Add staticcheck and staticstyle analyzers.

This change also adds support to go_stateify for detecting an appropriate
receiver name, avoiding a large number of false positives.

PiperOrigin-RevId: 335994587

6 files changed, 474 insertions, 29 deletions

diff --git a/tools/go_marshal/gomarshal/generator.go b/tools/go_marshal/gomarshal/generator.go
index 56fbcb5d2..4a53d25be 100644
--- a/tools/go_marshal/gomarshal/generator.go
+++ b/tools/go_marshal/gomarshal/generator.go
@@ -80,15 +80,15 @@ type Generator struct {
 func NewGenerator(srcs []string, out, outTest, outTestUnconditional, pkg string, imports []string) (*Generator, error) {
 	f, err := os.OpenFile(out, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open output file %q: %w", out, err)
 	}
 	fTest, err := os.OpenFile(outTest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open test output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open test output file %q: %w", out, err)
 	}
 	fTestUC, err := os.OpenFile(outTestUnconditional, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open unconditional test output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open unconditional test output file %q: %w", out, err)
 	}
 	g := Generator{
 		inputs:       srcs,
@@ -181,7 +181,7 @@ func (g *Generator) parse() ([]*ast.File, []*token.FileSet, error) {
 		f, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
 		if err != nil {
 			// Not a valid input file?
-			return nil, nil, fmt.Errorf("Input %q can't be parsed: %v", path, err)
+			return nil, nil, fmt.Errorf("input %q can't be parsed: %w", path, err)
 		}
 
 		if debugEnabled() {
diff --git a/tools/go_stateify/main.go b/tools/go_stateify/main.go
index 4f6ed208a..4ec9fbf89 100644
--- a/tools/go_stateify/main.go
+++ b/tools/go_stateify/main.go
@@ -214,9 +214,6 @@ func main() {
 	emitRegister := func(name string) {
 		initCalls = append(initCalls, fmt.Sprintf("%sRegister((*%s)(nil))", statePrefix, name))
 	}
-	emitZeroCheck := func(name string) {
-		fmt.Fprintf(outputFile, "	if !%sIsZeroValue(&x.%s) { %sFailf(\"%s is %%#v, expected zero\", &x.%s) }\n", statePrefix, name, statePrefix, name, name)
-	}
 
 	// Automated warning.
 	fmt.Fprint(outputFile, "// automatically generated by stateify.\n\n")
@@ -349,6 +346,7 @@ func main() {
 
 			for _, gs := range d.Specs {
 				ts := gs.(*ast.TypeSpec)
+				letter := strings.ToLower(ts.Name.Name[:1])
 				switch x := ts.Type.(type) {
 				case *ast.StructType:
 					maybeEmitImports()
@@ -365,29 +363,32 @@ func main() {
 						emitField(name)
 					}
 					emitLoadValue := func(name, typName string) {
-						fmt.Fprintf(outputFile, "	m.LoadValue(%d, new(%s), func(y interface{}) { x.load%s(y.(%s)) })\n", fields[name], typName, camelCased(name), typName)
+						fmt.Fprintf(outputFile, "	stateSourceObject.LoadValue(%d, new(%s), func(y interface{}) { %s.load%s(y.(%s)) })\n", fields[name], typName, letter, camelCased(name), typName)
 					}
 					emitLoad := func(name string) {
-						fmt.Fprintf(outputFile, "	m.Load(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSourceObject.Load(%d, &%s.%s)\n", fields[name], letter, name)
 					}
 					emitLoadWait := func(name string) {
-						fmt.Fprintf(outputFile, "	m.LoadWait(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSourceObject.LoadWait(%d, &%s.%s)\n", fields[name], letter, name)
 					}
 					emitSaveValue := func(name, typName string) {
-						fmt.Fprintf(outputFile, "	var %s %s = x.save%s()\n", name, typName, camelCased(name))
-						fmt.Fprintf(outputFile, "	m.SaveValue(%d, %s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	var %sValue %s = %s.save%s()\n", name, typName, letter, camelCased(name))
+						fmt.Fprintf(outputFile, "	stateSinkObject.SaveValue(%d, %sValue)\n", fields[name], name)
 					}
 					emitSave := func(name string) {
-						fmt.Fprintf(outputFile, "	m.Save(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSinkObject.Save(%d, &%s.%s)\n", fields[name], letter, name)
+					}
+					emitZeroCheck := func(name string) {
+						fmt.Fprintf(outputFile, "	if !%sIsZeroValue(&%s.%s) { %sFailf(\"%s is %%#v, expected zero\", &%s.%s) }\n", statePrefix, letter, name, statePrefix, name, letter, name)
 					}
 
 					// Generate the type name method.
-					fmt.Fprintf(outputFile, "func (x *%s) StateTypeName() string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateTypeName() string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return \"%s.%s\"\n", *fullPkg, ts.Name.Name)
 					fmt.Fprintf(outputFile, "}\n\n")
 
