2 * Copyright (C) 2013 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * The plan here is to save all the possible values store to a given struct
22 * We will load all the values in to the function_type_val table first then
23 * run a script on that and load all the resulting values into the type_val
26 * So in this file we want to take the union of everything assigned to the
27 * struct member and insert it into the function_type_val at the end.
29 * You would think that we could use smatch_modification_hooks.c or
30 * extra_modification_hook() here to get the information here but in the end we
31 * need to code everything again a third time.
36 #include "smatch_slist.h"
37 #include "smatch_extra.h"
41 struct stree_stack
*fn_type_val_stack
;
42 struct stree
*fn_type_val
;
43 struct stree
*global_type_val
;
45 static int get_vals(void *_db_vals
, int argc
, char **argv
, char **azColName
)
47 char **db_vals
= _db_vals
;
49 *db_vals
= alloc_string(argv
[0]);
53 static void match_inline_start(struct expression
*expr
)
55 push_stree(&fn_type_val_stack
, fn_type_val
);
59 static void match_inline_end(struct expression
*expr
)
61 free_stree(&fn_type_val
);
62 fn_type_val
= pop_stree(&fn_type_val_stack
);
66 struct expression
*expr
;
67 struct range_list
*rl
;
69 static struct expr_rl cached_results
[10];
72 static int get_cached(struct expression
*expr
, struct range_list
**rl
, int *ret
)
78 for (i
= 0; i
< ARRAY_SIZE(cached_results
); i
++) {
79 if (expr
== cached_results
[i
].expr
) {
80 if (cached_results
[i
].rl
) {
81 *rl
= clone_rl(cached_results
[i
].rl
);
91 int get_db_type_rl(struct expression
*expr
, struct range_list
**rl
)
95 struct range_list
*tmp
;
99 if (get_cached(expr
, rl
, &ret
))
102 member
= get_member_name(expr
);
106 res_idx
= (res_idx
+ 1) % ARRAY_SIZE(cached_results
);
107 cached_results
[res_idx
].expr
= expr
;
108 cached_results
[res_idx
].rl
= NULL
;
110 run_sql(get_vals
, &db_vals
,
111 "select value from type_value where type = '%s';", member
);
115 type
= get_type(expr
);
116 str_to_rl(type
, db_vals
, &tmp
);
117 free_string(db_vals
);
118 if (is_whole_rl(tmp
))
122 cached_results
[res_idx
].rl
= clone_rl(tmp
);
127 static void add_type_val(char *member
, struct range_list
*rl
)
129 struct smatch_state
*old
, *add
, *new;
131 member
= alloc_string(member
);
132 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
133 add
= alloc_estate_rl(rl
);
135 new = merge_estates(old
, add
);
138 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
141 static void add_fake_type_val(char *member
, struct range_list
*rl
, int ignore
)
143 struct smatch_state
*old
, *add
, *new;
145 member
= alloc_string(member
);
146 old
= get_state_stree(fn_type_val
, my_id
, member
, NULL
);
147 if (old
&& strcmp(old
->name
, "min-max") == 0)
149 if (ignore
&& old
&& strcmp(old
->name
, "ignore") == 0)
151 add
= alloc_estate_rl(rl
);
153 new = merge_estates(old
, add
);
157 new->name
= alloc_string("ignore");
159 new->name
= alloc_string("min-max");
161 set_state_stree(&fn_type_val
, my_id
, member
, NULL
, new);
164 static void add_global_type_val(char *member
, struct range_list
*rl
)
166 struct smatch_state
*old
, *add
, *new;
168 member
= alloc_string(member
);
169 old
= get_state_stree(global_type_val
, my_id
, member
, NULL
);
170 add
= alloc_estate_rl(rl
);
172 new = merge_estates(old
, add
);
175 new = clone_estate_perm(new);
176 set_state_stree_perm(&global_type_val
, my_id
, member
, NULL
, new);
179 static int has_link_cb(void *has_link
, int argc
, char **argv
, char **azColName
)
181 *(int *)has_link
= 1;
185 static int is_ignored_fake_assignment(void)
187 struct expression
*expr
;
192 expr
= get_faked_expression();
193 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
195 if (!is_void_pointer(expr
->right
))
197 member_name
= get_member_name(expr
->right
);
201 type
= get_type(expr
->left
);
202 if (!type
|| type
->type
!= SYM_PTR
)
204 type
= get_real_base_type(type
);
205 if (!type
|| type
->type
!= SYM_STRUCT
)
208 run_sql(has_link_cb
, &has_link
,
209 "select * from data_info where type = %d and data = '%s' and value = '%s';",
210 TYPE_LINK
, member_name
, type_to_str(type
));
214 static int is_container_of(void)
216 /* We already check the macro name in is_ignored_macro() */
