1# 2# Series 2. 3# 4 5-doc_begin="The compiler implementation guarantees that the unreachable code is removed. 6Constant expressions and unreachable branches of if and switch statements are expected." 7-config=MC3A2.R2.1,+reports={safe,"first_area(^.*has an invariantly.*$)"} 8-config=MC3A2.R2.1,+reports={safe,"first_area(^.*incompatible with labeled statement$)"} 9-doc_end 10 11-doc_begin="Some functions are intended to be not referenced." 12-config=MC3A2.R2.1,+reports={deliberate,"first_area(^.*is never referenced$)"} 13-doc_end 14 15-doc_begin="Unreachability caused by calls to the following functions or macros is deliberate and there is no risk of code being unexpectedly left out." 16-config=MC3A2.R2.1,statements+={deliberate,"macro(name(BUG||assert_failed))"} 17-config=MC3A2.R2.1,statements+={deliberate, "call(decl(name(__builtin_unreachable||panic||do_unexpected_trap||machine_halt||machine_restart||reboot_or_halt)))"} 18-doc_end 19 20-doc_begin="Unreachability inside an ASSERT_UNREACHABLE() and analogous macro calls is deliberate and safe." 21-config=MC3A2.R2.1,reports+={deliberate, "any_area(any_loc(any_exp(macro(name(ASSERT_UNREACHABLE||PARSE_ERR_RET||PARSE_ERR||FAIL_MSR||FAIL_CPUID)))))"} 22-doc_end 23 24-doc_begin="The asm-offset files are not linked deliberately, since they are used to generate definitions for asm modules." 25-file_tag+={asm_offsets, "^xen/arch/(arm|x86)/(arm32|arm64|x86_64)/asm-offsets\\.c$"} 26-config=MC3A2.R2.1,reports+={deliberate, "any_area(any_loc(file(asm_offsets)))"} 27-doc_end 28 29-doc_begin="Pure declarations (i.e., declarations without initialization) are 30not executable, and therefore it is safe for them to be unreachable." 31-config=MC3A2.R2.1,ignored_stmts+={"any()", "pure_decl()"} 32-doc_end 33 34-doc_begin="The following autogenerated file is not linked deliberately." 35-file_tag+={C_runtime_failures,"^automation/eclair_analysis/C-runtime-failures\\.rst\\.c$"} 36-config=MC3A2.R2.1,reports+={deliberate, "any_area(any_loc(file(C_runtime_failures)))"} 37-doc_end 38 39-doc_begin="Calls to function `__builtin_unreachable()' in the expansion of macro 40`ASSERT_UNREACHABLE()' are not considered to have the `noreturn' property." 41-call_properties+={"name(__builtin_unreachable)&&stmt(begin(any_exp(macro(name(ASSERT_UNREACHABLE)))))", {"noreturn(false)"}} 42-doc_end 43 44-doc_begin="Proving compliance with respect to Rule 2.2 is generally impossible: 45see https://arxiv.org/abs/2212.13933 for details. Moreover, peer review gives us 46confidence that no evidence of errors in the program's logic has been missed due 47to undetected violations of Rule 2.2, if any. Testing on time behavior gives us 48confidence on the fact that, should the program contain dead code that is not 49removed by the compiler, the resulting slowdown is negligible." 50-config=MC3A2.R2.2,reports+={disapplied,"any()"} 51-doc_end 52 53-doc_begin="Some labels are unused in certain build configurations, or are deliberately marked as unused, so that the compiler is entitled to remove them." 54-config=MC3A2.R2.6,reports+={deliberate, "any_area(text(^.*__maybe_unused.*$))"} 55-doc_end 56 57# 58# Series 3. 59# 60 61-doc_begin="Comments starting with '/*' and containing hyperlinks are safe as 62they are not instances of commented-out code." 63-config=MC3A2.R3.1,reports+={safe, "first_area(text(^.*https?://.*$))"} 64-doc_end 65 66# 67# Series 4. 68# 69 70-doc_begin="The directive has been accepted only for the ARM codebase." 71-config=MC3A2.D4.3,reports+={disapplied,"!(any_area(any_loc(file(^xen/arch/arm/arm64/.*$))))"} 72-doc_end 73 74-doc_begin="The inline asm in 'arm64/lib/bitops.c' is tightly coupled with the surronding C code that acts as a wrapper, so it has been decided not to add an additional encapsulation layer." 75-file_tag+={arm64_bitops, "^xen/arch/arm/arm64/lib/bitops\\.c$"} 76-config=MC3A2.D4.3,reports+={deliberate, "all_area(any_loc(file(arm64_bitops)&&any_exp(macro(^(bit|test)op$))))"} 77-config=MC3A2.D4.3,reports+={deliberate, "any_area(any_loc(file(arm64_bitops))&&context(name(int_clear_mask16)))"} 78-doc_end 79 80-doc_begin="Files that are intended to be included more than once (and have 81a comment that says this explicitly) do not need to conform to the directive." 82-config=MC3A2.D4.10,reports+={safe, "first_area(text(^/\\* This file is intended to be included multiple times\\. \\*/$, begin-4))"} 83-config=MC3A2.D4.10,reports+={safe, "first_area(text(^/\\* Generated file, do not edit! \\*/$, begin-3...begin-2))"} 84-doc_end 85 86-doc_begin="Autogenerated files that do not need to conform to the directive." 87-config=MC3A2.D4.10,reports+={safe, "all_area(all_loc(file(^xen/include/generated/autoconf\\.h$)))"} 88-doc_end 89 90-doc_begin="Including multiple times a .c file is safe because every function or data item 91it defines would (in the common case) be already defined. Peer reviewed by the community." 92-config=MC3A2.D4.10,reports+={safe, "all_area(all_loc(^.*\\.c$))"} 93-doc_end 94 95# 96# Series 5. 