Re: [cocci] Can we match a known macro by macro name instead of expanded function name?

Hi Julia,

Am 29.11.2025 11:56 schrieb Julia Lawall:
> On Sat, 29 Nov 2025, Tobias Deiminger wrote:
> 
>> Hi,
>> 
>> my newbie assumption was we could match the following by macro name
>> 
>>   // my.c
>>   SYSCALL_DEFINE0(foo_bar) { return; }
>> 
>> using this rules
>> 
>>   // my.cocci
>>   @r@
>>   identifier fn =~ "SYSCALL_DEFINE[0-6]+";
>>   position p;
>>   @@
>>   fn@p(...) {...}
>> 
>>   @script:python@
>>   fn << r.fn;
>>   p << r.p;
>>   @@
>>   print(f"match: {fn} at line {p[0].current_element_line}")
>> 
>> 
>> Turns out, SYSCALL_DEFINE0 is a "known macro" from
>> /usr/lib/coccinelle/standard.h. In this case coccinelle seems to match 
>> an
>> identifier on the expanded function name, not the macro name. I.e., 
>> this would
>> work:
>> 
>>   identifier fn =~ "foo.*";
>> 
>> But I really want to search all syscalls by the conventional macro 
>> names, i.e.
>> search for SYSCALL_DEFINE[0-6]+. How to do that?
> 
> The problem is that the code won't parse with the conventional macro
> name.  Maybe you could change the macro definition in standard.h to put 
> eg
> __SYSCALL_DEFINE0 in front of the function name?  That would be 
> considered
> to be an attribute and then you could put __SYSCALL_DEFINE0 as an
> attribute name in your semantic patch.

sorry for having to ask again. Your suggestion sounds very reasonable. 
But I couldn't figure out how to match on attributes. I guessed it would 
be something like this

   @r@
   attribute a;
   identifier fn;
   @@

   a fn(...) { ... }

But that gives a .cocci parse error:

   minus: parse error:
     File "my.cocci", line 6, column 2, charpos = 38
     around = 'fn',
     whole content = a fn(...) { ... }

Expected, IIUC, since attribute doesn't occur in fundecl from grammar:

   fundecl ::=  [fn_ctype] funinfo * funid ([PARAMSEQ(param, ε)]) { 
[stmt_seq] }

How else to look for functions with attributes then?

Tobias