1 \documentclass{article
}
6 \usepackage[geometry
]{ifsym
}
7 \title{Coccinelle Usage (version
0.1.4)
}
8 \newcommand{\minimum}[2]{\paragraph*
{\makebox[0in
][r
]{\FilledBigDiamondshape\,\,
} {{#1}}} {#2}}
9 \newcommand{\normal}[2]{\paragraph*
{\makebox[0in
][r
]{\BigLowerDiamond\,\,
} {{#1}}} {#2}}
10 \newcommand{\rare}[2]{\paragraph*
{\makebox[0in
][r
]{\BigDiamondshape\,\,
} {{#1}}} {#2}}
11 \newcommand{\developer}[2]{\paragraph*
{{#1}} {#2}}
13 % Very convenient to add comments on the paper. Just set the boolean
14 % to false before sending the paper:
15 \newboolean{showcomments
}
16 \setboolean{showcomments
}{true
}
17 \ifthenelse{\boolean{showcomments
}}
18 { \newcommand{\mynote}[2]{
19 \fbox{\bfseries\sffamily\scriptsize#1}
20 {\small$
\blacktriangleright$
\textsf{\emph{#2}}$
\blacktriangleleft$
}}}
21 { \newcommand{\mynote}[2]{}}
23 \newcommand\jl[1]{\mynote{Julia
}{#1}}
28 \section{Introduction
}
30 This
document describes the options provided by Coccinelle. The options
31 have an impact on various phases of the semantic patch application
35 \item Selecting and parsing the semantic patch.
36 \item Selecting and parsing the C code.
37 \item Application of the semantic patch to the C code.
39 \item Generation of the result.
43 One can either initiate the complete process from step
1, or
44 to perform step
1 or step
2 individually.
46 Coccinelle has quite a lot of options. The most common usages are as
47 follows, for a semantic match
{\tt foo.cocci
}, a C file
{\tt foo.c
}, and a
48 directory
{\tt foodir
}:
51 \item {\tt spatch -parse
\_cocci foo.cocci
}: Check that the semantic patch
52 is syntactically correct.
53 \item {\tt spatch -parse
\_c foo.c
}: Check that the C file
54 is syntactically correct. The Coccinelle C parser tries to recover
55 during the parsing process, so if one function does not parse, it will
56 start up again with the next one. Thus, a parse error is often not a
57 cause for concern, unless it occurs in a function that is relevant to the
59 \item {\tt spatch -sp
\_file foo.cocci foo.c
}: Apply the semantic patch
{\tt
60 foo.cocci
} to the file
{\tt foo.c
} and print out any transformations as a
62 \item {\tt spatch -sp
\_file foo.cocci foo.c -debug
}: The same as the
63 previous case, but print out some information about the matching process.
64 \item {\tt spatch -sp
\_file foo.cocci -dir foodir
}: Apply the semantic
65 patch
{\tt foo.cocci
} to all of the C files in the directory
{\tt foodir
}.
66 \item {\tt spatch -sp
\_file foo.cocci -dir foodir -include
\_headers}: Apply
67 the semantic patch
{\tt foo.cocci
} to all of the C files and header files
68 in the directory
{\tt foodir
}.
71 In the rest of this
document, the options are annotated as follows:
73 \item \FilledBigDiamondshape: a basic option, that is most likely of
74 interest to all users.
75 \item \BigLowerDiamond: an option that is frequently used, often for better
76 understanding the effect of a semantic patch.
77 \item \BigDiamondshape: an option that is likely to be rarely used, but
78 whose effect is still comprehensible to a user.
79 \item An option with no annotation is likely of interest only to
83 \section{Selecting and parsing the semantic patch
}
85 \subsection{Standalone options
}
87 \normal{-parse
\_cocci $
\langle$file$
\rangle$
}{ Parse a semantic
88 patch file and print out some information about it.
}
90 \subsection{The semantic patch
}
92 \minimum{-sp
\_file $
\langle$file$
\rangle$, -c $
\langle$file$
\rangle$,
93 -cocci
\_file $
\langle$file$
\rangle$
}{ Specify the name of the file
94 containing the semantic patch. The file name should end in
{\tt .cocci
}.