 					// Generate the fields method.
-					fmt.Fprintf(outputFile, "func (x *%s) StateFields() []string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateFields() []string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return []string{\n")
 					scanFields(x, "", scanFunctions{
 						normal: emitField,
@@ -402,7 +403,7 @@ func main() {
 					// file not provided to this binary and prevents inherited methods
 					// from being called multiple times by overriding them.
 					if _, ok := simpleMethods[method{ts.Name.Name, "beforeSave"}]; !ok && generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) beforeSave() {}\n\n", ts.Name.Name)
+						fmt.Fprintf(outputFile, "func (%s *%s) beforeSave() {}\n\n", letter, ts.Name.Name)
 					}
 
 					// Generate the save method.
@@ -412,8 +413,8 @@ func main() {
 					// on this specific behavior, but the ability to specify slots
 					// allows a manual implementation to be order-dependent.
 					if generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) StateSave(m %sSink) {\n", ts.Name.Name, statePrefix)
-						fmt.Fprintf(outputFile, "	x.beforeSave()\n")
+						fmt.Fprintf(outputFile, "func (%s *%s) StateSave(stateSinkObject %sSink) {\n", letter, ts.Name.Name, statePrefix)
+						fmt.Fprintf(outputFile, "	%s.beforeSave()\n", letter)
 						scanFields(x, "", scanFunctions{zerovalue: emitZeroCheck})
 						scanFields(x, "", scanFunctions{value: emitSaveValue})
 						scanFields(x, "", scanFunctions{normal: emitSave, wait: emitSave})
@@ -424,14 +425,14 @@ func main() {
 					// the same reason that we do it for beforeSave.
 					_, hasAfterLoad := simpleMethods[method{ts.Name.Name, "afterLoad"}]
 					if !hasAfterLoad && generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) afterLoad() {}\n\n", ts.Name.Name)
+						fmt.Fprintf(outputFile, "func (%s *%s) afterLoad() {}\n\n", letter, ts.Name.Name)
 					}
 
 					// Generate the load method.
 					//
 					// N.B. See the comment above for the save method.
 					if generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) StateLoad(m %sSource) {\n", ts.Name.Name, statePrefix)
+						fmt.Fprintf(outputFile, "func (%s *%s) StateLoad(stateSourceObject %sSource) {\n", letter, ts.Name.Name, statePrefix)
 						scanFields(x, "", scanFunctions{normal: emitLoad, wait: emitLoadWait})
 						scanFields(x, "", scanFunctions{value: emitLoadValue})
 						if hasAfterLoad {
@@ -439,7 +440,7 @@ func main() {
 							// AfterLoad is called, the object encodes a dependency on
 							// referred objects (i.e. fields). This means that afterLoad
 							// will not be called until the other afterLoads are called.
-							fmt.Fprintf(outputFile, "	m.AfterLoad(x.afterLoad)\n")
+							fmt.Fprintf(outputFile, "	stateSourceObject.AfterLoad(%s.afterLoad)\n", letter)
 						}
 						fmt.Fprintf(outputFile, "}\n\n")
 					}
@@ -451,10 +452,10 @@ func main() {
 					maybeEmitImports()
 
 					// Generate the info methods.
-					fmt.Fprintf(outputFile, "func (x *%s) StateTypeName() string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateTypeName() string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return \"%s.%s\"\n", *fullPkg, ts.Name.Name)
 					fmt.Fprintf(outputFile, "}\n\n")
-					fmt.Fprintf(outputFile, "func (x *%s) StateFields() []string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateFields() []string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return nil\n")
 					fmt.Fprintf(outputFile, "}\n\n")
 
diff --git a/tools/nogo/BUILD b/tools/nogo/BUILD
index 9f1fcd9c7..a1a97d1d4 100644
--- a/tools/nogo/BUILD
+++ b/tools/nogo/BUILD
@@ -27,6 +27,8 @@ go_library(
     deps = [
         "//tools/checkescape",
         "//tools/checkunsafe",
+        "@co_honnef_go_tools//staticcheck:go_default_library",
+        "@co_honnef_go_tools//stylecheck:go_default_library",
         "@org_golang_x_tools//go/analysis:go_tool_library",
         "@org_golang_x_tools//go/analysis/internal/facts:go_tool_library",
         "@org_golang_x_tools//go/analysis/passes/asmdecl:go_tool_library",
diff --git a/tools/nogo/build.go b/tools/nogo/build.go
index 39c2ae418..55d34760f 100644
--- a/tools/nogo/build.go
+++ b/tools/nogo/build.go
@@ -29,6 +29,9 @@ var (
 	// internalDefault is applied when no paths are provided.
 	internalDefault = fmt.Sprintf("%s/.*", notPath("external"))
 
