@h2loop/autosar 1.0.1 → 1.1.0

package/python/ecuc_engine/audit.py

@@ -69,6 +69,7 @@ CALL = re.compile(r"\b(Com_(?:Send|Receive)Signal(?:Group)?|NvM_(?:ReadBlock|Wri
                   r"Dem_(?:SetEventStatus|ReportErrorStatus)|PduR_\w*Transmit|Rte_(?:Write|Read)_\w+)\s*\(")
 NUM = re.compile(r"^\(?\s*(?:\(\s*\w+\s*\)\s*)?(0[xX][0-9a-fA-F]+|\d+)[uUlL]*\s*\)?$")
 SYM = re.compile(r"^(\w+?)Conf_(\w+?)_(\w+)$")
+INSTANCE = re.compile(r"^(?:[A-Z]{1,3}\d{0,2}|\d{1,3}|[A-Za-z]?\d{1,3})$")  # FL, RR, L, 2, 02, R1
 NULLS = {"NULL_PTR", "NULL", "0", "((void*)0)", "(void*)0"}
 TYPE_BITS = {"boolean": 8, "uint8": 8, "sint8": 8, "uint16": 16, "sint16": 16, "uint32": 32, "sint32": 32,
              "uint64": 64, "sint64": 64, "float32": 32, "float64": 64, "char": 8, "int8_t": 8, "uint8_t": 8,
@@ -134,6 +135,23 @@ def split_args(src: str, open_idx: int):
     return None, i
 
 
+def iter_calls(unit: str, rx: re.Pattern = CALL):
+    """The audit's call scanner: (name, offset, line, args) for each call matched by ``rx`` (group 1 = callee,
+    match ends at '(') in comment-stripped C, skipping #define bodies and declarations/prototypes."""
+    for m in rx.finditer(unit):
+        ls = unit.rfind("\n", 0, m.start()) + 1
+        if unit[ls:m.start()].lstrip().startswith("#"):
+            continue  # macro definition, not a call
+        before = unit[ls:m.start()].rstrip()
+        prev = re.search(r"(\w+)\s*$", before)
+        if prev and prev.group(1) not in ("return", "void", "else", "do") and not before.endswith(")"):
+            continue  # a declaration/prototype ("Std_ReturnType Com_SendSignal(")
+        args, _ = split_args(unit, m.end() - 1)
+        if args is None:
+            continue
+        yield m.group(1), m.start(), unit.count("\n", 0, m.start()) + 1, args
+
+
 def parse_defines(files: list) -> dict:
     """NAME -> (params|None, body, file, line) for every #define in the given headers."""
     out: dict = {}
@@ -167,21 +185,32 @@ class Auditor:
         self.unchecked: list = []
         self.calls = 0
         self._handles: dict = {}
+        self.referenced: set = set()
+        self.sibling_candidates: list = []
+        self.rte_written: dict = {}
+        self.tu_defines: dict = {}
+        self._aliases: set = set()
+        self._struct_cache: dict = {}
+        self.header_text = ""
 
     # ---------- ECUC lookups ----------
     def module(self, name: str) -> list:
         return [m for m in self.p.modules if (m.def_ref or "").rsplit("/", 1)[-1] == name or m.name == name]
 
     def containers(self, module: str, defnames: tuple) -> list:
-        out = []
-        for m in self.module(module):
-            stack = list(m.children)
-            while stack:
-                e = stack.pop()
-                stack.extend(e.children)
-                if (e.def_ref or "").rsplit("/", 1)[-1] in defnames:
-                    out.append(e)
-        return out
+        key = (module, tuple(defnames))
+        cache = self.__dict__.setdefault("_cont_cache", {})
+        if key not in cache:
+            out = []
+            for m in self.module(module):
+                stack = list(m.children)
+                while stack:
+                    e = stack.pop()
+                    stack.extend(e.children)
+                    if (e.def_ref or "").rsplit("/", 1)[-1] in defnames:
+                        out.append(e)
+            cache[key] = out
+        return cache[key]
 
     def val(self, e: Elem, name: str) -> Optional[str]:
         for g in self.p.find(e.path):
@@ -208,27 +237,28 @@ class Auditor:
         mod, dname, short = m.groups()
         if mod != api.module:
             return None
-        for e in self.containers(api.module, (dname,)):
-            if e.name == short:
-                return e
-        return None
+        idx = self.__dict__.setdefault("_sym_cache", {})
+        if (mod, dname) not in idx:
+            idx[(mod, dname)] = {e.name: e for e in self.containers(api.module, (dname,))}
+        return idx[(mod, dname)].get(short)
 