95 All three options do the same thing; the last two are deprecated.
}
97 \subsection{Isomorphisms
}
99 \rare{-iso, -iso
\_file}{ Specify a file containing isomorphisms to be used in
100 place of the standard one. Normally one should use the
{\tt using
}
101 construct within a semantic patch to specify isomorphisms to be used
{\em
102 in addition to
} the standard ones.
}
104 \rare{-iso
\_limit $
\langle$int$
\rangle$
} Limit the depth of application of
105 isomorphisms to the specified integer.
107 \rare{-no
\_iso\_limit} Put no limit on the number of times that
108 isomorphisms can be applied. This is the default.
110 \developer{-track
\_iso}{ Gather information about isomorphism usage.
}
112 \developer{-profile
\_iso}{ Gather information about the time required for
113 isomorphism expansion.
}
115 \subsection{Display options
}
117 \rare{-show
\_cocci}{Show the semantic patch that is being processed before
118 expanding isomorphisms.
}
120 \rare{-show
\_SP}{Show the semantic patch that is being processed after
121 expanding isomorphisms.
}
123 \rare{-show
\_ctl\_text}{ Show the representation
124 of the semantic patch in CTL.
}
126 \rare{-ctl
\_inline\_let}{ Sometimes
{\tt let
} is used to name
127 intermediate terms CTL representation. This option causes the let-bound
128 terms to be inlined at the point of their reference.
129 This option implicitly sets
{\bf -show
\_ctl\_text}.
}
131 \rare{-ctl
\_show\_mcodekind}{ Show
132 transformation information within the CTL representation
133 of the semantic patch. This option implicitly sets
{\bf -show
\_ctl\_text}.
}
135 \rare{-show
\_ctl\_tex}{ Create a LaTeX files showing the representation
136 of the semantic patch in CTL.
}
138 \section{Selecting and parsing the C files
}
140 \subsection{Standalone options
}
142 \normal{-parse
\_c $
\langle$file/dir$
\rangle$
}{ Parse a
{\tt .c
} file or all
143 of the
{\tt .c
} files in a directory. This generates information about
144 any parse errors encountered.
}
146 \normal{-parse
\_h $
\langle$file/dir$
\rangle$
}{ Parse a
{\tt .h
} file or all
147 of the
{\tt .h
} files in a directory. This generates information about
148 any parse errors encountered.
}
150 \normal{-parse
\_ch $
\langle$file/dir$
\rangle$
}{ Parse a
{\tt .c
} or
{\tt
151 .h
} file or all of the
{\tt .c
} or
{\tt .h
} files in a directory. This
152 generates information about any parse errors encountered.
}
154 \normal{-control
\_flow $
\langle$file$
\rangle$, -control
\_flow
155 $
\langle$file$
\rangle$:$
\langle$function$
\rangle$
}{ Print a control-flow
156 graph for all of the functions in a file or for a specific function in a
157 file. This requires
{\tt dot
} (http://www.graphviz.org/) and
{\tt gv
}.
}
159 \rare{-type
\_c $
\langle$file$
\rangle$
}{ Parse a C file and pretty-print a
160 version including type information.
}
162 \developer{-tokens
\_c $
\langle$file$
\rangle$
}{Prints the tokens in a C
165 \developer{-parse
\_unparse $
\langle$file$
\rangle$
}{Parse and then reconstruct
168 \developer{-compare
\_c $
\langle$file$
\rangle$ $
\langle$file$
\rangle$,
169 -compare
\_c\_hardcoded}{Compares one C file to another, or compare the
170 file tests/compare1.c to the file tests/compare2.c.
}
172 \developer{-test
\_cfg\_ifdef $
\langle$file$
\rangle$
}{Do some special
173 processing of \#ifdef and display the resulting control-flow graph. This
174 requires
{\tt dot
} and
{\tt gv
}.
}
176 \developer{-test
\_attributes $
\langle$file$
\rangle$,
177 -test
\_cpp $
\langle$file$
\rangle$
}{
178 Test the parsing of cpp code and attributes, respectively.
}
180 \subsection{Selecting C files
}
182 An argument that ends in
{\tt .c
} is assumed to be a C file to process. A
183 directory can be specified with the option
{\bf -dir
}, described below.
184 Normally, only one C file or one directory is specified. If multiple files
185 are specified, they are treated in parallel,
{\em i.e.