+	// generatedPrefix is a regex for generated files.
+	generatedPrefix = "^(.*/)?(bazel-genfiles|bazel-out|bazel-bin)/"
+
 	// externalPrefix is external workspace packages.
 	externalPrefix = "^external/"
 )
diff --git a/tools/nogo/config.go b/tools/nogo/config.go
index cfe7b4aa4..8079618ab 100644
--- a/tools/nogo/config.go
+++ b/tools/nogo/config.go
@@ -41,6 +41,8 @@ import (
 	"golang.org/x/tools/go/analysis/passes/unreachable"
 	"golang.org/x/tools/go/analysis/passes/unsafeptr"
 	"golang.org/x/tools/go/analysis/passes/unusedresult"
+	"honnef.co/go/tools/staticcheck"
+	"honnef.co/go/tools/stylecheck"
 
 	"gvisor.dev/gvisor/tools/checkescape"
 	"gvisor.dev/gvisor/tools/checkunsafe"
@@ -123,6 +125,432 @@ var analyzerConfig = map[*analysis.Analyzer]matcher{
 	checkunsafe.Analyzer: internalMatches(),
 }
 
+func init() {
+	staticMatcher := and(
+		// Only match internal, non-generated files.
+		internalMatches(),
+		generatedExcluded(),
+
+		// We use ALL_CAPS for system definitions,
+		// which are common enough in the code base
+		// that we shouldn't annotate exceptions.
+		//
+		// Same story for underscores.
+		resultExcluded([]string{
+			"should not use ALL_CAPS in Go names",
+			"should not use underscores in Go names",
+		}),
+
+		// Exclude existing matches.
+		internalExcluded(
+			"pkg/abi/linux/fuse.go:22",
+			"pkg/abi/linux/fuse.go:25",
+			"pkg/abi/linux/socket.go:113",
+			"pkg/abi/linux/tty.go:73",
+			"pkg/bpf/decoder.go:112",
+			"pkg/cpuid/cpuid_x86.go:675",
+			"pkg/eventchannel/event.go:193",
+			"pkg/eventchannel/event.go:27",
+			"pkg/eventchannel/event_test.go:22",
+			"pkg/eventchannel/rate.go:19",
+			"pkg/gohacks/gohacks_unsafe.go:33",
+			"pkg/log/json.go:30",
+			"pkg/log/log.go:359",
+			"pkg/merkletree/merkletree.go:230",
+			"pkg/merkletree/merkletree.go:243",
+			"pkg/merkletree/merkletree.go:249",
+			"pkg/merkletree/merkletree.go:266",
+			"pkg/merkletree/merkletree.go:355",
+			"pkg/merkletree/merkletree.go:369",
+			"pkg/metric/metric_test.go:20",
+			"pkg/p9/p9test/client_test.go:687",
+			"pkg/p9/transport_test.go:196",
+			"pkg/pool/pool.go:15",
+			"pkg/refs/refcounter.go:510",
+			"pkg/refs/refcounter_test.go:169",
+			"pkg/refs_vfs2/refs.go:16",
+			"pkg/safemem/block_unsafe.go:89",
+			"pkg/seccomp/seccomp.go:82",
+			"pkg/segment/test/set_functions.go:15",
+			"pkg/sentry/arch/signal.go:166",
+			"pkg/sentry/arch/signal.go:171",
+			"pkg/sentry/control/pprof.go:196",
+			"pkg/sentry/devices/memdev/full.go:58",
+			"pkg/sentry/devices/memdev/null.go:59",
+			"pkg/sentry/devices/memdev/random.go:68",
+			"pkg/sentry/devices/memdev/zero.go:86",
+			"pkg/sentry/fdimport/fdimport.go:15",
+			"pkg/sentry/fs/attr.go:257",
+			"pkg/sentry/fsbridge/fs.go:116",
+			"pkg/sentry/fsbridge/vfs.go:124",
+			"pkg/sentry/fsbridge/vfs.go:70",
+			"pkg/sentry/fs/copy_up.go:365",
+			"pkg/sentry/fs/copy_up_test.go:65",
+			"pkg/sentry/fs/dev/net_tun.go:161",
+			"pkg/sentry/fs/dev/net_tun.go:63",
+			"pkg/sentry/fs/dev/null.go:97",
+			"pkg/sentry/fs/dirent_cache.go:64",
+			"pkg/sentry/fs/file_overlay.go:327",
+			"pkg/sentry/fs/file_overlay.go:524",
+			"pkg/sentry/fs/filetest/filetest.go:55",
+			"pkg/sentry/fs/filetest/filetest.go:60",
+			"pkg/sentry/fs/fs.go:77",
+			"pkg/sentry/fs/fsutil/file.go:290",
+			"pkg/sentry/fs/fsutil/file.go:346",
