[XEN PATCH v5 00/17] xen: address violation of MISRA C:2012 Directive 4.10

[XEN PATCH v5 00/17] xen: address violation of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

The Xen sources contain violations of MISRA C:2012 Directive 4.10 whose headline states:
"Precautions shall be taken in order to prevent the contents of a header file
being included more than once".

Following V2, V3 and V4, here are all the rules that have been applied:
- private headers -> <dir>__<filename>_H
- asm-generic headers -> ASM_GENERIC__<filename>_H
- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
- include/xen -> XEN__<filename>_H

Links to the discussions:
https://lists.xenproject.org/archives/html/xen-devel/2023-09/msg01928.html
https://lists.xenproject.org/archives/html/xen-devel/2023-10/msg01784.html
https://lists.xenproject.org/archives/html/xen-devel/2023-10/msg02073.html

Furthermore, the violations arising from the autogenerated header files
include/xen/compile.h and xen/hypercall-defs.h are addressed.

Changes in v5:
edit inclusion guard naming conventions, according to feedback received
edit inclusion guards in header files reflecting the naming convention
fix some rebasing mistakes left in the previous version

Changes in v4:
add/amend inclusion guards to address violations of the Directive and the new naming convention.
drop teh XEN_ prefix when needed, according to the feedback received.
add inclusion guard naming convention section in CODING_STYLE

Changes in v3:
Add/amend inclusion guards to address violations of the Directive and the new naming convention.
Remove trailing underscores.
Modify creation rule for asm-offsets.h to conform to the new standard and to not generate conflicting
guards between architectures (which is a violation of the Directive).

Alessandro Zucchelli (3):
  xen/build: address violation of MISRA C Directive 4.10
  CODING_STYLE: Add a section on header guards naming conventions
  include/asm-generic: rename inclusion guards for consistency

Maria Celeste Cesario (3):
  xen/arm: address violations of MISRA C:2012 Directive 4.10
  xen: address violations of MISRA C:2012 Directive 4.10
  xen/x86: rename inclusion guards for consistency

Nicola Vetrini (1):
  xen: add deviations for MISRA C 2012 Dir D4.10

Simone Ballarin (10):
  misra: add deviation for headers that explicitly avoid guards
  misra: modify deviations for empty and generated headers
  misra: add deviations for direct inclusion guards
  xen/arm: address violations of MISRA C:2012 Directive 4.10
  xen/x86: address violations of MISRA C:2012 Directive 4.10
  x86/EFI: address violations of MISRA C:2012 Directive 4.10
  xen/common: address violations of MISRA C:2012 Directive 4.10
  xen/efi: address violations of MISRA C:2012 Directive 4.10
  xen: address violations of MISRA C:2012 Directive 4.10
  x86/asm: address violations of MISRA C:2012 Directive 4.10

 CODING_STYLE                                  | 21 ++++++++++++
 .../eclair_analysis/ECLAIR/deviations.ecl     | 12 +++----
 docs/misra/deviations.rst                     |  6 ++++
 docs/misra/safe.json                          | 32 +++++++++++++++++++
 xen/arch/arm/efi/efi-boot.h                   |  6 ++++
 xen/arch/arm/efi/runtime.h                    |  1 +
 xen/arch/arm/include/asm/domain.h             |  6 ++--
 xen/arch/arm/include/asm/efibind.h            |  5 +++
 xen/arch/arm/include/asm/event.h              |  6 ++--
 xen/arch/arm/include/asm/grant_table.h        |  6 ++--
 xen/arch/arm/include/asm/hypercall.h          |  1 +
 xen/arch/arm/include/asm/io.h                 |  6 ++--
 xen/arch/arm/include/asm/irq.h                |  6 ++--
 xen/arch/arm/include/asm/smp.h                |  6 ++--
 xen/arch/arm/include/asm/spinlock.h           |  6 ++--
 xen/arch/arm/include/asm/system.h             |  6 ++--
 xen/arch/x86/Makefile                         |  9 +++---
 xen/arch/x86/cpu/cpu.h                        |  5 +++
 xen/arch/x86/efi/efi-boot.h                   |  5 +++
 xen/arch/x86/efi/runtime.h                    |  5 +++
 xen/arch/x86/include/asm/compat.h             |  5 +++
 xen/arch/x86/include/asm/cpufeatures.h        |  5 +--
 xen/arch/x86/include/asm/domain.h             |  6 ++--
 xen/arch/x86/include/asm/efibind.h            |  5 +++
 xen/arch/x86/include/asm/event.h              |  6 ++--
 xen/arch/x86/include/asm/grant_table.h        |  6 ++--
 xen/arch/x86/include/asm/hypercall.h          |  1 +
 xen/arch/x86/include/asm/io.h                 |  6 ++--
 xen/arch/x86/include/asm/irq.h                |  6 ++--
 xen/arch/x86/include/asm/smp.h                |  6 ++--
 xen/arch/x86/include/asm/spinlock.h           |  6 ++--
 xen/arch/x86/include/asm/system.h             |  6 ++--
 xen/arch/x86/x86_64/mmconfig.h                |  5 +++
 xen/arch/x86/x86_emulate/private.h            |  5 +++
 xen/build.mk                                  | 13 +++++---
 xen/common/decompress.h                       |  5 +++
 xen/common/efi/efi.h                          |  5 +++
 xen/common/event_channel.h                    |  5 +++
 xen/include/Makefile                          | 16 +++++++---
 xen/include/asm-generic/altp2m.h              |  6 ++--
 xen/include/asm-generic/atomic-ops.h          |  6 ++--
 xen/include/asm-generic/device.h              |  6 ++--
 xen/include/asm-generic/div64.h               |  6 ++--
 xen/include/asm-generic/hardirq.h             |  6 ++--
 xen/include/asm-generic/iocap.h               |  6 ++--
 xen/include/asm-generic/monitor.h             |  6 ++--
 xen/include/asm-generic/paging.h              |  6 ++--
 xen/include/asm-generic/percpu.h              |  6 ++--
 xen/include/asm-generic/random.h              |  6 ++--
 xen/include/asm-generic/softirq.h             |  6 ++--
 xen/include/asm-generic/vm_event.h            |  6 ++--
 xen/include/public/arch-x86/cpufeatureset.h   |  1 +
 xen/include/public/errno.h                    |  1 +
 xen/include/xen/err.h                         |  8 +++--
 xen/include/xen/pci_ids.h                     |  5 +++
 xen/include/xen/softirq.h                     |  8 +++--
 xen/include/xen/vmap.h                        |  8 +++--
 xen/scripts/Makefile.asm-generic              |  8 ++++-
 58 files changed, 268 insertions(+), 117 deletions(-)

-- 
2.34.1

[XEN PATCH v5 01/17] misra: add deviation for headers that explicitly avoid guards

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Some headers, under specific circumstances (documented in a comment at
the beginning of the file), explicitly do not have strict inclusion
guards: the caller is responsible for including them correctly.

These files are not supposed to comply with Directive 4.10:
"Precautions shall be taken in order to prevent the contents of a header
file being included more than once"

This patch adds deviation cooments for headers that avoid guards.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit deviation description
- edit commit message
Changes in v3:
- fix inconsistent deviation ID
- change comment-based deviation text
Changes in v2:
- use the format introduced with doc/misra/safe.json instead of
  a generic text-based deviation
---
 docs/misra/safe.json                        | 8 ++++++++
 xen/include/public/arch-x86/cpufeatureset.h | 1 +
 xen/include/public/errno.h                  | 1 +
 3 files changed, 10 insertions(+)

diff --git a/docs/misra/safe.json b/docs/misra/safe.json
index 3f18ef401c..44d1c4890e 100644
--- a/docs/misra/safe.json
+++ b/docs/misra/safe.json
@@ -68,6 +68,14 @@
         },
         {
             "id": "SAF-8-safe",
+            "analyser": {
+                "eclair": "MC3R1.D4.10"
+            },
+            "name": "Dir 4.10: headers that leave it up to the caller to include them correctly",
+            "text": "Headers that deliberatively leave the responsability of their correct inclusion to the caller are allowed."
+        },
+        {
+            "id": "SAF-9-safe",
             "analyser": {},
             "name": "Sentinel",
             "text": "Next ID to be used"
diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h
index d9eba5e9a7..3962ba9342 100644
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -23,6 +23,7 @@
  * their XEN_CPUFEATURE() being appropriate in the included context.
  */
 
+/* SAF-8-safe inclusion procedure left to caller */
 #ifndef XEN_CPUFEATURE
 
 /*
diff --git a/xen/include/public/errno.h b/xen/include/public/errno.h
index 5a78a7607c..b9fc6762fb 100644
--- a/xen/include/public/errno.h
+++ b/xen/include/public/errno.h
@@ -17,6 +17,7 @@
  * will unilaterally #undef XEN_ERRNO().
  */
 
+/* SAF-8-safe inclusion procedure left to caller */
 #ifndef XEN_ERRNO
 
 /*
-- 
2.34.1

[XEN PATCH v5 02/17] misra: modify deviations for empty and generated headers

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

This patch modifies deviations for Directive 4.10:
"Precautions shall be taken in order to prevent the contents of
a header file being included more than once"

This patch avoids the file-based deviation for empty headers, and
replaces it with a comment-based one using the format specified in
docs/misra/safe.json.

Generated headers are not generally safe against multi-inclusions,
whether a header is safe depends on the nature of the generated code
in the header. For that reason, this patch drops the deviation for
generated headers.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>

---
Changes in v4:
- rebased against current staging tree

Changes in v2:
- use the format introduced with doc/misra/safe.json instead of
  a file-based deviation for empty headers
- remove deviation for generated headers

The reason of moving the comment-based deviation in "runtime.h" is that
it should appear immediatly before the violation and, for files with no
tokens,	the location is the the last line of the file.
---
 automation/eclair_analysis/ECLAIR/deviations.ecl | 7 -------
 docs/misra/safe.json                             | 8 ++++++++
 xen/arch/arm/efi/runtime.h                       | 1 +
 xen/include/Makefile                             | 2 +-
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 0af1cb93d1..1c39a9a16d 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -72,13 +72,6 @@ they are not instances of commented-out code."
 -config=MC3R1.D4.3,reports+={deliberate, "any_area(any_loc(file(arm64_bitops))&&context(name(int_clear_mask16)))"}
 -doc_end
 
--doc_begin="This header file is autogenerated or empty, therefore it poses no
-risk if included more than once."
--file_tag+={empty_header, "^xen/arch/arm/efi/runtime\\.h$"}
--file_tag+={autogen_headers, "^xen/include/xen/compile\\.h$||^xen/include/generated/autoconf.h$||^xen/include/xen/hypercall-defs.h$"}
--config=MC3R1.D4.10,reports+={safe, "all_area(all_loc(file(empty_header||autogen_headers)))"}
--doc_end
-
 -doc_begin="Files that are intended to be included more than once do not need to
 conform to the directive."
 -config=MC3R1.D4.10,reports+={safe, "first_area(text(^/\\* This file is legitimately included multiple times\\. \\*/$, begin-4))"}
diff --git a/docs/misra/safe.json b/docs/misra/safe.json
index 44d1c4890e..ffa8bfdc4a 100644
--- a/docs/misra/safe.json
+++ b/docs/misra/safe.json
@@ -76,6 +76,14 @@
         },
         {
             "id": "SAF-9-safe",
+            "analyser": {
+                "eclair": "MC3R1.D4.10"
+            },
+            "name": "Dir 4.10: empty headers",
+            "text": "Empty headers pose no risk if included more than once."
+        },
+        {
+            "id": "SAF-10-safe",
             "analyser": {},
             "name": "Sentinel",
             "text": "Next ID to be used"
diff --git a/xen/arch/arm/efi/runtime.h b/xen/arch/arm/efi/runtime.h
index 25afcebed1..4d2d40bf3c 100644
--- a/xen/arch/arm/efi/runtime.h
+++ b/xen/arch/arm/efi/runtime.h
@@ -1 +1,2 @@
 /* Placeholder for ARM-specific runtime include/declarations */
+/* SAF-9-safe empty header */
diff --git a/xen/include/Makefile b/xen/include/Makefile
index 2e61b50139..058b0a566b 100644
--- a/xen/include/Makefile
+++ b/xen/include/Makefile
@@ -53,7 +53,7 @@ cmd_compat_h = \
     mv -f $@.new $@
 
 quiet_cmd_stub_h = GEN     $@
-cmd_stub_h = echo '/* empty */' >$@
+cmd_stub_h = echo '/* SAF-9-safe empty header */' >$@
 
 quiet_cmd_compat_i = CPP     $@
 cmd_compat_i = $(CPP) $(filter-out -Wa$(comma)% -include %/include/xen/config.h,$(XEN_CFLAGS)) $(cppflags-y) -o $@ $<
-- 
2.34.1

[XEN PATCH v5 03/17] misra: add deviations for direct inclusion guards

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add deviation comments to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Inclusion guards must appear at the beginning of the headers
(comments are permitted anywhere).