     def symbol_of(self, e: Elem, api: Api) -> str:
         return f"{api.module}Conf_{(e.def_ref or '').rsplit('/', 1)[-1]}_{e.name}"
 
     def ipdus_of(self, sig: Elem) -> list:
         """I-PDUs that reference this signal (or, for a group signal, its signal group)."""
-        targets = {sig.path}
-        if (sig.def_ref or "").endswith("/ComGroupSignal") and sig.parent is not None:
-            targets = {sig.parent.path}
-        out = []
-        for ip in self.containers("Com", ("ComIPdu",)):
-            for g in self.p.find(ip.path):
-                if any(pv.is_ref and pv.name in ("ComIPduSignalRef", "ComIPduSignalGroupRef") and (pv.value or "").strip() in targets
-                       for pv in g.params):
-                    out.append(ip)
-                    break
-        return out
+        if "_owners" not in self.__dict__:
+            own: dict = {}
+            for ip in self.containers("Com", ("ComIPdu",)):
+                for g in self.p.find(ip.path):
+                    for pv in g.params:
+                        if pv.is_ref and pv.name in ("ComIPduSignalRef", "ComIPduSignalGroupRef") and pv.value:
+                            lst = own.setdefault(pv.value.strip(), [])
+                            if ip not in lst:
+                                lst.append(ip)
+            self._owners = own
+        key = sig.parent.path if (sig.def_ref or "").endswith("/ComGroupSignal") and sig.parent is not None else sig.path
+        return list(self._owners.get(key, []))
 
     # ---------- findings ----------
     def add(self, rule, sev, f, line, call, msg, cite, evidence, fix=None):
@@ -248,7 +278,7 @@ class Auditor:
         while e.startswith("(") and e.endswith(")") and split_args("x" + e, 1)[1] == len(e) + 1:
             e = e[1:-1].strip()
         if re.fullmatch(r"\w+", e):
-            d = self.defines.get(e)
+            d = self.tu_defines.get(e) or self.defines.get(e)
             num = None
             if d and d[0] is None:
                 mm = NUM.match(d[1])
@@ -282,10 +312,29 @@ class Auditor:
                      "survives handle re-assignment", f"{cite_sym}; TPS_ECUConfiguration 3.4.1.1",
                      {"path": target.path, api.handle_param: h[1]}, fix=f"replace {args[0]} with {sym}")
         elif h[0] == "sym":
+            m = SYM.match(h[1])
+            if m and m.group(1) != api.module and self.module(m.group(1)):
+                other = next((e for e in self.containers(m.group(1), (m.group(2),)) if e.name == m.group(3)), None)
+                self.add("H2L-API-009", "error", f, line, call,
+                         f"{h[1]} is a {m.group(1)} handle ({other.path if other else m.group(2)}) but {name} takes a "
+                         f"{api.module} {'/'.join(api.defs)} handle ({api.handle_param}); the numeric value addresses an "
+                         f"unrelated {api.module} PDU/object", f"{api.cite}; TPS_ECUC_02108 symbolic names are per module",
+                         {"symbol": h[1], "belongsTo": other.path if other else None, "expects": f"{api.module}Conf_{api.defs[0]}_<name>"})
+                return
             target = self.by_symbol(api, h[1])
+            if target is None and m and m.group(1) == api.module:
+                d = self.tu_defines.get(h[1]) or self.defines.get(h[1])
+                self.add("H2L-API-002", "error", f, line, call,
+                         f"{h[1]} names no configured {m.group(2)} '{m.group(3)}' in {api.module}"
+                         + (f"; the generated define ({self.p.rel(d[2])}:{d[3]} = {h[2]}) is stale — regenerate and fix "
+                            "the configuration or the call" if d else ""),
+                         f"{api.cite}; TPS_ECUC_02108 symbolic name values",
+                         {"symbol": h[1], "define": h[2], "defineAt": f"{self.p.rel(d[2])}:{d[3]}" if d else None})
+                return
             if target is None and h[2] is not None:
                 hits = self.by_handle(api, h[2])
                 target = hits[0] if hits else None
+                self.check_alias(api, h[1], h[2], target)
             if target is None:
                 if SYM.match(h[1]) or h[2] is not None:
                     self.add("H2L-API-002", "error", f, line, call,
@@ -298,12 +347,23 @@ class Auditor:
         else:
             self.unchecked.append({"file": self.p.rel(f), "line": line, "call": call, "reason": "handle is an expression"})
             return
+        self.referenced.add(target.path)
+        if h[0] == "sym":
+            self.sibling_candidates.append((f, line, call, api, target, h[1], args, unit))
+        if api.kind == "send" and via is None and target.path in self.rte_written:
+            mac = self.rte_written[target.path]
+            self.add("H2L-API-010", "warning", f, line, call,
+                     f"{target.name} is written directly through Com here, but it is also the RTE-mapped signal of "
+                     f"{mac} (generated RTE): two writers for one signal, bypassing the RTE",
+                     "SWS_Rte inter-ECU sender-receiver communication (one sender per data element); TPS_SystemTemplate "
+                     "SenderReceiverToSignalMapping", {"signal": target.path, "rteApi": mac})
         if api.kind in ("send", "receive"):
             self.check_direction(f, line, call, api, target)
             if api.data is not None and len(args) > api.data:
                 self.check_width(f, line, call, target, args[api.data], unit)
         if api.kind == "nvm" and api.data is not None and len(args) > api.data:
             self.check_nvm_null(f, line, call, name, target, args[api.data])
+            self.check_nvm_ram(f, line, call, name, target, args[api.data])
 