}, the first semantic
186 patch rule is applied to all functions in all files, then the second
187 semantic patch rule is applied to all functions in all files, etc. If a
188 directory is specified then no files may be specified and only the
189 rightmost directory specified is used.
191 \minimum{-dir
}{ Specify a directory containing C files to process. By
192 default, the include path will be set to the ``include'' subdirectory of
193 this directory. A different include path can be specified using the
196 \normal{-include
\_headers}{ This option causes header files to be processed
197 independently. This option only makes sense if a directory is specified
200 \normal{-use
\_glimpse}{ Use a glimpse index to select the files to which
201 a semantic patch may be relevant. This option requires that a directory is
202 specified. The index may be created using the script
{\tt
203 coccinelle/scripts/ glimpseindex
\_cocci.sh
}. Glimpse is available at
204 http://webglimpse.net/. In conjunction with the option
{\bf -patch
\_cocci}
205 this option prints the regular expression that will be passed to glimpse.
}
207 \developer{-kbuild
\_info $
\langle$file$
\rangle$
}{ The specified file
208 contains information about which sets of files should be considered in
211 \developer{-disable
\_worth\_trying\_opt}{Normally, a C file is only
212 processed if it contains some keywords that have been determined to be
213 essential for the semantic patch to match somewhere in the file. This
214 option disables this optimization and tries the semantic patch on all files.
}
216 \developer{-test $
\langle$file$
\rangle$
}{ A shortcut for running Coccinelle
217 on the semantic patch ``file
{\tt{.cocci
}}'' and the C file ``file
{\tt{.c
}}''.
}
219 \developer{-testall
}{A shortcut for running Coccinelle on all files in a
220 subdirectory
{\tt tests
} such that there are all of a
{\tt .cocci
} file, a
{\tt
221 .c
} file, and a
{\tt .res
} file, where the
{\tt .res
} contains the
224 \developer{-test
\_okfailed, -test
\_regression\_okfailed} Other options for
225 keeping track of tests that have succeeded and failed.
227 \developer{-compare
\_with\_expected}{Compare the result of applying
228 Coccinelle to file
{\tt{.c
}} to the file file
{\tt{.res
}} representing the
231 \subsection{Parsing C files
}
233 \rare{-show
\_c}{Show the C code that is being processed.
}
235 \rare{-parse
\_error\_msg}{Show parsing errors in the C file.
}
237 \rare{-type
\_error\_msg}{Show information about where the C type checker
238 was not able to determine the type of an expression.
}
240 \developer{-use
\_cache} Use preparsed versions of the C files that are
243 \developer{-debug
\_cpp, -debug
\_lexer, -debug
\_etdt,
244 -debug
\_typedef}{Various options for debugging the C parser.
}
246 \developer{-filter
\_msg, -filter
\_define\_error,
247 -filter
\_passed\_level}{Various options for debugging the C parser.
}
249 \developer{-only
\_return\_is\_error\_exit}{In matching ``
{\tt{\ldots}}'' in
250 a semantic patch or when forall is specified, a rule must match all
251 control-flow paths starting from a node matching the beginning of the
252 rule. This is relaxed, however, for error handling code. Normally, error
253 handling code is considered to be a conditional with only a then branch
254 that ends in goto, break, continue, or return. If this option is set,
255 then only a then branch ending in a return is considered to be error
256 handling code. Usually a better strategy is to use
{\tt when strict
} in
257 the semantic patch, and then match explicitly the case where there is a
258 conditional whose then branch ends in a return.
}
260 \subsubsection*
{Macros and other preprocessor code
}
262 \normal{-D $
\langle$file$
\rangle$, -macro
\_file $
\langle$file$
\rangle$
}{
263 Extra macro definitions to be taken into account when parsing the C
266 \rare{-ifdef
\_to\_if}{ This option constructs represents an \#ifdef in
267 the source code as a conditional in the control-flow graph. This option is
268 unsafe, as it makes the source code unparsable when \#ifdef is used in a
269 way that does not directly convert to a conditional. Nevertheless, it can
270 be useful when \#ifdef is used in a well-structured way.
}
272 \rare{-use
\_if0\_code}{ Normally code under \#if
0 is ignored. If this
273 option is set then the code is considered, just like the code under any
276 \developer{-noadd
\_typedef\_root}{This seems to reduce the scope of a
277 typedef declaration found in the C code.
