2 * Copyright (C) 2013 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * The plan here is to save all the possible values store to a given struct
22 * We will load all the values in to the function_type_val table first then
23 * run a script on that and load all the resulting values into the type_val
26 * So in this file we want to take the union of everything assigned to the
27 * struct member and insert it into the function_type_val at the end.
29 * You would think that we could use smatch_modification_hooks.c or
30 * extra_modification_hook() here to get the information here but in the end we
31 * need to code everything again a third time.
36 #include "smatch_slist.h"
37 #include "smatch_extra.h"
41 struct stree_stack
*fn_type_val_stack
;
42 struct stree
*fn_type_val
;
43 struct stree
*global_type_val
;
45 static int get_vals(void *_db_vals
, int argc
, char **argv
, char **azColName
)
47 char **db_vals
= _db_vals
;
49 *db_vals
= alloc_string(argv
[0]);
53 static void match_inline_start(struct expression
*expr
)
55 push_stree(&fn_type_val_stack
, fn_type_val
);
59 static void match_inline_end(struct expression
*expr
)
61 free_stree(&fn_type_val
);
62 fn_type_val
= pop_stree(&fn_type_val_stack
);
66 struct expression
*expr
;
67 struct range_list
*rl
;
69 static struct expr_rl cached_results
[10];
72 static int get_cached(struct expression
*expr
, struct range_list
**rl
, int *ret
)
78 for (i
= 0; i
< ARRAY_SIZE(cached_results
); i
++) {
79 if (expr
== cached_results
[i
].expr
) {
80 if (cached_results
[i
].rl
) {
81 *rl
= clone_rl(cached_results
[i
].rl
);
91 int get_db_type_rl(struct expression
*expr
, struct range_list
**rl
)
95 struct range_list
*tmp
;
99 if (get_cached(expr
, rl
, &ret
))
102 member
= get_member_name(expr
);
106 res_idx
= (res_idx
+ 1) % ARRAY_SIZE(cached_results
);
107 cached_results
[res_idx
].expr
= expr
;
108 cached_results
[res_idx
].rl
= NULL
;
110 run_sql(get_vals
, &db_vals
,
111 "select value from type_value where type = '%s';", member
);
115 type
= get_type(expr
);
116 str_to_rl(type
, db_vals
, &tmp
);
117 free_string(db_vals
);
118 if (is_whole_rl(tmp
))
122 cached_results
[res_idx
].rl
= clone_rl(tmp
);
127 static void add_type_val(char *member
, struct range_list
*rl
)
129 struct smatch_state
*old
, *add
, *new;
131 member
= alloc_string(member
);
132 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
133 add
= alloc_estate_rl(rl
);
135 new = merge_estates(old
, add
);
138 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
141 static void add_fake_type_val(char *member
, struct range_list
*rl
, int ignore
)
143 struct smatch_state
*old
, *add
, *new;
145 member
= alloc_string(member
);
146 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
147 if (old
&& strcmp(old
->name
, "min-max") == 0)
149 if (ignore
&& old
&& strcmp(old
->name
, "ignore") == 0)
151 add
= alloc_estate_rl(rl
);
153 new = merge_estates(old
, add
);
157 new->name
= alloc_string("ignore");
159 new->name
= alloc_string("min-max");
161 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
164 static void add_global_type_val(char *member
, struct range_list
*rl
)
166 struct smatch_state
*old
, *add
, *new;
168 member
= alloc_string(member
);
169 old
= get_state_stree(global_type_val
, my_id
, member
, NULL
