make sparse keep its promise about context tracking

The sparse man page promises that it will check this:

   Functions with the extended attribute
	__attribute__((context(expression,in_context,out_context))
   require the context expression (for instance, a lock) to have the
   value in_context (a constant nonnegative integer) when called,
   and return with the value out_context (a constant nonnegative
   integer).

It doesn't keep that promise though, nor can it, especially with
contexts that can be acquired recursively (like RCU in the kernel.)

This patch makes sparse track different contexts, and also follows
up on that promise, but with slightly different semantics:

  * the "require the context to have the value" is changed to require
    it to have /at least/ the value if 'in_context',
  * an exact_context(...) attribute is introduced with the previously
    described semantics (to be used for non-recursive contexts),
  * the __context__ statement is extended to also include a required
    context argument (same at least semantics),

Unfortunately, I wasn't able to keep the same output, so now you'll
see different messages from sparse, especially when trying to unlock
a lock that isn't locked you'll see a message pointing to the unlock
function rather than complaining about the basic block, you can see
that in the test suite changes.

This patch also contains test updates and a lot of new tests for the
new functionality. Except for the changed messages, old functionality
should not be affected.

However, the kernel use of __attribute__((context(...)) is actually
wrong, the kernel often does things like:

    static void *dev_mc_seq_start(struct seq_file *seq, loff_t * pos)
            __acquires(dev_base_lock)
    {
            [...]
            read_lock(&dev_base_lock);
            [...]
    }

rather than

    static void *dev_mc_seq_start(struct seq_file *seq, loff_t * pos)
            __acquires(dev_base_lock)
    {
            [...]
            __acquire__(dev_base_lock);
            read_lock(&dev_base_lock);
            [...]
    }

(and possibly more when read_lock() is annotated appropriately, such
as dropping whatever context read_lock() returns to convert the context
to the dev_base_lock one.)

Currently, sparse doesn't care, but if it's going to check the context
of functions contained within another function then we need to put the
actual __acquire__ together with acquiring the context.

The great benefit of this patch is that you can now document at least
some locking assumptions in a machine-readable way:

before:
    /* requires mylock held */
    static void myfunc(void)
    {...}

after:
    static void myfunc(void)
            __requires(mylock)
    {...}

where, for sparse,
    #define __requires(x) __attribute__((context(x,1,1)))

Doing so may result in lots of other functions that need to be annoated
along with it because they also have the same locking requirements, but
ultimately sparse can check a lot of locking assumptions that way.

I have already used this patch and identify a number of kernel bugs by
marking things to require certain locks or RCU-protection and checking
sparse output. To do that, you need a few kernel patches which I'll
send separately.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>

1 files changed, 1 insertions, 1 deletions

diff --git a/linearize.h b/linearize.h
index 7b2961b..0004d43 100644
--- a/linearize.h
+++ b/linearize.h
@@ -116,7 +116,7 @@ struct instruction {
 			struct pseudo_list *arguments;
 		};
 		struct /* context */ {
-			int increment;
+			int increment, required;
 			int check;
 			struct expression *context_expr;
 		};