This patch adds deviation comments using the format specified
in docs/misra/safe.json for headers with just the direct
inclusion guard before the inclusion guard since they are
safe and not supposed to comply with the directive.

Note that with SAF-10-safe in place, failures to have proper guards later
in the header files will not be reported

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

---
Changes in v5:
- rebase against the current staging tree

Changes in v4:
- Added comment clarifying that no further checks will be performed
on a file that has a SAF-10-safe deviation against missing inclusion
guards.
- rebased against the current staging tree

Changes in v3:
- fix inconsistent deviation ID
The patch has been introduced in v2.
---
 docs/misra/safe.json                 | 8 ++++++++
 xen/arch/arm/include/asm/hypercall.h | 1 +
 xen/arch/x86/include/asm/hypercall.h | 1 +
 3 files changed, 10 insertions(+)

diff --git a/docs/misra/safe.json b/docs/misra/safe.json
index ffa8bfdc4a..684346386e 100644
--- a/docs/misra/safe.json
+++ b/docs/misra/safe.json
@@ -84,6 +84,14 @@
         },
         {
             "id": "SAF-10-safe",
+            "analyser": {
+                "eclair": "MC3R1.D4.10"
+            },
+            "name": "Dir 4.10: direct inclusion guard before",
+            "text": "Headers with just the direct inclusion guard before the inclusion guard are safe."
+        },
+        {
+            "id": "SAF-11-safe",
             "analyser": {},
             "name": "Sentinel",
             "text": "Next ID to be used"
diff --git a/xen/arch/arm/include/asm/hypercall.h b/xen/arch/arm/include/asm/hypercall.h
index ccd26c5184..07e231f8b5 100644
--- a/xen/arch/arm/include/asm/hypercall.h
+++ b/xen/arch/arm/include/asm/hypercall.h
@@ -1,3 +1,4 @@
+/* SAF-10-safe direct inclusion guard before */
 #ifndef __XEN_HYPERCALL_H__
 #error "asm/hypercall.h should not be included directly - include xen/hypercall.h instead"
 #endif
diff --git a/xen/arch/x86/include/asm/hypercall.h b/xen/arch/x86/include/asm/hypercall.h
index ec2edc771e..389fa62af2 100644
--- a/xen/arch/x86/include/asm/hypercall.h
+++ b/xen/arch/x86/include/asm/hypercall.h
@@ -2,6 +2,7 @@
  * asm-x86/hypercall.h
  */
 
+/* SAF-10-safe direct inclusion guard before */
 #ifndef __XEN_HYPERCALL_H__
 #error "asm/hypercall.h should not be included directly - include xen/hypercall.h instead"
 #endif
-- 
2.34.1

[XEN PATCH v5 04/17] xen/arm: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add inclusion guard to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Mechanical change.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

---
Changes in v5:
- edit inclusion guard, according to the feedback received
Changes in v4:
- Dropped ARCH_ string from the guard, according to the
feedback received
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- drop changes in xen/arch/arm/include/asm/hypercall.h
- drop changes in xen/arch/arm/include/asm/iocap.h since they are
  not related with the directive
---
 xen/arch/arm/efi/efi-boot.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/arm/efi/efi-boot.h b/xen/arch/arm/efi/efi-boot.h
index 199f526022..612c20f96f 100644
--- a/xen/arch/arm/efi/efi-boot.h
+++ b/xen/arch/arm/efi/efi-boot.h
@@ -3,6 +3,10 @@
  * is intended to be included by common/efi/boot.c _only_, and
  * therefore can define arch specific global variables.
  */
+
+#ifndef ARM__EFI__EFI_BOOT_H
+#define ARM__EFI__EFI_BOOT_H
+
 #include <xen/device_tree.h>
 #include <xen/libfdt/libfdt.h>
 #include <asm/setup.h>
@@ -992,6 +996,8 @@ static void __init efi_arch_flush_dcache_area(const void *vaddr, UINTN size)
     __flush_dcache_area(vaddr, size);
 }
 
+#endif /* ARM__EFI__EFI_BOOT_H */
+
 /*
  * Local variables:
  * mode: C
-- 
2.34.1

[XEN PATCH v5 05/17] xen/x86: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add or move inclusion guards to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Inclusion guards must appear at the beginning of the headers
(comments are permitted anywhere).

Mechanical change.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- remove hard tab that slipped in the makefile
- edit inclusion guards and makefile
Changes in v4:
- modified inclusion guards and makefile.
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- remove extra blanks
- drop changes in C files

Note:
Changes in Makefile were not strictly necessary in v1 and a maintainer
asked to removing them since there was a deviation for generated headers.
Now, in v2, they are required since the deviation has been removed by
another patch of this series.
---
 xen/arch/x86/Makefile              | 9 +++++----
 xen/arch/x86/cpu/cpu.h             | 5 +++++
 xen/arch/x86/x86_64/mmconfig.h     | 5 +++++
 xen/arch/x86/x86_emulate/private.h | 5 +++++
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index d902fb7acc..31197dfd96 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -260,17 +260,18 @@ $(objtree)/arch/x86/include/asm/asm-macros.h: $(obj)/asm-macros.i $(src)/Makefil
 	$(call filechk,asm-macros.h)
 
 define filechk_asm-macros.h
+    guard=$$(echo ASM__${SRCARCH}__ASM_MACROS_H | tr a-z A-Z);  \
+    echo '#ifndef $$guard'; \
+    echo '#define $$guard'; \
     echo '#if 0'; \
     echo '.if 0'; \
     echo '#endif'; \
-    echo '#ifndef __ASM_MACROS_H__'; \
-    echo '#define __ASM_MACROS_H__'; \
     echo 'asm ( ".include \"$@\"" );'; \
-    echo '#endif /* __ASM_MACROS_H__ */'; \
     echo '#if 0'; \
     echo '.endif'; \
     cat $<; \
-    echo '#endif'
+    echo '#endif'; \
+    echo '#endif /* $$guard */'
 endef
 
 $(obj)/efi.lds: AFLAGS-y += -DEFI
diff --git a/xen/arch/x86/cpu/cpu.h b/xen/arch/x86/cpu/cpu.h
index 8be65e975a..8e52f24e10 100644
--- a/xen/arch/x86/cpu/cpu.h
+++ b/xen/arch/x86/cpu/cpu.h
@@ -1,3 +1,6 @@
+#ifndef X86__CPU__CPU_H
+#define X86__CPU__CPU_H
+
 /* attempt to consolidate cpu attributes */
 struct cpu_dev {
 	void		(*c_early_init)(struct cpuinfo_x86 *c);
@@ -26,3 +29,5 @@ void amd_init_spectral_chicken(void);
 void detect_zen2_null_seg_behaviour(void);
 
 void intel_unlock_cpuid_leaves(struct cpuinfo_x86 *c);
+
+#endif /* X86__CPU__CPU_H */
diff --git a/xen/arch/x86/x86_64/mmconfig.h b/xen/arch/x86/x86_64/mmconfig.h
index 3da4b21e9b..0b51d2179e 100644
--- a/xen/arch/x86/x86_64/mmconfig.h
+++ b/xen/arch/x86/x86_64/mmconfig.h
@@ -5,6 +5,9 @@
  * Author: Allen Kay <allen.m.kay@intel.com> - adapted from linux
  */
 
+#ifndef X86__X86_64__MMCONFIG_H
+#define X86__X86_64__MMCONFIG_H
+
 #define PCI_DEVICE_ID_INTEL_E7520_MCH    0x3590
 #define PCI_DEVICE_ID_INTEL_82945G_HB    0x2770
 
@@ -72,3 +75,5 @@ int pci_mmcfg_reserved(uint64_t address, unsigned int segment,
 int pci_mmcfg_arch_init(void);
 int pci_mmcfg_arch_enable(unsigned int idx);
 void pci_mmcfg_arch_disable(unsigned int idx);
+
+#endif /* X86__X86_64__MMCONFIG_H */
diff --git a/xen/arch/x86/x86_emulate/private.h b/xen/arch/x86/x86_emulate/private.h
index 0fa26ba00a..940d511b06 100644
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -6,6 +6,9 @@
  * Copyright (c) 2005-2007 XenSource Inc.
  */
 
+#ifndef X86__X86_EMULATE__PRIVATE_H
+#define X86__X86_EMULATE__PRIVATE_H
+
 #ifdef __XEN__
 
 # include <xen/bug.h>
@@ -836,3 +839,5 @@ static inline int read_ulong(enum x86_segment seg,
     *val = 0;
     return ops->read(seg, offset, val, bytes, ctxt);
 }
+
+#endif /* X86__X86_EMULATE__PRIVATE_H */
-- 
2.34.1

[XEN PATCH v5 06/17] x86/EFI: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add inclusion guard to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Mechanical change.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

---
Changes in v5:
- Remove double blank lines
- edit inclusion guards
Changes in v4:
- Modified inclusion guard.
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- remove changes in "xen/arch/x86/efi/efi-boot.h"
---
 xen/arch/x86/efi/efi-boot.h | 5 +++++
 xen/arch/x86/efi/runtime.h  | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/xen/arch/x86/efi/efi-boot.h b/xen/arch/x86/efi/efi-boot.h
index f282358435..4f7b7b67dc 100644
--- a/xen/arch/x86/efi/efi-boot.h
+++ b/xen/arch/x86/efi/efi-boot.h
@@ -3,6 +3,9 @@
  * is intended to be included by common/efi/boot.c _only_, and
  * therefore can define arch specific global variables.
  */
+#ifndef X86__EFI__EFI_BOOT_H
+#define X86__EFI__EFI_BOOT_H
+
 #include <xen/vga.h>
 #include <asm/e820.h>
 #include <asm/edd.h>
@@ -912,6 +915,8 @@ void asmlinkage __init efi_multiboot2(EFI_HANDLE ImageHandle,
     efi_exit_boot(ImageHandle, SystemTable);
 }
 
+#endif /* X86__EFI__EFI_BOOT_H */
+
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/x86/efi/runtime.h b/xen/arch/x86/efi/runtime.h
index 77866c5f21..c88c0a6bbd 100644
--- a/xen/arch/x86/efi/runtime.h
+++ b/xen/arch/x86/efi/runtime.h
@@ -1,3 +1,6 @@
+#ifndef X86__EFI__RUNTIME_H
+#define X86__EFI__RUNTIME_H
+
 #include <xen/domain_page.h>
 #include <xen/mm.h>
 #include <asm/atomic.h>
@@ -17,3 +20,5 @@ void efi_update_l4_pgtable(unsigned int l4idx, l4_pgentry_t l4e)
     }
 }
 #endif
+
+#endif /* X86__EFI__RUNTIME_H */
-- 
2.34.1

[XEN PATCH v5 07/17] xen/common: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add inclusion guards to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Mechanical change.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guards
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- drop changes in C files
---
 xen/common/decompress.h    | 5 +++++
 xen/common/event_channel.h | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/xen/common/decompress.h b/xen/common/decompress.h
index e8195b353a..2d5a99451d 100644
--- a/xen/common/decompress.h
+++ b/xen/common/decompress.h
@@ -1,3 +1,6 @@
+#ifndef COMMON__DECOMPRESS_H
+#define COMMON__DECOMPRESS_H
+
 #ifdef __XEN__
 
 #include <xen/cache.h>
@@ -23,3 +26,5 @@
 #define large_free free
 
 #endif
+
+#endif /* COMMON__DECOMPRESS_H */
diff --git a/xen/common/event_channel.h b/xen/common/event_channel.h
index 45219ca67c..3a8c240b40 100644
--- a/xen/common/event_channel.h
+++ b/xen/common/event_channel.h
@@ -1,5 +1,8 @@
 /* Event channel handling private header. */
 
+#ifndef COMMON__EVENT_CHANNEL_H
+#define COMMON__EVENT_CHANNEL_H
+
 #include <xen/event.h>
 
 static inline unsigned int max_evtchns(const struct domain *d)
@@ -52,6 +55,8 @@ int evtchn_fifo_init_control(struct evtchn_init_control *init_control);
 int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array);
 void evtchn_fifo_destroy(struct domain *d);
 
+#endif /* COMMON__EVENT_CHANNEL_H */
+
 /*
  * Local variables:
  * mode: C
-- 
2.34.1

[XEN PATCH v5 08/17] xen/efi: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Add inclusion guards to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Mechanical change.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guard
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- drop changes in C files
---
 xen/common/efi/efi.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/xen/common/efi/efi.h b/xen/common/efi/efi.h
index c02fbb7b69..3876d15207 100644
--- a/xen/common/efi/efi.h
+++ b/xen/common/efi/efi.h
@@ -1,3 +1,6 @@
+#ifndef COMMON__EFI__EFI_H
+#define COMMON__EFI__EFI_H
+
 #include <asm/efibind.h>
 #include <efi/efidef.h>
 #include <efi/efierr.h>
@@ -51,3 +54,5 @@ void free_ebmalloc_unused_mem(void);
 
 const void *pe_find_section(const void *image, const UINTN image_size,
                             const CHAR16 *section_name, UINTN *size_out);
+
+#endif /* COMMON__EFI__EFI_H */
-- 
2.34.1

[XEN PATCH v5 09/17] xen: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Amend inclusion guards to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

Inclusion guards must appear at the beginning of the headers
(comments are permitted anywhere) and the #if directive cannot
be used for other checks.