);
170 add
= alloc_estate_rl(rl
);
172 new = merge_estates(old
, add
);
175 new = clone_estate_perm(new);
176 set_state_stree_perm(&global_type_val
, my_id
, member
, NULL
, new);
179 static int has_link_cb(void *has_link
, int argc
, char **argv
, char **azColName
)
181 *(int *)has_link
= 1;
185 static int is_ignored_fake_assignment(void)
187 struct expression
*expr
;
192 expr
= get_faked_expression();
193 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
195 if (!is_void_pointer(expr
->right
))
197 member_name
= get_member_name(expr
->right
);
201 type
= get_type(expr
->left
);
202 if (!type
|| type
->type
!= SYM_PTR
)
204 type
= get_real_base_type(type
);
205 if (!type
|| type
->type
!= SYM_STRUCT
)
208 run_sql(has_link_cb
, &has_link
,
209 "select * from data_info where type = %d and data = '%s' and value = '%s';",
210 TYPE_LINK
, member_name
, type_to_str(type
));
214 static int is_container_of(void)
216 /* We already check the macro name in is_ignored_macro() */
217 struct expression
*expr
;
220 expr
= get_faked_expression();
221 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
224 offset
= get_offset_from_container_of(expr
->right
);
230 static bool is_driver_data(void)
232 static struct expression
*prev_expr
;
233 struct expression
*expr
;
235 static bool prev_ret
;
238 expr
= get_faked_expression();
239 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
242 if (expr
== prev_expr
)
246 name
= expr_to_str(expr
->right
);
252 if (strstr(name
, "get_drvdata(") ||
253 strstr(name
, "dev.driver_data") ||
254 strstr(name
, "dev->driver_data"))
263 static int is_ignored_macro(void)
265 struct expression
*expr
;
268 expr
= get_faked_expression();
269 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
|| expr
->op
!= '=')
271 name
= get_macro_name(expr
->right
->pos
);
274 if (strcmp(name
, "container_of") == 0)
276 if (strcmp(name
, "rb_entry") == 0)
278 if (strcmp(name
, "list_entry") == 0)
280 if (strcmp(name
, "list_first_entry") == 0)
282 if (strcmp(name
, "hlist_entry") == 0)
284 if (strcmp(name
, "per_cpu_ptr") == 0)
286 if (strcmp(name
, "raw_cpu_ptr") == 0)
288 if (strcmp(name
, "this_cpu_ptr") == 0)
291 if (strcmp(name
, "TRACE_EVENT") == 0)
293 if (strcmp(name
, "DECLARE_EVENT_CLASS") == 0)
295 if (strcmp(name
, "DEFINE_EVENT") == 0)
298 if (strstr(name
, "for_each"))
303 static int is_ignored_function(void)
305 struct expression
*expr
;
307 expr
= get_faked_expression();
308 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
310 expr
= strip_expr(expr
->right
);
311 if (!expr
|| expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
)
314 if (sym_name_is("kmalloc", expr
->fn
))
316 if (sym_name_is("vmalloc", expr
->fn
))
318 if (sym_name_is("kvmalloc", expr
->fn
))
320 if (sym_name_is("kmalloc_array", expr
->fn
))
322 if (sym_name_is("vmalloc_array", expr
->fn
))
324 if (sym_name_is("kvmalloc_array", expr
->fn
))
327 if (sym_name_is("mmu_memory_cache_alloc", expr
->fn
))
329 if (sym_name_is("kmem_alloc", expr
->fn
))
331 if (sym_name_is("alloc_pages", expr
->fn
))
334 if (sym_name_is("netdev_priv", expr
->fn
))
336 if (sym_name_is("dev_get_drvdata", expr
->fn
))
338 if (sym_name_is("i2c_get_clientdata", expr
->fn
))
344 static int is_uncasted_pointer_assign(void)
346 struct expression