217 struct expression
*expr
;
220 expr
= get_faked_expression();
221 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
224 offset
= get_offset_from_container_of(expr
->right
);
230 static int is_ignored_macro(void)
232 struct expression
*expr
;
235 expr
= get_faked_expression();
236 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
238 name
= get_macro_name(expr
->right
->pos
);
241 if (strcmp(name
, "container_of") == 0)
243 if (strcmp(name
, "rb_entry") == 0)
245 if (strcmp(name
, "list_entry") == 0)
247 if (strcmp(name
, "list_first_entry") == 0)
249 if (strcmp(name
, "hlist_entry") == 0)
251 if (strstr(name
, "for_each"))
256 static int is_ignored_function(void)
258 struct expression
*expr
;
260 expr
= get_faked_expression();
261 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
263 expr
= strip_expr(expr
->right
);
264 if (!expr
|| expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
)
267 if (sym_name_is("kmalloc", expr
->fn
))
269 if (sym_name_is("netdev_priv", expr
->fn
))
275 static int is_uncasted_pointer_assign(void)
277 struct expression
*expr
;
278 struct symbol
*left_type
, *right_type
;
280 expr
= get_faked_expression();
283 if (expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) {
284 if (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
)
287 if (expr
->type
!= EXPR_ASSIGNMENT
)
289 left_type
= get_type(expr
->left
);
290 right_type
= get_type(expr
->right
);
292 if (!left_type
|| !right_type
)
295 if (left_type
->type
!= SYM_PTR
&&
296 left_type
->type
!= SYM_ARRAY
)
298 if (right_type
->type
!= SYM_PTR
&&
299 right_type
->type
!= SYM_ARRAY
)
301 left_type
= get_real_base_type(left_type
);
302 right_type
= get_real_base_type(right_type
);
304 if (left_type
== right_type
)
309 static int set_param_type(void *_type_str
, int argc
, char **argv
, char **azColName
)
311 char **type_str
= _type_str
;
312 static char type_buf
[128];
315 if (strcmp(*type_str
, argv
[0]) == 0)
317 strncpy(type_buf
, "unknown", sizeof(type_buf
));
320 strncpy(type_buf
, argv
[0], sizeof(type_buf
));
321 *type_str
= type_buf
;
326 static char *db_get_parameter_type(int param
)
333 run_sql(set_param_type
, &ret
,
334 "select value from fn_data_link where "
335 "file = '%s' and function = '%s' and static = %d and type = %d and parameter = %d and key = '$';",
336 (cur_func_sym
->ctype
.modifiers
& MOD_STATIC
) ? get_base_file() : "extern",
337 cur_func_sym
->ident
->name
,
338 !!(cur_func_sym
->ctype
.modifiers
& MOD_STATIC
),
344 static int is_uncasted_fn_param_from_db(void)
346 struct expression
*expr
, *right
;
347 struct symbol
*left_type
;
348 char left_type_name
[128];
350 char *right_type_name
;
351 static struct expression
*prev_expr
;
354 expr
= get_faked_expression();
356 if (expr
== prev_expr
)
361 if (!expr
|| expr
->type
!= EXPR_ASSIGNMENT
)
363 left_type
= get_type(expr
->left
);
364 if (!left_type
|| left_type
->type
!= SYM_PTR
)
366 left_type
= get_real_base_type(left_type
);
367 if (!left_type
|| left_type
->type
!= SYM_STRUCT
)
369 snprintf(left_type_name
, sizeof(left_type_name
), "%s", type_to_str(left_type
));
371 right
= strip_expr(expr
->right
);
372 param
= get_param_num(right
);
375 right_type_name
= db_get_parameter_type(param
);
376 if (!right_type_name
)
379 if (strcmp(right_type_name
, left_type_name
) == 0) {
387 static void match_assign_value(struct expression
*expr
)
389 char *member
, *right_member
;
390 struct range_list
*rl
;
393 type
= get_type(expr
->left
);
394 if (type
&& type
->type
== SYM_STRUCT
)
397 member
= get_member_name(expr
->left
);
401 /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
402 right_member
= get_member_name(expr
->right
);
403 if (right_member
&& strcmp(right_member
, member
) == 0)
406 if (is_fake_call(expr
->right
)) {
407 if (is_ignored_macro())
409 if (is_ignored_function())
411 if (is_uncasted_pointer_assign())
413 if (is_uncasted_fn_param_from_db())
415 if (is_container_of())
417 add_fake_type_val(member
, alloc_whole_rl(get_type(expr
->left
)), is_ignored_fake_assignment());
421 if (expr
->op
== '=') {
422 get_absolute_rl(expr
->right
, &rl
);
423 rl
= cast_rl(type
, rl
);
426 * This is a bit cheating. We order it so this will already be set
427 * by smatch_extra.c and we just look up the value.