     def audit_rte(self, f, line, name, args, unit):
         d = self.defines.get(name)
@@ -334,29 +394,63 @@ class Auditor:
                      f"ECUC_Com_00493 ComIPduDirection; {api.cite}",
                      {"signal": sig.path, "ipdu": ip.path, "ComIPduDirection": d})
 
+    def struct_member(self, type_name: str, member: str, unit: str) -> Optional[tuple]:
+        key = (type_name, member)
+        if key in self._struct_cache:
+            return self._struct_cache[key]
+        res = None
+        for text in (unit, self.header_text):
+            m = re.search(rf"typedef\s+struct\s*\w*\s*\{{([^{{}}]*)\}}\s*{re.escape(type_name)}\s*;", text) or \
+                re.search(rf"struct\s+{re.escape(type_name)}\s*\{{([^{{}}]*)\}}", text)
+            if m:
+                mm = re.search(rf"\b(\w+)\s+{re.escape(member)}\s*(\[\s*(\w*)\s*\])?\s*;", m.group(1))
+                if mm:
+                    res = (mm.group(1), mm.group(3) if mm.group(2) else None)
+                break
+        self._struct_cache[key] = res
+        return res
+
+    def decl(self, var: str, unit: str):
+        m = re.search(rf"\b(?:(?:static|volatile|const|extern)\s+)*(\w+)\s*(\*?)\s*(?:const\s+)?{re.escape(var)}"
+                      rf"\s*(\[\s*(\w*)\s*\])?\s*[;=,)]", unit)
+        if not m or m.group(1) in ("return", "else", "case", "goto", "sizeof", "struct", "union", "enum"):
+            return None
+        return m.group(1), bool(m.group(2)), bool(m.group(3)), m.group(4), unit.count("\n", 0, m.start()) + 1
+
     def c_type(self, expr: str, unit: str):
         """Type of the object a data-pointer argument points to -> (type, array_len|None), or None if unknown."""
+        self.last_decl_line = None
         e = expr.strip()
         while e.startswith("(") and e.endswith(")") and split_args("x" + e, 1)[1] == len(e) + 1:
             e = e[1:-1].strip()
         lit = re.fullmatch(r"&\s*\(\s*(\w+)\s*\)\s*\{.*\}", e, re.S)  # &(uint8){ x }
         if lit:
             return lit.group(1), None
+        mem = re.fullmatch(r"&\s*\(?\s*(\w+)\s*(\.|->)\s*(\w+)\s*\)?", e)  # &var.member / &ptr->member
+        if mem:
+            d = self.decl(mem.group(1), unit)
+            if d is None or (mem.group(2) == "->") != d[1]:
+                return None
+            t = self.struct_member(d[0], mem.group(3), unit)
+            if t is None:
+                return None
+            self.last_decl_line = d[4]
+            return t
         ref = re.fullmatch(r"&\s*(\w+)", e)  # &var
         elem = re.fullmatch(r"&\s*(\w+)\s*\[[^\]]*\]", e)  # &buf[i]
         bare = re.fullmatch(r"(\w+)", e)  # buf (array decays) or a pointer variable
         var = (ref or elem or bare).group(1) if (ref or elem or bare) else None
         if var is None:
             return None
-        decl = re.search(rf"\b(?:(?:static|volatile|const|extern)\s+)*(\w+)\s+(?:const\s+)?{re.escape(var)}"
-                         rf"\s*(\[\s*(\w*)\s*\])?\s*[;=,)]", unit)
-        if not decl or decl.group(1) in ("return", "else", "case", "goto", "sizeof", "struct", "union", "enum"):
+        d = self.decl(var, unit)
+        if d is None or d[1]:
             return None
-        is_array = bool(decl.group(2))
+        typ, _ptr, is_array, alen, dline = d
+        self.last_decl_line = dline
         if ref:
-            return decl.group(1), (decl.group(3) if is_array else None)
+            return typ, (alen if is_array else None)
         if elem or (bare and is_array):
-            return decl.group(1), None
+            return typ, None
         return None  # bare non-array variable: a pointer whose pointee is not visible here
 
