[PATCH] misra: deviate MISRA C Rule 10.1 for boolean operands of arithmetic

[Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>]

MISRA C Rule 10.1 states: "Operands shall not be of an inappropriate
essential type".

The result of relational, equality and logical negation operators has
type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5), so using
it as an operand of +, -, * and their assignment forms has well-defined
semantics.

Update ECLAIR configuration to tag such uses as safe.

Update deviations.rst and rules.rst accordingly.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
---
Current patch resolves all ARM Rule 10.1 violations (actually, there were only 
two),
and resolves around 55 x86 violations.

Test CI pipeline:
https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/2963748389
---
 automation/eclair_analysis/ECLAIR/deviations.ecl | 5 +++++
 docs/misra/deviations.rst                        | 6 ++++++
 docs/misra/rules.rst                             | 2 ++
 3 files changed, 13 insertions(+)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 6cdb10a129..8bfb1a0f89 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -335,6 +335,11 @@ still non-negative."
 -config=MC3A2.R10.1,etypes+={safe, 
"stmt(operator(logical)||node(conditional_operator||binary_conditional_operator))",
 "dst_type(ebool||boolean)"}
 -doc_end
 
+-doc_begin="The result of relational, equality and logical negation operators 
has type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5),
+so using it as an operand of an arithmetic operator is well defined and well 
known to all Xen developers."
+-config=MC3A2.R10.1,etypes+={safe, 
"stmt(operator(add||sub||mul||add_assign||sub_assign))", 
"src_type(ebool||boolean)"}
+-doc_end
+
 -doc_begin="The macro ISOLATE_LSB encapsulates a well-known pattern to obtain
 a mask where only the lowest bit set in the argument is set, if any, for 
unsigned
 integers arguments on two's complement architectures
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 6bcc2adf95..5aeb3ef9a3 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -347,6 +347,12 @@ Deviations related to MISRA C:2012 Rules:
        well-known to all Xen developers to be a comparison with 0.
      - Tagged as `safe` for ECLAIR.
 
+   * - R10.1
+     - The result of relational, equality and logical negation operators has
+       type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5), so using
+       it as an operand of an arithmetic operator has well-defined semantics.
+     - Tagged as `safe` for ECLAIR.
+
    * - R10.1
      - Xen only supports architectures where signed integers are representend
        using two's complement and all the Xen developers are aware of this. For
diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
index a59cf1782e..54b1cefba1 100644
--- a/docs/misra/rules.rst
+++ b/docs/misra/rules.rst
@@ -387,6 +387,8 @@ maintainers if you want to suggest a change.
            compilers' extensions)
          - Implicit conversions to boolean for conditionals (?: if while
            for) and logical operators (! || &&)
+         - Results of relational, equality and logical negation operators
+           (0 or 1) used as operands of arithmetic operators (+ - *)
          - The essential type model allows the constants defined by anonymous
            enums (e.g., enum { A, B, C }) to be used as operands to arithmetic
            operators, as they have a signed essential type.
-- 
2.43.0