}
279 \subsubsection*
{Include files
}
281 \normal{-all
\_includes, -local
\_includes, -no
\_includes}{
282 These options control which include files mentioned in a C file are taken into
283 account.
{\bf -all
\_includes} indicates that all included files will be
284 processed.
{\bf -local
\_includes} indicates that only included files in
285 the current directory will be processed.
{\bf -no
\_includes} indicates
286 that no included files will be processed. If the semantic patch contains
287 type specifications on expression metavariables, then the default is
{\bf
288 -local
\_includes}. Otherwise the default is
{\bf -no
\_includes}. At most
289 one of these options can be specified.
}
291 \normal{-I $
\langle$path$
\rangle$
}{ This option specifies the directory in
292 which to find non-local include files. This option should be used only
293 once, as each use will overwrite the preceding one.
}
295 \rare{-relax
\_include\_path}{This option causes the search for local
296 include files to consider the directory specified using
{\bf -I
} if the
297 included file is not found in the current directory.
}
299 \section{Application of the semantic patch to the C code
}
301 \subsection{Feedback at the rule level during the application of the
304 \normal{-show
\_bindings}{
305 Show the environments with respect to which each rule is applied and the
306 bindings that result from each such application.
}
308 \normal{-show
\_dependencies}{ Show the status (matched or unmatched) of the
309 rules on which a given rule depends.
{\bf -show
\_dependencies} implicitly
310 sets
{\bf -show
\_bindings}, as the values of the dependencies are
311 environment-specific.
}
313 \normal{-show
\_trying}{
314 Show the name of each program element to which each rule is applied.
}
316 \normal{-show
\_transinfo}{
317 Show information about each transformation that is performed.
318 The node numbers that are referenced are the number of the nodes in the
319 control-flow graph, which can be seen using the option
{\bf -control
\_flow}
320 (the initial control-flow graph only) or the option
{\bf -show
\_flow} (the
321 control-flow graph before and after each rule application).
}
323 \normal{-show
\_misc}{Show some miscellaneous information.
}
325 \rare{-show
\_flow $
\langle$file$
\rangle$, -show
\_flow
326 $
\langle$file$
\rangle$:$
\langle$function$
\rangle$
} Show the control-flow
327 graph before and after the application of each rule.
329 \developer{-show
\_before\_fixed\_flow}{This is similar to
{\bf
330 -show
\_flow}, but shows a preliminary version of the control-flow graph.
}
332 \subsection{Feedback at the CTL level during the application of the
335 \normal{-verbose
\_engine}{Show a trace of the matching of atomic terms to C
338 \rare{-verbose
\_ctl\_engine}{Show a trace of the CTL matching process.
339 This is unfortunately rather voluminous and not so helpful for someone
340 who is not familiar with CTL in general and the translation of SmPL into
341 CTL specifically. This option implicitly sets the option
{\bf
344 \rare{-graphical
\_trace}{Create a pdf file containing the control flow
345 graph annotated with the various nodes matched during the CTL matching
346 process. Unfortunately, except for the most simple examples, the output
347 is voluminous, and so the option is not really practical for most
348 examples. This requires
{\tt dot
} (http://www.graphviz.org/) and
{\tt
351 \rare{-gt
\_without\_label}{The same as
{\bf -graphical
\_trace}, but the PDF
352 file does not contain the CTL code.
}
354 \rare{-partial
\_match}{
355 Report partial matches of the semantic patch on the C file. This can
356 be substantially slower than normal matching.
}
358 \rare{-verbose
\_match}{
359 Report on when CTL matching is not applied to a function or other program
360 unit because it does not contain some required atomic pattern.
361 This can be viewed as a simpler, more efficient, but less informative
362 version of
{\bf -partial
\_match}.
}
364 \subsection{Actions during the application of the semantic patch
}
366 \rare{-allow
\_inconsistent\_paths}{Normally, a term that is transformed
367 should only be accessible from other terms that are matched by the
368 semantic patch. This option removes this constraint. Doing so, is
369 unsafe, however, because the properties that hold along the matched path
370 might not hold at all along the unmatched path.
}
372 \rare{-disallow
\_nested\_exps}{In an expression that contains repeated
373 nested subterms,
{\em e.g.