     def check_width(self, f, line, call, sig, arg, unit):
@@ -379,9 +473,136 @@ class Auditor:
             self.add("H2L-API-004", "error", f, line, call,
                      f"{arg} is a {ct[0]}{'[' + ct[1] + ']' if ct[1] else ''} ({cbits} bits) but {sig.name} is "
                      f"ComSignalType={typ} ({expect // 8}-byte object, ComBitSize={bs}); Com accesses {expect // 8} "
-                     f"byte(s) at that address — wrong signal or wrong variable",
+                     f"byte(s) at that address — " + ("Com writes past the object (overflow)" if "Receive" in call else
+                     "wrong signal or wrong variable") + (f"; object declared at line {self.last_decl_line}" if self.last_decl_line else ""),
                      "SWS_Com_00197/00198 SignalDataPtr points to an object of the ComSignalType; ECUC_Com_00127 ComSignalType",
-                     {"signal": sig.path, "ComSignalType": typ, "ComBitSize": bs, "cType": ct[0]})
+                     {"signal": sig.path, "ComSignalType": typ, "ComBitSize": bs, "cType": ct[0],
+                      "declLine": self.last_decl_line})
+
+    def check_alias(self, api, sym, value, target):
+        """A hand-written #define standing in for a generated handle (H2L-API-007), reported at the #define."""
+        d = self.tu_defines.get(sym) or self.defines.get(sym)
+        if d is None or sym in self._aliases:
+            return
+        self._aliases.add(sym)
+        dfile, dline = d[2], d[3]
+        try:
+            raw = open(dfile, encoding="utf-8", errors="replace").read().split("\n")[dline - 1]
+        except (OSError, IndexError):
+            raw = ""
+        named = re.search(r"\b(\w+Conf_\w+?_\w+)\b", raw.split("define", 1)[-1].split(sym, 1)[-1])
+        call = f"#define {sym} {d[1]}"
+        if named:
+            meant = self.by_symbol(api, named.group(1))
+            mv = parse_int(self.val(meant, api.handle_param) or "") if meant is not None else None
+            if meant is not None and mv != value:
+                self.add("H2L-API-007", "error", dfile, dline, call,
+                         f"stale handle alias: {sym} = {value} is commented as {named.group(1)}, whose {api.handle_param} is "
+                         f"{mv}; {value} addresses {target.path if target else 'no configured element'}",
+                         "TPS_ECUC_02108 symbolic name values; TPS_ECUConfiguration 3.4.1.1",
+                         {"alias": sym, "value": value, "meant": meant.path, api.handle_param: mv,
+                          "actual": target.path if target else None}, fix=f"use {named.group(1)} directly")
+                return
+        self.add("H2L-API-007", "warning", dfile, dline, call,
+                 f"hand-coded handle macro {sym} = {value} ({target.path if target else 'matches nothing'}); it breaks "
+                 "silently when the generator re-assigns handles",
+                 "TPS_ECUC_02108 symbolic name values", {"alias": sym, "value": value, "path": target.path if target else None},
+                 fix=f"use {self.symbol_of(target, api)}" if target else None)
+
+    def check_nvm_ram(self, f, line, call, name, blk, arg):
+        """Data pointer is the permanent RAM block of a *different* NvM block (H2L-API-008)."""
+        m = re.fullmatch(r"\(?\s*&?\s*(\w+)\s*\)?", arg.strip())
+        if not m or arg.replace(" ", "") in NULLS:
+            return
+        sym = m.group(1)
+        own = (self.val(blk, "NvMRamBlockDataAddress") or "").strip()
+        if re.search(rf"\b{re.escape(sym)}\b", own):
+            return
+        for other in self.containers("NvM", ("NvMBlockDescriptor",)):
+            if other.path == blk.path:
+                continue
+            addr = (self.val(other, "NvMRamBlockDataAddress") or "").strip()
+            if addr and re.search(rf"(?:^|[^\w]){re.escape(sym)}\b", addr):
+                self.add("H2L-API-008", "error", f, line, call,
+                         f"{name} on {blk.name} is given {arg}, the permanent RAM block of {other.name} "
+                         f"(NvMRamBlockDataAddress={addr}); {blk.name}'s own RAM block is {own or '(none)'} — wrong data is "
+                         f"stored/overwritten", "SWS_NvM_00454/00455 NvM_DstPtr/NvM_SrcPtr; ECUC_NvM_00482 NvMRamBlockDataAddress",
+                         {"block": blk.path, "ownRam": own or None, "givenRamOf": other.path,
