Coccinelle

Note

2009-07-31T13:28:05+02:00

For more information, see the following thread First, we update the inner function @haslocalflash@ identifier f; identifier flash; expression V1, V2, V3; @@ f(...) { struct flashchip *flash; <+... ( -chip_readb(V1) +chip_readb(flash,V1) | -chip_writeb(V2, V3) +chip_writeb(flash,V2, V3) ) ...+> } @hasflash depends on !haslocalflash@ identifier f; identifier flash; parameter list[n] AS; expression V1, V2, V3; @@ f(struct flashchi…

Consequence of a syntax error

2010-05-22T07:16:16+02:00

Consequence of a syntax error spatch performs syntax error recovery using various heuristics. If a syntax error occurs while processing a function definition no matching is attempted on the contents of that definition. The following: spatch -parse_c foo.c provides information about the parsing of the C file, foo.c. Lines annotated with BAD contain parse errors. A summary is provided at the end of the reasons for the most common parsing problems. Often parsing problems are due to macro u…

ce_func_ptr

2009-10-29T16:55:51+02:00

In the following code, foo, bar and baz are used as function pointers in funclist initialization. #include typedef int (Func)(); int foo(void) { printf("foo"); }; int bar(void) { printf("bar"); }; int baz(void) { printf("baz"); }; Func *funclist [] = { foo, bar, baz }; int main(void) { printf("baz"); baz(); (funclist[2])(); return 1; }

ce_use_wrapper

2009-10-29T16:35:00+02:00

When you introduce a wrapper function then you would like that the original function call isn't replaced inside the implementation of the wrapper function itself. Example C-code: #include int buh(void) { printf("wrapper"); return baz(); } int main(void) { printf("baz"); baz(); return 1; }

Alter the matching process

2010-04-23T08:45:35+02:00

Alter the matching process The following discards the environment that caused execution of the python rule. cocci.include_match(False) API for org mode Legacy API @r@ position p,p1; @@ // Place your cocci code here // using position p and then position p1. @script:python@ p << r.p; p1 << r.p1; @@ cocci.print_main("main message",p) # Use print_sec when you have exactly one p1 for every p. cocci.print_sec("secondary message", p1) # Use print_secs when you have at least one p1 for eve…

Python scripts

2009-05-31T21:00:05+02:00

Python scripts The characters that appear within a Python script, e.g., script:python @ expr_1 << if_eq_1.E_1; expr_2 << if_eq_1.E_2; @@ print expr_1, " @ ", expr_2 are not converted to tokens of any kind, they are simply scanned as characters. This means that a @ character appearing within a Python script is treated as a SmPL section organization character, even although it appears within what would otherwise be considered to be a string.

controlling_the_execution_of_python_rules

2009-07-23T18:04:06+02:00

Coccinelle applies the rules in order, with the first rule applied to every toplevel object (function, declaration, macro definition, etc) in the C source file, then the second rule applied to every toplevel object, etc. Furthermore, as Coccinelle proceeds through the rules, it applies a given rule once for each permutation of the bindings of the inherited metavariables. For a SmPL rule, it tries the rule even if some of the referenced metavariables are not bound, although a match on an unboun…

controlling_the_running_time_of_spatch

2009-05-31T22:19:47+02:00

There are two options that can be used to limit the cpu resources devoted to processing a given source file: * -steps n: This allows each rule to take at most n steps. It is probably not very easy for the user to figure out what a step is, because the matching process of Coccinelle includes a fixpoint iteration (ie, loops), so the number of steps does not eg, depend on the size of the SmPL code. But 10000 might be a reasonable number. The weakness of this approach is that then the rule (e…

dependencies_between_patterns

2010-03-14T14:57:19+02:00

It is possible for one rule to depend on the success or failure of another rule. There are four possibilities: * X: The rule is only applied to bindings that X succeeded on. In the following: @foo_found disable all@ identifier foo; @@ foo(...) { <+... { ... return; } ...+> } @bar depends on foo_found@ @@ -bar() any instances of the call bar() will only be removed when a match has occurred against a function called foo.

executing_python_at_start_end_of_every_source_file

2009-10-03T14:47:20+02:00

When spatch is given the name of a directory as an option it will run the semantic patch on every source file in that directory. If the semantic patch file starts with a Python action, then this action will be executed just prior to the processing of every source file. Similarly if the patch file ends with a Python action, then this will be executed at the end of processing of every source file.

global_local_var

2009-10-29T16:47:28+02:00

In the following example, the variable a defined in line 1 is hidden in the scope from line 5 to 9. The problem is thus to write a semantic patch that transforms only one of the two variables. 1. extern int a; 2. 3. void foo() 4. { 5. { 6. int a; 7. a = bar() + 3; 8. ... 9. } 10. 11 a = bar1() + bar2(); 12. }

if_statements

2009-05-31T22:19:47+02:00

The SmPL code: if (E) S1 else S2 where S2 is a statement metavariable that is not used elsewhere will match both an if-statement that contains an “else” part and an if-statement that does not contain an “else” part. This behavior is due to the following isomorphism defined in standard.iso:

language_constructs

2009-05-31T22:19:47+02:00

* if statements

matching_code_that_does_not_contain_some_construct

2009-08-21T21:31:05+02:00

Coccinelle patterns are designed to match source code that contains some construct. The following is a technique that can be used to match source code that does not contain some construct. For instance, to match all if-statements whose then arm contains a statement that is not a compound statement, i.e., not enclosed in curly brackets.

