如何解决MISRA C：2012规则11.6？

Question

I am utilizing Microchip sample nvmem.c file function to write data into particular memory address of PIC32 Microcontroller. When I am trying to use it showing following MISRA error: I just posted sample code where I got an error. My whole code is compiled and working fine.

1] explicit cast from 'unsigned int' to 'void ' [MISRA 2012 Rule 11.6, required] at NVMemWriteWord((void )APP_FLASH_MARK_ADDRESS,(UINT)_usermark);

How can I resolve this error?

nvmem.c
uint8_t NVMemWriteWord(void* address, uint32_t data)
{
    uint8_t res;
    NVMADDR = KVA_TO_PA((uint32_t)address); //destination address to write
    NVMDATA = data;
    res = NVMemOperation(NVMOP_WORD_PGM);
}

test.c
#define ADDRESS 0x9D007FF0U;
NVMemWriteWord((void*)ADDRESS,(uint32_t)_usermark);

Answer 1

Use

uint8_t NVMemWriteWord(unsigned int  address, uint32_t data)
{
    uint8_t res;
    NVMADDR = KVA_TO_PA(address);
    NVMDATA = data;
    res = NVMemOperation(NVMOP_WORD_PGM);
}

and

#define  ADDRESS  0x9D007FF0U

NVMemWriteWord(ADDRESS,(uint32_t)_usermark);

instead. Functionally it is exactly equivalent to the example, it just avoids the cast from a void pointer to an unsigned integer address.

Answer 2

Suggest:

#define ADDRESS (volatile uint32_t*)0x9D007FF0U
NVMemWriteWord( ADDRESS, _usermark) ;

Never cast to void* - the purpose of void* is that you can assign any other pointer type to it safely and without explicit cast. The cast of _usermark may or may not be necessary, but unnecessary explicit casts should be avoided - they can suppress important compiler warnings. You should approach type conversions in the following order of preference:

• Type agreement - exactly same types.
• Type compatibility - smaller type to larger type, same signedness.
• Type case - last resort (eg larger to smaller type, signedness mismatch, integer to/from pointer).

In this instance since NVMemWriteWord simply casts address to an integer, then the use of void* may not be appropriate. If in other contexts you are actually using a pointer, then it may be valid.

Answer 3

The whole of MISRA-C:2012 chapter 12 regarding pointer conversions is quite picky. And rightly so, since this is very dangerous territory.

11.6 is a sound rule that bans conversions from integers to void* . The rationale is to block alignment bugs. There aren't many reasons why you would want to do such conversions anyway.

Notably, there's also two rigid but advisory rules 11.4 which bans conversions from integers to pointers, and 11.5 which pretty much bans the use of void* entirely. It isn't possible to do hardware-related programming and follow 11.4, so that rule has to be ignored. But you have little reason to use void* .

In this specific cast you can get away by using uint32_t and avoiding pointers entirely.

In the general case of register access, you must do a conversion with volatile -qualified pointers: (volatile uint32_t*)ADDRESS , assuming that the MCU uses 32 bit registers.