[PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[Nicola Vetrini]

From: Nicola Vetrini <nicola.vetrini@bugseng.com>

These do not add any value to the analysis other than duplicating some reports
in whole-program analysis, as the intermediate linking steps are only used to
build the symbol table.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
Pipeline: https://gitlab.com/xen-project/people/bugseng/xen/-/pipelines/2524548198

A significant reduction in wallclock time can be seen for both arm64 and x86_64 jobs,
with no impact on correctness as far as I'm aware.
---
 automation/eclair_analysis/ECLAIR/analysis.ecl | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/automation/eclair_analysis/ECLAIR/analysis.ecl b/automation/eclair_analysis/ECLAIR/analysis.ecl
index 399099938f..ec37f7eff5 100644
--- a/automation/eclair_analysis/ECLAIR/analysis.ecl
+++ b/automation/eclair_analysis/ECLAIR/analysis.ecl
@@ -34,6 +34,13 @@ their Standard Library equivalents."
 
 -doc_end
 
+-doc_begin="Do not analyze intermediate linking artifacts, as they do not differ from their final
+counterparts for the purposes of MISRA C static analysis."
+-file_tag+={xen_efi, "^xen/\\.xen\\.efi\\..*$"}
+-file_tag+={xen_syms, "^xen/\\.xen-syms\\.[0-9]+$"}
+-frames+={hide, "kind(program)&&target(xen_syms||xen_efi)"}
+-doc_end
+
 -eval_file=toolchain.ecl
 -eval_file=public_APIs.ecl
 
-- 
2.54.0

Re: [PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[Andrew Cooper]

On 14/05/2026 11:16 am, Nicola Vetrini wrote:
> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
>
> These do not add any value to the analysis other than duplicating some reports
> in whole-program analysis, as the intermediate linking steps are only used to
> build the symbol table.
>
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> ---
> Pipeline: https://gitlab.com/xen-project/people/bugseng/xen/-/pipelines/2524548198
>
> A significant reduction in wallclock time can be seen for both arm64 and x86_64 jobs,
> with no impact on correctness as far as I'm aware.

Yes, a very nice improvement.  I suspect this wants backporting to
stable trees too?

> ---
>  automation/eclair_analysis/ECLAIR/analysis.ecl | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/automation/eclair_analysis/ECLAIR/analysis.ecl b/automation/eclair_analysis/ECLAIR/analysis.ecl
> index 399099938f..ec37f7eff5 100644
> --- a/automation/eclair_analysis/ECLAIR/analysis.ecl
> +++ b/automation/eclair_analysis/ECLAIR/analysis.ecl
> @@ -34,6 +34,13 @@ their Standard Library equivalents."
>  
>  -doc_end
>  
> +-doc_begin="Do not analyze intermediate linking artifacts, as they do not differ from their final
> +counterparts for the purposes of MISRA C static analysis."
> +-file_tag+={xen_efi, "^xen/\\.xen\\.efi\\..*$"}
> +-file_tag+={xen_syms, "^xen/\\.xen-syms\\.[0-9]+$"}
> +-frames+={hide, "kind(program)&&target(xen_syms||xen_efi)"}
> +-doc_end

Why the difference in suffix in the regex?  Slightly rhetorical because
it's the full link address so includes an x for 0x.

But, the two regexs for suffixes really ought to be the same, so I
suppose we should exclude .* for xen_syms too?

For the sake of clarity, do the names xen_efi and xen_syms want a _tmp
or _intermediate suffix, just to make things a bit clearer?

~Andrew

Re: [PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[Nicola Vetrini]

On 2026-05-14 12:38, Andrew Cooper wrote:
> On 14/05/2026 11:16 am, Nicola Vetrini wrote:
>> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
>> 
>> These do not add any value to the analysis other than duplicating some 
>> reports
>> in whole-program analysis, as the intermediate linking steps are only 
>> used to
>> build the symbol table.
>> 
>> Suggested-by: Jan Beulich <jbeulich@suse.com>
>> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
>> ---
>> Pipeline: 
>> https://gitlab.com/xen-project/people/bugseng/xen/-/pipelines/2524548198
>> 
>> A significant reduction in wallclock time can be seen for both arm64 
>> and x86_64 jobs,
>> with no impact on correctness as far as I'm aware.
> 
> Yes, a very nice improvement.  I suspect this wants backporting to
> stable trees too?
> 

Perhaps. Is the rate of analysis significant there?

