;
410 static int call_implies_callbacks(void *unused, int argc, char **argv, char **azColName)
412 struct call_implies_callback *cb;
413 struct expression *arg = NULL;
414 int type;
415 int param;
417 if (argc != 4)
418 return 0;
420 type = atoi(argv[1]);
421 param = atoi(argv[2]);
423 FOR_EACH_PTR(call_implies_cb_list, cb) {
424 if (cb->type != type)
425 continue;
426 if (param != -1) {
427 arg = get_argument_from_call_expr(call_implies_call_expr->args, param);
428 if (!arg)
429 continue;
431 cb->callback(arg, argv[3]);
432 } END_FOR_EACH_PTR(cb);
434 return 0;
437 static void match_call_implies(struct expression *expr)
439 struct symbol *sym;
440 static char sql_filter[1024];
442 if (expr->fn->type != EXPR_SYMBOL)
443 return;
444 sym = expr->fn->symbol;
445 if (!sym)
446 return;
448 if (sym->ctype.modifiers & MOD_STATIC) {
449 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
450 get_filename(), sym->ident->name);
451 } else {
452 snprintf(sql_filter, 1024, "function = '%s' and static = 0;",
453 sym->ident->name);
456 call_implies_call_expr = expr;
457 run_sql(call_implies_callbacks,
458 "select function, type, parameter, value from call_implies where %s",
459 sql_filter);
460 return;
463 static void print_initializer_list(struct expression_list *expr_list,
464 struct symbol *struct_type)
466 struct expression *expr;
467 struct symbol *base_type;
469 FOR_EACH_PTR(expr_list, expr) {
470 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
471 print_initializer_list(expr->idx_expression->expr_list, struct_type);
472 continue;
474 if (expr->type != EXPR_IDENTIFIER)
475 continue;
476 if (!expr->expr_ident)
477 continue;
478 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
479 continue;
480 base_type = get_type(expr->ident_expression);
481 if (!base_type || base_type->type != SYM_FN)
482 continue;
483 sm_msg("info: sets_fn_ptr '(struct %s)->%s' '%s'", struct_type->ident->name,
484 expr->expr_ident->name,
485 expr->ident_expression->symbol_name->name);
486 } END_FOR_EACH_PTR(expr);
489 static void global_variable(struct symbol *sym)
491 struct symbol *struct_type;
493 if (!sym->ident)
494 return;
495 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
496 return;
497 struct_type = get_base_type(sym);
498 if (!struct_type)
499 return;
500 if (struct_type->type == SYM_ARRAY) {
501 struct_type = get_base_type(struct_type);
502 if (!struct_type)
503 return;
505 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
506 return;
507 print_initializer_list(sym->initializer->expr_list, struct_type);
510 static void match_return_info(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
512 sm_msg("info: return_marker %d '%s' %s", return_id, return_ranges,
513 global_static());
516 static int return_id;
517 static void match_function_def(struct symbol *sym)
519 return_id = 0;
522 static void call_return_state_hooks_compare(struct expression *expr)
524 struct returned_state_callback *cb;
525 struct state_list *slist;
526 char *return_ranges;
527 int final_pass_orig = final_pass;
529 __push_fake_cur_slist();
531 final_pass = 0;
532 __split_whole_condition(expr);
533 final_pass = final_pass_orig;
535 return_ranges = alloc_sname("1");
537 return_id++;
538 slist = __get_cur_slist();
539 FOR_EACH_PTR(returned_state_callbacks, cb) {
540 cb->callback(return_id, return_ranges, expr, slist);
541 } END_FOR_EACH_PTR(cb);
543 __push_true_states();
544 __use_false_states();
546 return_ranges = alloc_sname("0");;
547 return_id++;
548 slist = __get_cur_slist();
549 FOR_EACH_PTR(returned_state_callbacks, cb) {
550 cb->callback(return_id, return_ranges, expr, slist);
551 } END_FOR_EACH_PTR(cb);
553 __merge_true_states();
554 __pop_fake_cur_slist();
557 static int call_return_state_hooks_split_possible(struct expression *expr)
559 struct returned_state_callback *cb;
560 struct state_list *slist;
561 struct range_list *rl;
562 char *return_ranges;
563 struct sm_state *sm;
