2 * Copyright (C) 2013 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * The plan here is to save all the possible values store to a given struct
22 * We will load all the values in to the function_type_val table first then
23 * run a script on that and load all the resulting values into the type_val
26 * So in this file we want to take the union of everything assigned to the
27 * struct member and insert it into the function_type_val at the end.
29 * You would think that we could use smatch_modification_hooks.c or
30 * extra_modification_hook() here to get the information here but in the end we
31 * need to code everything again a third time.
36 #include "smatch_slist.h"
37 #include "smatch_extra.h"
41 struct stree_stack
*fn_type_val_stack
;
42 struct stree
*fn_type_val
;
43 struct stree
*global_type_val
;
45 static int get_vals(void *_db_vals
, int argc
, char **argv
, char **azColName
)
47 char **db_vals
= _db_vals
;
49 *db_vals
= alloc_string(argv
[0]);
53 static void match_inline_start(struct expression
*expr
)
55 push_stree(&fn_type_val_stack
, fn_type_val
);
59 static void match_inline_end(struct expression
*expr
)
61 free_stree(&fn_type_val
);
62 fn_type_val
= pop_stree(&fn_type_val_stack
);
65 int get_db_type_rl(struct expression
*expr
, struct range_list
**rl
)
69 struct range_list
*tmp
;
72 member
= get_member_name(expr
);
76 run_sql(get_vals
, &db_vals
,
77 "select value from type_value where type = '%s';", member
);
81 type
= get_type(expr
);
82 str_to_rl(type
, db_vals
, &tmp
);
91 static void add_type_val(char *member
, struct range_list
*rl
)
93 struct smatch_state
*old
, *add
, *new;
95 member
= alloc_string(member
);
96 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
97 add
= alloc_estate_rl(rl
);
99 new = merge_estates(old
, add
);
102 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
105 static void add_fake_type_val(char *member
, struct range_list
*rl
, int ignore
)
107 struct smatch_state
*old
, *add
, *new;
109 member
= alloc_string(member
);
110 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
111 if (old
&& strcmp(old
->name
, "min-max") == 0)
113 if (ignore
&& old
&& strcmp(old
->name
, "ignore") == 0)
115 add
= alloc_estate_rl(rl
);
117 new = merge_estates(old
, add
);
121 new->name
= alloc_string("ignore");
123 new->name
= alloc_string("min-max");
125 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
128 static void add_global_type_val(char *member
, struct range_list
*rl
)
130 struct smatch_state
*old
, *add
, *new;
132 member
= alloc_string(member
);
133 old
= get_state_stree(global_type_val
, my_id
, member
, NULL
);
134 add
= alloc_estate_rl(rl
);
136 new = merge_estates(old
, add
);
139 new = clone_estate_perm(new);
140 set_state_stree_perm(&global_type_val
, my_id
, member
, NULL
, new);
143 static int has_link_cb(void *has_link
, int argc
, char **argv
, char **azColName
)
145 *(int *)has_link
= 1;
149 static int is_ignored_fake_assignment(void)
151 struct expression
*expr
;
156 expr
= get_faked_expression();
157 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
159 if (!is_void_pointer(expr
->right
))
161 member_name
= get_member_name(expr
->right
);
165 type
= get_type(expr
->left
);
166 if (!type
|| type
->type
!= SYM_PTR
)
168 type
= get_real_base_type(type
);
169 if (!type
|| type
->type
!= SYM_STRUCT
)
172 run_sql(has_link_cb
, &has_link
,
173 "select * from data_info where type = %d and data = '%s' and value = '%s';",
174 TYPE_LINK
, member_name
, type_to_str(type
));
178 static int is_container_of(void)
180 /* We already check the macro name in is_ignored_macro() */
181 struct expression
*expr
;
184 expr
= get_faked_expression();
185 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
188 offset
= get_offset_from_container_of(expr
->right
);
194 static int is_ignored_macro(void)
196 struct expression
*expr
;
