Re: Notes from FuSa meeting 2022-06-22 about Deviations

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Tue, Jun 28, 2022 at 08:16:33AM +0000, Luca Fancellu wrote:
> 
> 
> > On 28 Jun 2022, at 08:37, Roger Pau Monné <roger.pau@xxxxxxxxxx> wrote:
> > 
> > On Mon, Jun 27, 2022 at 12:23:32PM -0700, Stefano Stabellini wrote:
> >> Hi all,
> >> 
> >> These are some of the notes that I took today during the meeting about
> >> deviations
> >> 
> >> Cheers,
> >> 
> >> Stefano
> >> 
> >> 
> >> ---
> >> 
> >> 
> >> reasons for deviations:
> >> - code quality
> >> - access to hardware (need compiler extensions to access hardware)
> >> - adopted code integration
> >> - non-compliant adopted code
> >> 
> >> Purpose of tagging:
> >> - I don't want to see this report from the tools again
> >> - This is the reason why I am deviating
> >> 
> >> 
> >> Tags:
> >> - adopted
> >> this is adopted code
> >> - safe
> >> it is a violation but actually the code is safe
> >> - relied
> >> this is for adopted code again and only concern dev confusion
> >> - false-positive
> >> - compliant
> >> for *possible* violations which are safe
> >> - false-negative
> >> Flagging a violation that is present in the code even if the tool
> >> doesn't spot it. Probably not applicable to Xen as we want to enable
> >> multiple tools
> >> 
> >> 
> >> Probably none of our code can be claimed to be "adopted" according to
> >> MISRA, even the one coming from Linux.
> > 
> > So that would limit the tags that we use to: safe, compliant and
> > false-positive?
> 
> Hi Roger,
> 
> I’m afraid we don’t have an answer yet, the meeting run out of time
> yesterday because there was a lot to talk about each tag, probably
> In the following meetings we will have the chance to talk about it.
> 
> > 
> > I'm not sure the difference between safe and compliant is worth having
> > a different tag: both will need a written justification anyway. Maybe
> > would be clearer if there was some example of the different usage of
> > safe vs compliant.
> 
> my understanding from Roberto Bagnara’s explanation is that Compliant is
> a tag marking a *possible* violation emitted by the tool, so the tool tells 
> you
> that there might be a violation because there are probably variables above its
> control (for example it doesn’t have a full path graph because a function is 
> called
> by interrupt vectors, architectural behaviours, …) so the tool’s job is to 
> warn you
> about that and our job is to have a look on that piece of code and prove that 
> it
> works under all the conditions the code is meant to work.

OK, so a 'compliant' is a possible violation, at which point a human
should go and analyze whether it's a real violation (and thus requires
a 'safe' tag) or it's a tool 'false-positive'.

I'm not sure I see the need for such tag, but I might be missing the
point.  It seems to be a tag designed to cover for a checker
deficiency (ie: unable to determine without uncertainty whether a code
is a violation), but we already have false-positive for that.

Thanks, Roger.