97# 98 99-doc_begin="The project adopted the rule with an exception listed in 100'docs/misra/rules.rst'" 101-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^READ_SYSREG$))&&any_exp(macro(^WRITE_SYSREG$))))"} 102-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^max(_t)?$))&&any_exp(macro(^min(_t)?$))))"} 103-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^read[bwlq]$))&&any_exp(macro(^read[bwlq]_relaxed$))))"} 104-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^per_cpu$))&&any_exp(macro(^this_cpu$))))"} 105-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^__emulate_2op$))&&any_exp(macro(^__emulate_2op_nobyte$))))"} 106-config=MC3A2.R5.3,reports+={safe, "any_area(any_loc(any_exp(macro(^read_debugreg$))&&any_exp(macro(^write_debugreg$))))"} 107-doc_end 108 109-doc_begin="Macros expanding to their own identifier (e.g., \"#define x x\") are deliberate." 110-config=MC3A2.R5.5,reports+={deliberate, "all_area(macro(same_id_body())||!macro(!same_id_body()))"} 111-doc_end 112 113-doc_begin="There is no clash between function like macros and not callable objects." 114-config=MC3A2.R5.5,reports+={deliberate, "all_area(macro(function_like())||decl(any()))&&all_area(macro(any())||!decl(kind(function))&&!decl(__function_pointer_decls))"} 115-doc_end 116 117-doc_begin="Clashes between function names and macros are deliberate for string handling functions since some architectures may want to use their own arch-specific implementation." 118-config=MC3A2.R5.5,reports+={deliberate, "all_area(all_loc(file(^xen/arch/x86/string\\.c|xen/include/xen/string\\.h|xen/lib/.*$)))"} 119-doc_end 120 121-doc_begin="In libelf, clashes between macros and function names are deliberate and needed to prevent the use of undecorated versions of memcpy, memset and memmove." 122-config=MC3A2.R5.5,reports+={deliberate, "any_area(decl(kind(function))||any_loc(macro(name(memcpy||memset||memmove))))&&any_area(any_loc(file(^xen/common/libelf/libelf-private\\.h$)))"} 123-doc_end 124 125-doc_begin="Clashes between bitops functions and macro names are deliberate. 126These macros are needed for input validation and error handling." 127-config=MC3A2.R5.5,ignored_macros+="^(__)?(test|set|clear|change|test_and_(set|clear|change))_bit$" 128-doc_end 129 130-doc_begin="Clashes between grant table functions and macro names in 'xen/common/grant_table.c' are deliberate. 131These macros address differences in argument count during compile-time, effectively discarding unused parameters to avoid warnings or errors related to them." 132-config=MC3A2.R5.5,ignored_macros+="name(update_gnttab_par||parse_gnttab_limit)&&loc(file(^xen/common/grant_table\\.c$))" 133-doc_end 134 135-doc_begin="The type \"ret_t\" is deliberately defined multiple times, 136depending on the guest." 137-config=MC3A2.R5.6,reports+={deliberate,"any_area(any_loc(text(^.*ret_t.*$)))"} 138-doc_end 139 140-doc_begin="On X86, the types \"guest_intpte_t\", \"guest_l1e_t\" and 141\"guest_l2e_t\" are deliberately defined multiple times, depending on the 142number of guest paging levels." 143-config=MC3A2.R5.6,reports+={deliberate,"any_area(any_loc(file(^xen/arch/x86/include/asm/guest_pt\\.h$)))&&any_area(any_loc(text(^.*(guest_intpte_t|guest_l[12]e_t).*$)))"} 144-doc_end 145 146-doc_begin="The following files are imported from the gnu-efi package." 147-file_tag+={adopted_r5_6,"^xen/include/efi/.*$"} 148-file_tag+={adopted_r5_6,"^xen/arch/.*/include/asm/.*/efibind\\.h$"} 149-config=MC3A2.R5.6,reports+={deliberate,"any_area(any_loc(file(adopted_r5_6)))"} 150-doc_end 151 152-doc_begin="The project intentionally reuses tag names in order to have identifiers matching the applicable external specifications as well as established internal conventions. 153As there is little possibility for developer confusion not resulting into compilation errors, the risk of renaming outweighs the potential advantages of compliance." 154-config=MC3A2.R5.7,reports+={deliberate,"any()"} 155-doc_end 156 157# 158# Series 7. 159# 160 161-doc_begin="It is safe to use certain octal constants the way they are defined 162in specifications, manuals, and algorithm descriptions." 163-config=MC3A2.R7.1,reports+={safe, "any_area(any_loc(any_exp(text(^.*octal-ok.*$))))"} 164-doc_end 165 166-doc_begin="Violations in files that maintainers have asked to not modify in the 167context of R7.2." 168-file_tag+={adopted_r7_2,"^xen/include/xen/libfdt/.*$"} 169-file_tag+={adopted_r7_2,"^xen/arch/x86/include/asm/x86_64/efibind.h$"} 170-file_tag+={adopted_r7_2,"^xen/include/efi/efiapi\\.h$"} 171-file_tag+={adopted_r7_2,"^xen/include/efi/efidef\\.h$"} 172-file_tag+={adopted_r7_2,"^xen/include/efi/efiprot\\.h$"} 173-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/intel\\.c$"} 174-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/amd\\.c$"} 175-file_tag+={adopted_r7_2,"^xen/arch/x86/cpu/common\\.c$"} 176-config=MC3A2.R7.2,reports+={deliberate,"any_area(any_loc(file(adopted_r7_2)))"} 177-doc_end 178 179-doc_begin="Violations caused by __HYPERVISOR_VIRT_START are related to the 180particular use of it done in xen_mk_ulong." 