linux-kernel - [RFC] PatchWise: Unified Static Analysis for Kernel Development

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <86bbc54c-3fc9-4c6d-9f93-b684634121bb@oss.qualcomm.com>
Date: Fri, 12 Sep 2025 13:21:00 -0700
From: David Gantman <david.gantman@....qualcomm.com>
To: workflows@...r.kernel.org
Cc: linux-arm-msm@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: [RFC] PatchWise: Unified Static Analysis for Kernel Development

Kernel developers and maintainers often need to manually run
multiple static analysis tools (checkpatch, coccicheck, sparse,
dt_binding_check, dtbs_check, etc.) and create custom scripts to
consolidate results. This leads to:

- Inconsistent testing environments across different developers
- Time spent writing and maintaining custom integration scripts
- Missed issues due to incomplete tool coverage
- Difficulty in reproducing analysis results

I'd like to introduce PatchWise, a tool designed to address this
fragmentation and manual orchestration of static analysis tools. I'm
seeking feedback from the community on this approach and suggestions for
how it could better serve kernel developers and maintainers.

Key features (All Optional and Configurable):
- Unified interface for checkpatch, coccicheck, sparse,
dt_binding_check, dtbs_check
- Docker-based execution for consistent, reproducible environments
- Simple installation and usage: `$ pip install patchwise` then `$
patchwise` in your kernel tree root
- Allows selective review execution (e.g., `$ patchwise --reviews
checkpatch sparse`)
- Supports both individual commits and commit ranges

Optional AI-Powered Review Features:
PatchWise also includes optional AI-based code review capabilities that
aim to overcome a key limitation in automated patch review: limited
context. When enabled, the tool uses Language Server Protocol (LSP)
integration with clangd to:

- Generate compile_commands.json for accurate code understanding
- Fetch relevant function definitions, struct declarations, and related code
- Provide context-aware feedback rather than superficial pattern matching
- Support multiple LLM providers (OpenAI, etc.)

Important note: All features including AI code review can be selectively
enabled and disabled based on user preference.

Technical Architecture:
- Python 3.10+ with pip installation
- Docker-based isolation for tool execution
- LSP integration for deep AI code understanding
- YAML-based configuration
- Rich logging and debugging support

Source code and current status: https://github.com/qualcomm/PatchWise

Upcoming improvements include patch series support and Docker-based
dependency management for each tool. Open tasks and planned features are
documented in the GitHub issues for visibility and collaboration/

Feedback Requested:
- Tool Integration: Are there other static analysis tools you'd
like to see supported?
- Workflow Integration: How could PatchWise better fit into your
existing development and review workflows?
- Output Format: What formats would be most useful for your use
cases?
- AI Features: For those interested, how else can AI code review and
commit text analysis be improved?

Try it out:
$ pip install patchwise
$ cd /path/to/your/kernel/tree
$ patchwise  # Analyzes HEAD commit with all available tools
$ patchwise --reviews checkpatch sparse  # Runs only specific tools

The goal is to eliminate the need for custom scripts to consolidate
kernel test tools, while offering optional advanced features for those
who want them.

Thanks,
David