Re: [PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 14/05/2026 12:01 pm, Nicola Vetrini wrote:
> On 2026-05-14 12:38, Andrew Cooper wrote:
>> On 14/05/2026 11:16 am, Nicola Vetrini wrote:
>>> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
>>>
>>> These do not add any value to the analysis other than duplicating
>>> some reports
>>> in whole-program analysis, as the intermediate linking steps are
>>> only used to
>>> build the symbol table.
>>>
>>> Suggested-by: Jan Beulich <jbeulich@suse.com>
>>> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
>>> ---
>>> Pipeline:
>>> https://gitlab.com/xen-project/people/bugseng/xen/-/pipelines/2524548198
>>>
>>>
>>> A significant reduction in wallclock time can be seen for both arm64
>>> and x86_64 jobs,
>>> with no impact on correctness as far as I'm aware.
>>
>> Yes, a very nice improvement.  I suspect this wants backporting to
>> stable trees too?
>>
>
> Perhaps. Is the rate of analysis significant there?

Security content drops on all trees at once.  Even shaving 5 minutes per
tree (and it's more than that) makes a half our improvement in wallclock
time for CI to complete.

>
>>> ---
>>>  automation/eclair_analysis/ECLAIR/analysis.ecl | 7 +++++++
>>>  1 file changed, 7 insertions(+)
>>>
>>> diff --git a/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> b/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> index 399099938f..ec37f7eff5 100644
>>> --- a/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> +++ b/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> @@ -34,6 +34,13 @@ their Standard Library equivalents."
>>>
>>>  -doc_end
>>>
>>> +-doc_begin="Do not analyze intermediate linking artifacts, as they
>>> do not differ from their final
>>> +counterparts for the purposes of MISRA C static analysis."
>>> +-file_tag+={xen_efi, "^xen/\\.xen\\.efi\\..*$"}
>>> +-file_tag+={xen_syms, "^xen/\\.xen-syms\\.[0-9]+$"}
>>> +-frames+={hide, "kind(program)&&target(xen_syms||xen_efi)"}
>>> +-doc_end
>>
>> Why the difference in suffix in the regex?  Slightly rhetorical because
>> it's the full link address so includes an x for 0x.
>>
>> But, the two regexs for suffixes really ought to be the same, so I
>> suppose we should exclude .* for xen_syms too?
>>
>
> Fine with me.
>
>> For the sake of clarity, do the names xen_efi and xen_syms want a _tmp
>> or _intermediate suffix, just to make things a bit clearer?
>>
>
> Ack
>

Ok, I'll fix up on commit.  Reviewed-by: Andrew Cooper
<andrew.cooper3@citrix.com>