181-config=MC3A2.R7.2,reports+={deliberate,"any_area(any_loc(macro(name(BUILD_BUG_ON))))"} 182-doc_end 183 184-doc_begin="Allow pointers of non-character type as long as the pointee is 185const-qualified." 186-config=MC3A2.R7.4,same_pointee=false 187-doc_end 188 189# 190# Series 8. 191# 192 193-doc_begin="The type ret_t is deliberately used and defined as int or long depending on the architecture." 194-config=MC3A2.R8.3,reports+={deliberate,"any_area(any_loc(text(^.*ret_t.*$)))"} 195-doc_end 196 197-doc_begin="The following files are imported from Linux and decompress.h defines a unique and documented interface towards all the (adopted) decompress functions." 198-file_tag+={adopted_decompress_r8_3,"^xen/common/bunzip2\\.c$"} 199-file_tag+={adopted_decompress_r8_3,"^xen/common/unlz4\\.c$"} 200-file_tag+={adopted_decompress_r8_3,"^xen/common/unlzma\\.c$"} 201-file_tag+={adopted_decompress_r8_3,"^xen/common/unlzo\\.c$"} 202-file_tag+={adopted_decompress_r8_3,"^xen/common/unxz\\.c$"} 203-file_tag+={adopted_decompress_r8_3,"^xen/common/unzstd\\.c$"} 204-config=MC3A2.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_decompress_r8_3)))&&any_area(any_loc(file(^xen/include/xen/decompress\\.h$)))"} 205-doc_end 206 207-doc_begin="Parameter name \"unused\" (with an optional numeric suffix) is deliberate and makes explicit the intention of not using such parameter within the function." 208-config=MC3A2.R8.3,reports+={deliberate, "any_area(^.*parameter `unused[0-9]*'.*$)"} 209-doc_end 210 211-doc_begin="The following file is imported from Linux: ignore for now." 212-file_tag+={adopted_time_r8_3,"^xen/arch/x86/time\\.c$"} 213-config=MC3A2.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_time_r8_3)))&&(any_area(any_loc(file(^xen/include/xen/time\\.h$)))||any_area(any_loc(file(^xen/arch/x86/include/asm/setup\\.h$))))"} 214-doc_end 215 216-doc_begin="The following file is imported from Linux: ignore for now." 217-file_tag+={adopted_cpu_idle_r8_3,"^xen/arch/x86/acpi/cpu_idle\\.c$"} 218-config=MC3A2.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_cpu_idle_r8_3)))&&any_area(any_loc(file(^xen/include/xen/pmstat\\.h$)))"} 219-doc_end 220 221-doc_begin="The following file is imported from Linux: ignore for now." 222-file_tag+={adopted_mpparse_r8_3,"^xen/arch/x86/mpparse\\.c$"} 223-config=MC3A2.R8.3,reports+={deliberate,"any_area(any_loc(file(adopted_mpparse_r8_3)))&&any_area(any_loc(file(^xen/arch/x86/include/asm/mpspec\\.h$)))"} 224-doc_end 225 226-doc_begin="The definitions present in this file are meant to generate definitions for asm modules, and are not called by C code. Therefore the absence of prior declarations is safe." 227-file_tag+={asm_offsets, "^xen/arch/(arm|x86)/(arm32|arm64|x86_64)/asm-offsets\\.c$"} 228-config=MC3A2.R8.4,reports+={safe, "first_area(any_loc(file(asm_offsets)))"} 229-doc_end 230 231-doc_begin="The functions defined in this file are meant to be called from gcc-generated code in a non-release build configuration. 232Therefore the absence of prior declarations is safe." 233-file_tag+={gcov, "^xen/common/coverage/gcov_base\\.c$"} 234-config=MC3A2.R8.4,reports+={safe, "first_area(any_loc(file(gcov)))"} 235-doc_end 236 237-doc_begin="Recognize the occurrence of current_stack_pointer as a declaration." 238-file_tag+={asm_defns, "^xen/arch/x86/include/asm/asm_defns\\.h$"} 239-config=MC3A2.R8.4,declarations+={safe, "loc(file(asm_defns))&&^current_stack_pointer$"} 240-doc_end 241 242-doc_begin="The function apei_(read|check|clear)_mce are dead code and are excluded from non-debug builds, therefore the absence of prior declarations is safe." 243-config=MC3A2.R8.4,declarations+={safe, "^apei_(read|check|clear)_mce\\(.*$"} 244-doc_end 245 246-doc_begin="asmlinkage is a marker to indicate that the function is only used to interface with asm modules." 247-config=MC3A2.R8.4,declarations+={safe,"loc(text(^(?s).*asmlinkage.*$, -1..0))"} 248-doc_end 249 250-doc_begin="Given that bsearch and sort are defined with the attribute 'gnu_inline', it's deliberate not to have a prior declaration. 251See Section \"6.33.1 Common Function Attributes\" of \"GCC_MANUAL\" for a full explanation of gnu_inline." 252-file_tag+={bsearch_sort, "^xen/include/xen/(sort|bsearch)\\.h$"} 253-config=MC3A2.R8.4,reports+={deliberate, "any_area(any_loc(file(bsearch_sort))&&decl(name(bsearch||sort)))"} 254-doc_end 255 256-doc_begin="first_valid_mfn is defined in this way because the current lack of NUMA support in Arm and PPC requires it." 257-file_tag+={first_valid_mfn, "^xen/common/page_alloc\\.c$"} 258-config=MC3A2.R8.4,declarations+={deliberate,"loc(file(first_valid_mfn))"} 259-doc_end 260 261-doc_begin="The following variables are compiled in multiple translation units 262belonging to different executables and therefore are safe." 263-config=MC3A2.R8.6,declarations+={safe, "name(current_stack_pointer||bsearch||sort)"} 264-doc_end 265 266-doc_begin="Declarations without definitions are allowed (specifically when the 267definition is compiled-out or optimized-out by the compiler)" 268-config=MC3A2.R8.6,reports+={deliberate, "first_area(^.