1# 2# Series 2. 3# 4 5-doc_begin="The compiler implementation guarantees that the unreachable code is removed. 6Constant expressions and unreachable branches of if and switch statements are expected." 7-config=MC3R1.R2.1,+reports={safe,"first_area(^.*has an invariantly.*$)"} 8-config=MC3R1.R2.1,+reports={safe,"first_area(^.*incompatible with labeled statement$)"} 9-doc_end 10 11-doc_begin="Some functions are intended to be not referenced." 12-config=MC3R1.R2.1,+reports={deliberate,"first_area(^.*is never referenced$)"} 13-doc_end 14 15-doc_begin="Unreachability caused by calls to the following functions or macros is deliberate and there is no risk of code being unexpectedly left out." 16-config=MC3R1.R2.1,statements+={deliberate,"macro(name(BUG||assert_failed))"} 17-config=MC3R1.R2.1,statements+={deliberate, "call(decl(name(__builtin_unreachable||panic||do_unexpected_trap||machine_halt||machine_restart||reboot_or_halt)))"} 18-doc_end 19 20-doc_begin="Unreachability inside an ASSERT_UNREACHABLE() and analogous macro calls is deliberate and safe." 21-config=MC3R1.R2.1,reports+={deliberate, "any_area(any_loc(any_exp(macro(name(ASSERT_UNREACHABLE||PARSE_ERR_RET||PARSE_ERR||FAIL_MSR||FAIL_CPUID)))))"} 22-doc_end 23 24-doc_begin="The asm-offset files are not linked deliberately, since they are used to generate definitions for asm modules." 25-file_tag+={asm_offsets, "^xen/arch/(arm|x86)/(arm32|arm64|x86_64)/asm-offsets\\.c$"} 26-config=MC3R1.R2.1,reports+={deliberate, "any_area(any_loc(file(asm_offsets)))"} 27-doc_end 28 29-doc_begin="Pure declarations (i.e., declarations without initialization) are 30not executable, and therefore it is safe for them to be unreachable." 31-config=MC3R1.R2.1,ignored_stmts+={"any()", "pure_decl()"} 32-doc_end 33 34-doc_begin="The following autogenerated file is not linked deliberately." 35-file_tag+={C_runtime_failures,"^automation/eclair_analysis/C-runtime-failures\\.rst\\.c$"} 36-config=MC3R1.R2.1,reports+={deliberate, "any_area(any_loc(file(C_runtime_failures)))"} 37-doc_end 38 39-doc_begin="Proving compliance with respect to Rule 2.2 is generally impossible: 40see https://arxiv.org/abs/2212.13933 for details. Moreover, peer review gives us 41confidence that no evidence of errors in the program's logic has been missed due 42to undetected violations of Rule 2.2, if any. Testing on time behavior gives us 43confidence on the fact that, should the program contain dead code that is not 44removed by the compiler, the resulting slowdown is negligible." 45-config=MC3R1.R2.2,reports+={disapplied,"any()"} 46-doc_end 47 48-doc_begin="Some labels are unused in certain build configurations, or are deliberately marked as unused, so that the compiler is entitled to remove them." 49-config=MC3R1.R2.6,reports+={deliberate, "any_area(text(^.*__maybe_unused.*$))"} 50-doc_end 51 52# 53# Series 3. 54# 55 56-doc_begin="Comments starting with '/*' and containing hyperlinks are safe as 57they are not instances of commented-out code." 58-config=MC3R1.R3.1,reports+={safe, "first_area(text(^.*https?://.*$))"} 59-doc_end 60 61# 62# Series 4. 63# 64 65-doc_begin="The directive has been accepted only for the ARM codebase." 66-config=MC3R1.D4.3,reports+={disapplied,"!(any_area(any_loc(file(^xen/arch/arm/arm64/.*$))))"} 67-doc_end 68 69-doc_begin="The inline asm in 'arm64/lib/bitops.c' is tightly coupled with the surronding C code that acts as a wrapper, so it has been decided not to add an additional encapsulation layer." 70-file_tag+={arm64_bitops, "^xen/arch/arm/arm64/lib/bitops\\.c$"} 71-config=MC3R1.D4.3,reports+={deliberate, "all_area(any_loc(file(arm64_bitops)&&any_exp(macro(^(bit|test)op$))))"} 72-config=MC3R1.D4.3,reports+={deliberate, "any_area(any_loc(file(arm64_bitops))&&context(name(int_clear_mask16)))"} 73-doc_end 74 75-doc_begin="This header file is autogenerated or empty, therefore it poses no 76risk if included more than once." 77-file_tag+={empty_header, "^xen/arch/arm/efi/runtime\\.h$"} 78-file_tag+={autogen_headers, "^xen/include/xen/compile\\.h$||^xen/include/generated/autoconf.h$||^xen/include/xen/hypercall-defs.h$"} 79-config=MC3R1.D4.10,reports+={safe, "all_area(all_loc(file(empty_header||autogen_headers)))"} 80-doc_end 81 82-doc_begin="Files that are intended to be included more than once do not need to 83conform to the directive." 