+                          "NvMNvBlockLength": self.val(blk, "NvMNvBlockLength"),
+                          "otherLength": self.val(other, "NvMNvBlockLength")},
+                         fix=f"pass {own}" if own else None)
+                return
+
+    def check_siblings(self):
+        """Handle whose instance token (FL/FR/2/...) disagrees with the call's context, while the sibling with the
+        context's token is configured and never referenced (H2L-API-006)."""
+        uses_by: dict = {}
+        for c in self.sibling_candidates:
+            uses_by[(c[0], c[4].path)] = uses_by.get((c[0], c[4].path), 0) + 1
+        sib_index: dict = {}
+        for f, line, call, api, target, sym, args, unit in self.sibling_candidates:
+            if uses_by[(f, target.path)] < 2:
+                continue
+            dname = (target.def_ref or "").rsplit("/", 1)[-1]
+            mine = target.name.split("_")
+            key = (api.module, dname)
+            if key not in sib_index:  # pattern with one part blanked -> containers
+                idx: dict = {}
+                for e in self.containers(api.module, (dname,)):
+                    parts = e.name.split("_")
+                    for i in range(len(parts)):
+                        idx.setdefault((len(parts), i, tuple(parts[:i] + parts[i + 1:])), []).append((e, parts[i]))
+                sib_index[key] = idx
+            sibs = []
+            for i in range(len(mine)):
+                for e, tok in sib_index[key].get((len(mine), i, tuple(mine[:i] + mine[i + 1:])), []):
+                    if e.path != target.path:
+                        sibs.append((e, mine[i], tok))
+            if not sibs:
+                continue
+            ctx_text = " ".join(args[1:])
+            fn = self._function_at(unit, line)
+            tokens = set(re.split(r"[^A-Za-z0-9]+", ctx_text + " " + fn)) | \
+                {t for ident in re.findall(r"\w+", ctx_text + " " + fn) for t in ident.split("_")}
+            uses = uses_by[(f, target.path)]  # copy-paste signature: the same handle is used again in this file
+            for e, my_tok, sib_tok in sibs:
+                if not (INSTANCE.match(my_tok) and INSTANCE.match(sib_tok)):
+                    continue
+                if sib_tok in tokens and my_tok not in tokens and e.path not in self.referenced:
+                    self.add("H2L-API-006", "warning", f, line, call,
+                             f"{sym} uses instance '{my_tok}' (and is used {uses}x in this file) but this call's context "
+                             f"refers to '{sib_tok}' "
+                             f"({ctx_text[:80].strip() or fn}); {e.name} (the '{sib_tok}' sibling) is configured but never "
+                             "referenced in the code — likely copy-paste of the wrong handle",
+                             "heuristic: sibling handle mismatch (instance token)",
+                             {"handle": target.path, "sibling": e.path, "contextToken": sib_tok, "siblingReferenced": False},
+                             fix=f"use {self.symbol_of(e, api)}")
+                    break
+
+    @staticmethod
+    def _function_at(unit: str, line: int) -> str:
+        head = "\n".join(unit.split("\n")[:line])
+        m = list(re.finditer(r"^\s*(?:static\s+)?[\w\s\*]+?\b(\w+)\s*\([^;{]*\)\s*\{", head, re.M))
+        return m[-1].group(1) if m else ""
+
+    def unreferenced(self) -> dict:
+        out = {}
+        dem = [e for e in self.containers("Dem", ("DemEventParameter",)) if e.path not in self.referenced
+               and any(pv.is_ref and pv.name == "DemDTCRef" for g in self.p.find(e.path) for pv in g.params)]
+        tx = []
+        for ip in self.containers("Com", ("ComIPdu",)):
+            if (self.val(ip, "ComIPduDirection") or "").strip() != "SEND":
+                continue
+            for g in self.p.find(ip.path):
+                for pv in g.params:
+                    if pv.name == "ComIPduSignalRef" and pv.value and pv.value.strip() not in self.referenced:
+                        tx.append(pv.value.strip())
+        nvm = [e for e in self.containers("NvM", ("NvMBlockDescriptor",)) if e.path not in self.referenced]
+        for k, items in (("demEventsWithDtc", [e.path for e in dem]), ("txSignals", sorted(set(tx))),
+                         ("nvmBlocks", [e.path for e in nvm])):
+            if items:
+                out[k] = {"count": len(items), "sample": items[:10]}
+        return out
 