*has no definition$)"} 269-doc_end 270 271-doc_begin="The search procedure for Unix linkers is well defined, see ld(1) 272manual: \"The linker will search an archive only once, at the location where it 273is specified on the command line. If the archive defines a symbol which was 274undefined in some object which appeared before the archive on the command line, 275the linker will include the appropriate file(s) from the archive\". 276In Xen, thanks to the order in which file names appear in the build commands, 277if arch-specific definitions are present, they get always linked in before 278searching in the lib.a archive resulting from xen/lib." 279-config=MC3A2.R8.6,declarations+={deliberate, "loc(file(^xen/lib/.*$))"} 280-doc_end 281 282-doc_begin="The gnu_inline attribute without static is deliberately allowed." 283-config=MC3A2.R8.10,declarations+={deliberate,"property(gnu_inline)"} 284-doc_end 285 286# 287# Series 9. 288# 289 290-doc_begin="Violations in files that maintainers have asked to not modify in the 291context of R9.1." 292-file_tag+={adopted_r9_1,"^xen/arch/arm/arm64/lib/find_next_bit\\.c$"} 293-config=MC3A2.R9.1,reports+={deliberate,"any_area(any_loc(file(adopted_r9_1)))"} 294-doc_end 295 296-doc_begin="The possibility of committing mistakes by specifying an explicit 297dimension is higher than omitting the dimension." 298-config=MC3A2.R9.5,reports+={deliberate, "any()"} 299-doc_end 300 301# 302# Series 10. 303# 304 305-doc_begin="The value-preserving conversions of integer constants are safe" 306-config=MC3A2.R10.1,etypes={safe,"any()","preserved_integer_constant()"} 307-config=MC3A2.R10.3,etypes={safe,"any()","preserved_integer_constant()"} 308-config=MC3A2.R10.4,etypes={safe,"any()","preserved_integer_constant()||sibling(rhs,preserved_integer_constant())"} 309-doc_end 310 311-doc_begin="Shifting non-negative integers to the right is safe." 312-config=MC3A2.R10.1,etypes+={safe, 313 "stmt(node(binary_operator)&&operator(shr))", 314 "src_expr(definitely_in(0..))"} 315-doc_end 316 317-doc_begin="Shifting non-negative integers to the left is safe if the result is 318still non-negative." 319-config=MC3A2.R10.1,etypes+={safe, 320 "stmt(node(binary_operator)&&operator(shl)&&definitely_in(0..))", 321 "src_expr(definitely_in(0..))"} 322-doc_end 323 324-doc_begin="Bitwise logical operations on non-negative integers are safe." 325-config=MC3A2.R10.1,etypes+={safe, 326 "stmt(node(binary_operator)&&operator(and||or||xor))", 327 "src_expr(definitely_in(0..))"} 328-doc_end 329 330-doc_begin="The implicit conversion to Boolean for logical operator arguments is well known to all Xen developers to be a comparison with 0" 331-config=MC3A2.R10.1,etypes+={safe, "stmt(operator(logical)||node(conditional_operator||binary_conditional_operator))", "dst_type(ebool||boolean)"} 332-doc_end 333 334-doc_begin="The macro ISOLATE_LSB encapsulates a well-known pattern to obtain 335a mask where only the lowest bit set in the argument is set, if any, for unsigned 336integers arguments on two's complement architectures 337(all the architectures supported by Xen satisfy this requirement)." 338-config=MC3A2.R10.1,reports+={safe, "any_area(any_loc(any_exp(macro(^ISOLATE_LSB$))))"} 339-doc_end 340 341-doc_begin="XEN only supports architectures where signed integers are 342representend using two's complement and all the XEN developers are aware of 343this." 344-config=MC3A2.R10.1,etypes+={safe, 345 "stmt(operator(and||or||xor||not||and_assign||or_assign||xor_assign))", 346 "any()"} 347-doc_end 348 349-doc_begin="See Section \"4.5 Integers\" of \"GCC_MANUAL\", where it says that 350\"Signed `>>' acts on negative numbers by sign extension. As an extension to the 351C language, GCC does not use the latitude given in C99 and C11 only to treat 352certain aspects of signed `<<' as undefined. However, -fsanitize=shift (and 353-fsanitize=undefined) will diagnose such cases. They are also diagnosed where 354constant expressions are required.\"" 355-config=MC3A2.R10.1,etypes+={safe, 356 "stmt(operator(shl||shr||shl_assign||shr_assign))", 357 "any()"} 358-doc_end 359 360-doc_begin="Unary minus operations on unsigned type(s) have a semantics (wrap around) that is well-defined by the toolchains." 361-config=MC3A2.R10.1,etypes+={safe, 362 "stmt(node(unary_operator)&&operator(minus))", 363 "src_expr(definitely_in(0..))"