84-config=MC3R1.D4.10,reports+={safe, "first_area(text(^/\\* This file is legitimately included multiple times\\. \\*/$, begin-4))"} 85-config=MC3R1.D4.10,reports+={safe, "first_area(text(^/\\* Generated file, do not edit! \\*/$, begin-3))"} 86-doc_end 87 88# 89# Series 5. 90# 91 92-doc_begin="The project adopted the rule with an exception listed in 93'docs/misra/rules.rst'" 94-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^READ_SYSREG$))&&any_exp(macro(^WRITE_SYSREG$))))"} 95-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^max(_t)?$))&&any_exp(macro(^min(_t)?$))))"} 96-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^read[bwlq]$))&&any_exp(macro(^read[bwlq]_relaxed$))))"} 97-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^per_cpu$))&&any_exp(macro(^this_cpu$))))"} 98-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^__emulate_2op$))&&any_exp(macro(^__emulate_2op_nobyte$))))"} 99-config=MC3R1.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^read_debugreg$))&&any_exp(macro(^write_debugreg$))))"} 100-doc_end 101 102-doc_begin="Macros expanding to their own identifier (e.g., \"#define x x\") are deliberate." 103-config=MC3R1.R5.5,reports+={deliberate, "all_area(macro(same_id_body())||!macro(!same_id_body()))"} 104-doc_end 105 106-doc_begin="There is no clash between function like macros and not callable objects." 107-config=MC3R1.R5.5,reports+={deliberate, "all_area(macro(function_like())||decl(any()))&&all_area(macro(any())||!decl(kind(function))&&!decl(__function_pointer_decls))"} 108-doc_end 109 110-doc_begin="Clashes between function names and macros are deliberate for string handling functions since some architectures may want to use their own arch-specific implementation." 111-config=MC3R1.R5.5,reports+={deliberate, "all_area(all_loc(file(^xen/arch/x86/string\\.c|xen/include/xen/string\\.h|xen/lib/.*$)))"} 112-doc_end 113 114-doc_begin="In libelf, clashes between macros and function names are deliberate and needed to prevent the use of undecorated versions of memcpy, memset and memmove." 115-config=MC3R1.R5.5,reports+={deliberate, "any_area(decl(kind(function))||any_loc(macro(name(memcpy||memset||memmove))))&&any_area(any_loc(file(^xen/common/libelf/libelf-private\\.h$)))"} 116-doc_end 117 118-doc_begin="The type \"ret_t\" is deliberately defined multiple times, 119depending on the guest." 120-config=MC3R1.R5.6,reports+={deliberate,"any_area(any_loc(text(^.*ret_t.*$)))"} 121-doc_end 122 123-doc_begin="On X86, the types \"guest_intpte_t\", \"guest_l1e_t\" and 124\"guest_l2e_t\" are deliberately defined multiple times, depending on the 125number of guest paging levels." 126-config=MC3R1.R5.6,reports+={deliberate,"any_area(any_loc(file(^xen/arch/x86/include/asm/guest_pt\\.h$)))&&any_area(any_loc(text(^.*(guest_intpte_t|guest_l[12]e_t).*$)))"} 127-doc_end 128 129-doc_begin="The following files are imported from the gnu-efi package." 130-file_tag+={adopted_r5_6,"^xen/include/efi/.*$"} 131-file_tag+={adopted_r5_6,"^xen/arch/.*/include/asm/.*/efibind\\.h$"} 132-config=MC3R1.R5.6,reports+={deliberate,"any_area(any_loc(file(adopted_r5_6)))"} 133-doc_end 134 135-doc_begin="The project intentionally reuses tag names in order to have identifiers matching the applicable external specifications as well as established internal conventions. 136As there is little possibility for developer confusion not resulting into compilation errors, the risk of renaming outweighs the potential advantages of compliance." 137-config=MC3R1.R5.7,reports+={deliberate,"any()"} 138-doc_end 139 140# 141# Series 7. 142# 143 144-doc_begin="It is safe to use certain octal constants the way they are defined 145in specifications, manuals, and algorithm descriptions." 146-config=MC3R1.R7.1,reports+={safe, "any_area(any_loc(any_exp(text(^.*octal-ok.*$))))"} 147-doc_end 148 149-doc_begin="Violations in files that maintainers have asked to not modify in the 150context of R7.2." 151-file_tag+={adopted_r7_2,"^xen/include/xen/libfdt/.