>> ---
>>  automation/eclair_analysis/ECLAIR/analysis.ecl | 7 +++++++
>>  1 file changed, 7 insertions(+)
>> 
>> diff --git a/automation/eclair_analysis/ECLAIR/analysis.ecl 
>> b/automation/eclair_analysis/ECLAIR/analysis.ecl
>> index 399099938f..ec37f7eff5 100644
>> --- a/automation/eclair_analysis/ECLAIR/analysis.ecl
>> +++ b/automation/eclair_analysis/ECLAIR/analysis.ecl
>> @@ -34,6 +34,13 @@ their Standard Library equivalents."
>> 
>>  -doc_end
>> 
>> +-doc_begin="Do not analyze intermediate linking artifacts, as they do 
>> not differ from their final
>> +counterparts for the purposes of MISRA C static analysis."
>> +-file_tag+={xen_efi, "^xen/\\.xen\\.efi\\..*$"}
>> +-file_tag+={xen_syms, "^xen/\\.xen-syms\\.[0-9]+$"}
>> +-frames+={hide, "kind(program)&&target(xen_syms||xen_efi)"}
>> +-doc_end
> 
> Why the difference in suffix in the regex?  Slightly rhetorical because
> it's the full link address so includes an x for 0x.
> 
> But, the two regexs for suffixes really ought to be the same, so I
> suppose we should exclude .* for xen_syms too?
> 

Fine with me.

> For the sake of clarity, do the names xen_efi and xen_syms want a _tmp
> or _intermediate suffix, just to make things a bit clearer?
> 

Ack

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

Re: [PATCH] ci: ECLAIR: avoid intercepting intermediate linking steps

[Andrew Cooper]

On 14/05/2026 12:01 pm, Nicola Vetrini wrote:
> On 2026-05-14 12:38, Andrew Cooper wrote:
>> On 14/05/2026 11:16 am, Nicola Vetrini wrote:
>>> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
>>>
>>> These do not add any value to the analysis other than duplicating
>>> some reports
>>> in whole-program analysis, as the intermediate linking steps are
>>> only used to
>>> build the symbol table.
>>>
>>> Suggested-by: Jan Beulich <jbeulich@suse.com>
>>> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
>>> ---
>>> Pipeline:
>>> https://gitlab.com/xen-project/people/bugseng/xen/-/pipelines/2524548198
>>>
>>>
>>> A significant reduction in wallclock time can be seen for both arm64
>>> and x86_64 jobs,
>>> with no impact on correctness as far as I'm aware.
>>
>> Yes, a very nice improvement.  I suspect this wants backporting to
>> stable trees too?
>>
>
> Perhaps. Is the rate of analysis significant there?

Security content drops on all trees at once.  Even shaving 5 minutes per
tree (and it's more than that) makes a half our improvement in wallclock
time for CI to complete.

>
>>> ---
>>>  automation/eclair_analysis/ECLAIR/analysis.ecl | 7 +++++++
>>>  1 file changed, 7 insertions(+)
>>>
>>> diff --git a/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> b/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> index 399099938f..ec37f7eff5 100644
>>> --- a/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> +++ b/automation/eclair_analysis/ECLAIR/analysis.ecl
>>> @@ -34,6 +34,13 @@ their Standard Library equivalents."
>>>
>>>  -doc_end
>>>
>>> +-doc_begin="Do not analyze intermediate linking artifacts, as they
>>> do not differ from their final
>>> +counterparts for the purposes of MISRA C static analysis."
>>> +-file_tag+={xen_efi, "^xen/\\.xen\\.efi\\..*$"}
>>> +-file_tag+={xen_syms, "^xen/\\.xen-syms\\.[0-9]+$"}
>>> +-frames+={hide, "kind(program)&&target(xen_syms||xen_efi)"}
>>> +-doc_end
>>
>> Why the difference in suffix in the regex?  Slightly rhetorical because
>> it's the full link address so includes an x for 0x.
>>
>> But, the two regexs for suffixes really ought to be the same, so I
>> suppose we should exclude .* for xen_syms too?
>>
>
> Fine with me.
>
>> For the sake of clarity, do the names xen_efi and xen_syms want a _tmp
>> or _intermediate suffix, just to make things a bit clearer?
>>
>
> Ack
>

Ok, I'll fix up on commit.  Reviewed-by: Andrew Cooper
<andrew.cooper3@citrix.com>