[PATCH v2] automation/eclair: generalize the noreturn function-pointer deviation

[Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>]

The R11.1 safe cast only matched void noreturn (*)(void *). Accept any
noreturn function pointer converted to a compatible function pointer.
canonical() covers typeof destinations, and compatible_deep_unqualified
keeps the parameter and return types aligned.

Discarding noreturn does not change the calling convention. The full
rationale is in docs/misra/deviations.rst.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
---
CI test pipeline:
https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/2941365256

Changes in v2:
- do not claim that discarding noreturn leaves compiler behavior unchanged
- write that code after the call is unreachable, and that Xen's behavior
  is the same (whether the compiler deletes that code or leaves it)

Link to v1:
https://patchew.org/Xen/d68c56607781bfa829766aed36eeb31f06080fbc.1791224638.git.dmytro._5Fprokopchuk1@xxxxxxxx/
---
 automation/eclair_analysis/ECLAIR/deviations.ecl |  7 +++----
 docs/misra/deviations.rst                        | 10 ++++++----
 docs/misra/rules.rst                             |  7 ++++---
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 6cdb10a129..226793f52e 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -394,11 +394,10 @@ constant expressions are required.\""
 }
 -doc_end
 
--doc_begin="The conversion from 'void noreturn (*)(void *)' to 'void (*)(void 
*)' is safe
-because the semantics of the 'noreturn' attribute do not alter the calling 
convention or behavior of the resulting code."
+-doc_begin="The conversion from a noreturn function pointer to a function 
pointer with a compatible signature does not alter the calling convention."
 -config=MC3A2.R11.1,casts+={safe,
-  "kind(bitcast)&&to(type(pointer(inner(return(builtin(void))&&all_param(1, 
pointer(builtin(void)))))))&&from(expr(skip(!syntactic(),
-   ref(property(noreturn)))))"} 
+  
"kind(bitcast)&&to(type(canonical(__function_pointer_types)))&&from(expr(skip(!syntactic(),
+   ref(property(noreturn)))))&&relation(compatible_deep_unqualified)"}
 -doc_end
 
 -doc_begin="The conversion from a pointer to an incomplete type to unsigned 
long does not lose any information, provided that the target type has enough 
bits to store it."
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 6bcc2adf95..430811b39d 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -392,10 +392,12 @@ Deviations related to MISRA C:2012 Rules:
      - Tagged as `safe` for ECLAIR.
 
    * - R11.1
-     - The conversion from 'void noreturn (*)(...)' to 'void (*)(...)' is safe
-       because the semantics of the 'noreturn' attribute do not alter the 
calling
-       convention or behavior of the resulting code, parameters handling remain
-       consistent.
+     - The conversion from a noreturn function pointer to a function pointer
+       with a compatible signature does not alter the calling convention.
+       The callee does not return, so code following a call through the
+       resulting pointer is unreachable. The compiler may delete that
+       unreachable code when it can see the noreturn callee, or it may
+       leave the code in place. Xen's behavior is the same in either case.
      - Tagged as `safe` for ECLAIR.
 
    * - R11.2
diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
index a59cf1782e..bd288bba29 100644
--- a/docs/misra/rules.rst
+++ b/docs/misra/rules.rst
@@ -435,9 +435,10 @@ maintainers if you want to suggest a change.
        and any other type
      - All conversions to integer types are permitted if the destination
        type has enough bits to hold the entire value. Conversions to bool
-       and void* are permitted. Conversions from 'void noreturn (*)(...)'
-       to 'void (*)(...)' are permitted. Conversions from [unsigned] long
-       or '(void *)' to a function pointer are permitted.
+       and void* are permitted. Conversions from a noreturn function pointer
+       to a function pointer with a compatible signature are permitted.
+       Conversions from [unsigned] long or '(void *)' to a function pointer
+       are permitted.
        Example::
 
            unsigned long func_addr = (unsigned long)&some_function;
-- 
2.43.0