} 364-doc_end 365 366# 367# Series 11 368# 369 370-doc_begin="The conversion from a function pointer to unsigned long or (void *) does not lose any information, provided that the target type has enough bits to store it." 371-config=MC3A2.R11.1,casts+={safe, 372 "from(type(canonical(__function_pointer_types))) 373 &&to(type(canonical(builtin(unsigned long)||pointer(builtin(void))))) 374 &&relation(definitely_preserves_value)" 375} 376-doc_end 377 378-doc_begin="The conversion from a function pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour." 379-config=MC3A2.R11.1,casts+={safe, 380 "from(type(canonical(__function_pointer_types))) 381 &&kind(pointer_to_boolean)" 382} 383-doc_end 384 385-doc_begin="The conversion from 'void noreturn (*)(void *)' to 'void (*)(void *)' is safe 386because the semantics of the 'noreturn' attribute do not alter the calling convention or behavior of the resulting code." 387-config=MC3A2.R11.1,casts+={safe, 388 "kind(bitcast)&&to(type(pointer(inner(return(builtin(void))&&all_param(1, pointer(builtin(void)))))))&&from(expr(skip(!syntactic(), 389 ref(property(noreturn)))))"} 390-doc_end 391 392-doc_begin="The conversion from a pointer to an incomplete type to unsigned long does not lose any information, provided that the target type has enough bits to store it." 393-config=MC3A2.R11.2,casts+={safe, 394 "from(type(any())) 395 &&to(type(canonical(builtin(unsigned long)))) 396 &&relation(definitely_preserves_value)" 397} 398-doc_end 399 400-doc_begin="Conversions to object pointers that have a pointee type with a smaller (i.e., less strict) alignment requirement are safe." 401-config=MC3A2.R11.3,casts+={safe, 402 "!relation(more_aligned_pointee)" 403} 404-doc_end 405 406-doc_begin="Conversions from and to integral types are safe, in the assumption that the target type has enough bits to store the value. 407See also Section \"4.7 Arrays and Pointers\" of \"GCC_MANUAL\"" 408-config=MC3A2.R11.6,casts+={safe, 409 "(from(type(canonical(integral())))||to(type(canonical(integral())))) 410 &&relation(definitely_preserves_value)"} 411-doc_end 412 413-doc_begin="The conversion from a pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour." 414-config=MC3A2.R11.6,casts+={safe, 415 "from(type(canonical(__pointer_types))) 416 &&kind(pointer_to_boolean)" 417} 418-doc_end 419 420-doc_begin="Violations caused by container_of are due to pointer arithmetic operations 421with the provided offset. The resulting pointer is then immediately cast back to its 422original type, which preserves the qualifier. This use is deemed safe. 423Fixing this violation would require to increase code complexity and lower readability." 424-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(any_exp(macro(^container_of$))))"} 425-doc_end 426 427-doc_begin="Function __hvm_copy in xen/arch/x86/hvm/hvm.c is a double-use 428function, where the parameter needs to not be const because it can be set for 429write or not" 430-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(text(^.*__hvm_copy.*HVMCOPY_to_guest doesn't modify.*$)))"} 431-doc_end 432 433-doc_begin="This construct is used to check if the type is scalar, and for this purpose the use of 0 as a null pointer constant is deliberate." 434-config=MC3A2.R11.9,reports+={deliberate, "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))" 435} 436-doc_end 437 438# 439# Series 12 440# 441 442-doc_begin="Consider the C standard type instead of the essential type for the purposes of determining the width in bits of the operand." 443-config=MC3A2.R12.2,out_of_bounds=negative_or_too_big_for_type 444-doc_end 445 446# 447# Series 13 448# 449 450-doc_begin="All developers and reviewers can be safely assumed to be well aware 451of the short-circuit evaluation strategy of such logical operators." 452-config=MC3A2.R13.5,reports+={disapplied,"any()"} 453-doc_end 454 455-doc_begin="Macros alternative_v?call[0-9] use sizeof and typeof to check that the argument types match the corresponding parameter ones." 456-config=MC3A2.R13.6,reports+={deliberate,"any_area(any_loc(any_exp(macro(^alternative_vcall[0-9]$))&&file(^xen/arch/x86/include/asm/alternative-call\\.h*$)))"} 457-config=B.UNEVALEFF,reports+={deliberate,"any_area(any_loc(any_exp(macro(^alternative_v?call[0-9]$))&&file(^xen/arch/x86/include/asm/alterantive-call\\.h*$)))"} 458-doc_end 459 460-doc_begin="Anything, no matter how complicated, inside the BUILD_BUG_ON macro is subject to a compile-time evaluation without relevant side effects." 461-config=MC3A2.R13.6,reports+={safe,"any_area(any_loc(any_exp(macro(name(BUILD_BUG_ON)))))"} 462-config=B.UNEVALEFF,reports+={safe,"any_area(any_loc(any_exp(macro(name(BUILD_BUG_ON)))))"} 463-doc_end 464 465# 466# Series 14 467# 468 469-doc_begin="The severe restrictions imposed by this rule on the use of for 470statements are not balanced by the presumed facilitation of the peer review 471activity." 472-config=MC3A2.R14.2,reports+={disapplied,"any()"} 473-doc_end 474 475-doc_begin="The XEN team relies on the fact that invariant conditions of 'if' statements and conditional operators are deliberate" 476-config=MC3A2.R14.3,statements+={deliberate, "wrapped(any(),node(if_stmt||conditional_operator||binary_conditional_operator))" } 477-doc_end 478 479-doc_begin="Switches having a 'sizeof' operator as the condition are deliberate and have limited scope." 