MISRA C rules for Xen

The following are allowed:

• Invariantly constant conditions, e.g. if(IS_ENABLED(CONFIG_HVM)) { S; }
• Switch with a controlling value statically determined not to match one or more case statements
• Functions that are intended to be referenced only from assembly code (e.g. 'do_trap_fiq')
• asm-offsets.c, as they are not linked deliberately, because they are used to generate definitions for asm modules
• Declarations without initializer are safe, as they are not executed

Macros expanding to their own name are allowed, e.g.:

#define x x

Clashes between names of function-like macros and identifiers of non-callable entities are allowed. Callable entities having an identifier that is the same of the name of a function-like macro are not allowed. Example (not allowed):

#define f(x, y) f(x, y)
void f(int x, int y);

The following are allowed:

• Value-preserving conversions of integer constants
• Bitwise and, or, xor, one's complement, bitwise and assignment, bitwise or assignment, bitwise xor assignment (bitwise and, or, xor are safe on non-negative integers; also Xen assumes two's complement representation)
• Left shift, right shift, left shift assignment, right shift assignment (see C-language-toolchain.rst for uses of compilers' extensions)
• Implicit conversions to boolean for conditionals (?: if while for) and logical operators (! || &&)
• The essential type model allows the constants defined by anonymous enums (e.g., enum { A, B, C }) to be used as operands to arithmetic operators, as they have a signed essential type.

Please beware that this rule has many violations in the Xen codebase today, and its adoption is aspirational. However, when submitting new patches please try to decrease the number of violations when possible.

gcc has a helpful warning that can help you spot and remove violations of this kind: conversion. For instance, you can use it as follows:

CFLAGS="-Wconversion -Wno-error=sign-conversion -Wno-error=conversion" make -C xen

Switch statements with enums as controlling expression don't need a default label as gcc -Wall enables -Wswitch which warns (and breaks the build as we use -Werror) if one of the enum labels is missing from the switch.

Switch statements with integer types as controlling expression should have a default label:

• if the switch is expected to handle all possible cases explicitly, then a default label shall be added to handle unexpected error conditions, using BUG(), ASSERT(), WARN(), domain_crash(), or other appropriate methods;

• if the switch is expected to handle a subset of all possible cases, then an empty default label shall be added with an in-code comment on top of the default label with a reason and when possible a more detailed explanation. Example:

  default:
      /* Notifier pattern */
      break;