Re: [cocci] Can we match a known macro by macro name instead of expanded function name?

On Sat, 29 Nov 2025, Tobias Deiminger wrote:

> Hi,
>
> my newbie assumption was we could match the following by macro name
>
>   // my.c
>   SYSCALL_DEFINE0(foo_bar) { return; }
>
> using this rules
>
>   // my.cocci
>   @r@
>   identifier fn =~ "SYSCALL_DEFINE[0-6]+";
>   position p;
>   @@
>   fn@p(...) {...}
>
>   @script:python@
>   fn << r.fn;
>   p << r.p;
>   @@
>   print(f"match: {fn} at line {p[0].current_element_line}")
>
>
> Turns out, SYSCALL_DEFINE0 is a "known macro" from
> /usr/lib/coccinelle/standard.h. In this case coccinelle seems to match an
> identifier on the expanded function name, not the macro name. I.e., this would
> work:
>
>   identifier fn =~ "foo.*";
>
> But I really want to search all syscalls by the conventional macro names, i.e.
> search for SYSCALL_DEFINE[0-6]+. How to do that?

The problem is that the code won't parse with the conventional macro
name.  Maybe you could change the macro definition in standard.h to put eg
__SYSCALL_DEFINE0 in front of the function name?  That would be considered
to be an attribute and then you could put __SYSCALL_DEFINE0 as an
attribute name in your semantic patch.

The position also can't be on the expanded part.  That will give you a
position in standard.h.  Just move it to the {

julia