480-config=MC3A2.R14.3,statements+={deliberate, "wrapped(any(),node(switch_stmt)&&child(cond, operator(sizeof)))" } 481-doc_end 482 483-doc_begin="The use of an invariant size argument in {put,get}_unsafe_size and array_access_ok, as defined in arch/x86(_64)?/include/asm/uaccess.h is deliberate and is deemed safe." 484-file_tag+={x86_uaccess, "^xen/arch/x86(_64)?/include/asm/uaccess\\.h$"} 485-config=MC3A2.R14.3,reports+={deliberate, "any_area(any_loc(file(x86_uaccess)&&any_exp(macro(^(put|get)_unsafe_size$))))"} 486-config=MC3A2.R14.3,reports+={deliberate, "any_area(any_loc(file(x86_uaccess)&&any_exp(macro(^array_access_ok$))))"} 487-doc_end 488 489-doc_begin="A controlling expression of 'if' and iteration statements having integer, character or pointer type has a semantics that is well-known to all Xen developers." 490-config=MC3A2.R14.4,etypes+={deliberate, "any()", "src_type(integer||character)||src_expr(type(desugar(pointer(any()))))"} 491-doc_end 492 493-doc_begin="The XEN team relies on the fact that the enum is_dying has the 494constant with assigned value 0 act as false and the other ones as true, 495therefore have the same behavior of a boolean" 496-config=MC3A2.R14.4,etypes+={deliberate, "stmt(child(cond,child(expr,ref(^<?domain>?::is_dying$))))","src_type(enum)"} 497-doc_end 498 499# 500# Series 16. 501# 502 503-doc_begin="Complying with the Rule would entail a lot of code duplication in the implementation of the x86 emulator, 504therefore it is deemed better to leave such files as is." 505-file_tag+={x86_emulate,"^xen/arch/x86/x86_emulate/.*$"} 506-file_tag+={x86_svm_emulate,"^xen/arch/x86/hvm/svm/emulate\\.c$"} 507-config=MC3A2.R16.2,reports+={deliberate, "any_area(any_loc(file(x86_emulate||x86_svm_emulate)))"} 508-doc_end 509 510-doc_begin="Statements that change the control flow (i.e., break, continue, goto, return) and calls to functions that do not return the control back are \"allowed terminal statements\"." 511-stmt_selector+={r16_3_allowed_terminal, "node(break_stmt||continue_stmt||goto_stmt||return_stmt)||call(property(noreturn))"} 512-config=MC3A2.R16.3,terminals+={safe, "r16_3_allowed_terminal"} 513-doc_end 514 515-doc_begin="An if-else statement having both branches ending with an allowed terminal statement is itself an allowed terminal statement." 516-stmt_selector+={r16_3_if, "node(if_stmt)&&(child(then,r16_3_allowed_terminal)||child(then,any_stmt(stmt,-1,r16_3_allowed_terminal)))"} 517-stmt_selector+={r16_3_else, "node(if_stmt)&&(child(else,r16_3_allowed_terminal)||child(else,any_stmt(stmt,-1,r16_3_allowed_terminal)))"} 518-stmt_selector+={r16_3_if_else, "r16_3_if&&r16_3_else"} 519-config=MC3A2.R16.3,terminals+={safe, "r16_3_if_else"} 520-doc_end 521 522-doc_begin="An if-else statement having an always true condition and the true branch ending with an allowed terminal statement is itself an allowed terminal statement." 523-stmt_selector+={r16_3_if_true, "r16_3_if&&child(cond,definitely_in(1..))"} 524-config=MC3A2.R16.3,terminals+={safe, "r16_3_if_true"} 525-doc_end 526 527-doc_begin="A switch clause ending with a statement expression which, in turn, ends with an allowed terminal statement is safe." 528-config=MC3A2.R16.3,terminals+={safe, "node(stmt_expr)&&child(stmt,node(compound_stmt)&&any_stmt(stmt,-1,r16_3_allowed_terminal||r16_3_if_else||r16_3_if_true))"} 529-doc_end 530 531-doc_begin="A switch clause ending with a do-while-false the body of which, in turn, ends with an allowed terminal statement is safe. 532An exception to that is the macro ASSERT_UNREACHABLE() which is effective in debug build only: a switch clause ending with ASSERT_UNREACHABLE() is not considered safe." 533-config=MC3A2.R16.3,terminals+={safe, "!macro(name(ASSERT_UNREACHABLE))&&node(do_stmt)&&child(cond,definitely_in(0))&&child(body,any_stmt(stmt,-1,r16_3_allowed_terminal||r16_3_if_else||r16_3_if_true))"} 534-doc_end 535 536-doc_begin="Switch clauses ending with pseudo-keyword \"fallthrough\" are 537safe." 538-config=MC3A2.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(/fallthrough;/))))"} 539-doc_end 540 541-doc_begin="Switch clauses ending with failure method \"BUG()\" are safe." 542-config=MC3A2.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(/BUG\\(\\);/))))"} 543-doc_end 544 545-doc_begin="Switch clauses ending with an explicit comment indicating the fallthrough intention are safe." 546-config=MC3A2.R16.3,reports+={safe, "any_area(end_loc(any_exp(text(^(?s).*/\\* [fF]all ?through\\.? \\*/.*$,0..2))))"} 547-doc_end 548 549-doc_begin="Switch statements having a controlling expression of enum type deliberately do not have a default case: gcc -Wall enables -Wswitch which warns (and breaks the build as we use -Werror) if one of the enum labels is missing from the switch." 550-config=MC3A2.R16.4,reports+={deliberate,'any_area(kind(context)&&^.* has no `default.*$&&stmt(node(switch_stmt)&&child(cond,skip(__non_syntactic_paren_stmts,type(canonical(enum_underlying_type(any())))))))'} 551-doc_end 552 553-doc_begin="A switch statement with a single switch clause and no default label may be used in place of an equivalent if statement if it is considered to improve readability." 