[PATCH v2] misra: deviate MISRA C Rule 10.1 for boolean operands of arithmetic

[Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>]

MISRA C Rule 10.1 states: "Operands shall not be of an inappropriate
essential type".

The result of relational, equality and logical negation operators has
type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5). An object
or function result of type bool has value 0 or 1 too, and it is
promoted to int (C99 6.3.1.2, 6.3.1.1p2). Using that value as an
operand of binary +, -, *, <<, >>, <, >, <=, >= and of +=, -=, *=,
<<=, >>= is well-defined. Division, remainder, unary plus and minus,
and the increment operators stay covered by the rule. Update the
ECLAIR configuration to tag the accepted uses as safe.

Update docs/misra/deviations.rst and rules.rst accordingly.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
---
Test CI pipeline:
https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/3048651323

Changes in v2:
- use the same operator list in the ECLAIR config, deviations.rst and rules.rst
- extend deviation to: +, -, *, +=, -=, *=, <<, >>, <<=, >>=, <, >, <=, >=
- leave the full explanation in deviations.rst, ECLAIR config doc only names 
the operators and points there

Link to v1:
https://patchew.org/Xen/a536212d9cb18b5c23d06c1c06b9a8ae03941440.1792428626.git.dmytro._5Fprokopchuk1@xxxxxxxx/
---
 .../eclair_analysis/ECLAIR/deviations.ecl     |  4 ++++
 docs/misra/deviations.rst                     | 20 +++++++++++++++++++
 docs/misra/rules.rst                          |  4 ++++
 3 files changed, 28 insertions(+)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 6cdb10a129..1d8f5ab657 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -335,6 +335,10 @@ still non-negative."
 -config=MC3A2.R10.1,etypes+={safe, 
"stmt(operator(logical)||node(conditional_operator||binary_conditional_operator))",
 "dst_type(ebool||boolean)"}
 -doc_end
 
+-doc_begin="A 0-or-1 Boolean operand of binary +, -, *, <<, >>, <, >, <=, >= 
and of +=, -=, *=, <<=, >>= is safe. See docs/misra/deviations.rst for the full 
explanation."
+-config=MC3A2.R10.1,etypes+={safe, 
"stmt(operator(add||sub||add_assign||sub_assign||mul||mul_assign||shl||shr||shl_assign||shr_assign||lt||gt||le||ge))",
 "src_type(ebool||boolean)"}
+-doc_end
+
 -doc_begin="The macro ISOLATE_LSB encapsulates a well-known pattern to obtain
 a mask where only the lowest bit set in the argument is set, if any, for 
unsigned
 integers arguments on two's complement architectures
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 6bcc2adf95..eb2f393ec5 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -347,6 +347,26 @@ Deviations related to MISRA C:2012 Rules:
        well-known to all Xen developers to be a comparison with 0.
      - Tagged as `safe` for ECLAIR.
 
+   * - R10.1
+     - The result of relational, equality and logical negation operators has
+       type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5). An object
+       or function result of type bool has value 0 or 1 too, and it is
+       promoted to int (C99 6.3.1.2, 6.3.1.1p2). Such a value is a
+       well-defined operand of the following operators. These are the operators
+       for which that 0-or-1 operand has a clear meaning. Binary + and -
+       (and += and -=) count something if the condition holds. \* (and \*=)
+       yields the other operand if the condition holds and 0 otherwise.
+       << and >> (and <<= and >>=) extend that selection to a shift: a Boolean
+       left operand contributes 0 or 1, and a Boolean right operand is a shift
+       count of 0 or 1. The operators <, >, <= and >= compare the same 0-or-1
+       value, so false compares less than true. / and % (and /= and %=) are
+       excluded. A Boolean divisor is 0 when the condition is false, and
+       division or remainder by zero is undefined behavior (C99 6.5.5p5).
+       Unary plus, unary minus, increment and decrement are excluded too:
+       unary minus yields 0 or -1, and none of these is one of the meanings
+       above, so the rule still applies to them.
+     - Tagged as `safe` for ECLAIR.
+
    * - R10.1
      - Xen only supports architectures where signed integers are representend
        using two's complement and all the Xen developers are aware of this. For
diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
index a59cf1782e..a7245be8c6 100644
--- a/docs/misra/rules.rst
+++ b/docs/misra/rules.rst
@@ -387,6 +387,10 @@ maintainers if you want to suggest a change.
            compilers' extensions)
          - Implicit conversions to boolean for conditionals (?: if while
            for) and logical operators (! || &&)
+         - Operands of essentially Boolean type (results of relational,
+           equality and logical negation operators, objects and function
+           results of type bool) used only with binary +, -, \*, <<, >>,
+           <, >, <=, >=, +=, -=, \*=, <<= and >>=
          - The essential type model allows the constants defined by anonymous
            enums (e.g., enum { A, B, C }) to be used as operands to arithmetic
            operators, as they have a signed essential type.
-- 
2.43.0