Mechanical change.

Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Acked-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guards, according to the feedback received
Changes in v3:
- remove trailing underscores
- change inclusion guard name to adhere to the new standard
Changes in v2:
- drop changes in xen/include/xen/unaligned.h since this second
  series adds a comment-based deviation in a separate patch
- use #ifndef instead of #if !defined()
---
 xen/include/xen/err.h     | 8 +++++---
 xen/include/xen/pci_ids.h | 5 +++++
 xen/include/xen/softirq.h | 8 +++++---
 xen/include/xen/vmap.h    | 8 +++++---
 4 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/xen/include/xen/err.h b/xen/include/xen/err.h
index cbdd1bf7f8..45988e0cbb 100644
--- a/xen/include/xen/err.h
+++ b/xen/include/xen/err.h
@@ -1,5 +1,6 @@
-#if !defined(__XEN_ERR_H__) && !defined(__ASSEMBLY__)
-#define __XEN_ERR_H__
+#ifndef XEN__ERR_H
+#define XEN__ERR_H
+#ifndef __ASSEMBLY__
 
 #include <xen/compiler.h>
 #include <xen/errno.h>
@@ -41,4 +42,5 @@ static inline int __must_check PTR_RET(const void *ptr)
 	return IS_ERR(ptr) ? PTR_ERR(ptr) : 0;
 }
 
-#endif /* __XEN_ERR_H__ */
+#endif /* __ASSEMBLY__ */
+#endif /* XEN__ERR_H */
diff --git a/xen/include/xen/pci_ids.h b/xen/include/xen/pci_ids.h
index e798477a7e..7f74954d6a 100644
--- a/xen/include/xen/pci_ids.h
+++ b/xen/include/xen/pci_ids.h
@@ -1,3 +1,6 @@
+#ifndef XEN__PCI_IDS_H
+#define XEN__PCI_IDS_H
+
 #define PCI_VENDOR_ID_AMD                0x1022
 
 #define PCI_VENDOR_ID_NVIDIA             0x10de
@@ -11,3 +14,5 @@
 #define PCI_VENDOR_ID_BROADCOM           0x14e4
 
 #define PCI_VENDOR_ID_INTEL              0x8086
+
+#endif /* XEN__PCI_IDS_H */
diff --git a/xen/include/xen/softirq.h b/xen/include/xen/softirq.h
index 33d6f2ecd2..5fd57160df 100644
--- a/xen/include/xen/softirq.h
+++ b/xen/include/xen/softirq.h
@@ -1,5 +1,6 @@
-#if !defined(__XEN_SOFTIRQ_H__) && !defined(__ASSEMBLY__)
-#define __XEN_SOFTIRQ_H__
+#ifndef XEN__SOFTIRQ_H
+#define XEN__SOFTIRQ_H
+#ifndef __ASSEMBLY__
 
 /* Low-latency softirqs come first in the following list. */
 enum {
@@ -40,4 +41,5 @@ void cpu_raise_softirq_batch_finish(void);
  */
 void process_pending_softirqs(void);
 
-#endif /* __XEN_SOFTIRQ_H__ */
+#endif /* __ASSEMBLY__ */
+#endif /* XEN__SOFTIRQ_H */
diff --git a/xen/include/xen/vmap.h b/xen/include/xen/vmap.h
index 0c16baa85f..a8475bd05b 100644
--- a/xen/include/xen/vmap.h
+++ b/xen/include/xen/vmap.h
@@ -1,5 +1,6 @@
-#if !defined(__XEN_VMAP_H__) && defined(VMAP_VIRT_START)
-#define __XEN_VMAP_H__
+#ifndef XEN__VMAP_H
+#define XEN__VMAP_H
+#ifdef VMAP_VIRT_START
 
 #include <xen/mm-frame.h>
 #include <xen/page-size.h>
@@ -42,4 +43,5 @@ static inline void vm_init(void)
     vm_init_type(VMAP_DEFAULT, (void *)VMAP_VIRT_START, arch_vmap_virt_end());
 }
 
-#endif /* __XEN_VMAP_H__ */
+#endif /* VMAP_VIRT_START */
+#endif /* XEN__VMAP_H */
-- 
2.34.1

[XEN PATCH v5 10/17] x86/asm: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Simone Ballarin <simone.ballarin@bugseng.com>

Amend generation script, add inclusion guards to address violations
of MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
to prevent the contents of a header file being included more than
once").

This patch amends the Makefile adding the required inclusion guards
for xlat.h.

Add deviation comment for files intended for multiple inclusion.

Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- rebase against current staging tree
- remove an unused path in Makefile that was mistakenly left in
- edit inclusion guards, according to feedback received
Changes in v4:
- changed guard creation for autogenerated headers in Makefile
Changes in v3:
- fix inconsistent deviation ID
- remove trailing underscores
Changes in v2:
- merge patches 7/13 and 13/13 of v1 as they had the same
  commit message
- amend the Makefile to produce the required inclusion guard
- use the format introduced with doc/misra/safe.json instead of
  a generic text-based deviation
---
 docs/misra/safe.json                   | 8 ++++++++
 xen/arch/x86/include/asm/compat.h      | 5 +++++
 xen/arch/x86/include/asm/cpufeatures.h | 5 +----
 xen/arch/x86/include/asm/efibind.h     | 5 +++++
 xen/include/Makefile                   | 9 +++++++--
 5 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/docs/misra/safe.json b/docs/misra/safe.json
index 684346386e..6ede5c91c2 100644
--- a/docs/misra/safe.json
+++ b/docs/misra/safe.json
@@ -92,6 +92,14 @@
         },
         {
             "id": "SAF-11-safe",
+            "analyser": {
+                "eclair": "MC3R1.D4.10"
+            },
+            "name": "Dir 4.10: file intended for multiple inclusion",
+            "text": "Files intended for multiple inclusion are not supposed to comply with D4.10."
+        },
+        {
+            "id": "SAF-12-safe",
             "analyser": {},
             "name": "Sentinel",
             "text": "Next ID to be used"
diff --git a/xen/arch/x86/include/asm/compat.h b/xen/arch/x86/include/asm/compat.h
index 818cad87db..98ed170b95 100644
--- a/xen/arch/x86/include/asm/compat.h
+++ b/xen/arch/x86/include/asm/compat.h
@@ -2,6 +2,9 @@
  * compat.h
  */
 
+#ifndef ASM__X86__COMPAT_H
+#define ASM__X86__COMPAT_H
+
 #ifdef CONFIG_COMPAT
 
 #define COMPAT_BITS_PER_LONG 32
@@ -18,3 +21,5 @@ int switch_compat(struct domain *);
 #include <xen/errno.h>
 static inline int switch_compat(struct domain *d) { return -EOPNOTSUPP; }
 #endif
+
+#endif /* ASM__X86__COMPAT_H */
diff --git a/xen/arch/x86/include/asm/cpufeatures.h b/xen/arch/x86/include/asm/cpufeatures.h
index ba3df174b7..d590fe31ea 100644
--- a/xen/arch/x86/include/asm/cpufeatures.h
+++ b/xen/arch/x86/include/asm/cpufeatures.h
@@ -1,7 +1,4 @@
-/*
- * Explicitly intended for multiple inclusion.
- */
-
+/* SAF-11-safe file intended for multiple inclusion */
 #include <xen/lib/x86/cpuid-autogen.h>
 
 /* Number of capability words covered by the featureset words. */
diff --git a/xen/arch/x86/include/asm/efibind.h b/xen/arch/x86/include/asm/efibind.h
index bce02f3707..57c712748a 100644
--- a/xen/arch/x86/include/asm/efibind.h
+++ b/xen/arch/x86/include/asm/efibind.h
@@ -1,2 +1,7 @@
+#ifndef ASM__X86__EFIBIND_H
+#define ASM__X86__EFIBIND_H
+
 #include <xen/types.h>
 #include <asm/x86_64/efibind.h>
+
+#endif /* ASM__X86__EFIBIND_H */
diff --git a/xen/include/Makefile b/xen/include/Makefile
index 058b0a566b..1ff9468eeb 100644
--- a/xen/include/Makefile
+++ b/xen/include/Makefile
@@ -105,9 +105,14 @@ xlat-y := $(shell sed -ne 's,@arch@,$(compat-arch-y),g' -re 's,^[?!][[:blank:]]+
 xlat-y := $(filter $(patsubst compat/%,%,$(headers-y)),$(xlat-y))
 
 quiet_cmd_xlat_h = GEN     $@
-cmd_xlat_h = \
-	cat $(filter %.h,$^) >$@.new; \
+define cmd_xlat_h
+	guard=$$(echo ASM__${SRCARCH}__COMPAT__XLAT_H | tr a-z A-Z); \
+	echo "#ifndef $$guard" > $@.new; \
+	echo "#define $$guard" >> $@.new; \
+	cat $(filter %.h,$^) >> $@.new; \
+	echo "#endif /* $$guard */" >> $@.new; \
 	mv -f $@.new $@
+endef
 
 $(obj)/compat/xlat.h: $(addprefix $(obj)/compat/.xlat/,$(xlat-y)) FORCE
 	$(call if_changed,xlat_h)
-- 
2.34.1

[XEN PATCH v5 11/17] xen/arm: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>

Add or modify inclusion guards to address violations of
MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order to
prevent the contents of a header file being included more than once").
Mechanical change.