*$"} 152-file_tag+={adopted_r7_2,"^xen/arch/x86/include/asm/x86_64/efibind.h$"} 153-file_tag+={adopted_r7_2,"^xen/include/efi/efiapi\\.h$"} 154-file_tag+={adopted_r7_2,"^xen/include/efi/efidef\\.h$"} 155-file_tag+={adopted_r7_2,"^xen/include/efi/efiprot\\.h$"} 156-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/intel\\.c$"} 157-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/amd\\.c$"} 158-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/common\\.c$"} 159-config=MC3R1.R7.2,reports+={deliberate,"any_area(any_loc(file(adopted_r7_2)))"} 160-doc_end 161 162-doc_begin="Violations caused by __HYPERVISOR_VIRT_START are related to the 163particular use of it done in xen_mk_ulong." 164-config=MC3R1.R7.2,reports+={deliberate,"any_area(any_loc(macro(name(BUILD_BUG_ON))))"} 165-doc_end 166 167-doc_begin="Allow pointers of non-character type as long as the pointee is 168const-qualified." 169-config=MC3R1.R7.4,same_pointee=false 170-doc_end 171 172# 173# Series 8. 174# 175 176-doc_begin="The type ret_t is deliberately used and defined as int or long depending on the architecture." 177-config=MC3R1.R8.3,reports+={deliberate,"any_area(any_loc(text(^.*ret_t.*$)))"} 178-doc_end 179 180-doc_begin="The following files are imported from Linux and decompress.h defines a unique and documented interface towards all the (adopted) decompress functions." 181-file_tag+={adopted_decompress_r8_3,"^xen/common/bunzip2\\.c$"} 182-file_tag+={adopted_decompress_r8_3,"^xen/common/unlz4\\.c$"} 183-file_tag+={adopted_decompress_r8_3,"^xen/common/unlzma\\.c$"} 184-file_tag+={adopted_decompress_r8_3,"^xen/common/unlzo\\.c$"} 185-file_tag+={adopted_decompress_r8_3,"^xen/common/unxz\\.c$"} 186-file_tag+={adopted_decompress_r8_3,"^xen/common/unzstd\\.c$"} 187-config=MC3R1.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_decompress_r8_3)))&&any_area(any_loc(file(^xen/include/xen/decompress\\.h$)))"} 188-doc_end 189 190-doc_begin="Parameter name \"unused\" (with an optional numeric suffix) is deliberate and makes explicit the intention of not using such parameter within the function." 191-config=MC3R1.R8.3,reports+={deliberate, "any_area(^.*parameter `unused[0-9]*'.*$)"} 192-doc_end 193 194-doc_begin="The following file is imported from Linux: ignore for now." 195-file_tag+={adopted_time_r8_3,"^xen/arch/x86/time\\.c$"} 196-config=MC3R1.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_time_r8_3)))&&(any_area(any_loc(file(^xen/include/xen/time\\.h$)))||any_area(any_loc(file(^xen/arch/x86/include/asm/setup\\.h$))))"} 197-doc_end 198 199-doc_begin="The following file is imported from Linux: ignore for now." 200-file_tag+={adopted_cpu_idle_r8_3,"^xen/arch/x86/acpi/cpu_idle\\.c$"} 201-config=MC3R1.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_cpu_idle_r8_3)))&&any_area(any_loc(file(^xen/include/xen/pmstat\\.h$)))"} 202-doc_end 203 204-doc_begin="The following file is imported from Linux: ignore for now." 205-file_tag+={adopted_mpparse_r8_3,"^xen/arch/x86/mpparse\\.c$"} 206-config=MC3R1.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_mpparse_r8_3)))&&any_area(any_loc(file(^xen/arch/x86/include/asm/mpspec\\.h$)))"} 207-doc_end 208 209-doc_begin="The definitions present in this file are meant to generate definitions for asm modules, and are not called by C code. Therefore the absence of prior declarations is safe." 210-file_tag+={asm_offsets, "^xen/arch/(arm|x86)/(arm32|arm64|x86_64)/asm-offsets\\.c$"} 211-config=MC3R1.R8.4,reports+={safe, "first_area(any_loc(file(asm_offsets)))"} 212-doc_end 213 214-doc_begin="The functions defined in this file are meant to be called from gcc-generated code in a non-release build configuration. 215Therefore the absence of prior declarations is safe." 216-file_tag+={gcov, "^xen/common/coverage/gcov_base\\.c$"} 217-config=MC3R1.R8.4,reports+={safe, "first_area(any_loc(file(gcov)))"} 218-doc_end 219 220-doc_begin="Recognize the occurrence of current_stack_pointer as a declaration." 221-file_tag+={asm_defns, "^xen/arch/x86/include/asm/asm_defns\\.h$"} 222-config=MC3R1.R8.4,declarations+={safe, "loc(file(asm_defns))&&^current_stack_pointer$"} 223-doc_end 224 225-doc_begin="The function apei_(read|check|clear)_mce are dead code and are excluded from non-debug builds, therefore the absence of prior declarations is safe." 226-config=MC3R1.R8.4,declarations+={safe, "^apei_(read|check|clear)_mce\\(.*$"} 227-doc_end 228 229-doc_begin="asmlinkage is a marker to indicate that the function is only used to interface with asm modules." 230-config=MC3R1.R8.4,declarations+={safe,"loc(text(^(?s).*asmlinkage.