*expr
;
347 struct symbol
*left_type
, *right_type
;
349 expr
= get_faked_expression();
352 if (expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) {
353 if (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
)
356 if (expr
->type
!= EXPR_ASSIGNMENT
)
358 left_type
= get_type(expr
->left
);
359 right_type
= get_type(expr
->right
);
361 if (!left_type
|| !right_type
)
364 if (left_type
->type
== SYM_STRUCT
&& left_type
== right_type
)
367 if (left_type
->type
!= SYM_PTR
&&
368 left_type
->type
!= SYM_ARRAY
)
370 if (right_type
->type
!= SYM_PTR
&&
371 right_type
->type
!= SYM_ARRAY
)
373 left_type
= get_real_base_type(left_type
);
374 right_type
= get_real_base_type(right_type
);
376 if (left_type
== right_type
)
381 static int set_param_type(void *_type_str
, int argc
, char **argv
, char **azColName
)
383 char **type_str
= _type_str
;
384 static char type_buf
[128];
387 if (strcmp(*type_str
, argv
[0]) == 0)
389 strncpy(type_buf
, "unknown", sizeof(type_buf
));
392 strncpy(type_buf
, argv
[0], sizeof(type_buf
));
393 *type_str
= type_buf
;
398 static char *db_get_parameter_type(int param
)
405 run_sql(set_param_type
, &ret
,
406 "select value from fn_data_link where "
407 "file = '%s' and function = '%s' and static = %d and type = %d and parameter = %d and key = '$';",
408 (cur_func_sym
->ctype
.modifiers
& MOD_STATIC
) ? get_base_file() : "extern",
409 cur_func_sym
->ident
->name
,
410 !!(cur_func_sym
->ctype
.modifiers
& MOD_STATIC
),
416 static int is_uncasted_fn_param_from_db(void)
418 struct expression
*expr
, *right
;
419 struct symbol
*left_type
;
420 char left_type_name
[128];
422 char *right_type_name
;
423 static struct expression
*prev_expr
;
426 expr
= get_faked_expression();
428 if (expr
== prev_expr
)
433 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
435 left_type
= get_type(expr
->left
);
436 if (!left_type
|| left_type
->type
!= SYM_PTR
)
438 left_type
= get_real_base_type(left_type
);
439 if (!left_type
|| left_type
->type
!= SYM_STRUCT
)
441 snprintf(left_type_name
, sizeof(left_type_name
), "%s", type_to_str(left_type
));
443 right
= strip_expr(expr
->right
);
444 param
= get_param_num(right
);
447 right_type_name
= db_get_parameter_type(param
);
448 if (!right_type_name
)
451 if (strcmp(right_type_name
, left_type_name
) == 0) {
459 static void match_assign_value(struct expression
*expr
)
461 char *member
, *right_member
;
462 struct range_list
*rl
;
468 type
= get_type(expr
->left
);
469 if (type
&& type
->type
== SYM_STRUCT
)
471 member
= get_member_name(expr
->left
);
475 /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
476 right_member
= get_member_name(expr
->right
);
477 if (right_member
&& strcmp(right_member
, member
) == 0)
480 if (is_fake_call(expr
->right
)) {
481 if (is_ignored_macro())
483 if (is_ignored_function())
485 if (is_uncasted_pointer_assign())
487 if (is_uncasted_fn_param_from_db())
489 if (is_container_of())
491 if (is_driver_data())
493 add_fake_type_val(member
, alloc_whole_rl(get_type(expr
->left
)), is_ignored_fake_assignment());
497 if (expr
->op
== '=') {
498 get_absolute_rl(expr
->right
, &rl
);
499 rl
= cast_rl(type
, rl
);
502 * This is a bit cheating. We order it so this will already be set
503 * by smatch_extra.c and we just look up the value.