Signed-off-by: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

--
Change in v5:
- edit inclusion guards, according to feedback received
Changes in v4:
- fix typo in include guard for arm efibind

Commit introduced in v3
---
 xen/arch/arm/include/asm/domain.h      | 6 +++---
 xen/arch/arm/include/asm/efibind.h     | 5 +++++
 xen/arch/arm/include/asm/event.h       | 6 +++---
 xen/arch/arm/include/asm/grant_table.h | 6 +++---
 xen/arch/arm/include/asm/io.h          | 6 +++---
 xen/arch/arm/include/asm/irq.h         | 6 +++---
 xen/arch/arm/include/asm/smp.h         | 6 +++---
 xen/arch/arm/include/asm/spinlock.h    | 6 +++---
 xen/arch/arm/include/asm/system.h      | 6 +++---
 9 files changed, 29 insertions(+), 24 deletions(-)

diff --git a/xen/arch/arm/include/asm/domain.h b/xen/arch/arm/include/asm/domain.h
index f1d72c6e48..f27353d9c8 100644
--- a/xen/arch/arm/include/asm/domain.h
+++ b/xen/arch/arm/include/asm/domain.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_DOMAIN_H__
-#define __ASM_DOMAIN_H__
+#ifndef ASM__ARM__DOMAIN_H
+#define ASM__ARM__DOMAIN_H
 
 #include <xen/cache.h>
 #include <xen/timer.h>
@@ -310,7 +310,7 @@ static inline void update_guest_memory_policy(struct vcpu *v,
                                               struct guest_memory_policy *gmp)
 {}
 
-#endif /* __ASM_DOMAIN_H__ */
+#endif /* ASM__ARM__DOMAIN_H */
 
 /*
  * Local variables:
diff --git a/xen/arch/arm/include/asm/efibind.h b/xen/arch/arm/include/asm/efibind.h
index 09dca7a8c9..88e0307ef1 100644
--- a/xen/arch/arm/include/asm/efibind.h
+++ b/xen/arch/arm/include/asm/efibind.h
@@ -1,2 +1,7 @@
+#ifndef ASM__ARM__EFIBIND_H
+#define ASM__ARM__EFIBIND_H
+
 #include <xen/types.h>
 #include <asm/arm64/efibind.h>
+
+#endif /* ASM__ARM__EFIBIND_H */
diff --git a/xen/arch/arm/include/asm/event.h b/xen/arch/arm/include/asm/event.h
index b14c166ad6..c495994437 100644
--- a/xen/arch/arm/include/asm/event.h
+++ b/xen/arch/arm/include/asm/event.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_EVENT_H__
-#define __ASM_EVENT_H__
+#ifndef ASM__ARM__EVENT_H
+#define ASM__ARM__EVENT_H
 
 #include <asm/domain.h>
 
@@ -52,7 +52,7 @@ static inline bool arch_virq_is_global(unsigned int virq)
     return true;
 }
 
-#endif
+#endif /* ASM__ARM__EVENT_H */
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/arm/include/asm/grant_table.h b/xen/arch/arm/include/asm/grant_table.h
index d3c518a926..b104fc890c 100644
--- a/xen/arch/arm/include/asm/grant_table.h
+++ b/xen/arch/arm/include/asm/grant_table.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_GRANT_TABLE_H__
-#define __ASM_GRANT_TABLE_H__
+#ifndef ASM__ARM__GRANT_TABLE_H
+#define ASM__ARM__GRANT_TABLE_H
 
 #include <xen/grant_table.h>
 #include <xen/kernel.h>
@@ -76,7 +76,7 @@ int replace_grant_host_mapping(uint64_t gpaddr, mfn_t frame,
 #define gnttab_need_iommu_mapping(d)                    \
     (is_domain_direct_mapped(d) && is_iommu_enabled(d))
 
-#endif /* __ASM_GRANT_TABLE_H__ */
+#endif /* ASM__ARM__GRANT_TABLE_H */
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/arm/include/asm/io.h b/xen/arch/arm/include/asm/io.h
index e426804424..837c864fac 100644
--- a/xen/arch/arm/include/asm/io.h
+++ b/xen/arch/arm/include/asm/io.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_IO_H
-#define _ASM_IO_H
+#ifndef ASM__ARM__IO_H
+#define ASM__ARM__IO_H
 
 #if defined(CONFIG_ARM_32)
 # include <asm/arm32/io.h>
@@ -9,7 +9,7 @@
 # error "unknown ARM variant"
 #endif
 
-#endif
+#endif /* ASM__ARM__IO_H */
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/arm/include/asm/irq.h b/xen/arch/arm/include/asm/irq.h
index ec437add09..019147ef11 100644
--- a/xen/arch/arm/include/asm/irq.h
+++ b/xen/arch/arm/include/asm/irq.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_HW_IRQ_H
-#define _ASM_HW_IRQ_H
+#ifndef ASM__ARM__IRQ_H
+#define ASM__ARM__IRQ_H
 
 #include <xen/device_tree.h>
 #include <public/device_tree_defs.h>
@@ -101,7 +101,7 @@ bool irq_type_set_by_domain(const struct domain *d);
 void irq_end_none(struct irq_desc *irq);
 #define irq_end_none irq_end_none
 
-#endif /* _ASM_HW_IRQ_H */
+#endif /* ASM__ARM__IRQ_H */
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/arm/include/asm/smp.h b/xen/arch/arm/include/asm/smp.h
index e99a3a3f53..1a3088dfb9 100644
--- a/xen/arch/arm/include/asm/smp.h
+++ b/xen/arch/arm/include/asm/smp.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_SMP_H
-#define __ASM_SMP_H
+#ifndef ASM__ARM__SMP_H
+#define ASM__ARM__SMP_H
 
 #ifndef __ASSEMBLY__
 #include <xen/cpumask.h>
@@ -39,7 +39,7 @@ extern unsigned int smp_get_max_cpus(void);
 
 #define cpu_physical_id(cpu) cpu_logical_map(cpu)
 
-#endif
+#endif /* ASM__ARM__SMP_H */
 
 /*
  * Local variables:
diff --git a/xen/arch/arm/include/asm/spinlock.h b/xen/arch/arm/include/asm/spinlock.h
index 42b0f584fe..b1fd46336f 100644
--- a/xen/arch/arm/include/asm/spinlock.h
+++ b/xen/arch/arm/include/asm/spinlock.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_SPINLOCK_H
-#define __ASM_SPINLOCK_H
+#ifndef ASM__ARM__SPINLOCK_H
+#define ASM__ARM__SPINLOCK_H
 
 #define arch_lock_acquire_barrier() smp_mb()
 #define arch_lock_release_barrier() smp_mb()
@@ -12,4 +12,4 @@
 
 #define arch_lock_signal_wmb()  arch_lock_signal()
 
-#endif /* __ASM_SPINLOCK_H */
+#endif /* ASM__ARM__SPINLOCK_H */
diff --git a/xen/arch/arm/include/asm/system.h b/xen/arch/arm/include/asm/system.h
index 65d5c8e423..cf548089d8 100644
--- a/xen/arch/arm/include/asm/system.h
+++ b/xen/arch/arm/include/asm/system.h
@@ -1,6 +1,6 @@
 /* Portions taken from Linux arch arm */
-#ifndef __ASM_SYSTEM_H
-#define __ASM_SYSTEM_H
+#ifndef ASM__ARM__SYSTEM_H
+#define ASM__ARM__SYSTEM_H
 
 #include <xen/lib.h>
 #include <public/arch-arm.h>
@@ -62,7 +62,7 @@ static inline int local_abort_is_enabled(void)
 
 extern struct vcpu *__context_switch(struct vcpu *prev, struct vcpu *next);
 
-#endif
+#endif /* ASM__ARM__SYSTEM_H */
 /*
  * Local variables:
  * mode: C
-- 
2.34.1

[XEN PATCH v5 12/17] xen: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>

Modify creation rule for asm-offsets.h to conform to
the new standard and to not generate conflicting guards
between architectures (which is a violation of the directive).
Modify generic-y creation rule to generate code without violations
and to conform to the new standard.

Mechanical change.

Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guards of autogenerated files
Commit introduced in v3
---
 xen/build.mk                     | 7 ++++---
 xen/scripts/Makefile.asm-generic | 8 +++++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/xen/build.mk b/xen/build.mk
index 0f490ca71b..32624d3097 100644
--- a/xen/build.mk
+++ b/xen/build.mk
@@ -47,6 +47,7 @@ asm-offsets.s: arch/$(SRCARCH)/$(ARCH)/asm-offsets.c
 
 arch/$(SRCARCH)/include/asm/asm-offsets.h: asm-offsets.s
 	@(set -e; \
+	  guard=$$(echo ASM__${SRCARCH}__ASM_OFFSETS_H | tr a-z A-Z); \
 	  echo "/*"; \
 	  echo " * DO NOT MODIFY."; \
 	  echo " *"; \
@@ -54,12 +55,12 @@ arch/$(SRCARCH)/include/asm/asm-offsets.h: asm-offsets.s
 	  echo " *"; \
 	  echo " */"; \
 	  echo ""; \
-	  echo "#ifndef __ASM_OFFSETS_H__"; \
-	  echo "#define __ASM_OFFSETS_H__"; \
+	  echo "#ifndef $$guard"; \
+	  echo "#define $$guard"; \
 	  echo ""; \
 	  sed -rne "/^[^#].*==>/{s:.*==>(.*)<==.*:\1:; s: [\$$#]: :; p;}"; \
 	  echo ""; \
-	  echo "#endif") <$< >$@
+	  echo "#endif /* $$guard */") <$< >$@
 
 build-dirs := $(patsubst %/built_in.o,%,$(filter %/built_in.o,$(ALL_OBJS) $(ALL_LIBS)))
 
diff --git a/xen/scripts/Makefile.asm-generic b/xen/scripts/Makefile.asm-generic
index b0d356bfa3..2d2fd9f76e 100644
--- a/xen/scripts/Makefile.asm-generic
+++ b/xen/scripts/Makefile.asm-generic
@@ -32,7 +32,13 @@ old-headers := $(wildcard $(obj)/*.h)
 unwanted    := $(filter-out $(generic-y) $(generated-y),$(old-headers))
 
 quiet_cmd_wrap = WRAP    $@
-      cmd_wrap = echo "\#include <asm-generic/$*.h>" > $@
+cmd_wrap = \
+    guard=$$(echo ASM_GENERIC__${SRCARCH}__$*_H | tr a-z A-Z); \
+    echo "\#ifndef $$guard" >$@.new; \
+    echo "\#define $$guard" >>$@.new; \
+    echo "\#include <asm-generic/$*.h>" >>$@.new; \
+    echo "\#endif /* $$guard */" >>$@.new; \
+    mv -f $@.new $@
 
 quiet_cmd_remove = REMOVE  $(unwanted)
       cmd_remove = rm -f $(unwanted)
-- 
2.34.1

[XEN PATCH v5 13/17] xen: add deviations for MISRA C 2012 Dir D4.10

[Alessandro Zucchelli]

From: Nicola Vetrini <nicola.vetrini@bugseng.com>

Add safe deviation for *.c files, as estabilished in past discussion.

Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

---
Changes in v4:
- split the commit from the unrelated SAF deviation
Commit introduced in v3

Link to the discussion thread:
https://lists.xenproject.org/archives/html/xen-devel/2023-09/msg00239.html
---
 automation/eclair_analysis/ECLAIR/deviations.ecl | 5 +++++
 docs/misra/deviations.rst                        | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 1c39a9a16d..c6b1a10bcf 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -78,6 +78,11 @@ conform to the directive."
 -config=MC3R1.D4.10,reports+={safe, "first_area(text(^/\\* Generated file, do not edit! \\*/$, begin-3))"}
 -doc_end
 
+-doc_begin="Including multiple times a .c file is safe because every function or data item
+it defines would (in the common case) be already defined. Peer reviewed by the community."
+-config=MC3R1.D4.10,reports+={safe, "all_area(all_loc(^.*\\.c$))"}
+-doc_end
+
 #
 # Series 5.
 #
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 1ecce1469a..d51aa422b5 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -30,6 +30,12 @@ Deviations related to MISRA C:2012 Directives:
        not to add an additional encapsulation layer.
      - Tagged as `deliberate` for ECLAIR.
 
+   * - D4.10
+     - Including multiple times a .c file is safe because every function or data item
+       it defines would in (the common case) be already defined.
+       Peer reviewed by the community.
+     - Tagged as `safe` for ECLAIR.
+
 Deviations related to MISRA C:2012 Rules:
 -----------------------------------------
 
-- 
2.34.1

[XEN PATCH v5 14/17] xen/x86: rename inclusion guards for consistency

[Alessandro Zucchelli]

From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>

Edit inclusion guards in order to make them consistent with the
estabilished naming conventions.

No functional change.

Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changs in v5:
- edit inclusion guards, according to feedback received
Changes in v4:
- Improve commit message
Commit introduced in v3
---
 xen/arch/x86/include/asm/domain.h      | 6 +++---
 xen/arch/x86/include/asm/event.h       | 6 +++---
 xen/arch/x86/include/asm/grant_table.h | 6 +++---
 xen/arch/x86/include/asm/io.h          | 6 +++---
 xen/arch/x86/include/asm/irq.h         | 6 +++---
 xen/arch/x86/include/asm/smp.h         | 6 +++---
 xen/arch/x86/include/asm/spinlock.h    | 6 +++---
 xen/arch/x86/include/asm/system.h      | 6 +++---
 8 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/xen/arch/x86/include/asm/domain.h b/xen/arch/x86/include/asm/domain.h
index f5daeb182b..9818835805 100644
--- a/xen/arch/x86/include/asm/domain.h
+++ b/xen/arch/x86/include/asm/domain.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_DOMAIN_H__
-#define __ASM_DOMAIN_H__
+#ifndef ASM__X86__DOMAIN_H
+#define ASM__X86__DOMAIN_H
 
 #include <xen/mm.h>
 #include <xen/radix-tree.h>
@@ -779,7 +779,7 @@ struct arch_vcpu_io {
 /* Maxphysaddr supportable by the paging infrastructure. */
 unsigned int domain_max_paddr_bits(const struct domain *d);
 
-#endif /* __ASM_DOMAIN_H__ */
+#endif /* ASM__X86__DOMAIN_H */
 
 /*
  * Local variables:
diff --git a/xen/arch/x86/include/asm/event.h b/xen/arch/x86/include/asm/event.h
index 5e09ede6d7..8932727d5a 100644
--- a/xen/arch/x86/include/asm/event.h
+++ b/xen/arch/x86/include/asm/event.h
@@ -6,8 +6,8 @@
  *
  */
 
-#ifndef __ASM_EVENT_H__
-#define __ASM_EVENT_H__
+#ifndef ASM__X86__EVENT_H
+#define ASM__X86__EVENT_H
 
 #include <xen/shared.h>
 
@@ -53,4 +53,4 @@ static inline bool arch_virq_is_global(unsigned int virq)
              (pv_shim && (chn)->port && (chn)->state == ECS_RESERVED)
 #endif
 
-#endif
+#endif /* ASM__X86__EVENT_H */
diff --git a/xen/arch/x86/include/asm/grant_table.h b/xen/arch/x86/include/asm/grant_table.h
index 5c23cec90c..67a4f84cbb 100644
--- a/xen/arch/x86/include/asm/grant_table.h
+++ b/xen/arch/x86/include/asm/grant_table.h
@@ -4,8 +4,8 @@
  * Copyright (c) 2004-2005 K A Fraser
  */
 
-#ifndef __ASM_GRANT_TABLE_H__
-#define __ASM_GRANT_TABLE_H__
+#ifndef ASM__X86__GRANT_TABLE_H
+#define ASM__X86__GRANT_TABLE_H
 
 #include <asm/paging.h>
 
@@ -72,4 +72,4 @@ static inline void gnttab_clear_flags(struct domain *d,
 #define gnttab_need_iommu_mapping(d)                \
     (!paging_mode_translate(d) && need_iommu_pt_sync(d))
 
-#endif /* __ASM_GRANT_TABLE_H__ */
+#endif /* ASM__X86__GRANT_TABLE_H */
diff --git a/xen/arch/x86/include/asm/io.h b/xen/arch/x86/include/asm/io.h
index 1cb4217cff..6b56a18850 100644
--- a/xen/arch/x86/include/asm/io.h
+++ b/xen/arch/x86/include/asm/io.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_IO_H
-#define _ASM_IO_H
+#ifndef ASM__X86__IO_H
+#define ASM__X86__IO_H
 
 #include <xen/vmap.h>
 #include <xen/types.h>
@@ -57,4 +57,4 @@ struct cpu_user_regs;
 unsigned int ioemul_handle_proliant_quirk(
     uint8_t opcode, char *io_emul_stub, const struct cpu_user_regs *regs);
 
-#endif
+#endif /* ASM__X86__IO_H */
diff --git a/xen/arch/x86/include/asm/irq.h b/xen/arch/x86/include/asm/irq.h
index 5f445299be..a73141a15e 100644
--- a/xen/arch/x86/include/asm/irq.h
+++ b/xen/arch/x86/include/asm/irq.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_HW_IRQ_H
-#define _ASM_HW_IRQ_H
+#ifndef ASM__X86__IRQ_H
+#define ASM__X86__IRQ_H
 
 /* (C) 1992, 1993 Linus Torvalds, (C) 1997 Ingo Molnar */
 
@@ -231,4 +231,4 @@ int allocate_and_map_gsi_pirq(struct domain *d, int index, int *pirq_p);
 int allocate_and_map_msi_pirq(struct domain *d, int index, int *pirq_p,
                               int type, struct msi_info *msi);
 
-#endif /* _ASM_HW_IRQ_H */
+#endif /* ASM__X86__IRQ_H */
diff --git a/xen/arch/x86/include/asm/smp.h b/xen/arch/x86/include/asm/smp.h
index c8c7960134..72cf218b8c 100644
--- a/xen/arch/x86/include/asm/smp.h
+++ b/xen/arch/x86/include/asm/smp.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_SMP_H
-#define __ASM_SMP_H
+#ifndef ASM__X86__SMP_H
+#define ASM__X86__SMP_H
 
 /*
  * We need the APIC definitions automatically as part of 'smp.h'
@@ -81,4 +81,4 @@ void *cpu_alloc_stack(unsigned int cpu);
 
 #endif /* !__ASSEMBLY__ */
 
-#endif
+#endif /* ASM__X86__SMP_H */
diff --git a/xen/arch/x86/include/asm/spinlock.h b/xen/arch/x86/include/asm/spinlock.h
index 56f6095752..11bec91e7f 100644
--- a/xen/arch/x86/include/asm/spinlock.h
+++ b/xen/arch/x86/include/asm/spinlock.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_SPINLOCK_H
-#define __ASM_SPINLOCK_H
+#ifndef ASM__X86__SPINLOCK_H
+#define ASM__X86__SPINLOCK_H
 
 #define _raw_read_unlock(l) \
     BUILD_BUG_ON(sizeof((l)->lock) != 4); /* Clang doesn't support %z in asm. */ \
@@ -24,4 +24,4 @@
     arch_lock_signal();             \
 })
 
-#endif /* __ASM_SPINLOCK_H */
+#endif /* ASM__X86__SPINLOCK_H */
diff --git a/xen/arch/x86/include/asm/system.h b/xen/arch/x86/include/asm/system.h
index 73cb16ca68..4e1480c497 100644
--- a/xen/arch/x86/include/asm/system.h
+++ b/xen/arch/x86/include/asm/system.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_SYSTEM_H
-#define __ASM_SYSTEM_H
+#ifndef ASM__X86__SYSTEM_H
+#define ASM__X86__SYSTEM_H
 
 #include <xen/bitops.h>
 #include <xen/bug.h>
@@ -269,4 +269,4 @@ void load_system_tables(void);
 void percpu_traps_init(void);
 void subarch_percpu_traps_init(void);
 
-#endif
+#endif /* ASM__X86__SYSTEM_H */
-- 
2.34.1

[XEN PATCH v5 15/17] xen/build: address violation of MISRA C Directive 4.10

[Alessandro Zucchelli]

This addresses violations of MISRA C:2012 Rule 4.10 which states as
following: Precautions shall be taken in order to prevent the contents
of a header file being included more than once.

Changes are made for autogenerated header files: include/xen/compile.h
and include/xen/hypercall-defs.h.

No functional change.

Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guards for autogenerated header files
---
 xen/build.mk         | 6 +++++-
 xen/include/Makefile | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/xen/build.mk b/xen/build.mk
index 32624d3097..ebb2d06b3c 100644
--- a/xen/build.mk
+++ b/xen/build.mk
@@ -18,6 +18,8 @@ quiet_cmd_compile.h = UPD     $@
 define cmd_compile.h
     if [ ! -r $@ -o -O $@ ]; then \
 	cat .banner; \
+	echo '#ifndef XEN__COMPILE_H' > $(dot-target).tmp; \
+	echo '#define XEN__COMPILE_H' >> $(dot-target).tmp; \
 	sed -e 's/@@date@@/$(XEN_BUILD_DATE)/g' \
 	    -e 's/@@time@@/$(XEN_BUILD_TIME)/g' \
 	    -e 's/@@whoami@@/$(XEN_WHOAMI)/g' \
@@ -28,8 +30,9 @@ define cmd_compile.h
 	    -e 's/@@subversion@@/$(XEN_SUBVERSION)/g' \
 	    -e 's/@@extraversion@@/$(XEN_EXTRAVERSION)/g' \
 	    -e 's!@@changeset@@!$(shell $(srctree)/tools/scmversion $(XEN_ROOT) || echo "unavailable")!g' \
-	    < $< > $(dot-target).tmp; \
+	    < $< >> $(dot-target).tmp; \
 	sed -rf $(srctree)/tools/process-banner.sed < .banner >> $(dot-target).tmp; \
+	echo '#endif /* XEN__COMPILE_H */' >> $(dot-target).tmp; \
 	mv -f $(dot-target).tmp $@; \
     fi
 endef
@@ -40,6 +43,7 @@ include/xen/compile.h: include/xen/compile.h.in .banner FORCE
 
 targets += include/xen/compile.h
 
+
 -include $(wildcard .asm-offsets.s.d)
 asm-offsets.s: arch/$(SRCARCH)/$(ARCH)/asm-offsets.c
 	$(CC) $(call cpp_flags,$(c_flags)) -S -g0 -o $@.new -MQ $@ $<
diff --git a/xen/include/Makefile b/xen/include/Makefile
index 1ff9468eeb..35df93c82e 100644
--- a/xen/include/Makefile
+++ b/xen/include/Makefile
@@ -119,7 +119,10 @@ $(obj)/compat/xlat.h: $(addprefix $(obj)/compat/.xlat/,$(xlat-y)) FORCE
 
 quiet_cmd_genhyp = GEN     $@
 define cmd_genhyp
-    awk -f $(srctree)/scripts/gen_hypercall.awk <$< >$@
+    echo "#ifndef XEN__HYPERCALL_DEFS_H" >$@; \
+    echo "#define XEN__HYPERCALL_DEFS_H" >>$@; \
+    awk -f $(srctree)/scripts/gen_hypercall.awk <$< >>$@; \
+    echo "#endif /* XEN__HYPERCALL_DEFS_H */" >>$@
 endef
 
 all: $(obj)/xen/hypercall-defs.h
-- 
2.34.1

[XEN PATCH v5 16/17] CODING_STYLE: Add a section on header guards naming conventions

[Alessandro Zucchelli]

This section explains which format should be followed by header
inclusion guards via a drop-down list of rules.

No functional change.

Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

---
Changes in v5:
- edit inclusion guards naming conventions, according to feedback
  received
---
 CODING_STYLE | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/CODING_STYLE b/CODING_STYLE
index 7f6e9ad065..f4f26a3cd8 100644
--- a/CODING_STYLE
+++ b/CODING_STYLE
@@ -159,6 +159,27 @@ Emacs local variables
 A comment block containing local variables for emacs is permitted at
 the end of files.  It should be:
 
+Header inclusion guards
+-----------------------
+
+Unless differently specified all header files should have proper inclusion
+guards in order to avoid being included multiple times.
+The following naming conventions have been devised:
+
+- private headers -> <dir>__<filename>_H
+    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
+    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
+    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
+
+- asm-generic headers -> ASM_GENERIC__<filename>_H
+    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
+
+- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
+    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
+
+- include/xen -> XEN__<filename>_H
+    - include/xen/something.h -> XEN__SOMETHING_H
+
 /*
  * Local variables:
  * mode: C
-- 
2.34.1

[XEN PATCH v5 17/17] include/asm-generic: rename inclusion guards for consistency

[Alessandro Zucchelli]

Edit inclusion guards in asm-generic header files in order to make them
consistent with the estabilished naming convention.

No functional change.

Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
---
 xen/include/asm-generic/altp2m.h     | 6 +++---
 xen/include/asm-generic/atomic-ops.h | 6 +++---
 xen/include/asm-generic/device.h     | 6 +++---
 xen/include/asm-generic/div64.h      | 6 +++---
 xen/include/asm-generic/hardirq.h    | 6 +++---
 xen/include/asm-generic/iocap.h      | 6 +++---
 xen/include/asm-generic/monitor.h    | 6 +++---
 xen/include/asm-generic/paging.h     | 6 +++---
 xen/include/asm-generic/percpu.h     | 6 +++---
 xen/include/asm-generic/random.h     | 6 +++---
 xen/include/asm-generic/softirq.h    | 6 +++---
 xen/include/asm-generic/vm_event.h   | 6 +++---
 12 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/xen/include/asm-generic/altp2m.h b/xen/include/asm-generic/altp2m.h
index 39865a842a..34ae943145 100644
--- a/xen/include/asm-generic/altp2m.h
+++ b/xen/include/asm-generic/altp2m.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_ALTP2M_H
-#define __ASM_GENERIC_ALTP2M_H
+#ifndef ASM_GENERIC__ALTP2M_H
+#define ASM_GENERIC__ALTP2M_H
 
 #include <xen/bug.h>
 
@@ -22,7 +22,7 @@ static inline unsigned int altp2m_vcpu_idx(const struct vcpu *v)
     return 0;
 }
 
-#endif /* __ASM_GENERIC_ALTP2M_H */
+#endif /* ASM_GENERIC__ALTP2M_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/atomic-ops.h b/xen/include/asm-generic/atomic-ops.h
index 98dd907942..50f1db909d 100644
--- a/xen/include/asm-generic/atomic-ops.h
+++ b/xen/include/asm-generic/atomic-ops.h
@@ -4,8 +4,8 @@
  * forward inline declaration that can be synthesized from other atomic
  * functions or being created from scratch.
  */
-#ifndef _ASM_GENERIC_ATOMIC_OPS_H_
-#define _ASM_GENERIC_ATOMIC_OPS_H_
+#ifndef ASM_GENERIC__ATOMIC_OPS_H_
+#define ASM_GENERIC__ATOMIC_OPS_H_
 
 #include <xen/atomic.h>
 #include <xen/lib.h>
@@ -94,4 +94,4 @@ static inline int atomic_add_negative(int i, atomic_t *v)
 }
 #endif
 
-#endif /* _ASM_GENERIC_ATOMIC_OPS_H_ */
+#endif /* ASM_GENERIC__ATOMIC_OPS_H_ */
diff --git a/xen/include/asm-generic/device.h b/xen/include/asm-generic/device.h
index 1acd1ba1d8..eccd3159a9 100644
--- a/xen/include/asm-generic/device.h
+++ b/xen/include/asm-generic/device.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_DEVICE_H__
-#define __ASM_GENERIC_DEVICE_H__
+#ifndef ASM_GENERIC__DEVICE_H
+#define ASM_GENERIC__DEVICE_H
 
 #include <xen/stdbool.h>
 
@@ -127,7 +127,7 @@ __section(".adev.info") = {                                         \
 
 #endif /* CONFIG_ACPI */
 
-#endif /* __ASM_GENERIC_DEVICE_H__ */
+#endif /* ASM_GENERIC__DEVICE_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/div64.h b/xen/include/asm-generic/div64.h
index 068d8a11ad..c1770561c6 100644
--- a/xen/include/asm-generic/div64.h
+++ b/xen/include/asm-generic/div64.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_DIV64
-#define __ASM_GENERIC_DIV64
+#ifndef ASM_GENERIC__DIV64_H
+#define ASM_GENERIC__DIV64_H
 
 #include <xen/types.h>
 
@@ -15,7 +15,7 @@
 
 #endif /* BITS_PER_LONG */
 
-#endif
+#endif /* ASM_GENERIC__DIV64_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/hardirq.h b/xen/include/asm-generic/hardirq.h
index ddccf460b9..09260b1b08 100644
--- a/xen/include/asm-generic/hardirq.h
+++ b/xen/include/asm-generic/hardirq.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_HARDIRQ_H
-#define __ASM_GENERIC_HARDIRQ_H
+#ifndef ASM_GENERIC__HARDIRQ_H
+#define ASM_GENERIC__HARDIRQ_H
 
 #include <xen/cache.h>
 #include <xen/smp.h>
@@ -17,7 +17,7 @@ typedef struct {
 #define irq_enter()     (local_irq_count(smp_processor_id())++)
 #define irq_exit()      (local_irq_count(smp_processor_id())--)
 
-#endif /* __ASM_GENERIC_HARDIRQ_H */
+#endif /* ASM_GENERIC__HARDIRQ_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/iocap.h b/xen/include/asm-generic/iocap.h
index dd7cb45488..1001fb629a 100644
--- a/xen/include/asm-generic/iocap.h
+++ b/xen/include/asm-generic/iocap.h
@@ -1,11 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_IOCAP_H__
-#define __ASM_GENERIC_IOCAP_H__
+#ifndef ASM_GENERIC__IOCAP_H
+#define ASM_GENERIC__IOCAP_H
 
 #define cache_flush_permitted(d)                        \
     (!rangeset_is_empty((d)->iomem_caps))
 
-#endif /* __ASM_GENERIC_IOCAP_H__ */
+#endif /* ASM_GENERIC__IOCAP_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/monitor.h b/xen/include/asm-generic/monitor.h
index 1ade289099..e53f0823cb 100644
--- a/xen/include/asm-generic/monitor.h
+++ b/xen/include/asm-generic/monitor.h
@@ -9,8 +9,8 @@
  *
  */
 
-#ifndef __ASM_GENERIC_MONITOR_H__
-#define __ASM_GENERIC_MONITOR_H__
+#ifndef ASM_GENERIC__MONITOR_H
+#define ASM_GENERIC__MONITOR_H
 
 #include <xen/errno.h>
 #include <xen/lib.h>
@@ -52,7 +52,7 @@ void arch_monitor_cleanup_domain(struct domain *d)
     /* No arch-specific domain cleanup on GENERIC. */
 }
 
-#endif /* __ASM_GENERIC_MONITOR_H__ */
+#endif /* ASM_GENERIC__MONITOR_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/paging.h b/xen/include/asm-generic/paging.h
index 8df534cfdc..1a8fae6543 100644
--- a/xen/include/asm-generic/paging.h
+++ b/xen/include/asm-generic/paging.h
@@ -1,13 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_PAGING_H__
-#define __ASM_GENERIC_PAGING_H__
+#ifndef ASM_GENERIC__PAGING_H
+#define ASM_GENERIC__PAGING_H
 
 #include <xen/stdbool.h>
 
 #define paging_mode_translate(d)    ((void)(d), true)
 #define paging_mode_external(d)     ((void)(d), true)
 
-#endif /* __ASM_GENERIC_PAGING_H__ */
+#endif /* ASM_GENERIC__PAGING_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/percpu.h b/xen/include/asm-generic/percpu.h
index 60af4f9ff9..7302edb00c 100644
--- a/xen/include/asm-generic/percpu.h
+++ b/xen/include/asm-generic/percpu.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_PERCPU_H__
-#define __ASM_GENERIC_PERCPU_H__
+#ifndef ASM_GENERIC__PERCPU_H
+#define ASM_GENERIC__PERCPU_H
 
 #ifndef __ASSEMBLY__
 
@@ -25,7 +25,7 @@ void percpu_init_areas(void);
 
 #endif
 
-#endif /* __ASM_GENERIC_PERCPU_H__ */
+#endif /* ASM_GENERIC__PERCPU_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/random.h b/xen/include/asm-generic/random.h
index d0d35dd217..f2e6c1c11c 100644
--- a/xen/include/asm-generic/random.h
+++ b/xen/include/asm-generic/random.h
@@ -1,13 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_RANDOM_H__
-#define __ASM_GENERIC_RANDOM_H__
+#ifndef ASM_GENERIC__RANDOM_H
+#define ASM_GENERIC__RANDOM_H
 
 static inline unsigned int arch_get_random(void)
 {
     return 0;
 }
 
-#endif /* __ASM_GENERIC_RANDOM_H__ */
+#endif /* ASM_GENERIC__RANDOM_H */
 
 /*
  * Local variables:
diff --git a/xen/include/asm-generic/softirq.h b/xen/include/asm-generic/softirq.h
index 83be855e50..92144c7eca 100644
--- a/xen/include/asm-generic/softirq.h
+++ b/xen/include/asm-generic/softirq.h
@@ -1,12 +1,12 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
-#ifndef __ASM_GENERIC_SOFTIRQ_H__
-#define __ASM_GENERIC_SOFTIRQ_H__
+#ifndef ASM_GENERIC__SOFTIRQ_H
+#define ASM_GENERIC__SOFTIRQ_H
 
 #define NR_ARCH_SOFTIRQS       0
 
 #define arch_skip_send_event_check(cpu) 0
 
-#endif /* __ASM_GENERIC_SOFTIRQ_H__ */
+#endif /* ASM_GENERIC__SOFTIRQ_H */
 /*
  * Local variables:
  * mode: C
diff --git a/xen/include/asm-generic/vm_event.h b/xen/include/asm-generic/vm_event.h
index 620c7b971c..ff538b6ba4 100644
--- a/xen/include/asm-generic/vm_event.h
+++ b/xen/include/asm-generic/vm_event.h
@@ -5,8 +5,8 @@
  * Copyright (c) 2015 Tamas K Lengyel (tamas@tklengyel.com)
  */
 
-#ifndef __ASM_GENERIC_VM_EVENT_H__
-#define __ASM_GENERIC_VM_EVENT_H__
+#ifndef ASM_GENERIC__VM_EVENT_H
+#define ASM_GENERIC__VM_EVENT_H
 
 #include <xen/sched.h>
 #include <public/vm_event.h>
@@ -52,4 +52,4 @@ void vm_event_reset_vmtrace(struct vcpu *v)
     /* Nothing to do. */
 }
 
-#endif /* __ASM_GENERIC_VM_EVENT_H__ */
+#endif /* ASM_GENERIC__VM_EVENT_H */
-- 
2.34.1

Re: [XEN PATCH v5 16/17] CODING_STYLE: Add a section on header guards naming conventions

[Jan Beulich]

On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> This section explains which format should be followed by header
> inclusion guards via a drop-down list of rules.
> 
> No functional change.
> 
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

As indicated in reply to v4, this wants (imo needs) to move to the very start
of the series. No changes following the new scheme should be made without the
new scheme actually having been committed.

> --- a/CODING_STYLE
> +++ b/CODING_STYLE
> @@ -159,6 +159,27 @@ Emacs local variables
>  A comment block containing local variables for emacs is permitted at
>  the end of files.  It should be:
>  
> +Header inclusion guards
> +-----------------------
> +
> +Unless differently specified all header files should have proper inclusion
> +guards in order to avoid being included multiple times.
> +The following naming conventions have been devised:
> +
> +- private headers -> <dir>__<filename>_H
> +    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
> +    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
> +    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
> +
> +- asm-generic headers -> ASM_GENERIC__<filename>_H
> +    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
> +
> +- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
> +    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
> +
> +- include/xen -> XEN__<filename>_H
> +    - include/xen/something.h -> XEN__SOMETHING_H

While I think this expresses what we have settled on, it lack details. For
example, when to use single vs double underscores is left for the reader
to derive from the examples, which leaves room for interpretation.

Jan

Re: [XEN PATCH v5 01/17] misra: add deviation for headers that explicitly avoid guards

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> From: Simone Ballarin <simone.ballarin@bugseng.com>
> 
> Some headers, under specific circumstances (documented in a comment at
> the beginning of the file), explicitly do not have strict inclusion
> guards: the caller is responsible for including them correctly.
> 
> These files are not supposed to comply with Directive 4.10:
> "Precautions shall be taken in order to prevent the contents of a header
> file being included more than once"
> 
> This patch adds deviation cooments for headers that avoid guards.
> 
> Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Re: [XEN PATCH v5 10/17] x86/asm: address violations of MISRA C:2012 Directive 4.10

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> From: Simone Ballarin <simone.ballarin@bugseng.com>
> 
> Amend generation script, add inclusion guards to address violations
> of MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
> to prevent the contents of a header file being included more than
> once").
> 
> This patch amends the Makefile adding the required inclusion guards
> for xlat.h.
> 
> Add deviation comment for files intended for multiple inclusion.
> 
> Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Re: [XEN PATCH v5 12/17] xen: address violations of MISRA C:2012 Directive 4.10

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
> 
> Modify creation rule for asm-offsets.h to conform to
> the new standard and to not generate conflicting guards
> between architectures (which is a violation of the directive).
> Modify generic-y creation rule to generate code without violations
> and to conform to the new standard.
> 
> Mechanical change.
> 
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Re: [XEN PATCH v5 12/17] xen: address violations of MISRA C:2012 Directive 4.10

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
> 
> Modify creation rule for asm-offsets.h to conform to
> the new standard and to not generate conflicting guards
> between architectures (which is a violation of the directive).
> Modify generic-y creation rule to generate code without violations
> and to conform to the new standard.
> 
> Mechanical change.
> 
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

I know I gave my Reviewed-by already but I have a question below...


