[PATCH] expand __builtin_object_size()

[Luc Van Oostenryck <luc.vanoostenryck@xxxxxxxxx>]

__builtin_object_size() is one of these builtins that must be
somehow expanded because it can't possibly be implemented at
runtime. It's used by the kernel's copy_{to,from}_user() and
the 'fortified' string functions, as well as by userspace's
'checked string/memory functions' like __builtin___memcpy_chk().

So, use the normal builtin expansion interface for this one too.
This gets rid of 2/3 of them when used on the kernel and shaves
~0.5% of the total IR code (with x86's defconfig).

Notes:
1) What is covered is an object symbol, with an optional designator
   of arbitrary complexity, ignoring casts and accessed via
   an optional chain of simple dereferences. Maybe some access
   path need to be added.
2) Anything with dynamic value is currently considered as unknown.
   For example VLAs or dynamically allocated memory (attribute
   alloc_size() is not supported).
3) It's not totally clear to me when to give up (and thus return
   'size unknown') and when things can or must be left to the
   simplification phase. This matters because __builtin_object_size()
   is relatively often used with __builtin_constant_p().

Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@xxxxxxxxx>
---
 builtin.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 ptrlist.h |  4 ++++
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/builtin.c b/builtin.c
index 5c7321cad3e4..38cd7b847860 100644
--- a/builtin.c
+++ b/builtin.c
@@ -454,6 +454,73 @@ static struct symbol_op atomic_op = {
 };
 
 
+static int expand_object_size(struct expression *expr, int cost)
+{
+	struct expression *arg = first_expression(expr->args);
+	int type = get_expression_value_silent(ptr_list_nth(expr->args, 1));
+	unsigned long val = -1, off = 0;
+
+	// Note: type 1 and type 3 are not supported because
+	// they can't be done after convert_designators().
+	if (type & 1)
+		return UNSAFE;
+
+	while (arg) {
+		switch (arg->type) {
+		case EXPR_IMPLIED_CAST:
+		case EXPR_CAST:
+			// ignore those
+			arg = arg->cast_expression;
+			continue;
+		case EXPR_BINOP:
+			// a constant add is (maybe) an offset
+			if (!arg->right || arg->op != '+' || arg->right->type != EXPR_VALUE)
+				break;
+			off += arg->right->value;
+			arg = arg->left;
+			continue;
+		case EXPR_PREOP:
+			// a deref is just intermediate variable
+			// and so the offset needs to be zeroed.
+			if (arg->op == '*') {
+				arg = arg->unop;
+				off = 0;
+				switch (arg->type) {
+				case EXPR_SYMBOL:
+					arg = arg->symbol->initializer;
+					continue;
+				default:
+					break;
+				}
+			}
+			break;
+		case EXPR_SYMBOL:
+			// the symbol we'e looking after
+			val = bits_to_bytes(arg->symbol->bit_size);
+			break;
+		case EXPR_CALL:
+			// use alloc_size() attribute but only after linearization.
+			return UNSAFE;
+		default:
+			break;
+		}
+		break;
+	}
+
+	if (val == -1)
+		return UNSAFE;
+
+	expr->flags |= CEF_SET_ICE;
+	expr->type = EXPR_VALUE;
+	expr->value = val;
+	expr->taint = 0;
+	return cost;
+}
+
+static struct symbol_op object_size_op = {
+	.expand = expand_object_size,
+};
+
 /*
  * Builtin functions
  */
@@ -598,7 +665,7 @@ static const struct builtin_fn builtins_common[] = {
 	{ "__builtin_nan", &double_ctype, 0, { &const_string_ctype }},
 	{ "__builtin_nanf", &float_ctype, 0, { &const_string_ctype }},
 	{ "__builtin_nanl", &ldouble_ctype, 0, { &const_string_ctype }},
-	{ "__builtin_object_size", size_t_ctype, 0, { &const_ptr_ctype, &int_ctype }},
+	{ "__builtin_object_size", size_t_ctype, 0, { &const_ptr_ctype, &int_ctype }, .op = &object_size_op},
 	{ "__builtin_parity", &int_ctype, 0, { &uint_ctype }, .op = &parity_op },
 	{ "__builtin_parityl", &int_ctype, 0, { &ulong_ctype }, .op = &parity_op },
 	{ "__builtin_parityll", &int_ctype, 0, { &ullong_ctype }, .op = &parity_op },
diff --git a/ptrlist.h b/ptrlist.h
index 4bf8c709ac08..c5fa4cdd94cb 100644
--- a/ptrlist.h
+++ b/ptrlist.h
@@ -73,6 +73,10 @@ extern void __free_ptr_list(struct ptr_list **);
 		__free_ptr_list((struct ptr_list **)(list));		\
 	} while (0)
 
+#define ptr_list_nth(lst, nth) ({					\
+		struct ptr_list* head = (struct ptr_list*)(lst);	\
+		(__typeof__((lst)->list[0])) ptr_list_nth_entry(head, nth);\
+	})
 
 ////////////////////////////////////////////////////////////////////////
 // API
-- 
2.30.0