     def check_nvm_null(self, f, line, call, name, blk, arg):
         if arg.replace(" ", "") not in NULLS:
@@ -426,30 +647,34 @@ def audit(project: Project, paths_arg: Optional[list] = None, headers_arg: Optio
     extra = paths.expand(root, headers_arg or cfg.get("headers") or [], paths.is_c)
     hdrs = sorted({f for f in tree.files + extra if f.lower().endswith(".h")})
     a = Auditor(project, parse_defines(hdrs))
+    try:
+        a.header_text = strip_comments("\n".join(open(h, encoding="utf-8", errors="replace").read() for h in hdrs[:2000]))
+    except OSError:
+        a.header_text = ""
+    for mac, (params, body, _f, _l) in a.defines.items():
+        if mac.startswith("Rte_Write_") and params is not None:
+            mm = re.search(r"Com_SendSignal\s*\(\s*(\w+)", body)
+            if mm:
+                t = a.by_symbol(APIS["Com_SendSignal"], mm.group(1))
+                if t is not None:
+                    a.rte_written.setdefault(t.path, mac)
     for f in sources:
         try:
             unit = strip_comments(open(f, encoding="utf-8", errors="replace").read())
         except OSError:
             continue
-        for m in CALL.finditer(unit):
-            ls = unit.rfind("\n", 0, m.start()) + 1
-            if unit[ls:m.start()].lstrip().startswith("#"):
-                continue  # macro definition, not a call
-            before = unit[ls:m.start()].rstrip()
-            prev = re.search(r"(\w+)\s*$", before)
-            if prev and prev.group(1) not in ("return", "void") and not before.endswith(")"):
-                continue  # a declaration/prototype ("Std_ReturnType Com_SendSignal(")
-            args, _ = split_args(unit, m.end() - 1)
-            if args is None:
-                continue
-            a.audit_call(f, unit.count("\n", 0, m.start()) + 1, m.group(1), args, unit)
+        a.tu_defines = parse_defines([f])
+        for name, start, line, args in iter_calls(unit, CALL):
+            a.audit_call(f, line, name, args, unit)
+    a.check_siblings()
     a.findings.sort(key=lambda d: (d["file"], d["line"], d["rule"]))
     summary: dict = {}
     for d in a.findings:
         summary[d["severity"]] = summary.get(d["severity"], 0) + 1
     res = {"scanned": {"sources": [project.rel(f) for f in sources], "headers": len(hdrs), "calls": a.calls,
                        "generatedSkipped": len(generated)},
-           "summary": summary, "findings": a.findings, "unchecked": a.unchecked}
+           "summary": summary, "findings": a.findings, "unchecked": a.unchecked,
+           "unreferenced": a.unreferenced()}
     if notes:
         res["notes"] = notes
     if explicit and not sources:
@@ -458,6 +683,56 @@ def audit(project: Project, paths_arg: Optional[list] = None, headers_arg: Optio
     return res
 