199 expr
= get_faked_expression();
200 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
202 name
= get_macro_name(expr
->right
->pos
);
205 if (strcmp(name
, "container_of") == 0)
207 if (strcmp(name
, "rb_entry") == 0)
209 if (strcmp(name
, "list_entry") == 0)
211 if (strcmp(name
, "list_first_entry") == 0)
213 if (strcmp(name
, "hlist_entry") == 0)
215 if (strstr(name
, "for_each"))
220 static int is_ignored_function(void)
222 struct expression
*expr
;
224 expr
= get_faked_expression();
225 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
227 expr
= strip_expr(expr
->right
);
228 if (!expr
|| expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
)
231 if (sym_name_is("kmalloc", expr
->fn
))
233 if (sym_name_is("netdev_priv", expr
->fn
))
239 static int is_uncasted_function(void)
241 struct expression
*expr
;
242 struct symbol
*left_type
, *right_type
;
244 expr
= get_faked_expression();
245 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
247 if (expr
->right
->type
!= EXPR_CALL
)
249 left_type
= get_type(expr
->left
);
250 right_type
= get_type(expr
->right
);
252 if (!left_type
|| !right_type
)
254 if (left_type
->type
!= SYM_PTR
|| right_type
->type
!= SYM_PTR
)
256 left_type
= get_real_base_type(left_type
);
257 right_type
= get_real_base_type(right_type
);
259 if (left_type
== right_type
)
264 static int set_param_type(void *_type_str
, int argc
, char **argv
, char **azColName
)
266 char **type_str
= _type_str
;
267 static char type_buf
[128];
270 if (strcmp(*type_str
, argv
[0]) == 0)
272 strncpy(type_buf
, "unknown", sizeof(type_buf
));
275 strncpy(type_buf
, argv
[0], sizeof(type_buf
));
276 *type_str
= type_buf
;
281 static char *db_get_parameter_type(int param
)
288 run_sql(set_param_type
, &ret
,
289 "select value from fn_data_link where "
290 "file = '%s' and function = '%s' and static = %d and type = %d and parameter = %d and key = '$';",
291 (cur_func_sym
->ctype
.modifiers
& MOD_STATIC
) ? get_base_file() : "extern",
292 cur_func_sym
->ident
->name
,
293 !!(cur_func_sym
->ctype
.modifiers
& MOD_STATIC
),
299 static int is_uncasted_fn_param_from_db(void)
301 struct expression
*expr
, *right
;
302 struct symbol
*left_type
;
303 char left_type_name
[128];
305 char *right_type_name
;
306 static struct expression
*prev_expr
;
309 expr
= get_faked_expression();
311 if (expr
== prev_expr
)
316 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
318 left_type
= get_type(expr
->left
);
319 if (!left_type
|| left_type
->type
!= SYM_PTR
)
321 left_type
= get_real_base_type(left_type
);
322 if (!left_type
|| left_type
->type
!= SYM_STRUCT
)
324 snprintf(left_type_name
, sizeof(left_type_name
), "%s", type_to_str(left_type
));
326 right
= strip_expr(expr
->right
);
327 param
= get_param_num(right
);
330 right_type_name
= db_get_parameter_type(param
);
331 if (!right_type_name
)
334 if (strcmp(right_type_name
, left_type_name
) == 0) {
342 static void match_assign_value(struct expression
*expr
)
344 char *member
, *right_member
;
345 struct range_list
*rl
;
348 type
= get_type(expr
->left
);
349 if (type
&& type
->type
== SYM_STRUCT
)
352 member
= get_member_name(expr
->left
);
356 /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
357 right_member
= get_member_name(expr
->right
);
358 if (right_member
&& strcmp(right_member
, member
) == 0)
361 if (is_fake_call(expr
->right
)) {
362 if (is_ignored_macro())
364 if (is_ignored_function())
366 if (is_uncasted_function())
368 if (is_uncasted_fn_param_from_db())
370 if (is_container_of())
372 add_fake_type_val(member
, alloc_whole_rl(get_type(expr
->left
)), is_ignored_fake_assignment());
376 if (expr
->op
== '=') {
377 get_absolute_rl(expr
->right
, &rl
);
378 rl
= cast_rl(type
, rl
);
381 * This is a bit cheating. We order it so this will already be set
382 * by smatch_extra.c and we just look up the value.
