Re: [cocci] Can we match a known macro by macro name instead of expanded function name?

On Sat, 29 Nov 2025, Tobias Deiminger wrote:

> Hi Julia,
>
> Am 29.11.2025 11:56 schrieb Julia Lawall:
> > On Sat, 29 Nov 2025, Tobias Deiminger wrote:
> >
> > > Hi,
> > >
> > > my newbie assumption was we could match the following by macro name
> > >
> > >   // my.c
> > >   SYSCALL_DEFINE0(foo_bar) { return; }
> > >
> > > using this rules
> > >
> > >   // my.cocci
> > >   @r@
> > >   identifier fn =~ "SYSCALL_DEFINE[0-6]+";
> > >   position p;
> > >   @@
> > >   fn@p(...) {...}
> > >
> > >   @script:python@
> > >   fn << r.fn;
> > >   p << r.p;
> > >   @@
> > >   print(f"match: {fn} at line {p[0].current_element_line}")
> > >
> > >
> > > Turns out, SYSCALL_DEFINE0 is a "known macro" from
> > > /usr/lib/coccinelle/standard.h. In this case coccinelle seems to match an
> > > identifier on the expanded function name, not the macro name. I.e., this
> > > would
> > > work:
> > >
> > >   identifier fn =~ "foo.*";
> > >
> > > But I really want to search all syscalls by the conventional macro names,
> > > i.e.
> > > search for SYSCALL_DEFINE[0-6]+. How to do that?
> >
> > The problem is that the code won't parse with the conventional macro
> > name.  Maybe you could change the macro definition in standard.h to put eg
> > __SYSCALL_DEFINE0 in front of the function name?  That would be considered
> > to be an attribute and then you could put __SYSCALL_DEFINE0 as an
> > attribute name in your semantic patch.
>
> sorry for having to ask again. Your suggestion sounds very reasonable. But I
> couldn't figure out how to match on attributes. I guessed it would be
> something like this
>
>   @r@
>   attribute a;
>   identifier fn;
>   @@
>
>   a fn(...) { ... }
>
> But that gives a .cocci parse error:
>
>   minus: parse error:
>     File "my.cocci", line 6, column 2, charpos = 38
>     around = 'fn',
>     whole content = a fn(...) { ... }
>
> Expected, IIUC, since attribute doesn't occur in fundecl from grammar:
>
>   fundecl ::=  [fn_ctype] funinfo * funid ([PARAMSEQ(param, ε)]) { [stmt_seq]
> }
>
> How else to look for functions with attributes then?

The return type for the function is required in this case:

@r@
attribute a;
identifier fn;
types t;
@@

* t a fn(...) { ... }

julia