> ---
> Changes in v5:
> - edit inclusion guards of autogenerated files
> Commit introduced in v3
> ---
>  xen/build.mk                     | 7 ++++---
>  xen/scripts/Makefile.asm-generic | 8 +++++++-
>  2 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/xen/build.mk b/xen/build.mk
> index 0f490ca71b..32624d3097 100644
> --- a/xen/build.mk
> +++ b/xen/build.mk
> @@ -47,6 +47,7 @@ asm-offsets.s: arch/$(SRCARCH)/$(ARCH)/asm-offsets.c
>  
>  arch/$(SRCARCH)/include/asm/asm-offsets.h: asm-offsets.s
>  	@(set -e; \
> +	  guard=$$(echo ASM__${SRCARCH}__ASM_OFFSETS_H | tr a-z A-Z); \
>  	  echo "/*"; \
>  	  echo " * DO NOT MODIFY."; \
>  	  echo " *"; \
> @@ -54,12 +55,12 @@ arch/$(SRCARCH)/include/asm/asm-offsets.h: asm-offsets.s
>  	  echo " *"; \
>  	  echo " */"; \
>  	  echo ""; \
> -	  echo "#ifndef __ASM_OFFSETS_H__"; \
> -	  echo "#define __ASM_OFFSETS_H__"; \
> +	  echo "#ifndef $$guard"; \
> +	  echo "#define $$guard"; \
>  	  echo ""; \
>  	  sed -rne "/^[^#].*==>/{s:.*==>(.*)<==.*:\1:; s: [\$$#]: :; p;}"; \
>  	  echo ""; \
> -	  echo "#endif") <$< >$@
> +	  echo "#endif /* $$guard */") <$< >$@
>  
>  build-dirs := $(patsubst %/built_in.o,%,$(filter %/built_in.o,$(ALL_OBJS) $(ALL_LIBS)))
>  
> diff --git a/xen/scripts/Makefile.asm-generic b/xen/scripts/Makefile.asm-generic
> index b0d356bfa3..2d2fd9f76e 100644
> --- a/xen/scripts/Makefile.asm-generic
> +++ b/xen/scripts/Makefile.asm-generic
> @@ -32,7 +32,13 @@ old-headers := $(wildcard $(obj)/*.h)
>  unwanted    := $(filter-out $(generic-y) $(generated-y),$(old-headers))
>  
>  quiet_cmd_wrap = WRAP    $@
> -      cmd_wrap = echo "\#include <asm-generic/$*.h>" > $@
> +cmd_wrap = \
> +    guard=$$(echo ASM_GENERIC__${SRCARCH}__$*_H | tr a-z A-Z); \

Shouldn't this be: ASM_GENERIC__$*_H  according to the coding style?



> +    echo "\#ifndef $$guard" >$@.new; \
> +    echo "\#define $$guard" >>$@.new; \
> +    echo "\#include <asm-generic/$*.h>" >>$@.new; \
> +    echo "\#endif /* $$guard */" >>$@.new; \
> +    mv -f $@.new $@
>  
>  quiet_cmd_remove = REMOVE  $(unwanted)
>        cmd_remove = rm -f $(unwanted)
> -- 
> 2.34.1
> 

Re: [XEN PATCH v5 15/17] xen/build: address violation of MISRA C Directive 4.10

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> This addresses violations of MISRA C:2012 Rule 4.10 which states as
> following: Precautions shall be taken in order to prevent the contents
> of a header file being included more than once.
> 
> Changes are made for autogenerated header files: include/xen/compile.h
> and include/xen/hypercall-defs.h.
> 
> No functional change.
> 
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
> 
> ---
> Changes in v5:
> - edit inclusion guards for autogenerated header files
> ---
>  xen/build.mk         | 6 +++++-
>  xen/include/Makefile | 5 ++++-
>  2 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/xen/build.mk b/xen/build.mk
> index 32624d3097..ebb2d06b3c 100644
> --- a/xen/build.mk
> +++ b/xen/build.mk
> @@ -18,6 +18,8 @@ quiet_cmd_compile.h = UPD     $@
>  define cmd_compile.h
>      if [ ! -r $@ -o -O $@ ]; then \
>  	cat .banner; \
> +	echo '#ifndef XEN__COMPILE_H' > $(dot-target).tmp; \
> +	echo '#define XEN__COMPILE_H' >> $(dot-target).tmp; \
>  	sed -e 's/@@date@@/$(XEN_BUILD_DATE)/g' \
>  	    -e 's/@@time@@/$(XEN_BUILD_TIME)/g' \
>  	    -e 's/@@whoami@@/$(XEN_WHOAMI)/g' \
> @@ -28,8 +30,9 @@ define cmd_compile.h
>  	    -e 's/@@subversion@@/$(XEN_SUBVERSION)/g' \
>  	    -e 's/@@extraversion@@/$(XEN_EXTRAVERSION)/g' \
>  	    -e 's!@@changeset@@!$(shell $(srctree)/tools/scmversion $(XEN_ROOT) || echo "unavailable")!g' \
> -	    < $< > $(dot-target).tmp; \
> +	    < $< >> $(dot-target).tmp; \
>  	sed -rf $(srctree)/tools/process-banner.sed < .banner >> $(dot-target).tmp; \
> +	echo '#endif /* XEN__COMPILE_H */' >> $(dot-target).tmp; \
>  	mv -f $(dot-target).tmp $@; \
>      fi
>  endef
> @@ -40,6 +43,7 @@ include/xen/compile.h: include/xen/compile.h.in .banner FORCE
>  
>  targets += include/xen/compile.h
>  
> +

Spurious change? Could be fixed on commit. Other than this

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>


>  -include $(wildcard .asm-offsets.s.d)
>  asm-offsets.s: arch/$(SRCARCH)/$(ARCH)/asm-offsets.c
>  	$(CC) $(call cpp_flags,$(c_flags)) -S -g0 -o $@.new -MQ $@ $<
> diff --git a/xen/include/Makefile b/xen/include/Makefile
> index 1ff9468eeb..35df93c82e 100644
> --- a/xen/include/Makefile
> +++ b/xen/include/Makefile
> @@ -119,7 +119,10 @@ $(obj)/compat/xlat.h: $(addprefix $(obj)/compat/.xlat/,$(xlat-y)) FORCE
>  
>  quiet_cmd_genhyp = GEN     $@
>  define cmd_genhyp
> -    awk -f $(srctree)/scripts/gen_hypercall.awk <$< >$@
> +    echo "#ifndef XEN__HYPERCALL_DEFS_H" >$@; \
> +    echo "#define XEN__HYPERCALL_DEFS_H" >>$@; \
> +    awk -f $(srctree)/scripts/gen_hypercall.awk <$< >>$@; \
> +    echo "#endif /* XEN__HYPERCALL_DEFS_H */" >>$@
>  endef
>  
>  all: $(obj)/xen/hypercall-defs.h
> -- 
> 2.34.1
> 

Re: [XEN PATCH v5 16/17] CODING_STYLE: Add a section on header guards naming conventions

[Stefano Stabellini]

On Tue, 23 Jul 2024, Jan Beulich wrote:
> On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> > This section explains which format should be followed by header
> > inclusion guards via a drop-down list of rules.
> > 
> > No functional change.
> > 
> > Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
> 
> As indicated in reply to v4, this wants (imo needs) to move to the very start
> of the series. No changes following the new scheme should be made without the
> new scheme actually having been committed.
> 
> > --- a/CODING_STYLE
> > +++ b/CODING_STYLE
> > @@ -159,6 +159,27 @@ Emacs local variables
> >  A comment block containing local variables for emacs is permitted at
> >  the end of files.  It should be:
> >  
> > +Header inclusion guards
> > +-----------------------
> > +
> > +Unless differently specified all header files should have proper inclusion
> > +guards in order to avoid being included multiple times.
> > +The following naming conventions have been devised:
> > +
> > +- private headers -> <dir>__<filename>_H
> > +    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
> > +    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
> > +    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
> > +
> > +- asm-generic headers -> ASM_GENERIC__<filename>_H
> > +    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
> > +
> > +- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
> > +    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
> > +
> > +- include/xen -> XEN__<filename>_H
> > +    - include/xen/something.h -> XEN__SOMETHING_H
> 
> While I think this expresses what we have settled on, it lack details. For
> example, when to use single vs double underscores is left for the reader
> to derive from the examples, which leaves room for interpretation.

I think so too. Here is my improved version, what do you think:


Header inclusion guards
-----------------------

Unless otherwise specified, all header files should include proper
guards to prevent multiple inclusions. The following naming conventions
apply:

- Private headers: <dir>__<filename>_H
    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H

- asm-generic headers: ASM_GENERIC__<filename>_H
    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H

- arch-specific headers: ASM__<architecture>__<subdir>__<filename>_H
    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H

- Xen headers: XEN__<filename>_H
    - include/xen/something.h -> XEN__SOMETHING_H

Notes:

- Filenames and directories are converted to uppercase.
- Dashes are converted to underscores.
- Directories, subdirectories, and filenames are separated by double
  underscores.

Re: [XEN PATCH v5 17/17] include/asm-generic: rename inclusion guards for consistency

[Stefano Stabellini]

On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
> Edit inclusion guards in asm-generic header files in order to make them
> consistent with the estabilished naming convention.
> 
> No functional change.
> 
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Re: [XEN PATCH v5 16/17] CODING_STYLE: Add a section on header guards naming conventions

[Jan Beulich]

On 24.07.2024 00:40, Stefano Stabellini wrote:
> On Tue, 23 Jul 2024, Jan Beulich wrote:
>> On 23.07.2024 10:15, Alessandro Zucchelli wrote:
>>> This section explains which format should be followed by header
>>> inclusion guards via a drop-down list of rules.
>>>
>>> No functional change.
>>>
>>> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
>>
>> As indicated in reply to v4, this wants (imo needs) to move to the very start
>> of the series. No changes following the new scheme should be made without the
>> new scheme actually having been committed.
>>
>>> --- a/CODING_STYLE
>>> +++ b/CODING_STYLE
>>> @@ -159,6 +159,27 @@ Emacs local variables
>>>  A comment block containing local variables for emacs is permitted at
>>>  the end of files.  It should be:
>>>  
>>> +Header inclusion guards
>>> +-----------------------
>>> +
>>> +Unless differently specified all header files should have proper inclusion
>>> +guards in order to avoid being included multiple times.
>>> +The following naming conventions have been devised:
>>> +
>>> +- private headers -> <dir>__<filename>_H
>>> +    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
>>> +    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
>>> +    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
>>> +
>>> +- asm-generic headers -> ASM_GENERIC__<filename>_H
>>> +    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
>>> +
>>> +- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
>>> +    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
>>> +
>>> +- include/xen -> XEN__<filename>_H
>>> +    - include/xen/something.h -> XEN__SOMETHING_H
>>
>> While I think this expresses what we have settled on, it lack details. For
>> example, when to use single vs double underscores is left for the reader
>> to derive from the examples, which leaves room for interpretation.
> 
> I think so too. Here is my improved version, what do you think:
> 
> 
> Header inclusion guards
> -----------------------
> 
> Unless otherwise specified, all header files should include proper
> guards to prevent multiple inclusions. The following naming conventions
> apply:
> 
> - Private headers: <dir>__<filename>_H
>     - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
>     - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
>     - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
> 
> - asm-generic headers: ASM_GENERIC__<filename>_H
>     - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
> 
> - arch-specific headers: ASM__<architecture>__<subdir>__<filename>_H
>     - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
> 
> - Xen headers: XEN__<filename>_H
>     - include/xen/something.h -> XEN__SOMETHING_H
> 
> Notes:
> 
> - Filenames and directories are converted to uppercase.
> - Dashes are converted to underscores.

s/Dashes/Non-alphanumeric characters/

Jan

> - Directories, subdirectories, and filenames are separated by double
>   underscores.
> 

Re: [XEN PATCH v5 12/17] xen: address violations of MISRA C:2012 Directive 4.10

[Alessandro Zucchelli]