384 get_absolute_rl(expr
->left
, &rl
);
386 add_type_val(member
, rl
);
388 free_string(right_member
);
393 * If we too: int *p = &my_struct->member then abandon all hope of tracking
396 static void match_assign_pointer(struct expression
*expr
)
398 struct expression
*right
;
400 struct range_list
*rl
;
403 right
= strip_expr(expr
->right
);
404 if (right
->type
!= EXPR_PREOP
|| right
->op
!= '&')
406 right
= strip_expr(right
->unop
);
408 member
= get_member_name(right
);
411 type
= get_type(right
);
412 rl
= alloc_whole_rl(type
);
413 add_type_val(member
, rl
);
417 static void match_global_assign(struct expression
*expr
)
420 struct range_list
*rl
;
423 type
= get_type(expr
->left
);
424 if (type
&& (type
->type
== SYM_ARRAY
|| type
->type
== SYM_STRUCT
))
426 member
= get_member_name(expr
->left
);
429 get_absolute_rl(expr
->right
, &rl
);
430 rl
= cast_rl(type
, rl
);
431 add_global_type_val(member
, rl
);
435 static void unop_expr(struct expression
*expr
)
437 struct range_list
*rl
;
440 if (expr
->op
!= SPECIAL_DECREMENT
&& expr
->op
!= SPECIAL_INCREMENT
)
443 expr
= strip_expr(expr
->unop
);
444 member
= get_member_name(expr
);
447 rl
= alloc_whole_rl(get_type(expr
));
448 add_type_val(member
, rl
);
452 static void asm_expr(struct statement
*stmt
)
454 struct expression
*expr
;
455 struct range_list
*rl
;
459 FOR_EACH_PTR(stmt
->asm_outputs
, expr
) {
461 case 0: /* identifier */
462 case 1: /* constraint */
465 case 2: /* expression */
467 member
= get_member_name(expr
);
470 rl
= alloc_whole_rl(get_type(expr
));
471 add_type_val(member
, rl
);
475 } END_FOR_EACH_PTR(expr
);
478 static void db_param_add(struct expression
*expr
, int param
, char *key
, char *value
)
480 struct expression
*arg
;
482 struct range_list
*rl
;
485 if (strcmp(key
, "*$") != 0)
488 while (expr
->type
== EXPR_ASSIGNMENT
)
489 expr
= strip_expr(expr
->right
);
490 if (expr
->type
!= EXPR_CALL
)
493 arg
= get_argument_from_call_expr(expr
->args
, param
);
494 arg
= strip_expr(arg
);
497 type
= get_member_type_from_key(arg
, key
);
498 if (arg
->type
!= EXPR_PREOP
|| arg
->op
!= '&')
500 arg
= strip_expr(arg
->unop
);
502 member
= get_member_name(arg
);
505 call_results_to_rl(expr
, type
, value
, &rl
);
506 add_type_val(member
, rl
);
510 static void match_end_func_info(struct symbol
*sym
)
514 FOR_EACH_SM(fn_type_val
, sm
) {
515 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
516 } END_FOR_EACH_SM(sm
);
519 static void match_after_func(struct symbol
*sym
)
521 free_stree(&fn_type_val
);
524 static void match_end_file(struct symbol_list
*sym_list
)
528 FOR_EACH_SM(global_type_val
, sm
) {
529 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
530 } END_FOR_EACH_SM(sm
);
533 void register_type_val(int id
)
540 add_hook(&match_assign_value
, ASSIGNMENT_HOOK_AFTER
);
541 add_hook(&match_assign_pointer
, ASSIGNMENT_HOOK
);
542 add_hook(&unop_expr
, OP_HOOK
);
543 add_hook(&asm_expr
, ASM_HOOK
);
544 select_return_states_hook(PARAM_ADD
, &db_param_add
);
545 select_return_states_hook(PARAM_SET
, &db_param_add
);
548 add_hook(&match_inline_start
, INLINE_FN_START
);
549 add_hook(&match_inline_end
, INLINE_FN_END
);
551 add_hook(&match_end_func_info
, END_FUNC_HOOK
);
552 add_hook(&match_after_func
, AFTER_FUNC_HOOK
);
554 add_hook(&match_global_assign
, GLOBAL_ASSIGNMENT_HOOK
);
555 add_hook(&match_end_file
, END_FILE_HOOK
);