matching_python_rules

2009-07-23T21:32:05+02:00

After a pattern has matched it is possible to execute Python code. The execution of this code is conditional on any metavariables appearing in the script prelude having been bound to values within the matching pattern. In the following example the first Python script will not be executed unless the metavariable E_2_2 has been bound to a value and this will only occur when the matched expression-statement has the logical-OR form.

Constant

2010-05-24T11:08:46+02:00

Constant The constant attribute on a metavariable declaration will only match an explicit literal value. For instance constant int matches a literal that is considered to have int type. @r@ int E1; constant int C; @@ E1 = C Because in Linux constant defined using #define are commonly written using only capital letters, an identifier written using only capital letters is considered to be a constant as well. For example, consider the following semantic patch:

parameter_list_matching

2009-05-31T21:37:56+02:00

Sometimes is it useful to match a function parameter in an unknown position and then match the arguments at call sites that correspond to that parameter. The following semantic patch illustrates how to do this: @r@ identifier fn, x; parameter list[n] P; @@ fn(P, long x,...) { ... } @@ identifier r.fn; expression list[r.n] E; @@ fn(E, - atoi + atol (...),...) It is of course possible to go the other way, and match first an argument and then the parameter in the corresponding …

pattern_match_failure

2009-05-31T22:19:47+02:00

The following are some of the reasons why a .cocci script fails to match the expected source code constructs: * The source contains a syntax error. For instance, if a function definition contains a syntax error the contents of that function might be ignored when matching. The parse_c option can be used to check whether any syntax errors were encountered in the source.

Note

2009-07-31T13:29:34+02:00

For more information, see the following thread @initialize:python@ import re m = re.compile('_new$') @r_init@ expression E; identifier id; position p; @@ E = id@p(); @script:python@ id << r_init.id; @@ print "COCCI: Analyzing %s" % id if m.search(id.ident) != None: print "COCCI: %s matchs '_new$'" % id else: print "COCCI: %s discarded" % id cocci.include_match(False) @r_do@ expression E; identifier id; …

source_location_information

2010-03-07T12:28:13+02:00

Location metavariables are attached to a token with the '@' characted. A position metavariable contain the following information relative to its token: Field Information file the name of the current source file current_element the name of the function currently proceed line the starting line number of the token column the starting character position of the token line_end the ending li…

Coccinelle wiki

2010-08-07T15:07:11+02:00

spatch * Metavariables * C syntax errors * Coccinelle syntax errors * Matching Python rules Usage Tips * Language constructs * Controlling the running time of spatch * Pattern match failure * The use of "when" * Parameter list matching * Working on global/local variables -- using the ''local'' attribute * Position metavariables * Working on if with single statement, ignoring if with curly brakets * Update function calls to use a wrapper function without updating th…

the_use_of_when

2009-08-20T04:53:40+02:00

The when modifier on ”...” is normally used to indicate code that should not appear in the region matched by the ”...”. For example, the following pattern only matches if there is no call to xxx() between the calls to f and g: f(); ... when != xxx() g(); It is also possible to use when forall or when exists, to specify that ”...” should match all paths or only a single one. Finally, there are when strict and when any, which are explained as follows.

The spp tool

2010-08-07T15:12:05+02:00

In the source distribution of Coccinelle, there is the source code of the spp tool that call cpp before running spatch. All the -D and -I options are passed to cpp when it is called. An example is in the demos/spp directory of the Coccinelle distribution.

virtual_identifiers

2010-01-26T10:00:38+02:00

Often it is useful to have several semantic patches that have a similar structure, but that use different concrete variable names. For example, one could have a collection of semantic patches for finding or fixing memory leaks. These might all have the same structure, but differ in the names of the allocation and deallocation functions. To address this case, it is possible (starting in version 0.2.1) to parameterize a rule using virtual identifiers. Any identifier metavariable can be declare…

virtual_rules

2009-10-23T10:23:12+02:00

Sometimes it may be interesting to apply only a subset of the rules in a semantic patch. This is done in the case of coccicheck, to choose between rules that generate the output in diff and org mode format. It could also be useful when some rules are more precise, but more expensive, than others, and so it is not always desirable to run the more precise version. Essentially, this feature is analogous to #ifdef in C.

windows

2009-09-14T11:39:20+02:00

Coccinelle can be used under Windows using cygwin, but without support for Python. You must install ocaml. Then, give configure the argument --without-python. The difficulty in using Python is that Coccinelle uses pycaml, which does not seem to compile under cygwin. If anyone has succeeded in compiling pycaml under cygwin, we would be most interested to hear about it: cocci@diku.dk