On 2024-07-24 00:29, Stefano Stabellini wrote:
> On Tue, 23 Jul 2024, Alessandro Zucchelli wrote:
>> From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
>> 
>> Modify creation rule for asm-offsets.h to conform to
>> the new standard and to not generate conflicting guards
>> between architectures (which is a violation of the directive).
>> Modify generic-y creation rule to generate code without violations
>> and to conform to the new standard.
>> 
>> Mechanical change.
>> 
>> Signed-off-by: Maria Celeste Cesario  
>> <maria.celeste.cesario@bugseng.com>
>> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
>> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
>> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
> 
> I know I gave my Reviewed-by already but I have a question below...
> 
> 
>> ---
>> Changes in v5:
>> - edit inclusion guards of autogenerated files
>> Commit introduced in v3
>> ---
>>  xen/build.mk                     | 7 ++++---
>>  xen/scripts/Makefile.asm-generic | 8 +++++++-
>>  2 files changed, 11 insertions(+), 4 deletions(-)
>> 
>> diff --git a/xen/build.mk b/xen/build.mk
>> index 0f490ca71b..32624d3097 100644
>> --- a/xen/build.mk
>> +++ b/xen/build.mk
>> @@ -47,6 +47,7 @@ asm-offsets.s: arch/$(SRCARCH)/$(ARCH)/asm-offsets.c
>> 
>>  arch/$(SRCARCH)/include/asm/asm-offsets.h: asm-offsets.s
>>  	@(set -e; \
>> +	  guard=$$(echo ASM__${SRCARCH}__ASM_OFFSETS_H | tr a-z A-Z); \
>>  	  echo "/*"; \
>>  	  echo " * DO NOT MODIFY."; \
>>  	  echo " *"; \
>> @@ -54,12 +55,12 @@ arch/$(SRCARCH)/include/asm/asm-offsets.h: 
>> asm-offsets.s
>>  	  echo " *"; \
>>  	  echo " */"; \
>>  	  echo ""; \
>> -	  echo "#ifndef __ASM_OFFSETS_H__"; \
>> -	  echo "#define __ASM_OFFSETS_H__"; \
>> +	  echo "#ifndef $$guard"; \
>> +	  echo "#define $$guard"; \
>>  	  echo ""; \
>>  	  sed -rne "/^[^#].*==>/{s:.*==>(.*)<==.*:\1:; s: [\$$#]: :; p;}"; \
>>  	  echo ""; \
>> -	  echo "#endif") <$< >$@
>> +	  echo "#endif /* $$guard */") <$< >$@
>> 
>>  build-dirs := $(patsubst %/built_in.o,%,$(filter 
>> %/built_in.o,$(ALL_OBJS) $(ALL_LIBS)))
>> 
>> diff --git a/xen/scripts/Makefile.asm-generic 
>> b/xen/scripts/Makefile.asm-generic
>> index b0d356bfa3..2d2fd9f76e 100644
>> --- a/xen/scripts/Makefile.asm-generic
>> +++ b/xen/scripts/Makefile.asm-generic
>> @@ -32,7 +32,13 @@ old-headers := $(wildcard $(obj)/*.h)
>>  unwanted    := $(filter-out $(generic-y) 
>> $(generated-y),$(old-headers))
>> 
>>  quiet_cmd_wrap = WRAP    $@
>> -      cmd_wrap = echo "\#include <asm-generic/$*.h>" > $@
>> +cmd_wrap = \
>> +    guard=$$(echo ASM_GENERIC__${SRCARCH}__$*_H | tr a-z A-Z); \
> 
> Shouldn't this be: ASM_GENERIC__$*_H  according to the coding style?

Yes, you are right, this slipped through.

>> +    echo "\#ifndef $$guard" >$@.new; \
>> +    echo "\#define $$guard" >>$@.new; \
>> +    echo "\#include <asm-generic/$*.h>" >>$@.new; \
>> +    echo "\#endif /* $$guard */" >>$@.new; \
>> +    mv -f $@.new $@
>> 
>>  quiet_cmd_remove = REMOVE  $(unwanted)
>>        cmd_remove = rm -f $(unwanted)
>> --
>> 2.34.1
>> 

-- 
Alessandro Zucchelli, B.Sc.

Software Engineer, BUGSENG (https://bugseng.com)

Re: [XEN PATCH v5 05/17] xen/x86: address violations of MISRA C:2012 Directive 4.10

[Jan Beulich]

On 23.07.2024 10:14, Alessandro Zucchelli wrote:
> From: Simone Ballarin <simone.ballarin@bugseng.com>
> 
> Add or move inclusion guards to address violations of
> MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
> to prevent the contents of a header file being included more than
> once").
> 
> Inclusion guards must appear at the beginning of the headers
> (comments are permitted anywhere).
> 
> Mechanical change.
> 
> Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Provided the description of the scheme itself goes in first:
Acked-by: Jan Beulich <jbeulich@suse.com>

Re: [XEN PATCH v5 09/17] xen: address violations of MISRA C:2012 Directive 4.10

[Jan Beulich]

On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> From: Simone Ballarin <simone.ballarin@bugseng.com>
> 
> Amend inclusion guards to address violations of
> MISRA C:2012 Directive 4.10 ("Precautions shall be taken in order
> to prevent the contents of a header file being included more than
> once").
> 
> Inclusion guards must appear at the beginning of the headers
> (comments are permitted anywhere) and the #if directive cannot
> be used for other checks.
> 
> Mechanical change.
> 
> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Acked-by: Julien Grall <jgrall@amazon.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Provided the description of the scheme itself goes in first:
Acked-by: Jan Beulich <jbeulich@suse.com>

> ---
> Changes in v5:
> - edit inclusion guards, according to the feedback received

Given how exactly the guards look like is the main aspect here, I
question the retaining of earlier R-b with changes like what is said
here.

Jan

Re: [XEN PATCH v5 10/17] x86/asm: address violations of MISRA C:2012 Directive 4.10

[Jan Beulich]

On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> --- a/xen/include/Makefile
> +++ b/xen/include/Makefile
> @@ -105,9 +105,14 @@ xlat-y := $(shell sed -ne 's,@arch@,$(compat-arch-y),g' -re 's,^[?!][[:blank:]]+
>  xlat-y := $(filter $(patsubst compat/%,%,$(headers-y)),$(xlat-y))
>  
>  quiet_cmd_xlat_h = GEN     $@
> -cmd_xlat_h = \
> -	cat $(filter %.h,$^) >$@.new; \
> +define cmd_xlat_h
> +	guard=$$(echo ASM__${SRCARCH}__COMPAT__XLAT_H | tr a-z A-Z); \

The generated living in xen/include/compat/xlat.h, I don't think this guard
identifier is correct.

Jan

Re: [XEN PATCH v5 14/17] xen/x86: rename inclusion guards for consistency

[Jan Beulich]

On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> From: Maria Celeste Cesario <maria.celeste.cesario@bugseng.com>
> 
> Edit inclusion guards in order to make them consistent with the
> estabilished naming conventions.
> 
> No functional change.
> 
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>

Provided the description of the scheme itself goes in first:
Acked-by: Jan Beulich <jbeulich@suse.com>

> ---
> Changs in v5:
> - edit inclusion guards, according to feedback received

Same remark as on the earlier patch regarding the retained R-b.

Jan

Re: [XEN PATCH v5 16/17] CODING_STYLE: Add a section on header guards naming conventions

[Stefano Stabellini]

On Wed, 24 Jul 2024, Jan Beulich wrote:
> On 24.07.2024 00:40, Stefano Stabellini wrote:
> > On Tue, 23 Jul 2024, Jan Beulich wrote:
> >> On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> >>> This section explains which format should be followed by header
> >>> inclusion guards via a drop-down list of rules.
> >>>
> >>> No functional change.
> >>>
> >>> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
> >>
> >> As indicated in reply to v4, this wants (imo needs) to move to the very start
> >> of the series. No changes following the new scheme should be made without the
> >> new scheme actually having been committed.
> >>
> >>> --- a/CODING_STYLE
> >>> +++ b/CODING_STYLE
> >>> @@ -159,6 +159,27 @@ Emacs local variables
> >>>  A comment block containing local variables for emacs is permitted at
> >>>  the end of files.  It should be:
> >>>  
> >>> +Header inclusion guards
> >>> +-----------------------
> >>> +
> >>> +Unless differently specified all header files should have proper inclusion
> >>> +guards in order to avoid being included multiple times.
> >>> +The following naming conventions have been devised:
> >>> +
> >>> +- private headers -> <dir>__<filename>_H
> >>> +    - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
> >>> +    - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
> >>> +    - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
> >>> +
> >>> +- asm-generic headers -> ASM_GENERIC__<filename>_H
> >>> +    - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
> >>> +
> >>> +- arch/<architecture>/include/asm/<subdir>/<filename>.h -> ASM__<architecture>__<subdir>__<filename>_H
> >>> +    - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
> >>> +
> >>> +- include/xen -> XEN__<filename>_H
> >>> +    - include/xen/something.h -> XEN__SOMETHING_H
> >>
> >> While I think this expresses what we have settled on, it lack details. For
> >> example, when to use single vs double underscores is left for the reader
> >> to derive from the examples, which leaves room for interpretation.
> > 
> > I think so too. Here is my improved version, what do you think:
> > 
> > 
> > Header inclusion guards
> > -----------------------
> > 
> > Unless otherwise specified, all header files should include proper
> > guards to prevent multiple inclusions. The following naming conventions
> > apply:
> > 
> > - Private headers: <dir>__<filename>_H
> >     - arch/arm/arm64/lib/something.h -> ARM__ARM64__LIB__SOMETHING_H
> >     - arch/arm/arm32/lib/something.h -> ARM__ARM32__LIB__SOMETHING_H
> >     - arch/x86/lib/something.h -> X86__LIB__SOMETHING_H
> > 
> > - asm-generic headers: ASM_GENERIC__<filename>_H
> >     - include/asm-generic/something.h -> ASM_GENERIC__SOMETHING_H
> > 
> > - arch-specific headers: ASM__<architecture>__<subdir>__<filename>_H
> >     - arch/x86/include/asm/something.h -> ASM__X86__SOMETHING_H
> > 
> > - Xen headers: XEN__<filename>_H
> >     - include/xen/something.h -> XEN__SOMETHING_H
> > 
> > Notes:
> > 
> > - Filenames and directories are converted to uppercase.
> > - Dashes are converted to underscores.
> 
> s/Dashes/Non-alphanumeric characters/

+1

Re: [XEN PATCH v5 13/17] xen: add deviations for MISRA C 2012 Dir D4.10

[Jan Beulich]

On 23.07.2024 10:15, Alessandro Zucchelli wrote:
> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
> 
> Add safe deviation for *.c files, as estabilished in past discussion.
> 
> Signed-off-by: Maria Celeste Cesario  <maria.celeste.cesario@bugseng.com>
> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Hmm, I was about to commit this when I noticed the mismatch between From:
and the sequence of S-o-b: Who's properly the original author of this
patch (whose S-o-b ought to be first)?

Jan

Re: [XEN PATCH v5 13/17] xen: add deviations for MISRA C 2012 Dir D4.10

[Nicola Vetrini]

On 2024-07-30 11:45, Jan Beulich wrote:
> On 23.07.2024 10:15, Alessandro Zucchelli wrote:
>> From: Nicola Vetrini <nicola.vetrini@bugseng.com>
>> 
>> Add safe deviation for *.c files, as estabilished in past discussion.
>> 
>> Signed-off-by: Maria Celeste Cesario  
>> <maria.celeste.cesario@bugseng.com>
>> Signed-off-by: Simone Ballarin  <simone.ballarin@bugseng.com>
>> Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
>> Signed-off-by: Alessandro Zucchelli <alessandro.zucchelli@bugseng.com>
>> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
> 
> Hmm, I was about to commit this when I noticed the mismatch between 
> From:
> and the sequence of S-o-b: Who's properly the original author of this
> patch (whose S-o-b ought to be first)?
> 
> Jan

Hi,

the original authors are Maria Celeste Cesario and Simone Ballarin, then 
me and Alessandro picked this up.
Perhaps some git configuration made it so that my From is there, but the 
S-o-b order reflects the ordering of events.

Thanks,
  Nicola

-- 
Nicola Vetrini, BSc
Software Engineer, BUGSENG srl (https://bugseng.com)