+			"pkg/sentry/fs/fsutil/host_file_mapper.go:105",
+			"pkg/sentry/fs/fsutil/inode_cached.go:676",
+			"pkg/sentry/fs/fsutil/inode_cached.go:772",
+			"pkg/sentry/fs/gofer/attr.go:120",
+			"pkg/sentry/fs/gofer/fifo.go:33",
+			"pkg/sentry/fs/gofer/inode.go:410",
+			"pkg/sentry/fsimpl/devpts/devpts.go:110",
+			"pkg/sentry/fsimpl/devpts/devpts.go:246",
+			"pkg/sentry/fsimpl/devpts/devpts.go:50",
+			"pkg/sentry/fsimpl/devpts/master.go:110",
+			"pkg/sentry/fsimpl/devpts/master.go:55",
+			"pkg/sentry/fsimpl/devpts/replica.go:113",
+			"pkg/sentry/fsimpl/devpts/replica.go:57",
+			"pkg/sentry/fsimpl/devtmpfs/devtmpfs.go:54",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_64.go:97",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_old.go:92",
+			"pkg/sentry/fsimpl/ext/disklayout/block_group_32.go:44",
+			"pkg/sentry/fsimpl/ext/disklayout/inode_new.go:91",
+			"pkg/sentry/fsimpl/ext/disklayout/inode_old.go:93",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_32.go:66",
+			"pkg/sentry/fsimpl/ext/disklayout/block_group_64.go:53",
+			"pkg/sentry/fsimpl/eventfd/eventfd.go:268",
+			"pkg/sentry/fsimpl/ext/directory.go:163",
+			"pkg/sentry/fsimpl/ext/directory.go:164",
+			"pkg/sentry/fsimpl/ext/extent_file.go:142",
+			"pkg/sentry/fsimpl/ext/extent_file.go:143",
+			"pkg/sentry/fsimpl/ext/ext.go:105",
+			"pkg/sentry/fsimpl/ext/filesystem.go:287",
+			"pkg/sentry/fsimpl/ext/regular_file.go:153",
+			"pkg/sentry/fsimpl/ext/symlink.go:113",
+			"pkg/sentry/fsimpl/fuse/connection_control.go:194",
+			"pkg/sentry/fsimpl/fuse/dev.go:387",
+			"pkg/sentry/fsimpl/fuse/dev_test.go:318",
+			"pkg/sentry/fsimpl/fuse/fusefs.go:102",
+			"pkg/sentry/fsimpl/fuse/read_write.go:129",
+			"pkg/sentry/fsimpl/fuse/request_response.go:71",
+			"pkg/sentry/fsimpl/gofer/directory.go:135",
+			"pkg/sentry/fsimpl/gofer/filesystem.go:679",
+			"pkg/sentry/fsimpl/gofer/gofer.go:1694",
+			"pkg/sentry/fsimpl/gofer/gofer.go:276",
+			"pkg/sentry/fsimpl/gofer/regular_file.go:81",
+			"pkg/sentry/fsimpl/gofer/special_file.go:141",
+			"pkg/sentry/fsimpl/host/host.go:184",
+			"pkg/sentry/fsimpl/kernfs/dynamic_bytes_file.go:50",
+			"pkg/sentry/fsimpl/kernfs/dynamic_bytes_file.go:90",
+			"pkg/sentry/fsimpl/kernfs/fd_impl_util.go:273",
+			"pkg/sentry/fsimpl/kernfs/filesystem.go:247",
+			"pkg/sentry/fsimpl/kernfs/inode_impl_util.go:320",
+			"pkg/sentry/fsimpl/kernfs/inode_impl_util.go:497",
+			"pkg/sentry/fsimpl/kernfs/synthetic_directory.go:52",
+			"pkg/sentry/fsimpl/overlay/directory.go:119",
+			"pkg/sentry/fsimpl/overlay/filesystem.go:527",
+			"pkg/sentry/fsimpl/overlay/non_directory.go:152",
+			"pkg/sentry/fsimpl/overlay/overlay.go:115",
+			"pkg/sentry/fsimpl/overlay/overlay.go:719",
+			"pkg/sentry/fsimpl/pipefs/pipefs.go:74",
+			"pkg/sentry/fsimpl/proc/filesystem.go:52",
+			"pkg/sentry/fsimpl/proc/filesystem.go:81",
+			"pkg/sentry/fsimpl/proc/subtasks.go:126",
+			"pkg/sentry/fsimpl/proc/subtasks.go:189",
+			"pkg/sentry/fsimpl/proc/task_fds.go:168",
+			"pkg/sentry/fsimpl/proc/task_fds.go:228",
+			"pkg/sentry/fsimpl/proc/task_fds.go:301",
+			"pkg/sentry/fsimpl/proc/task_fds.go:318",
+			"pkg/sentry/fsimpl/proc/task_fds.go:67",
+			"pkg/sentry/fsimpl/proc/task_files.go:112",
+			"pkg/sentry/fsimpl/proc/task_files.go:158",
+			"pkg/sentry/fsimpl/proc/task_files.go:259",
+			"pkg/sentry/fsimpl/proc/task_files.go:285",