*$, -1..0))"} 231-doc_end 232 233-doc_begin="Given that bsearch and sort are defined with the attribute 'gnu_inline', it's deliberate not to have a prior declaration. 234See Section \"6.33.1 Common Function Attributes\" of \"GCC_MANUAL\" for a full explanation of gnu_inline." 235-file_tag+={bsearch_sort, "^xen/include/xen/(sort|lib)\\.h$"} 236-config=MC3R1.R8.4,reports+={deliberate, "any_area(any_loc(file(bsearch_sort))&&decl(name(bsearch||sort)))"} 237-doc_end 238 239-doc_begin="first_valid_mfn is defined in this way because the current lack of NUMA support in Arm and PPC requires it." 240-file_tag+={first_valid_mfn, "^xen/common/page_alloc\\.c$"} 241-config=MC3R1.R8.4,declarations+={deliberate,"loc(file(first_valid_mfn))"} 242-doc_end 243 244-doc_begin="The following variables are compiled in multiple translation units 245belonging to different executables and therefore are safe." 246-config=MC3R1.R8.6,declarations+={safe, "name(current_stack_pointer||bsearch||sort)"} 247-doc_end 248 249-doc_begin="Declarations without definitions are allowed (specifically when the 250definition is compiled-out or optimized-out by the compiler)" 251-config=MC3R1.R8.6,reports+={deliberate, "first_area(^.*has no definition$)"} 252-doc_end 253 254-doc_begin="The search procedure for Unix linkers is well defined, see ld(1) 255manual: \"The linker will search an archive only once, at the location where it 256is specified on the command line. If the archive defines a symbol which was 257undefined in some object which appeared before the archive on the command line, 258the linker will include the appropriate file(s) from the archive\". 259In Xen, thanks to the order in which file names appear in the build commands, 260if arch-specific definitions are present, they get always linked in before 261searching in the lib.a archive resulting from xen/lib." 262-config=MC3R1.R8.6,declarations+={deliberate, "loc(file(^xen/lib/.*$))"} 263-doc_end 264 265-doc_begin="The gnu_inline attribute without static is deliberately allowed." 266-config=MC3R1.R8.10,declarations+={deliberate,"property(gnu_inline)"} 267-doc_end 268 269# 270# Series 9. 271# 272 273-doc_begin="Violations in files that maintainers have asked to not modify in the 274context of R9.1." 275-file_tag+={adopted_r9_1,"^xen/arch/arm/arm64/lib/find_next_bit\\.c$"} 276-config=MC3R1.R9.1,reports+={deliberate,"any_area(any_loc(file(adopted_r9_1)))"} 277-doc_end 278 279-doc_begin="The possibility of committing mistakes by specifying an explicit 280dimension is higher than omitting the dimension." 281-config=MC3R1.R9.5,reports+={deliberate, "any()"} 282-doc_end 283 284# 285# Series 10. 286# 287 288-doc_begin="The value-preserving conversions of integer constants are safe" 289-config=MC3R1.R10.1,etypes={safe,"any()","preserved_integer_constant()"} 290-config=MC3R1.R10.3,etypes={safe,"any()","preserved_integer_constant()"} 291-config=MC3R1.R10.4,etypes={safe,"any()","preserved_integer_constant()||sibling(rhs,preserved_integer_constant())"} 292-doc_end 293 294-doc_begin="Shifting non-negative integers to the right is safe." 295-config=MC3R1.R10.1,etypes+={safe, 296 "stmt(node(binary_operator)&&operator(shr))", 297 "src_expr(definitely_in(0..))"} 298-doc_end 299 300-doc_begin="Shifting non-negative integers to the left is safe if the result is 301still non-negative." 302-config=MC3R1.R10.1,etypes+={safe, 303 "stmt(node(binary_operator)&&operator(shl)&&definitely_in(0..))", 304 "src_expr(definitely_in(0..))"} 305-doc_end 306 307-doc_begin="Bitwise logical operations on non-negative integers are safe." 308-config=MC3R1.R10.1,etypes+={safe, 309 "stmt(node(binary_operator)&&operator(and||or||xor))", 310 "src_expr(definitely_in(0..))"} 311-doc_end 312 313-doc_begin="The implicit conversion to Boolean for logical operator arguments is well known to all Xen developers to be a comparison with 0" 314-config=MC3R1.R10.1,etypes+={safe, "stmt(operator(logical)||node(conditional_operator||binary_conditional_operator))", "dst_type(ebool||boolean)"} 315-doc_end 316 317-doc_begin="The macro ISOLATE_LSB encapsulates a well-known pattern to obtain 318a mask where only the lowest bit set in the argument is set, if any, for unsigned 319integers arguments on two's complement architectures 320(all the architectures supported by Xen satisfy this requirement)." 