554-config=MC3A2.R16.4,switch_clauses+={deliberate,"switch(1)&&default(0)"} 555-doc_end 556 557-doc_begin="A switch statement with a single switch clause and no default label may be used in place of an equivalent if statement if it is considered to improve readability." 558-config=MC3A2.R16.6,switch_clauses+={deliberate, "default(0)"} 559-doc_end 560 561# 562# Series 17. 563# 564 565-doc_begin="printf()-like functions are allowed to use the variadic features provided by stdarg.h." 566-config=MC3A2.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(^.*printk\\(.*\\)$)))"} 567-config=MC3A2.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(^.*printf\\(.*\\)$)))"} 568-config=MC3A2.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(panic)&&kind(function))))"} 569-config=MC3A2.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(elf_call_log_callback)&&kind(function))))"} 570-config=MC3A2.R17.1,reports+={deliberate,"any_area(^.*va_list.*$&&context(ancestor_or_self(name(vprintk_common)&&kind(function))))"} 571-config=MC3A2.R17.1,macros+={hide , "^va_(arg|start|copy|end)$"} 572-doc_end 573 574-doc_begin="Not using the return value of a function does not endanger safety if it coincides with an actual argument." 575-config=MC3A2.R17.7,calls+={safe, "any()", "decl(name(__builtin_memcpy||__builtin_memmove||__builtin_memset||cpumask_check))"} 576-doc_end 577 578# 579# Series 18. 580# 581 582-doc_begin="Subtractions between pointers involving at least one of the linker symbols specified by the regex below 583are guaranteed not to be exploited by a compiler that relies on the absence of 584C99 Undefined Behaviour 45: Pointers that do not point into, or just beyond, the same array object are subtracted (6.5.6)." 585-eval_file=linker_symbols.ecl 586-config=MC3A2.R18.2,reports+={safe, "any_area(stmt(operator(sub)&&child(lhs||rhs, skip(__non_syntactic_paren_stmts, ref(linker_symbols)))))"} 587-doc_end 588 589-doc_begin="The following macro performs a subtraction between pointers to obtain the mfn, but does not lead to undefined behaviour." 590-config=MC3A2.R18.2,reports+={safe, "any_area(any_loc(any_exp(macro(^page_to_mfn$))))"} 591-doc_end 592 593-doc_begin="Flexible array members are deliberately used and XEN developers are aware of the dangers related to them: 594unexpected result when the structure is given as argument to a sizeof() operator and the truncation in assignment between structures." 595-config=MC3A2.R18.7,reports+={deliberate, "any()"} 596-doc_end 597 598# 599# Series 20. 600# 601 602-doc_begin="Code violating Rule 20.7 is safe when macro parameters are used: (1) 603as function arguments; (2) as macro arguments; (3) as array indices; (4) as lhs 604in assignments; (5) as initializers, possibly designated, in initalizer lists; 605(6) as the constant expression in a switch clause label." 606-config=MC3A2.R20.7,expansion_context= 607{safe, "context(__call_expr_arg_contexts)"}, 608{safe, "left_right(^[(,\\[]$,^[),\\]]$)"}, 609{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(array_subscript_expr), subscript)))"}, 610{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(operator(assign), lhs)))"}, 611{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(init_list_expr||designated_init_expr), init)))"}, 612{safe, "context(skip_to(__expr_non_syntactic_contexts, stmt_child(node(case_stmt), lower||upper)))"} 613-doc_end 614 615-doc_begin="Violations involving the __config_enabled macros cannot be fixed without 616breaking the macro's logic; futhermore, the macro is only ever used in the context 617of the IS_ENABLED or STATIC_IF/STATIC_IF_NOT macros, so it always receives a literal 6180 or 1 as input, posing no risk to safety." 619-config=MC3A2.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^___config_enabled$))))"} 620-doc_end 621 622-doc_begin="Violations due to the use of macros defined in files that are 623not in scope for compliance are allowed, as that is imported code." 624-file_tag+={gnu_efi_include, "^xen/include/efi/.*$"} 625-file_tag+={acpi_cpu_idle, "^xen/arch/x86/acpi/cpu_idle\\.c$"} 626-config=MC3A2.R20.7,reports+={safe, "any_area(any_loc(file(gnu_efi_include)||any_exp(macro(^NextMemoryDescriptor$))))"} 627-config=MC3A2.R20.7,reports+={safe, "any_area(any_loc(file(acpi_cpu_idle)))"} 628-doc_end 629 630-doc_begin="To avoid compromising readability, the macros alternative_(v)?call[0-9] are allowed 631not to parenthesize their arguments." 632-config=MC3A2.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^alternative_(v)?call[0-9]$))))"} 633-doc_end 634 635-doc_begin="The argument 'x' of the count_args_ macro can't be parenthesized as 636the rule would require, without breaking the functionality of the macro. The uses 637of this macro do not lead to developer confusion, and can thus be deviated." 