[PATCH 4/5] x86/shadow: split a nested max() invocation

[Jan Beulich <jbeulich@suse.com>]

Such nesting causes the inner instance to shadow the outer instance's
macro-local variables, thus violating Misra C:2012 rule 5.3 ("An
identifier declared in an inner scope shall not hide an identifier
declared in an outer scope"). Use an intermediate variable for the
inner invocation. No difference in generated code.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Supposedly this case is deviated (rules.rst). Does that deviation not work
quite right? Actually, am I mis-reading deviations.ecl or is the
respective setting only covering the combination of min() and max(), but
not multiple use of the same macro? Furthermore, why would e.g.
min(max_t(), ...) need a deviation? Even more generally, aren't those
expressions too permissive?

--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -767,11 +767,12 @@ static unsigned int sh_min_allocation(co
      * megabyte of RAM (for the p2m table, minimally enough for HVM's setting
      * up of slot zero and an LAPIC page), plus one for HVM's 1-to-1 pagetable.
      */
+    unsigned int extra = max(domain_tot_pages(d) / 256,
+                             is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0U) +
+                         is_hvm_domain(d);
+
     return shadow_min_acceptable_pages(d) +
-           max(max(domain_tot_pages(d) / 256,
-                   is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0U) +
-               is_hvm_domain(d),
-               d->arch.paging.p2m_pages);
+           max(extra, d->arch.paging.p2m_pages);
 }
 
 int shadow_set_allocation(struct domain *d, unsigned int pages, bool *preempted)