321-config=MC3R1.R10.1,reports+={safe, "any_area(any_loc(any_exp(macro(^ISOLATE_LSB$))))"} 322-doc_end 323 324-doc_begin="XEN only supports architectures where signed integers are 325representend using two's complement and all the XEN developers are aware of 326this." 327-config=MC3R1.R10.1,etypes+={safe, 328 "stmt(operator(and||or||xor||not||and_assign||or_assign||xor_assign))", 329 "any()"} 330-doc_end 331 332-doc_begin="See Section \"4.5 Integers\" of \"GCC_MANUAL\", where it says that 333\"Signed `>>' acts on negative numbers by sign extension. As an extension to the 334C language, GCC does not use the latitude given in C99 and C11 only to treat 335certain aspects of signed `<<' as undefined. However, -fsanitize=shift (and 336-fsanitize=undefined) will diagnose such cases. They are also diagnosed where 337constant expressions are required.\"" 338-config=MC3R1.R10.1,etypes+={safe, 339 "stmt(operator(shl||shr||shl_assign||shr_assign))", 340 "any()"} 341-doc_end 342 343# 344# Series 11 345# 346 347-doc_begin="The conversion from a function pointer to unsigned long or (void *) does not lose any information, provided that the target type has enough bits to store it." 348-config=MC3R1.R11.1,casts+={safe, 349 "from(type(canonical(__function_pointer_types))) 350 &&to(type(canonical(builtin(unsigned long)||pointer(builtin(void))))) 351 &&relation(definitely_preserves_value)" 352} 353-doc_end 354 355-doc_begin="The conversion from a function pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour." 356-config=MC3R1.R11.1,casts+={safe, 357 "from(type(canonical(__function_pointer_types))) 358 &&kind(pointer_to_boolean)" 359} 360-doc_end 361 362-doc_begin="The conversion from a pointer to an incomplete type to unsigned long does not lose any information, provided that the target type has enough bits to store it." 363-config=MC3R1.R11.2,casts+={safe, 364 "from(type(any())) 365 &&to(type(canonical(builtin(unsigned long)))) 366 &&relation(definitely_preserves_value)" 367} 368-doc_end 369 370-doc_begin="Conversions to object pointers that have a pointee type with a smaller (i.e., less strict) alignment requirement are safe." 371-config=MC3R1.R11.3,casts+={safe, 372 "!relation(more_aligned_pointee)" 373} 374-doc_end 375 376-doc_begin="Conversions from and to integral types are safe, in the assumption that the target type has enough bits to store the value. 377See also Section \"4.7 Arrays and Pointers\" of \"GCC_MANUAL\"" 378-config=MC3R1.R11.6,casts+={safe, 379 "(from(type(canonical(integral())))||to(type(canonical(integral())))) 380 &&relation(definitely_preserves_value)"} 381-doc_end 382 383-doc_begin="The conversion from a pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour." 384-config=MC3R1.R11.6,casts+={safe, 385 "from(type(canonical(__pointer_types))) 386 &&kind(pointer_to_boolean)" 387} 388-doc_end 389 390-doc_begin="Violations caused by container_of are due to pointer arithmetic operations 391with the provided offset. The resulting pointer is then immediately cast back to its 392original type, which preserves the qualifier. This use is deemed safe. 393Fixing this violation would require to increase code complexity and lower readability." 394-config=MC3R1.R11.8,reports+={safe,"any_area(any_loc(any_exp(macro(^container_of$))))"} 395-doc_end 396 397-doc_begin="This construct is used to check if the type is scalar, and for this purpose the use of 0 as a null pointer constant is deliberate." 398-config=MC3R1.R11.9,reports+={deliberate, "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))" 399} 400-doc_end 401 402# 403# Series 13 404# 405 406-doc_begin="All developers and reviewers can be safely assumed to be well aware 407of the short-circuit evaluation strategy of such logical operators." 408-config=MC3R1.R13.5,reports+={disapplied,"any()"} 409-doc_end 410 411-doc_begin="Macros alternative_v?call[0-9] use sizeof and typeof to check that the argument types match the corresponding parameter ones." 412-config=MC3R1.R13.6,reports+={deliberate,"any_area(any_loc(any_exp(macro(^alternative_vcall[0-9]$))&&file(^xen/arch/x86/include/asm/alternative\\.h*$)))"} 413-config=B.UNEVALEFF,reports+={deliberate,"any_area(any_loc(any_exp(macro(^alternative_v?call[0-9]$))&&file(^xen/arch/x86/include/asm/alterantive\\.h*$)))"} 414-doc_end 415 416-doc_begin="Anything, no matter how complicated, inside the BUILD_BUG_ON macro is subject to a compile-time evaluation without relevant side effects." 