From d95f436c7dc6ccee68e1b77a3b01476ef41add55 Mon Sep 17 00:00:00 2001 From: Stefano Stabellini Date: Thu, 15 Jun 2023 14:19:22 -0700 Subject: [PATCH] docs/misra: new rules addition For Dir 1.1, a document describing all implementation-defined behaviour (i.e. gcc-specific behavior) will be added to docs/misra, also including implementation-specific (gcc-specific) appropriate types for bit-field relevant to Rule 6.1. Rule 21.21 is lacking an example on gitlab but the rule is straightforward: we don't use stdlib at all in Xen. Signed-off-by: Stefano Stabellini Reviewed-by: Michal Orzel Reviewed-by: Bertrand Marquis --- docs/misra/rules.rst | 50 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst index d5a6ee8cb6..a88c284e7d 100644 --- a/docs/misra/rules.rst +++ b/docs/misra/rules.rst @@ -40,6 +40,12 @@ existing codebase are work-in-progress. - Summary - Notes + * - `Dir 1.1 `_ + - Required + - Any implementation-defined behaviour on which the output of the + program depends shall be documented and understood + - + * - `Dir 2.1 `_ - Required - All source files shall compile without any compilation errors @@ -57,6 +63,13 @@ existing codebase are work-in-progress. header file being included more than once - + * - `Dir 4.11 `_ + - Required + - The validity of values passed to library functions shall be checked + - We do not have libraries in Xen (libfdt and others are not + considered libraries from MISRA C point of view as they are + imported in source form) + * - `Dir 4.14 `_ - Required - The validity of values received from external sources shall be @@ -133,6 +146,12 @@ existing codebase are work-in-progress. headers (xen/include/public/) are allowed to retain longer identifiers for backward compatibility. + * - `Rule 6.1 `_ + - Required + - Bit-fields shall only be declared with an appropriate type + - In addition to the C99 types, we also consider appropriate types + enum and all explicitly signed / unsigned integer types. + * - `Rule 6.2 `_ - Required - Single-bit named bit fields shall not be of a signed type @@ -143,6 +162,32 @@ existing codebase are work-in-progress. - Octal constants shall not be used - + * - `Rule 7.2 `_ + - Required + - A "u" or "U" suffix shall be applied to all integer constants + that are represented in an unsigned type + - The rule asks that any integer literal that is implicitly + unsigned is made explicitly unsigned by using one of the + indicated suffixes. As an example, on a machine where the int + type is 32-bit wide, 0x77777777 is signed whereas 0x80000000 is + (implicitly) unsigned. In order to comply with the rule, the + latter should be rewritten as either 0x80000000u or 0x80000000U. + Consistency considerations may suggest using the same suffix even + when not required by the rule. For instance, if one has: + + Original: f(0x77777777); f(0x80000000); + + one should do + + Solution 1: f(0x77777777U); f(0x80000000U); + + over + + Solution 2: f(0x77777777); f(0x80000000U); + + after having ascertained that "Solution 1" is compatible with the + intended semantics. + * - `Rule 7.3 `_ - Required - The lowercase character l shall not be used in a literal suffix @@ -314,6 +359,11 @@ existing codebase are work-in-progress. used following a subsequent call to the same function - + * - `Rule 21.21 `_ + - Required + - The Standard Library function system of shall not be used + - + * - `Rule 22.2 `_ - Mandatory - A block of memory shall only be freed if it was allocated by means of a