+			"pkg/sentry/fsimpl/proc/task_files.go:305",
+			"pkg/sentry/fsimpl/proc/task_files.go:384",
+			"pkg/sentry/fsimpl/proc/task_files.go:403",
+			"pkg/sentry/fsimpl/proc/task_files.go:428",
+			"pkg/sentry/fsimpl/proc/task_files.go:691",
+			"pkg/sentry/fsimpl/proc/task_files.go:770",
+			"pkg/sentry/fsimpl/proc/task_files.go:797",
+			"pkg/sentry/fsimpl/proc/task_files.go:828",
+			"pkg/sentry/fsimpl/proc/task_files.go:879",
+			"pkg/sentry/fsimpl/proc/task_files.go:910",
+			"pkg/sentry/fsimpl/proc/task_files.go:961",
+			"pkg/sentry/fsimpl/proc/task.go:127",
+			"pkg/sentry/fsimpl/proc/task.go:193",
+			"pkg/sentry/fsimpl/proc/task_net.go:134",
+			"pkg/sentry/fsimpl/proc/task_net.go:475",
+			"pkg/sentry/fsimpl/proc/task_net.go:491",
+			"pkg/sentry/fsimpl/proc/task_net.go:508",
+			"pkg/sentry/fsimpl/proc/task_net.go:665",
+			"pkg/sentry/fsimpl/proc/task_net.go:715",
+			"pkg/sentry/fsimpl/proc/task_net.go:779",
+			"pkg/sentry/fsimpl/proc/tasks_files.go:113",
+			"pkg/sentry/fsimpl/proc/tasks_files.go:388",
+			"pkg/sentry/fsimpl/proc/tasks.go:232",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:145",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:181",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:239",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:291",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:375",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:124",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:15",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:126",
+			"pkg/sentry/fsimpl/sockfs/sockfs.go:36",
+			"pkg/sentry/fsimpl/sockfs/sockfs.go:79",
+			"pkg/sentry/fsimpl/sys/kcov.go:49",
+			"pkg/sentry/fsimpl/sys/kcov.go:99",
+			"pkg/sentry/fsimpl/sys/sys.go:118",
+			"pkg/sentry/fsimpl/sys/sys.go:56",
+			"pkg/sentry/fsimpl/testutil/testutil.go:257",
+			"pkg/sentry/fsimpl/testutil/testutil.go:260",
+			"pkg/sentry/fsimpl/timerfd/timerfd.go:87",
+			"pkg/sentry/fsimpl/tmpfs/directory.go:112",
+			"pkg/sentry/fsimpl/tmpfs/filesystem.go:195",
+			"pkg/sentry/fsimpl/tmpfs/regular_file.go:226",
+			"pkg/sentry/fsimpl/tmpfs/regular_file.go:346",
+			"pkg/sentry/fsimpl/tmpfs/tmpfs.go:103",
+			"pkg/sentry/fsimpl/tmpfs/tmpfs.go:733",
+			"pkg/sentry/fsimpl/verity/filesystem.go:490",
+			"pkg/sentry/fsimpl/verity/verity.go:156",
+			"pkg/sentry/fsimpl/verity/verity.go:629",
+			"pkg/sentry/fsimpl/verity/verity.go:672",
+			"pkg/sentry/fs/mount.go:162",
+			"pkg/sentry/fs/mount.go:256",
+			"pkg/sentry/fs/mount_overlay.go:144",
+			"pkg/sentry/fs/mounts.go:432",
+			"pkg/sentry/fs/proc/exec_args.go:104",
+			"pkg/sentry/fs/proc/exec_args.go:73",
+			"pkg/sentry/fs/proc/fds.go:269",
+			"pkg/sentry/fs/proc/loadavg.go:33",
+			"pkg/sentry/fs/proc/meminfo.go:39",
+			"pkg/sentry/fs/proc/mounts.go:193",
+			"pkg/sentry/fs/proc/mounts.go:84",
+			"pkg/sentry/fs/proc/net.go:125",
+			"pkg/sentry/fs/proc/proc.go:146",
+			"pkg/sentry/fs/proc/proc.go:204",
+			"pkg/sentry/fs/proc/seqfile/seqfile.go:210",
+			"pkg/sentry/fs/proc/sys.go:146",
+			"pkg/sentry/fs/proc/sys.go:43",
+			"pkg/sentry/fs/proc/sys_net.go:113",
+			"pkg/sentry/fs/proc/sys_net.go:205",
+			"pkg/sentry/fs/proc/sys_net.go:233",
+			"pkg/sentry/fs/proc/sys_net.go:307",
+			"pkg/sentry/fs/proc/sys_net.go:335",
+			"pkg/sentry/fs/proc/sys_net.go:446",