505 get_absolute_rl(expr
->left
, &rl
);
507 add_type_val(member
, rl
);
509 free_string(right_member
);
514 * If we too: int *p = &my_struct->member then abandon all hope of tracking
517 static void match_assign_pointer(struct expression
*expr
)
519 struct expression
*right
;
521 struct range_list
*rl
;
524 right
= strip_expr(expr
->right
);
525 if (right
->type
!= EXPR_PREOP
|| right
->op
!= '&')
527 right
= strip_expr(right
->unop
);
529 member
= get_member_name(right
);
532 type
= get_type(right
);
533 rl
= alloc_whole_rl(type
);
534 add_type_val(member
, rl
);
538 static void match_global_assign(struct expression
*expr
)
541 struct range_list
*rl
;
544 type
= get_type(expr
->left
);
545 if (type
&& (type
->type
== SYM_ARRAY
|| type
->type
== SYM_STRUCT
))
547 member
= get_member_name(expr
->left
);
550 get_absolute_rl(expr
->right
, &rl
);
551 rl
= cast_rl(type
, rl
);
552 add_global_type_val(member
, rl
);
556 static void unop_expr(struct expression
*expr
)
558 struct range_list
*rl
;
561 if (expr
->op
!= SPECIAL_DECREMENT
&& expr
->op
!= SPECIAL_INCREMENT
)
564 expr
= strip_expr(expr
->unop
);
565 member
= get_member_name(expr
);
568 rl
= alloc_whole_rl(get_type(expr
));
569 add_type_val(member
, rl
);
573 static void asm_expr(struct statement
*stmt
)
575 struct expression
*expr
;
576 struct range_list
*rl
;
579 FOR_EACH_PTR(stmt
->asm_outputs
, expr
) {
580 member
= get_member_name(expr
->expr
);
583 rl
= alloc_whole_rl(get_type(expr
->expr
));
584 add_type_val(member
, rl
);
586 } END_FOR_EACH_PTR(expr
);
589 static void db_param_add(struct expression
*expr
, int param
, char *key
, char *value
)
591 struct expression
*arg
;
593 struct range_list
*rl
;
596 if (strcmp(key
, "*$") != 0)
599 while (expr
->type
== EXPR_ASSIGNMENT
)
600 expr
= strip_expr(expr
->right
);
601 if (expr
->type
!= EXPR_CALL
)
604 arg
= get_argument_from_call_expr(expr
->args
, param
);
605 arg
= strip_expr(arg
);
608 type
= get_member_type_from_key(arg
, key
);
610 * The situation here is that say we memset() a void pointer to zero
611 * then that's returned to the called as "*$ = 0;" but on the caller's
612 * side it's not void, it's a struct.
614 * So the question is should we be passing that slightly bogus
615 * information back to the caller? Maybe, maybe not, but either way we
616 * are not going to record it here because a struct can't be zero.
619 if (type
&& type
->type
== SYM_STRUCT
)
622 if (arg
->type
!= EXPR_PREOP
|| arg
->op
!= '&')
624 arg
= strip_expr(arg
->unop
);
626 member
= get_member_name(arg
);
629 call_results_to_rl(expr
, type
, value
, &rl
);
630 add_type_val(member
, rl
);
634 static void match_end_func_info(struct symbol
*sym
)
638 FOR_EACH_SM(fn_type_val
, sm
) {
639 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
640 } END_FOR_EACH_SM(sm
);
643 static void clear_cache(struct symbol
*sym
)
645 memset(cached_results
, 0, sizeof(cached_results
));
648 static void match_after_func(struct symbol
*sym
)
650 free_stree(&fn_type_val
);
653 static void match_end_file(struct symbol_list
*sym_list
)
657 FOR_EACH_SM(global_type_val
, sm
) {
658 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
659 } END_FOR_EACH_SM(sm
);
662 void register_type_val(int id
)
665 add_hook(&clear_cache
, AFTER_FUNC_HOOK
);
670 add_hook(&match_assign_value
, ASSIGNMENT_HOOK_AFTER
);
671 add_hook(&match_assign_pointer
, ASSIGNMENT_HOOK
);
672 add_hook(&unop_expr
, OP_HOOK
);
673 add_hook(&asm_expr
, ASM_HOOK
);
674 select_return_states_hook(PARAM_ADD
, &db_param_add
);
675 select_return_states_hook(PARAM_SET
, &db_param_add
);
678 add_hook(&match_inline_start
, INLINE_FN_START
);
679 add_hook(&match_inline_end
, INLINE_FN_END
);
681 add_hook(&match_end_func_info
, END_FUNC_HOOK
);
682 add_hook(&match_after_func
, AFTER_FUNC_HOOK
);
684 add_hook(&match_global_assign
, GLOBAL_ASSIGNMENT_HOOK
);
685 add_hook(&match_end_file
, END_FILE_HOOK
);