} of the form
{\tt f(f(x))
}, a pattern can
374 match a single expression in multiple ways, some nested inside others.
375 This option causes the matching process to stop immediately at the
376 outermost match. Thus, in the example
{\tt f(f(x))
}, the possibility
377 that the pattern
{\tt f(E)
}, with metavariable
{\tt E
}, matches with
{\tt
378 E
} as
{\tt x
} will not be considered.
}
380 \rare{-pyoutput coccilib.output.Gtk, -pyoutput coccilib.output.Console
}{
381 This controls whether Python output is sent to Gtk or to the console.
{\bf
382 -pyoutput coccilib.output.Console
} is the default. The Gtk option is
383 currently not well supported.
}
385 \developer{-loop
}{When there is ``
{\tt{\ldots}}'' in the semantic patch,
386 the CTL operator
{\sf AU
} is used if the current function does not
387 contain a loop, and
{\sf AW
} may be used if it does. This option causes
388 {\sf AW
} always to be used.
}
390 \developer{-steps $
\langle$int$
\rangle$
}{
391 This limits the number of steps performed by the CTL engine to the
392 specified number. This option is unsafe as it might cause a rule to fail
393 due to running out of steps rather than due to not matching.
}
395 \developer{-bench $
\langle$int$
\rangle$
}{This collects various information
396 about the operations performed during the CTL matching process.
}
398 \developer{-popl, -popl
\_mark\_all, -popl
\_keep\_all\_wits}{
399 These options use a simplified version of the SmPL language.
{\bf
400 -popl
\_mark\_all} and
{\bf -popl
\_keep\_all\_wits} implicitly set
{\bf
403 \section{Generation of the result
}
405 Normally, the only output is a diff printed to standard output.
407 \rare{-o $
\langle$file$
\rangle$
}{ The output file.
}
409 \rare{-inplace
}{ Modify the input file.
}
411 \rare{-outplace
}{ Store modifications in a .cocci
\_res file.
}
413 \rare{-no
\_show\_diff}{ Normally, a diff between the original and transformed
414 code is printed on the standard output. This option causes this not to be
417 \rare{-U
}{ Set number of diff context lines.
}
419 \rare{-save
\_tmp\_files}{Coccinelle creates some temporary
420 files in
{\tt /tmp
} that it deletes after use. This option causes these
423 \developer{-debug
\_unparsing}{Show some debugging information about the
424 generation of the transformed code. This has the side-effect of
425 deleting the transformed code.
}
427 \developer{-patch
}{ Deprecated option.
}
430 \section{Other options
}
432 \subsection{Version information
}
434 \normal{-version
}{ The version of Coccinelle. No other options are
437 \normal{-date
}{ The date of the current version of Coccinelle. No other
438 options are allowed.
}
442 \minimum{-h, -shorthelp
}{ The most useful commands.
}
444 \minimum{-help, --help, -longhelp
}{ A complete listing of the available
447 \subsection{Controlling the execution of Coccinelle
}
449 \normal{-timeout $
\langle$int$
\rangle$
}{ The maximum time in seconds for
450 processing a single file.
}
452 \rare{-max $
\langle$int$
\rangle$
}{This option informs Coccinelle of the
453 number of instances of Coccinelle that will be run concurrently. This
454 option requires
{\bf -index
}. It is usually used with
{\bf -dir
}.
}
456 \rare{-index $
\langle$int$
\rangle$
}{This option informs Coccinelle of
457 which of the concurrent instances is the current one. This option
458 requires
{\bf -max
}.
}
460 \rare{-mod
\_distrib}{When multiple instances of Coccinelle are run in
461 parallel, normally the first instance processes the first $n$ files, the
462 second instance the second $n$ files, etc. With this option, the files
463 are distributed among the instances in a round-robin fashion.
}
465 \developer{-debugger
}{Option for running Coccinelle from within the OCaml
468 \developer{-profile
}{ Gather timing information about the main Coccinelle
471 \developer{-disable
\_once}{Print various warning messages every time some
472 condition occurs, rather than only once.
}
474 \subsection{Miscellaneous
}
476 \rare{-quiet
}{Suppress most output. This is the default.
}
478 \developer{-pad, -hrule $
\langle$dir$
\rangle$, -xxx, -l1
}{}