+			"pkg/sentry/fs/proc/sys_net.go:456",
+			"pkg/sentry/fs/proc/sys_net.go:89",
+			"pkg/sentry/fs/proc/task.go:170",
+			"pkg/sentry/fs/proc/task.go:322",
+			"pkg/sentry/fs/proc/task.go:427",
+			"pkg/sentry/fs/proc/task.go:467",
+			"pkg/sentry/fs/proc/task.go:500",
+			"pkg/sentry/fs/proc/task.go:784",
+			"pkg/sentry/fs/proc/task.go:839",
+			"pkg/sentry/fs/proc/task.go:920",
+			"pkg/sentry/fs/proc/uid_gid_map.go:108",
+			"pkg/sentry/fs/proc/uid_gid_map.go:79",
+			"pkg/sentry/fs/proc/uptime.go:75",
+			"pkg/sentry/fs/ramfs/dir.go:447",
+			"pkg/sentry/fs/tmpfs/inode_file.go:436",
+			"pkg/sentry/fs/tmpfs/inode_file.go:537",
+			"pkg/sentry/fs/tty/dir.go:313",
+			"pkg/sentry/fs/tty/master.go:131",
+			"pkg/sentry/fs/tty/master.go:91",
+			"pkg/sentry/fs/tty/replica.go:116",
+			"pkg/sentry/fs/tty/replica.go:88",
+			"pkg/sentry/kernel/auth/id_map.go:269",
+			"pkg/sentry/kernel/fasync/fasync.go:67",
+			"pkg/sentry/kernel/kcov.go:209",
+			"pkg/sentry/kernel/kcov.go:223",
+			"pkg/sentry/kernel/kernel.go:343",
+			"pkg/sentry/kernel/kernel.go:368",
+			"pkg/sentry/kernel/pipe/node_test.go:112",
+			"pkg/sentry/kernel/pipe/node_test.go:119",
+			"pkg/sentry/kernel/pipe/node_test.go:130",
+			"pkg/sentry/kernel/pipe/node_test.go:137",
+			"pkg/sentry/kernel/pipe/node_test.go:149",
+			"pkg/sentry/kernel/pipe/node_test.go:150",
+			"pkg/sentry/kernel/pipe/node_test.go:158",
+			"pkg/sentry/kernel/pipe/node_test.go:174",
+			"pkg/sentry/kernel/pipe/node_test.go:180",
+			"pkg/sentry/kernel/pipe/node_test.go:193",
+			"pkg/sentry/kernel/pipe/node_test.go:202",
+			"pkg/sentry/kernel/pipe/node_test.go:205",
+			"pkg/sentry/kernel/pipe/node_test.go:216",
+			"pkg/sentry/kernel/pipe/node_test.go:219",
+			"pkg/sentry/kernel/pipe/node_test.go:271",
+			"pkg/sentry/kernel/pipe/node_test.go:290",
+			"pkg/sentry/kernel/pipe/pipe_test.go:93",
+			"pkg/sentry/kernel/pipe/reader_writer.go:65",
+			"pkg/sentry/kernel/posixtimer.go:157",
+			"pkg/sentry/kernel/ptrace.go:218",
+			"pkg/sentry/kernel/semaphore/semaphore.go:323",
+			"pkg/sentry/kernel/sessions.go:123",
+			"pkg/sentry/kernel/sessions.go:508",
+			"pkg/sentry/kernel/signal_handlers.go:57",
+			"pkg/sentry/kernel/task_context.go:72",
+			"pkg/sentry/kernel/task_exit.go:67",
+			"pkg/sentry/kernel/task_sched.go:255",
+			"pkg/sentry/kernel/task_sched.go:280",
+			"pkg/sentry/kernel/task_sched.go:323",
+			"pkg/sentry/kernel/task_stop.go:192",
+			"pkg/sentry/kernel/thread_group.go:530",
+			"pkg/sentry/kernel/timekeeper.go:316",
+			"pkg/sentry/kernel/vdso.go:106",
+			"pkg/sentry/kernel/vdso.go:118",
+			"pkg/sentry/memmap/memmap.go:103",
+			"pkg/sentry/memmap/memmap.go:163",
+			"pkg/sentry/mm/address_space.go:42",
+			"pkg/sentry/mm/address_space.go:42",
+			"pkg/sentry/mm/aio_context.go:208",
+			"pkg/sentry/mm/aio_context.go:288",
+			"pkg/sentry/mm/pma.go:683",
+			"pkg/sentry/mm/special_mappable.go:80",
+			"pkg/sentry/platform/systrap/subprocess.go:370",
+			"pkg/sentry/platform/systrap/usertrap/usertrap_amd64.go:124",
+			"pkg/sentry/socket/control/control.go:260",
+			"pkg/sentry/socket/control/control.go:94",
+			"pkg/sentry/socket/control/control_vfs2.go:37",
+			"pkg/sentry/socket/hostinet/stack.go:433",
+			"pkg/sentry/socket/hostinet/stack.go:438",
+			"pkg/sentry/socket/hostinet/stack.go:444",
+			"pkg/sentry/socket/hostinet/stack.go:460",
