Processing errors. Part of this class will be finding lots of bugs. A couple of things that will help other people use your results: 1. Flag false positives. Because the checkers are static and often simplistic some of the errors they flag are not errors at all. These primarily come from "impossible paths." So, before sending out bug reports, you'll need to manually inspect the results to check that "errors" are actual errors rather than false positives. 2. Put in context. For non-obvious bugs, you should put in an intuition about what causes it. 3. Put the bugs in a standard format. Capture the output of a run, in a file that has the linux version you checked, the checker name, and the run number (the first time you run the checker it's run 0, the second, run 1, etc): -- so for the null checker, run on 2.4.3 for the first time: linux-2.4.3-null-run0 Then put the processed errors in the same file name with a ``-inspected'' suffix. The easiest way is to use ''grep'' to extract all errors, unique them to get rid of duplicates using ``sort | uniq'' and then extract the error text using the perl script ``get-error.pl'': grep ERROR linux-2.4.3-null-run0 | sort | uniq \ | perl get-error.pl > linux-2.4.3-null-run0-inspected The inspected file will initially contain all the bugs, with some surrounding context, and a set of annotations. For example, for the null checker, you'll have a file full of annotations such as: --------------------------------------------------------- X [BUG] X [FALSE] X [BROKE] /u2/engler/oses/linux/2.4.1/drivers/block/ll_rw_blk.c:399:blk_init_free_list: ERROR:NULL:397:399: Using unknown ptr "rq" illegally! set by 'kmem_cache_alloc':397 Start ---> rq = kmem_cache_alloc(request_cachep, SLAB_KERNEL); memset(rq, 0, sizeof(struct request)); Error ---> rq->rq_status = RQ_INACTIVE; list_add(&rq->table, &q->request_freelist[i & 1]); ------------------------------------------------------------------------ Where the lines prefixed with "X" are the default annotation choices, the error line gives the actual error, and the C code is extracted by the perl script. The annations mean: BUG - this is an actual bug. someone should fix the kernel. FALSE - false positive BROKE - someone should fix xgcc because it's doing something stupid After you diagnose an error as BUG/FALSE/BROKE, remove the X from in front of the right annotation and delete all other annotations. For the above example, kmem_cache_alloc can fail, and the dereference would then cause a kernel seg fault so: ---------------------------------------------------------------------- [BUG] kmem_cache_alloc can return NULL /u2/engler/oses/linux/2.4.1/drivers/block/ll_rw_blk.c:399:blk_init_free_list: ERROR:NULL:397:399: Using unknown ptr "rq" illegally! set by 'kmem_cache_alloc':397 Start ---> rq = kmem_cache_alloc(request_cachep, SLAB_KERNEL); memset(rq, 0, sizeof(struct request)); Error ---> rq->rq_status = RQ_INACTIVE; list_add(&rq->table, &q->request_freelist[i & 1]); ------------------------------------------------------------------------ If you don't know if an error is a bug or not just skip the error entirely. Later scripts will know to ignore this report because the X's will still be in front of the annotations.