 
+def can_info(project: Project, pdu_path: Optional[str]) -> list:
+    """EcuC Pdu of a Com I-PDU -> CanIf Tx/Rx PDU(s) with CAN ID, controller and network.
+
+    Linked generically: the CanIf PDU's EcuC Pdu is the same Pdu, or the other end of a PduR routing path,
+    or stands for the same system I-PDU in the extract.
+    """
+    if not pdu_path:
+        return []
+    from .rules import RuleContext
+    from .rules.system import channels, system_ipdus
+    ctx = RuleContext(project)
+    pdu = project.find(pdu_path)
+    if not pdu:
+        return []
+    pdu = pdu[0]
+    linked = {pdu.path}
+    for rp in ctx.containers("PduR/PduRRoutingPaths/PduRRoutingPath"):
+        ends = [ctx.target(ctx.value(rp, "PduRSrcPduRRef"))] + [ctx.target(pv) for pv in ctx.values(rp, "PduRDestPduRRef")]
+        pdus = {ctx.target(ctx.value(e, n)).path for e in ends if e is not None
+                for n in ("PduRSrcPduRef", "PduRDestPduRef") if ctx.target(ctx.value(e, n)) is not None}
+        if pdu.path in pdus:
+            linked |= pdus
+    sys_ip = set(system_ipdus(ctx, pdu))
+    out = []
+    for kind, ref, cid, typ in (("Tx", "CanIfTxPduRef", "CanIfTxPduCanId", "CanIfTxPduCanIdType"),
+                                ("Rx", "CanIfRxPduRef", "CanIfRxPduCanId", "CanIfRxPduCanIdType")):
+        for cp in ctx.containers(f"CanIf/CanIfInitCfg/CanIf{kind}PduCfg"):
+            tgt = ctx.target(ctx.value(cp, ref))
+            if tgt is None:
+                continue
+            if tgt.path not in linked and not (sys_ip and sys_ip & set(system_ipdus(ctx, tgt))):
+                continue
+            can_id = parse_int(ctx.text(cp, cid) or "")
+            hoh = None
+            if kind == "Tx":
+                buf = ctx.target(ctx.value(cp, "CanIfTxPduBufferRef"))
+                hoh = ctx.target(ctx.value(buf, "CanIfBufferHthRef")) if buf is not None else None
+                ctrl = ctx.target(ctx.value(hoh, "CanIfHthCanCtrlIdRef")) if hoh is not None else None
+            else:
+                hoh = ctx.target(ctx.value(cp, "CanIfRxPduHrhIdRef"))
+                ctrl = ctx.target(ctx.value(hoh, "CanIfHrhCanCtrlIdRef")) if hoh is not None else None
+            out.append({"canIfPdu": cp.path, "direction": kind, "canId": can_id,
+                        "canIdHex": hex(can_id) if can_id is not None else None,
+                        "canIdType": ctx.text(cp, typ), "at": f"{project.rel(cp.file)}:{cp.line}",
+                        "controller": ctrl.path if ctrl is not None else None,
+                        "canController": (ctx.text(ctrl, "CanIfCtrlCanCtrlRef") or None) if ctrl is not None else None,
+                        "network": channels(ctx, tgt) or channels(ctx, pdu) or None})
+    return out
+
+
 def signal_owners(project: Project, paths: list) -> dict:
     """AUTOSAR path of a ComSignal / ComGroupSignal -> [{ipdu, direction, pdu}] from the local ECUC."""
     a = Auditor(project, {})
@@ -468,8 +743,13 @@ def signal_owners(project: Project, paths: list) -> dict:
             out[p] = None  # not in the local checkout
             continue
         sig = g[0]
-        if not (sig.def_ref or "").endswith(("/ComSignal", "/ComGroupSignal", "/ComSignalGroup")):
+        if (sig.def_ref or "").endswith("/ComIPdu"):
+            ipdus = [sig]
+        elif (sig.def_ref or "").endswith(("/ComSignal", "/ComGroupSignal", "/ComSignalGroup")):
+            ipdus = a.ipdus_of(sig)
+        else:
             continue
         out[p] = [{"ipdu": ip.path, "direction": (a.val(ip, "ComIPduDirection") or "").strip() or None,
-                   "pdu": (a.val(ip, "ComPduIdRef") or "").strip() or None} for ip in a.ipdus_of(sig)]
+                   "pdu": (a.val(ip, "ComPduIdRef") or "").strip() or None,
+                   "can": can_info(project, (a.val(ip, "ComPduIdRef") or "").strip() or None)} for ip in ipdus]
     return out