+			"pkg/sentry/socket/netfilter/tcp_matcher.go:74",
+			"pkg/sentry/socket/netfilter/udp_matcher.go:71",
+			"pkg/sentry/socket/netlink/route/protocol.go:38",
+			"pkg/sentry/socket/socket.go:332",
+			"pkg/sentry/socket/unix/transport/connectioned.go:394",
+			"pkg/sentry/socket/unix/transport/connectionless.go:152",
+			"pkg/sentry/socket/unix/transport/unix.go:436",
+			"pkg/sentry/socket/unix/transport/unix.go:490",
+			"pkg/sentry/socket/unix/transport/unix.go:685",
+			"pkg/sentry/socket/unix/transport/unix.go:795",
+			"pkg/sentry/syscalls/linux/sys_sem.go:62",
+			"pkg/sentry/syscalls/linux/sys_time.go:189",
+			"pkg/sentry/usage/cpu.go:42",
+			"pkg/sentry/vfs/anonfs.go:302",
+			"pkg/sentry/vfs/anonfs.go:99",
+			"pkg/sentry/vfs/dentry.go:214",
+			"pkg/sentry/vfs/epoll.go:168",
+			"pkg/sentry/vfs/epoll.go:314",
+			"pkg/sentry/vfs/file_description.go:549",
+			"pkg/sentry/vfs/file_description_impl_util.go:304",
+			"pkg/sentry/vfs/file_description_impl_util.go:412",
+			"pkg/sentry/vfs/filesystem.go:76",
+			"pkg/sentry/vfs/lock.go:15",
+			"pkg/sentry/vfs/lock.go:47",
+			"pkg/sentry/vfs/memxattr/xattr.go:37",
+			"pkg/sentry/vfs/mount.go:510",
+			"pkg/sentry/vfs/mount.go:667",
+			"pkg/sentry/vfs/mount_test.go:106",
+			"pkg/sentry/vfs/mount_test.go:160",
+			"pkg/sentry/vfs/mount_test.go:215",
+			"pkg/sentry/vfs/mount_unsafe.go:153",
+			"pkg/sentry/vfs/resolving_path.go:228",
+			"pkg/sentry/vfs/vfs.go:897",
+			"pkg/shim/runsc/runsc.go:16",
+			"pkg/shim/runsc/utils.go:16",
+			"pkg/shim/v1/proc/deleted_state.go:16",
+			"pkg/shim/v1/proc/exec.go:16",
+			"pkg/shim/v1/proc/exec_state.go:16",
+			"pkg/shim/v1/proc/init.go:16",
+			"pkg/shim/v1/proc/init_state.go:16",
+			"pkg/shim/v1/proc/io.go:16",
+			"pkg/shim/v1/proc/process.go:16",
+			"pkg/shim/v1/proc/types.go:16",
+			"pkg/shim/v1/proc/utils.go:16",
+			"pkg/shim/v1/shim/api.go:16",
+			"pkg/shim/v1/shim/platform.go:16",
+			"pkg/shim/v1/shim/service.go:16",
+			"pkg/shim/v1/utils/annotations.go:15",
+			"pkg/shim/v1/utils/utils.go:15",
+			"pkg/shim/v1/utils/volumes.go:15",
+			"pkg/shim/v2/api.go:16",
+			"pkg/shim/v2/epoll.go:18",
+			"pkg/shim/v2/options/options.go:15",
+			"pkg/shim/v2/options/options.go:24",
+			"pkg/shim/v2/options/options.go:26",
+			"pkg/shim/v2/runtimeoptions/runtimeoptions.go:16",
+			"pkg/shim/v2/runtimeoptions/runtimeoptions_test.go:22",
+			"pkg/shim/v2/service.go:15",
+			"pkg/shim/v2/service_linux.go:18",
+			"pkg/state/tests/integer_test.go:23",
+			"pkg/state/tests/integer_test.go:28",
+			"pkg/sync/rwmutex_test.go:105",
+			"pkg/syserr/host_linux.go:35",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:144",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:415",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:99",
+			"pkg/tcpip/buffer/view.go:238",
+			"pkg/tcpip/buffer/view.go:238",
+			"pkg/tcpip/buffer/view.go:246",
+			"pkg/tcpip/header/tcp.go:151",
+			"pkg/tcpip/link/sharedmem/pipe/pipe_test.go:493",
+			"pkg/tcpip/stack/iptables.go:293",
+			"pkg/tcpip/stack/iptables_types.go:277",
+			"pkg/tcpip/stack/stack.go:553",
+			"pkg/tcpip/stack/transport_test.go:30",
+			"pkg/tcpip/transport/packet/endpoint.go:126",
+			"pkg/tcpip/transport/raw/endpoint.go:145",
+			"pkg/tcpip/transport/tcp/sack_scoreboard.go:167",
+			"pkg/unet/unet_test.go:634",