638-config=MC3A2.R20.7,reports+={safe, "any_area(any_loc(any_exp(macro(^count_args_$))))"} 639-doc_end 640 641-doc_begin="The argument \"fn\" in macros {COMPILE,RUNTIME}_CHECK is not parenthesized 642on purpose, to be able to test function-like macros. Given the specialized and limited 643use of this macro, it is deemed ok to deviate them." 644-config=MC3A2.R20.7,reports+={deliberate, "any_area(any_loc(any_exp(macro(^(COMPILE_CHECK|RUNTIME_CHECK)$))))"} 645-doc_end 646 647-doc_begin="Problems related to operator precedence can not occur if the expansion of the macro argument is surrounded by tokens '{', '}' and ';'." 648-config=MC3A2.R20.7,expansion_context+={safe, "left_right(^[\\{;]$,^[;\\}]$)"} 649-doc_end 650 651-doc_begin="Uses of variadic macros that have one of their arguments defined as 652a macro and used within the body for both ordinary parameter expansion and as an 653operand to the # or ## operators have a behavior that is well-understood and 654deliberate." 655-config=MC3A2.R20.12,macros+={deliberate, "variadic()"} 656-doc_end 657 658-doc_begin="Uses of a macro parameter for ordinary expansion and as an operand 659to the # or ## operators within the following macros are deliberate, to provide 660useful diagnostic messages to the user." 661-config=MC3A2.R20.12,macros+={deliberate, "name(ASSERT||BUILD_BUG_ON||BUILD_BUG_ON_ZERO||RUNTIME_CHECK)"} 662-doc_end 663 664-doc_begin="The helper macro GENERATE_CASE may use a macro parameter for ordinary 665expansion and token pasting to improve readability. Only instances where this 666leads to a violation of the Rule are deviated." 667-file_tag+={deliberate_generate_case, "^xen/arch/arm/vcpreg\\.c$"} 668-config=MC3A2.R20.12,macros+={deliberate, "name(GENERATE_CASE)&&loc(file(deliberate_generate_case))"} 669-doc_end 670 671-doc_begin="The macro DEFINE is defined and used in excluded files asm-offsets.c. 672This may still cause violations if entities outside these files are referred to 673in the expansion." 674-config=MC3A2.R20.12,macros+={deliberate, "name(DEFINE)&&loc(file(asm_offsets))"} 675-doc_end 676 677# 678# Series 21. 679# 680 681-doc_begin="or, and and xor are reserved identifiers because they constitute alternate 682spellings for the corresponding operators (they are defined as macros by iso646.h). 683However, Xen doesn't use standard library headers, so there is no risk of overlap." 684-config=MC3A2.R21.2,reports+={safe, "any_area(stmt(ref(kind(label)&&^(or|and|xor|not)$)))"} 685-doc_end 686 687-doc_begin="Xen does not use the functions provided by the Standard Library, but 688implements a set of functions that share the same names as their Standard Library equivalent. 689The implementation of these functions is available in source form, so the undefined, unspecified 690or implementation-defined behaviors contemplated by the C Standard do not apply. 691If some undefined or unspecified behavior does arise in the implementation, it 692falls under the jurisdiction of other MISRA guidelines." 693-config=MC3A2.R21.6,reports+={deliberate, "any()"} 694-config=MC3A2.R21.9,reports+={deliberate, "any()"} 695-config=MC3A2.R21.10,reports+={deliberate, "any()"} 696-doc_end 697 698# 699# General 700# 701 702-doc_begin="do-while-[01] is a well recognized loop idiom by the xen community." 703-loop_idioms={do_stmt, "literal(0)||literal(1)"} 704-doc_end 705-doc_begin="while-[01] is a well recognized loop idiom by the xen community." 706-loop_idioms+={while_stmt, "literal(0)||literal(1)"} 707-doc_end 708 709# 710# Developer confusion 711# 712 713-doc="Selection for reports that are fully contained in adopted code." 714-report_selector+={adopted_report,"all_area(!kind(culprit||evidence)||all_loc(all_exp(adopted||pseudo)))"} 715 716-doc_begin="Adopted code is not meant to be read, reviewed or modified by human 717programmers:no developers' confusion is not possible. In addition, adopted code 718is assumed to work as is. Reports that are fully contained in adopted code are 719hidden/tagged with the 'adopted' tag." 720-service_selector={developer_confusion_guidelines,"^(MC3A2\\.R2\\.1|MC3A2\\.R2\\.2|MC3A2\\.R2\\.3|MC3A2\\.R2\\.4|MC3A2\\.R2\\.5|MC3A2\\.R2\\.6|MC3A2\\.R2\\.7|MC3A2\\.R4\\.1|MC3A2\\.R5\\.3|MC3A2\\.R5\\.6|MC3A2\\.R5\\.7|MC3A2\\.R5\\.8|MC3A2\\.R5\\.9|MC3A2\\.R7\\.1|MC3A2\\.R7\\.2|MC3A2\\.R7\\.3|MC3A2\\.R8\\.7|MC3A2\\.R8\\.8|MC3A2\\.R8\\.9|MC3A2\\.R8\\.11|MC3A2\\.R8\\.12|MC3A2\\.R8\\.13|MC3A2\\.R9\\.3|MC3A2\\.R9\\.4|MC3A2\\.R9\\.5|MC3A2\\.R10\\.2|MC3A2\\.R10\\.5|MC3A2\\.R10\\.6|MC3A2\\.R10\\.7|MC3A2\\.R10\\.8|MC3A2\\.R11\\.9|MC3A2\\.R12\\.1|MC3A2\\.R12\\.3|MC3A2\\.R12\\.4|MC3A2\\.R13\\.5|MC3A2\\.R14\\.1|MC3A2\\.R14\\.2|MC3A2\\.R14\\.3|MC3A2\\.R15\\.1|MC3A2\\.R15\\.2|MC3A2\\.R15\\.3|MC3A2\\.R15\\.4|MC3A2\\.R15\\.5|MC3A2\\.R15\\.6|MC3A2\\.R15\\.7|MC3A2\\.R16\\.1|MC3A2\\.R16\\.2|MC3A2\\.R16\\.3|MC3A2\\.R16\\.4|MC3A2\\.R16\\.5|MC3A2\\.R16\\.6|MC3A2\\.R16\\.7|MC3A2\\.R17\\.7|MC3A2\\.R17\\.8|MC3A2\\.R18\\.4|MC3A2\\.R18\\.5)$" 721} 722-config=developer_confusion_guidelines,reports+={relied,adopted_report} 723-doc_end 724