564 struct sm_state *tmp;
565 int ret = 0;
567 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
568 if (!sm || !sm->merged)
569 return 0;
571 /* bail if it gets too complicated */
572 if (ptr_list_size((struct ptr_list *)sm->possible) >= 100)
573 return 0;
575 FOR_EACH_PTR(sm->possible, tmp) {
576 if (tmp->merged)
577 continue;
579 ret = 1;
580 __push_fake_cur_slist();
582 overwrite_states_using_pool(tmp);
584 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
585 return_ranges = show_ranges(rl);
587 return_id++;
588 slist = __get_cur_slist();
589 FOR_EACH_PTR(returned_state_callbacks, cb) {
590 cb->callback(return_id, return_ranges, expr, slist);
591 } END_FOR_EACH_PTR(cb);
593 __pop_fake_cur_slist();
594 } END_FOR_EACH_PTR(tmp);
596 return ret;
599 static void call_return_state_hooks(struct expression *expr)
601 struct returned_state_callback *cb;
602 struct state_list *slist;
603 struct range_list *rl;
604 char *return_ranges;
606 expr = strip_expr(expr);
608 if (!expr) {
609 return_ranges = alloc_sname("");
610 } else if (is_condition(expr)) {
611 call_return_state_hooks_compare(expr);
612 return;
613 } else if (call_return_state_hooks_split_possible(expr)) {
614 return;
615 } else if (get_implied_rl(expr, &rl)) {
616 rl = cast_rl(cur_func_return_type(), rl);
617 return_ranges = show_ranges(rl);
618 } else {
619 rl = alloc_whole_rl(cur_func_return_type());
620 return_ranges = show_ranges(rl);
623 return_id++;
624 slist = __get_cur_slist();
625 FOR_EACH_PTR(returned_state_callbacks, cb) {
626 cb->callback(return_id, return_ranges, expr, slist);
627 } END_FOR_EACH_PTR(cb);
630 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
632 struct returned_member_callback *cb;
633 struct state_list *my_slist;
634 struct sm_state *sm;
635 struct symbol *type;
636 char *name;
637 char member_name[256];
638 int len;
640 type = get_type(expr);
641 if (!type || type->type != SYM_PTR)
642 return;
643 type = get_real_base_type(type);
644 if (!type || type->type != SYM_STRUCT)
645 return;
646 name = get_variable_from_expr(expr, NULL);
647 if (!name)
648 return;
650 member_name[sizeof(member_name) - 1] = '\0';
651 strcpy(member_name, "$$");
653 len = strlen(name);
654 FOR_EACH_PTR(returned_member_callbacks, cb) {
655 my_slist = get_all_states_slist(cb->owner, slist);
656 FOR_EACH_PTR(my_slist, sm) {
657 if (strncmp(sm->name, name, len) != 0)
658 continue;
659 if (strncmp(sm->name + len, "->", 2) != 0)
660 continue;
661 strncpy(member_name + 2, sm->name + len, sizeof(member_name) - 2);
662 cb->callback(return_id, return_ranges, member_name, sm->state);
663 } END_FOR_EACH_PTR(sm);
664 free_slist(&my_slist);
665 } END_FOR_EACH_PTR(cb);
667 free_string(name);
670 static void match_end_func_info(struct symbol *sym)
672 if (__path_is_null())
673 return;
674 call_return_state_hooks(NULL);
677 void open_smatch_db(void)
679 #ifdef SQLITE_OPEN_READONLY
680 int rc;
682 if (option_no_db)
683 return;
685 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
686 if (rc != SQLITE_OK) {
687 option_no_db = 1;
688 return;
690 return;
691 #else
692 option_no_db = 1;
693 return;
694 #endif
697 void register_definition_db_callbacks(int id)
699 add_hook(&match_function_def, FUNC_DEF_HOOK);
701 if (option_info) {
702 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
703 add_hook(&match_call_hack, FUNCTION_CALL_HOOK);
704 add_hook(&match_function_assign, ASSIGNMENT_HOOK);
705 add_hook(&match_function_assign, GLOBAL_ASSIGNMENT_HOOK);
706 add_hook(&global_variable, BASE_HOOK);
707 add_hook(&global_variable, DECLARATION_HOOK);
708 add_returned_state_callback(match_return_info);
709 add_returned_state_callback(print_returned_struct_members);
710 add_hook(&call_return_state_hooks, RETURN_HOOK);
711 add_hook(&match_end_func_info, END_FUNC_HOOK);
714 if (option_no_db)
715 return;
717 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
718 add_hook(&match_call_implies, FUNCTION_CALL_HOOK);