+			"pkg/unet/unet_test.go:662",
+			"pkg/unet/unet_test.go:703",
+			"pkg/unet/unet_test.go:98",
+			"pkg/usermem/addr.go:34",
+			"pkg/usermem/usermem.go:171",
+			"pkg/usermem/usermem.go:170",
+			"runsc/boot/compat.go:22",
+			"runsc/boot/compat.go:56",
+			"runsc/boot/loader.go:1115",
+			"runsc/boot/loader.go:1120",
+			"runsc/cmd/checkpoint.go:151",
+			"runsc/config/flags.go:32",
+			"runsc/container/container.go:641",
+			"runsc/container/container.go:988",
+			"runsc/specutils/specutils.go:172",
+			"runsc/specutils/specutils.go:428",
+			"runsc/specutils/specutils.go:436",
+			"runsc/specutils/specutils.go:442",
+			"runsc/specutils/specutils.go:447",
+			"runsc/specutils/specutils.go:454",
+			"test/cmd/test_app/fds.go:171",
+			"test/iptables/filter_output.go:251",
+			"test/packetimpact/testbench/connections.go:77",
+			"tools/bigquery/bigquery.go:106",
+			"tools/checkescape/test1/test1.go:108",
+			"tools/checkescape/test1/test1.go:122",
+			"tools/checkescape/test1/test1.go:137",
+			"tools/checkescape/test1/test1.go:151",
+			"tools/checkescape/test1/test1.go:170",
+			"tools/checkescape/test1/test1.go:39",
+			"tools/checkescape/test1/test1.go:45",
+			"tools/checkescape/test1/test1.go:50",
+			"tools/checkescape/test1/test1.go:64",
+			"tools/checkescape/test1/test1.go:80",
+			"tools/checkescape/test1/test1.go:94",
+			"tools/go_generics/imports.go:51",
+			"tools/go_generics/imports.go:75",
+			"tools/go_marshal/gomarshal/generator.go:177",
+			"tools/go_marshal/gomarshal/generator.go:81",
+			"tools/go_marshal/gomarshal/generator.go:85",
+			"tools/go_marshal/test/escape/escape.go:15",
+			"tools/go_marshal/test/test.go:164",
+		),
+	)
+
+	// Add all staticcheck analyzers; internal only.
+	for _, a := range staticcheck.Analyzers {
+		analyzerConfig[a] = staticMatcher
+	}
+	// Add all stylecheck analyzers; internal only.
+	for _, a := range stylecheck.Analyzers {
+		analyzerConfig[a] = staticMatcher
+	}
+}
+
 var escapesConfig = map[*analysis.Analyzer]matcher{
 	// Informational only: include all packages.
 	checkescape.EscapeAnalyzer: alwaysMatches(),
diff --git a/tools/nogo/matchers.go b/tools/nogo/matchers.go
index 5c39be630..b7b73fa27 100644
--- a/tools/nogo/matchers.go
+++ b/tools/nogo/matchers.go
@@ -102,6 +102,14 @@ func internalMatches() *pathRegexps {
 	}
 }
 
+// generatedExcluded excludes all generated code.
+func generatedExcluded() *pathRegexps {
+	return &pathRegexps{
+		expr:    buildRegexps(generatedPrefix, ".*"),
+		include: false,
+	}
+}
+
 // resultExcluded excludes explicit message contents.
 type resultExcluded []string
 
@@ -117,20 +125,23 @@ func (r resultExcluded) ShouldReport(d analysis.Diagnostic, _ *token.FileSet) bo
 
 // andMatcher is a composite matcher.
 type andMatcher struct {
-	first  matcher
-	second matcher
+	all []matcher
 }
 
 // ShouldReport implements matcher.ShouldReport.
 func (a *andMatcher) ShouldReport(d analysis.Diagnostic, fs *token.FileSet) bool {
-	return a.first.ShouldReport(d, fs) && a.second.ShouldReport(d, fs)
+	for _, m := range a.all {
+		if !m.ShouldReport(d, fs) {
+			return false
+		}
+	}
+	return true
 }
 
 // and is a syntactic convension for andMatcher.
-func and(first matcher, second matcher) *andMatcher {
+func and(ms ...matcher) *andMatcher {
 	return &andMatcher{
-		first:  first,
-		second: second,
+		all: ms,
 	}
 }