417-config=MC3R1.R13.6,reports+={safe,"any_area(any_loc(any_exp(macro(name(BUILD_BUG_ON)))))"} 418-config=B.UNEVALEFF,reports+={safe,"any_area(any_loc(any_exp(macro(name(BUILD_BUG_ON)))))"} 419-doc_end 420 421# 422# Series 14 423# 424 425-doc_begin="The severe restrictions imposed by this rule on the use of for 426statements are not balanced by the presumed facilitation of the peer review 427activity." 428-config=MC3R1.R14.2,reports+={disapplied,"any()"} 429-doc_end 430 431-doc_begin="The XEN team relies on the fact that invariant conditions of 'if' statements and conditional operators are deliberate" 432-config=MC3R1.R14.3,statements+={deliberate, "wrapped(any(),node(if_stmt||conditional_operator||binary_conditional_operator))" } 433-doc_end 434 435-doc_begin="Switches having a 'sizeof' operator as the condition are deliberate and have limited scope." 436-config=MC3R1.R14.3,statements+={deliberate, "wrapped(any(),node(switch_stmt)&&child(cond, operator(sizeof)))" } 437-doc_end 438 439-doc_begin="The use of an invariant size argument in {put,get}_unsafe_size and array_access_ok, as defined in arch/x86(_64)?/include/asm/uaccess.h is deliberate and is deemed safe." 440-file_tag+={x86_uaccess, "^xen/arch/x86(_64)?/include/asm/uaccess\\.h$"} 441-config=MC3R1.R14.3,reports+={deliberate, "any_area(any_loc(file(x86_uaccess)&&any_exp(macro(^(put|get)_unsafe_size$))))"} 442-config=MC3R1.R14.3,reports+={deliberate, "any_area(any_loc(file(x86_uaccess)&&any_exp(macro(^array_access_ok$))))"} 443-doc_end 444 445-doc_begin="A controlling expression of 'if' and iteration statements having integer, character or pointer type has a semantics that is well-known to all Xen developers." 446-config=MC3R1.R14.4,etypes+={deliberate, "any()", "src_type(integer||character)||src_expr(type(desugar(pointer(any()))))"} 447-doc_end 448 449-doc_begin="The XEN team relies on the fact that the enum is_dying has the 450constant with assigned value 0 act as false and the other ones as true, 451therefore have the same behavior of a boolean" 452-config=MC3R1.R14.4,etypes+={deliberate, "stmt(child(cond,child(expr,ref(^<?domain>?::is_dying$))))","src_type(enum)"} 453-doc_end 454 455# 456# Series 16. 457# 458 459-doc_begin="Complying with the Rule would entail a lot of code duplication in the implementation of the x86 emulator, 460therefore it is deemed better to leave such files as is." 461-file_tag+={x86_emulate,"^xen/arch/x86/x86_emulate/.*$"} 462-file_tag+={x86_svm_emulate,"^xen/arch/x86/hvm/svm/emulate\\.c$"} 463-config=MC3R1.R16.2,reports+={deliberate, "any_area(any_loc(file(x86_emulate||x86_svm_emulate)))"} 464-doc_end 465 466-doc_begin="Switch clauses ending with continue, goto, return statements are 467safe." 468-config=MC3R1.R16.3,terminals+={safe, "node(continue_stmt||goto_stmt||return_stmt)"} 469-doc_end 470 471-doc_begin="Switch clauses ending with a call to a function that does not give 472the control back (i.e., a function with attribute noreturn) are safe." 473-config=MC3R1.R16.3,terminals+={safe, "call(property(noreturn))"} 474-doc_end 475 476-doc_begin="Switch clauses ending with pseudo-keyword \"fallthrough\" are 477safe." 478-config=MC3R1.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(/fallthrough;/))))"} 479-doc_end 480 481-doc_begin="Switch clauses ending with failure method \"BUG()\" are safe." 482-config=MC3R1.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(/BUG\\(\\);/))))"} 483-doc_end 484 485-doc_begin="Switch clauses not ending with the break statement are safe if an 486explicit comment indicating the fallthrough intention is present." 487-config=MC3R1.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(^(?s).*/\\* [fF]all ?through.? \\*/.*$,0..1))))"} 488-doc_end 489 490-doc_begin="Switch statements having a controlling expression of enum type deliberately do not have a default case: gcc -Wall enables -Wswitch which warns (and breaks the build as we use -Werror) if one of the enum labels is missing from the switch." 491-config=MC3R1.R16.4,reports+={deliberate,'any_area(kind(context)&&^.* has no `default.