misra: deviate MISRA C Rule 10.1 for boolean operands of arithmetic

index 6cdb10a129..1d8f5ab657 100644
@@ -335,6 +335,10 @@ still non-negative."
 -config=MC3A2.R10.1,etypes+={safe, "stmt(operator(logical)||node(conditional_operator||binary_conditional_operator))", "dst_type(ebool||boolean)"}
 -doc_end
 
+-doc_begin="A 0-or-1 Boolean operand of binary +, -, *, <<, >>, <, >, <=, >= and of +=, -=, *=, <<=, >>= is safe. See docs/misra/deviations.rst for the full explanation."
+-config=MC3A2.R10.1,etypes+={safe, "stmt(operator(add||sub||add_assign||sub_assign||mul||mul_assign||shl||shr||shl_assign||shr_assign||lt||gt||le||ge))", "src_type(ebool||boolean)"}
+-doc_end
+
 -doc_begin="The macro ISOLATE_LSB encapsulates a well-known pattern to obtain
 a mask where only the lowest bit set in the argument is set, if any, for unsigned
 integers arguments on two's complement architectures

index 6bcc2adf95..eb2f393ec5 100644
@@ -347,6 +347,26 @@ Deviations related to MISRA C:2012 Rules:
        well-known to all Xen developers to be a comparison with 0.
      - Tagged as `safe` for ECLAIR.
 
+   * - R10.1
+     - The result of relational, equality and logical negation operators has
+       type int and value 0 or 1 (C99 6.5.8p6, 6.5.9p3, 6.5.3.3p5). An object
+       or function result of type bool has value 0 or 1 too, and it is
+       promoted to int (C99 6.3.1.2, 6.3.1.1p2). Such a value is a
+       well-defined operand of the following operators. These are the operators
+       for which that 0-or-1 operand has a clear meaning. Binary + and -
+       (and += and -=) count something if the condition holds. \* (and \*=)
+       yields the other operand if the condition holds and 0 otherwise.
+       << and >> (and <<= and >>=) extend that selection to a shift: a Boolean
+       left operand contributes 0 or 1, and a Boolean right operand is a shift
+       count of 0 or 1. The operators <, >, <= and >= compare the same 0-or-1
+       value, so false compares less than true. / and % (and /= and %=) are
+       excluded. A Boolean divisor is 0 when the condition is false, and
+       division or remainder by zero is undefined behavior (C99 6.5.5p5).
+       Unary plus, unary minus, increment and decrement are excluded too:
+       unary minus yields 0 or -1, and none of these is one of the meanings
+       above, so the rule still applies to them.
+     - Tagged as `safe` for ECLAIR.
+
    * - R10.1
      - Xen only supports architectures where signed integers are representend
        using two's complement and all the Xen developers are aware of this. For

index a59cf1782e..a7245be8c6 100644
@@ -387,6 +387,10 @@ maintainers if you want to suggest a change.
            compilers' extensions)
          - Implicit conversions to boolean for conditionals (?: if while
            for) and logical operators (! || &&)
+         - Operands of essentially Boolean type (results of relational,
+           equality and logical negation operators, objects and function
+           results of type bool) used only with binary +, -, \*, <<, >>,
+           <, >, <=, >=, +=, -=, \*=, <<= and >>=
          - The essential type model allows the constants defined by anonymous
            enums (e.g., enum { A, B, C }) to be used as operands to arithmetic
            operators, as they have a signed essential type.