Sparse reads the source and creates a parse tree. At the base, are function symbols, the function has a bunch statements and the statements have a bunch of expressions which branch out into even more expressions. If you have data that's a symbol. struct expression is defined in expression.h struct symbol is defined in symbol.h struct statement is in parse.h The important functions are: set_state(name, my_id, sym, ISNULL); get_state(deref, my_id, sym) set_true_false_states(left, my_id, sym_left, ISNULL, NONNULL); add_hook(&match_assign, ASSIGNMENT_HOOK); void register_your_check(int id) left = get_variable_from_expr(expr->left, &sym_left); left = alloc_string(left); my_id is a different int for every check script. sym is a symbol * to the sparse symbol. The condition hook feeds you one condition at a time. add_hook() sets up a call back that will be called for every assignment in this case. add the register_your_check() to smatch.c. get_variable_from_expr() is a bit buggy still but it's supposed to give a string representation of an expression and it also gives you a symbol pointer. If you want to keep the string instead of just printing it out or using it for get_state() then you have to call alloc_string(). I haven't added setting up custom merge_rules yet. Will do. Internally smatch_states are a struct. I'm going to add some more fields to that so it might be useful to have a get_state_struct() function... smatch_flow.c interprets that sparse tree. If you want to add another hook that's the place to do it. That's pretty much it. regards, dan carpenter - To unsubscribe from this list: send the line "unsubscribe linux-sparse" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html