Re: [XEN PATCH] misra: merge the two R14.3 invariant-condition deviations

[Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>]

On 2026-10-26 04:03, Shuaidong Chen wrote:
> MC3A2.R14.3 ("Controlling expressions shall not be invariant") is
> deviated by two separate entries.  One covers 'if' statements and
> conditional operators and places no restriction on where the invariant
> condition comes from.  The other covers 'switch' statements, but only
> when the controlling expression is a 'sizeof' operator.
>
> The rationale recorded for the two is the same: the condition is
> deliberate.  Nothing about a 'switch' makes an invariant condition less
> deliberate than the same condition in an 'if', so the 'sizeof'
> restriction reads as an artefact of that entry having been added for
> read_atomic() and friends in arch/x86/include/asm/atomic.h rather than
> as a considered limit.
>
> Fold switch_stmt into the general entry and drop the 
> 'sizeof'-restricted
> one, which the general predicate now subsumes.  Invariant 'switch'
> conditions that are not a 'sizeof' become deliberate as a result; that
> is the intent.
>
> Signed-off-by: Shuaidong Chen <shuaidong.chen@xxxxxxx>
Assuming maintainers are ok with this relaxation:

Acked-by: Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>

> ---
>  automation/eclair_analysis/ECLAIR/deviations.ecl | 8 ++------
>  docs/misra/deviations.rst                        | 8 ++------
>  2 files changed, 4 insertions(+), 12 deletions(-)
>
> diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
> b/automation/eclair_analysis/ECLAIR/deviations.ecl
> index 7f3fd35a33d..08a88ddfa62 100644
> --- a/automation/eclair_analysis/ECLAIR/deviations.ecl
> +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
> @@ -472,12 +472,8 @@ activity."
>  -config=MC3A2.R14.2,reports+={disapplied,"any()"}
>  -doc_end
>
> --doc_begin="The XEN team relies on the fact that invariant conditions 
> of 'if' statements and conditional operators are deliberate"
> --config=MC3A2.R14.3,statements+={deliberate, 
> "wrapped(any(),node(if_stmt||conditional_operator||binary_conditional_operator))" 
> }
> --doc_end
> -
> --doc_begin="Switches having a 'sizeof' operator as the condition are 
> deliberate and have limited scope."
> --config=MC3A2.R14.3,statements+={deliberate, 
> "wrapped(any(),node(switch_stmt)&&child(cond, operator(sizeof)))" }
> +-doc_begin="The XEN team relies on the fact that invariant conditions 
> of 'if' statements, conditional operators and 'switch' statements are 
> deliberate"
> +-config=MC3A2.R14.3,statements+={deliberate, 
> "wrapped(any(),node(if_stmt||conditional_operator||binary_conditional_operator||switch_stmt))" 
> }
>  -doc_end
>
>  -doc_begin="The use of an invariant size argument in 
> {put,get}_unsafe_size and array_access_ok, as defined in 
> arch/x86(_64)?/include/asm/uaccess.h is deliberate and is deemed safe."
> diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
> index 32713172067..99a1b2332c2 100644
> --- a/docs/misra/deviations.rst
> +++ b/docs/misra/deviations.rst
> @@ -458,12 +458,8 @@ Deviations related to MISRA C:2012 Rules:
>
>     * - R14.3
>       - The Xen team relies on the fact that invariant conditions of 
> 'if'
> -       statements and conditional operators are deliberate.
> -     - Tagged as `deliberate` for ECLAIR.
> -
> -   * - R14.3
> -     - Switches having a 'sizeof' operator as the condition are 
> deliberate and
> -       have limited scope.
> +       statements, conditional operators and 'switch' statements are
> +       deliberate.
>       - Tagged as `deliberate` for ECLAIR.
>
>     * - R14.3
--
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253