Covert clang ir types to c type string for pattern matching

Author: kumarak

docs/GettingStarted/patch_specifications.md

@@ -172,22 +172,21 @@ For operation-based matching, the following additional fields are available:
 | Field | Description | Example |
 |-------|-------------|---------|
 | `name` | Function name pattern (supports regex with `/pattern/`) | `"/.*secure.*/`, `"authenticate"` |
-| `type` | Function type pattern (optional) | `"!cir.func<!cir.void ()>"` |
 
 #### Symbol Match Fields  (Operation-Based Matching)
 
 | Field | Description | Example |
 |-------|-------------|---------|
 | `name` | Symbol name pattern (supports regex with `/pattern/`) | `"/.*password.*/`, `"secret_key"` |
-| `type` | Symbol type pattern (optional) | `"!cir.ptr<!cir.int<u, 32>>"` |
+| `type` | Symbol type pattern (optional) | `"int32*"` |
 
 #### Operand Match Fields (Operation-Based Matching)
 
 | Field | Description | Example |
 |-------|-------------|---------|
 | `index` | Position of the operand (0-based) | `0` (first operand), `1` (second operand) |
 | `name` | Name of the operand variable | `"addr"`, `"/.*buffer.*/` |
-| `type` | Type of the operand | `"!cir.ptr<!cir.int<u, 32>>"` |
+| `type` | Type of the operand | `"int32*"` |
 
 Common operand patterns:
 - `cir.load`: operand 0 = address to load from
@@ -208,7 +207,7 @@ Common operand patterns:
 | Field | Description | Example |
 |-------|-------------|---------|
 | `name` | Variable name pattern (supports regex with `/pattern/`) | `"/.*password.*/`, `"secret_key"` |
-| `type` | Variable type pattern (optional) | `"!cir.ptr<!cir.int<u, 32>>"` |
+| `type` | Variable type pattern (optional) | `"struct struct_anon_struct_4_1_58265f66*"` |
 
 ### Action Fields
 
@@ -378,6 +377,7 @@ meta_patches:
             argument_matches:
               - index: 0
                 name: "usb_g"
+                type: "struct struct_anon_struct_4_1_58265f66*"
 
         action:
           - mode: "apply_before"
@@ -409,7 +409,7 @@ meta_contracts:
       - name: "authenticate"  # Exact function name
     symbol_matches:
       - name: "/.*password.*/"  # Variables containing "password"
-        type: "!cir.ptr<!cir.int<u, 32>>"
+        type: "int32*"
 ```
 
 ### Example 2: Match Store Operations with Specific Operands
@@ -423,10 +423,10 @@ meta_contracts:
     operand_matches:
       - index: 0  # The value being stored (first operand)
         name: "user_input"
-        type: "!cir.ptr<!cir.char>"
+        type: "char*"
       - index: 1  # The address being stored to (second operand)
         name: "buffer"
-        type: "!cir.ptr<!cir.array<!cir.char x 256>>"
+        type: "char[256]"
 ```
 
 ### Pattern Matching

include/patchestry/Passes/OperationMatcher.hpp

@@ -192,6 +192,15 @@ namespace patchestry::passes {
          */
         static std::string extract_ssa_value_name(mlir::Value value); // NOLINT
 
+        /**
+         * @brief Extracts the type from an SSA value, following the definition chain.
+         *
+         * @param value The SSA value to extract type from
+         * @return The variable type, following through operations that may modify the original
+         * type
+         */
+        static mlir::Type extract_ssa_value_type(mlir::Value value); // NOLINT
+
         /**
          * @brief Extracts symbol name from operation attributes.
          *

include/patchestry/Passes/Utils.hpp

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2025, Trail of Bits, Inc.
+ *
+ * This source code is licensed in accordance with the terms specified in
+ * the LICENSE file found in the root directory of this source tree.
+ */
+
+#pragma once
+
+#include <string>
+
+namespace mlir {
+    class MLIRContext;
+    class Type;
+} // namespace mlir
+
+namespace patchestry {
+    namespace utils {
+
+        /// Convert C-like type names to CIR types
+        mlir::Type convertCTypesToCIRTypes(mlir::MLIRContext *context, std::string type_name);
+
+        /// Convert CIR type back to C-like type name string
+        std::string convertCIRTypesToCTypes(mlir::Type cir_type);
+
+    } // namespace utils
+} // namespace patchestry

lib/patchestry/Passes/CMakeLists.txt

@@ -7,6 +7,7 @@ add_library(patchestry_passes STATIC
     InstrumentationPass.cpp
     Compiler.cpp
     OperationMatcher.cpp
+    Utils.cpp
 )
 
 set(CLANG_IR_LIBS

lib/patchestry/Passes/OperationMatcher.cpp

@@ -17,6 +17,8 @@
 #include <mlir/IR/Operation.h>
 #include <mlir/IR/SymbolTable.h>
 
