On Thu, Oct 02, 2014 at 05:53:57PM +0200, Silvan Jegen wrote: > > Oh. It should have created a smatch_db.sqlite file as well. I suspect So, one trick is that if you rebuild the data again it gets slightly more accurate each time. I rebuild once a day. > > Ah, I have overlooked that one but it seems to have been created > successfully (5.2GB). > > Is there any documentation on how to make use of the db-based > functionality of smatch? > Oh... Hm. I thought it printed some help text but it doesn't. I've changed that now. The most common things I look at is just how a function is called: $ smdb.py ufshcd_pltfrm_probe file | caller | function | type | parameter | key | value | drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->driver_override | empty drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->id_entry | empty drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->mfd_cell | empty drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->name | empty drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->resource | empty drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | PARAM_VALUE | 0 | $$ | 4096-s64max drivers/base/platform.c | platform_drv_probe | (struct platform_driver)->probe | INTERNAL | -1 | | drivers/base/platform.c | early_platform_driver_probe_id | (struct platform_driver)->probe | BUF_SIZE | 0 | $$->dev.init_name | (-1) drivers/base/platform.c | early_platform_driver_probe_id | (struct platform_driver)->probe | DATA_SOURCE | 0 | $$ | r early_platform_match drivers/base/platform.c | early_platform_driver_probe_id | (struct platform_driver)->probe | PARAM_VALUE | 0 | $$ | 4096-s64max drivers/base/platform.c | early_platform_driver_probe_id | (struct platform_driver)->probe | INTERNAL | -1 | | I looked up ufshcd_pltfrm_probe() and it's called as a function pointer from platform_drv_probe() or early_platform_driver_probe_id(). The output is not terribly user friendly. Smatch isn't able to understand to_platform_device() or container_of() yet so the information about how the function is called is not very useful. I use it quite a bit to tell if a function is ever called with a NULL pointer. I also tried to record where data came from: net/ipv4/icmp.c | ip_options_echo | __ip_options_echo | DATA_SOURCE | 0 | $$ | p 0 But the user interface for that was never finished. The main thing that it does is if you rebuild your kernel and the database is there then it will print more accurate results. It will silence some false positives because the parameter verification happens in a different function. Or it can turn on some errors because maybe that data came from the user in a different function. I also use it to find where data is set: $ smdb where ip_options optlen drivers/net/ppp/pptp.c | pptp_xmit | (struct ip_options)->optlen | 0 net/ipv4/icmp.c | icmp_reply | (struct ip_options)->optlen | 0 net/ipv4/icmp.c | ip_options_echo | (struct ip_options)->optlen | 0 net/ipv4/icmp.c | icmp_send | (struct ip_options)->optlen | 0 net/ipv4/ip_input.c | ip_rcv_options | (struct ip_options)->optlen | 0-255 net/ipv4/cipso_ipv4.c | cipso_v4_sock_setattr | (struct ip_options)->optlen | 0-23 net/ipv4/cipso_ipv4.c | cipso_v4_req_setattr | (struct ip_options)->optlen | 0-23 net/ipv4/cipso_ipv4.c | cipso_v4_delopt | (struct ip_options)->optlen | 0-255 net/ipv4/cipso_ipv4.c | cipso_v4_skbuff_setattr | (struct ip_options)->optlen | 0-23 net/ipv4/ip_output.c | ip_setup_cork | (struct ip_options)->optlen | min-max net/ipv4/ip_output.c | ip_send_unicast_reply | (struct ip_options)->optlen | 0 net/ipv4/ip_options.c | __ip_options_echo | (struct ip_options)->optlen | 0-255 net/ipv4/ip_options.c | ip_options_get_finish | (struct ip_options)->optlen | 0-255 net/ipv4/ipmr.c | ip_encap | (struct ip_options)->optlen | 0 net/ipv4/ip_sockglue.c | ip_cmsg_recv_retopts | (struct ip_options)->optlen | 0-255 net/ipv4/ip_sockglue.c | ip_options_echo | (struct ip_options)->optlen | 0 net/ipv4/ip_sockglue.c | do_ip_getsockopt | (struct ip_options)->optlen | 0-255 net/ipv4/tcp_ipv4.c | tcp_v4_save_options | (struct ip_options)->optlen | 0 net/ipv4/syncookies.c | cookie_v4_check | (struct ip_options)->optlen | 0 net/ipv4/syncookies.c | ip_options_echo | (struct ip_options)->optlen | 0 net/netfilter/ipvs/ip_vs_xmit.c | ip_vs_tunnel_xmit | (struct ip_options)->optlen | 0 net/netfilter/ipvs/ip_vs_xmit.c | ip_vs_tunnel_xmit_v6 | (struct ip_options)->optlen | 0 net/bridge/br_netfilter.c | br_parse_ip_options | (struct ip_options)->optlen | 0-255 net/l2tp/l2tp_core.c | l2tp_xmit_skb | (struct ip_options)->optlen | 0 net/ipv6/ip6_udp_tunnel.c | udp_tunnel6_xmit_skb | (struct ip_options)->optlen | 0 regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe smatch" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