429 get_absolute_rl(expr
->left
, &rl
);
431 add_type_val(member
, rl
);
433 free_string(right_member
);
438 * If we too: int *p = &my_struct->member then abandon all hope of tracking
441 static void match_assign_pointer(struct expression
*expr
)
443 struct expression
*right
;
445 struct range_list
*rl
;
448 right
= strip_expr(expr
->right
);
449 if (right
->type
!= EXPR_PREOP
|| right
->op
!= '&')
451 right
= strip_expr(right
->unop
);
453 member
= get_member_name(right
);
456 type
= get_type(right
);
457 rl
= alloc_whole_rl(type
);
458 add_type_val(member
, rl
);
462 static void match_global_assign(struct expression
*expr
)
465 struct range_list
*rl
;
468 type
= get_type(expr
->left
);
469 if (type
&& (type
->type
== SYM_ARRAY
|| type
->type
== SYM_STRUCT
))
471 member
= get_member_name(expr
->left
);
474 get_absolute_rl(expr
->right
, &rl
);
475 rl
= cast_rl(type
, rl
);
476 add_global_type_val(member
, rl
);
480 static void unop_expr(struct expression
*expr
)
482 struct range_list
*rl
;
485 if (expr
->op
!= SPECIAL_DECREMENT
&& expr
->op
!= SPECIAL_INCREMENT
)
488 expr
= strip_expr(expr
->unop
);
489 member
= get_member_name(expr
);
492 rl
= alloc_whole_rl(get_type(expr
));
493 add_type_val(member
, rl
);
497 static void asm_expr(struct statement
*stmt
)
499 struct expression
*expr
;
500 struct range_list
*rl
;
504 FOR_EACH_PTR(stmt
->asm_outputs
, expr
) {
506 case 0: /* identifier */
507 case 1: /* constraint */
510 case 2: /* expression */
512 member
= get_member_name(expr
);
515 rl
= alloc_whole_rl(get_type(expr
));
516 add_type_val(member
, rl
);
520 } END_FOR_EACH_PTR(expr
);
523 static void db_param_add(struct expression
*expr
, int param
, char *key
, char *value
)
525 struct expression
*arg
;
527 struct range_list
*rl
;
530 if (strcmp(key
, "*$") != 0)
533 while (expr
->type
== EXPR_ASSIGNMENT
)
534 expr
= strip_expr(expr
->right
);
535 if (expr
->type
!= EXPR_CALL
)
538 arg
= get_argument_from_call_expr(expr
->args
, param
);
539 arg
= strip_expr(arg
);
542 type
= get_member_type_from_key(arg
, key
);
543 if (arg
->type
!= EXPR_PREOP
|| arg
->op
!= '&')
545 arg
= strip_expr(arg
->unop
);
547 member
= get_member_name(arg
);
550 call_results_to_rl(expr
, type
, value
, &rl
);
551 add_type_val(member
, rl
);
555 static void match_end_func_info(struct symbol
*sym
)
559 FOR_EACH_SM(fn_type_val
, sm
) {
560 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
561 } END_FOR_EACH_SM(sm
);
564 static void clear_cache(struct symbol
*sym
)
566 memset(cached_results
, 0, sizeof(cached_results
));
569 static void match_after_func(struct symbol
*sym
)
571 free_stree(&fn_type_val
);
574 static void match_end_file(struct symbol_list
*sym_list
)
578 FOR_EACH_SM(global_type_val
, sm
) {
579 sql_insert_function_type_value(sm
->name
, sm
->state
->name
);
580 } END_FOR_EACH_SM(sm
);
583 void register_type_val(int id
)
586 add_hook(&clear_cache
, AFTER_FUNC_HOOK
);
591 add_hook(&match_assign_value
, ASSIGNMENT_HOOK_AFTER
);
592 add_hook(&match_assign_pointer
, ASSIGNMENT_HOOK
);
593 add_hook(&unop_expr
, OP_HOOK
);
594 add_hook(&asm_expr
, ASM_HOOK
);
595 select_return_states_hook(PARAM_ADD
, &db_param_add
);
596 select_return_states_hook(PARAM_SET
, &db_param_add
);
599 add_hook(&match_inline_start
, INLINE_FN_START
);
600 add_hook(&match_inline_end
, INLINE_FN_END
);
602 add_hook(&match_end_func_info
, END_FUNC_HOOK
);
603 add_hook(&match_after_func
, AFTER_FUNC_HOOK
);
605 add_hook(&match_global_assign
, GLOBAL_ASSIGNMENT_HOOK
);
606 add_hook(&match_end_file
, END_FILE_HOOK
);