*$&&stmt(node(switch_stmt)&&child(cond,skip(__non_syntactic_paren_stmts,type(canonical(enum_underlying_type(any())))))))'} 492-doc_end 493 494-doc_begin="A switch statement with a single switch clause and no default label may be used in place of an equivalent if statement if it is considered to improve readability." 495-config=MC3R1.R16.4,switch_clauses+={deliberate,"switch(1)&&default(0)"} 496-doc_end 497 498-doc_begin="A switch statement with a single switch clause and no default label may be used in place of an equivalent if statement if it is considered to improve readability." 499-config=MC3R1.R16.6,switch_clauses+={deliberate, "default(0)"} 500-doc_end 501 502# 503# Series 17. 504# 505 506-doc_begin="printf()-like functions are allowed to use the variadic features provided by stdarg.h." 507-config=MC3R1.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(^.*printk\\(.*\\)$)))"} 508-config=MC3R1.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(^.*printf\\(.*\\)$)))"} 509-config=MC3R1.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(panic)&&kind(function))))"} 510-config=MC3R1.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(elf_call_log_callback)&&kind(function))))"} 511-config=MC3R1.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(vprintk_common)&&kind(function))))"} 512-config=MC3R1.R17.1,macros+={hide , "^va_(arg|start|copy|end)$"} 513-doc_end 514 515-doc_begin="Not using the return value of a function does not endanger safety if it coincides with an actual argument." 516-config=MC3R1.R17.7,calls+={safe, "any()", "decl(name(__builtin_memcpy||__builtin_memmove||__builtin_memset||cpumask_check))"} 517-doc_end 518 519# 520# Series 18. 521# 522 523-doc_begin="Flexible array members are deliberately used and XEN developers are aware of the dangers related to them: 524unexpected result when the structure is given as argument to a sizeof() operator and the truncation in assignment between structures." 525-config=MC3R1.R18.7,reports+={deliberate, "any()"} 526-doc_end 527 528# 529# Series 20. 530# 531 532-doc_begin="Code violating Rule 20.7 is safe when macro parameters are used: (1) 533as function arguments; (2) as macro arguments; (3) as array indices; (4) as lhs 534in assignments; (5) as initializers, possibly designated, in initalizer lists; 535(6) as the constant expression in a switch clause label." 536-config=MC3R1.R20.7,expansion_context= 537{safe, "context(__call_expr_arg_contexts)"}, 538{safe, "left_right(^[(,\\[]$,^[),\\]]$)"}, 539{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(array_subscript_expr), subscript)))"}, 540{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(operator(assign), lhs)))"}, 541{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(init_list_expr||designated_init_expr), init)))"}, 542{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(case_stmt), lower||upper)))"} 543-doc_end 544 545-doc_begin="Violations involving the __config_enabled macros cannot be fixed without 546breaking the macro's logic; futhermore, the macro is only ever used in the context 547of the IS_ENABLED or STATIC_IF/STATIC_IF_NOT macros, so it always receives a literal 5480 or 1 as input, posing no risk to safety." 549-config=MC3R1.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^___config_enabled$))))"} 550-doc_end 551 552-doc_begin="Violations due to the use of macros defined in files that are 553not in scope for compliance are allowed, as that is imported code." 554-file_tag+={gnu_efi_include, "^xen/include/efi/.*$"} 555-file_tag+={acpi_cpu_idle, "^xen/arch/x86/acpi/cpu_idle\\.c$"} 556-config=MC3R1.R20.7,reports+={safe, "any_area(any_loc(file(gnu_efi_include)))"} 557-config=MC3R1.R20.7,reports+={safe, "any_area(any_loc(file(acpi_cpu_idle)))"} 558-doc_end 559 560-doc_begin="To avoid compromising readability, the macros alternative_(v)?call[0-9] are allowed 561not to parenthesize their arguments." 562-config=MC3R1.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^alternative_(v)?call[0-9]$))))"} 563-doc_end 564 565-doc_begin="The argument 'x' of the count_args_ macro can't be parenthesized as 566the rule would require, without breaking the functionality of the macro. The uses 567of this macro do not lead to developer confusion, and can thus be deviated." 568-config=MC3R1.