+#include <patchestry/Passes/Utils.hpp>
+
 namespace patchestry::passes {
 
     bool OperationMatcher::matches(
@@ -133,19 +135,12 @@ namespace patchestry::passes {
         }
 
         std::string func_name = func.getName().str();
-        std::string func_type = type_to_string(func.getFunctionType());
-
         for (const auto &context : function_context) {
             // Check function name match
             if (!matches_pattern(func_name, context.name)) {
                 continue;
             }
 
-            // Check function type match if specified
-            if (!context.type.empty() && !matches_pattern(func_type, context.type)) {
-                continue;
-            }
-
             return true;
         }
 
@@ -180,7 +175,8 @@ namespace patchestry::passes {
 
             // Check argument type if specified
             if (!operand_match.type.empty()) {
-                if (!matches_type(operand.getType(), operand_match.type)) {
+                auto variable_type = extract_ssa_value_type(operand);
+                if (!matches_type(variable_type, operand_match.type)) {
                     return false;
                 }
             }
@@ -222,7 +218,7 @@ namespace patchestry::passes {
             auto result = results[i];
             std::string var_name =
                 extract_variable_name(op, static_cast< unsigned >(operands.size() + i));
-            std::string var_type = type_to_string(result.getType());
+            std::string var_type = utils::convertCIRTypesToCTypes(result.getType());
 
             for (const auto &var_match : symbol_matches) {
                 bool name_matches =
@@ -267,7 +263,13 @@ namespace patchestry::passes {
 
             // Check argument type if specified
             if (!arg_match.type.empty()) {
-                if (!matches_type(operand.getType(), arg_match.type)) {
+                auto variable_type = extract_ssa_value_type(operand);
+                // Note: The type matching here is relaxed and checks for matching types both
+                // following the chain of operations or the direct type of the operand; if the
+                // match is found with any one, it will go ahead with patching.
+                if (!matches_type(variable_type, arg_match.type)
+                    && !matches_type(operand.getType(), arg_match.type))
+                {
                     return false;
                 }
             }
@@ -289,7 +291,7 @@ namespace patchestry::passes {
         for (unsigned i = 0; i < operands.size(); ++i) {
             auto operand         = operands[i];
             std::string var_name = extract_variable_name(op, i);
-            std::string var_type = type_to_string(operand.getType());
+            std::string var_type = utils::convertCIRTypesToCTypes(operand.getType());
 
             for (const auto &var_match : variable_matches) {
                 bool name_matches =
@@ -356,7 +358,8 @@ namespace patchestry::passes {
             return true;
         }
 
-        std::string type_str = type_to_string(type);
+        // convert mlir types to c types
+        std::string type_str = utils::convertCIRTypesToCTypes(type);
         return matches_pattern(type_str, type_pattern);
     }
 
@@ -431,6 +434,55 @@ namespace patchestry::passes {
         return "";
     }
 
+    mlir::Type OperationMatcher::extract_ssa_value_type(mlir::Value value) {
+        // Check if the value is defined by an operation that might modify the original type
+        if (auto defining_op = value.getDefiningOp()) {
+            // For cast operations, try to get the original type
+            if (auto cast_op = mlir::dyn_cast< cir::CastOp >(defining_op)) {
+                // Follow the cast chain to get the original type
+                auto src_value = cast_op.getSrc();
+                return extract_ssa_value_type(src_value);
+            }
+
+            // For load operations, get the pointed-to type
+            if (auto load_op = mlir::dyn_cast< cir::LoadOp >(defining_op)) {
+                auto ptr_value = load_op.getAddr();
+                auto ptr_type  = ptr_value.getType();
+                if (auto cir_ptr_type = mlir::dyn_cast< cir::PointerType >(ptr_type)) {
+                    return cir_ptr_type.getPointee();
+                }
+            }
+
+            // For get member operations, try to get the member type
+            if (auto get_member_op = mlir::dyn_cast< cir::GetMemberOp >(defining_op)) {
+                // Return the type of the member being accessed
+                return get_member_op.getType();
+            }
+
+            // For other operations, recursively check operands
+            auto operands = defining_op->getOperands();
+            if (!operands.empty()) {
+                // For simple operations, follow the first operand
+                return extract_ssa_value_type(operands[0]);
+            }
+        }
+
+        // For block arguments, check if they represent function parameters with original types
+        if (auto block_arg = mlir::dyn_cast< mlir::BlockArgument >(value)) {
+            auto block = block_arg.getOwner();
+            if (auto parent_op = block->getParentOp()) {
+                // For function arguments, the block argument type should be the actual
+                // parameter type
+                if (auto func_op = mlir::dyn_cast< cir::FuncOp >(parent_op)) {
+                    return block_arg.getType();
+                }
+            }
+        }
+
+        // Default: return the direct type of the value
+        return value.getType();
+    }
+
     std::string OperationMatcher::extract_symbol_name(mlir::Operation *op) {
         // Check for standard symbol attributes
         if (auto symbol_name =