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^count_args_$))))"} 569-doc_end 570 571-doc_begin="Uses of variadic macros that have one of their arguments defined as 572a macro and used within the body for both ordinary parameter expansion and as an 573operand to the # or ## operators have a behavior that is well-understood and 574deliberate." 575-config=MC3R1.R20.12,macros+={deliberate, "variadic()"} 576-doc_end 577 578-doc_begin="Uses of a macro parameter for ordinary expansion and as an operand 579to the # or ## operators within the following macros are deliberate, to provide 580useful diagnostic messages to the user." 581-config=MC3R1.R20.12,macros+={deliberate, "name(ASSERT||BUILD_BUG_ON||BUILD_BUG_ON_ZERO||RUNTIME_CHECK)"} 582-doc_end 583 584-doc_begin="The helper macro GENERATE_CASE may use a macro parameter for ordinary 585expansion and token pasting to improve readability. Only instances where this 586leads to a violation of the Rule are deviated." 587-file_tag+={deliberate_generate_case, "^xen/arch/arm/vcpreg\\.c$"} 588-config=MC3R1.R20.12,macros+={deliberate, "name(GENERATE_CASE)&&loc(file(deliberate_generate_case))"} 589-doc_end 590 591-doc_begin="The macro DEFINE is defined and used in excluded files asm-offsets.c. 592This may still cause violations if entities outside these files are referred to 593in the expansion." 594-config=MC3R1.R20.12,macros+={deliberate, "name(DEFINE)&&loc(file(asm_offsets))"} 595-doc_end 596 597# 598# Series 21. 599# 600 601-doc_begin="or, and and xor are reserved identifiers because they constitute alternate 602spellings for the corresponding operators (they are defined as macros by iso646.h). 603However, Xen doesn't use standard library headers, so there is no risk of overlap." 604-config=MC3R1.R21.2,reports+={safe, "any_area(stmt(ref(kind(label)&&^(or|and|xor|not)$)))"} 605-doc_end 606 607-doc_begin="Xen does not use the functions provided by the Standard Library, but 608implements a set of functions that share the same names as their Standard Library equivalent. 609The implementation of these functions is available in source form, so the undefined, unspecified 610or implementation-defined behaviors contemplated by the C Standard do not apply. 611If some undefined or unspecified behavior does arise in the implementation, it 612falls under the jurisdiction of other MISRA rules." 613-config=MC3R1.R21.9,reports+={deliberate, "any()"} 614-config=MC3R1.R21.10,reports+={deliberate, "any()"} 615-doc_end 616 617# 618# General 619# 620 621-doc_begin="do-while-[01] is a well recognized loop idiom by the xen community." 622-loop_idioms={do_stmt, "literal(0)||literal(1)"} 623-doc_end 624-doc_begin="while-[01] is a well recognized loop idiom by the xen community." 625-loop_idioms+={while_stmt, "literal(0)||literal(1)"} 626-doc_end 627 628# 629# Developer confusion 630# 631 632-doc="Selection for reports that are fully contained in adopted code." 633-report_selector+={adopted_report,"all_area(!kind(culprit||evidence)||all_loc(all_exp(adopted||pseudo)))"} 634 635-doc_begin="Adopted code is not meant to be read, reviewed or modified by human 636programmers:no developers' confusion is not possible. In addition, adopted code 637is assumed to work as is. Reports that are fully contained in adopted code are 638hidden/tagged with the 'adopted' tag." 639-service_selector={developer_confusion_guidelines,"^(MC3R1\\.R2\\.1|MC3R1\\.R2\\.2|MC3R1\\.R2\\.3|MC3R1\\.R2\\.4|MC3R1\\.R2\\.5|MC3R1\\.R2\\.6|MC3R1\\.R2\\.7|MC3R1\\.R4\\.1|MC3R1\\.R5\\.3|MC3R1\\.R5\\.6|MC3R1\\.R5\\.7|MC3R1\\.R5\\.8|MC3R1\\.R5\\.9|MC3R1\\.R7\\.1|MC3R1\\.R7\\.2|MC3R1\\.R7\\.3|MC3R1\\.R8\\.7|MC3R1\\.R8\\.8|MC3R1\\.R8\\.9|MC3R1\\.R8\\.11|MC3R1\\.R8\\.12|MC3R1\\.R8\\.13|MC3R1\\.R9\\.3|MC3R1\\.R9\\.4|MC3R1\\.R9\\.5|MC3R1\\.R10\\.2|MC3R1\\.R10\\.5|MC3R1\\.R10\\.6|MC3R1\\.R10\\.7|MC3R1\\.R10\\.8|MC3R1\\.R11\\.9|MC3R1\\.R12\\.1|MC3R1\\.R12\\.3|MC3R1\\.R12\\.4|MC3R1\\.R13\\.5|MC3R1\\.R14\\.1|MC3R1\\.R14\\.2|MC3R1\\.R14\\.3|MC3R1\\.R15\\.1|MC3R1\\.R15\\.2|MC3R1\\.R15\\.3|MC3R1\\.R15\\.4|MC3R1\\.R15\\.5|MC3R1\\.R15\\.6|MC3R1\\.R15\\.7|MC3R1\\.R16\\.1|MC3R1\\.R16\\.2|MC3R1\\.R16\\.3|MC3R1\\.R16\\.4|MC3R1\\.R16\\.5|MC3R1\\.R16\\.6|MC3R1\\.R16\\.7|MC3R1\\.R17\\.7|MC3R1\\.R17\\.8|MC3R1\\.R18\\.4|MC3R1\\.R18\\.5)$" 640} 641-config=developer_confusion_guidelines,reports+={relied,adopted_report} 642-doc_end 643