2

I have a bare-metal program(driver) which reads/writes some memory-mapped registers. e.g:

void foo_read(uint64_t reg_base, uint32_t *out_value)
{
    *out = READREG(reg_base + FOO_REG_OFFSET);
}
  • reg_base is the base address of the memory-mapped device (64-bit address)
  • FOO_REG_OFFSET is the offset of the register (#define FOO_REG_OFFSET 0x00000123). Register "foo" is 32-bit "wide".

READREG is defined like this:

#define READREG(address)    (*(uint32_t*)(address))

As you can guess MISRA 2008 is not happy with the cast from unsigned long long to pointer (5-2-7/5-2-8 are reported). My question is: what is the best/appropriate way to access memory and get rid of MISRA warnings? I've tried to cast to uintptr_t before casting to pointer, but This didn't help.

Thank you.

8
  • 2
    A rather obvious question: since reg_base is actually a pointer, why not type it as uint8_t*? Commented Oct 28, 2016 at 15:21
  • 1
    @hidefromkgb: Or uint32_t*, If reg_base really needs to be an integer, why use uint64_t rather than uintptr_t? (MISRA probably wouldn't like that either, but intptr_t or uintptr_t is the most logical type to for an integer holding a pointer value.) Commented Oct 28, 2016 at 19:45
  • 1
    @KeithThompson, wouldn`t uint32_t* multiply FOO_REG_OFFSET by 4 when adding to reg_base? Commented Oct 28, 2016 at 19:58
  • @hidefromkgb: It depends on the exact meaning of FOO_REG_OFFSET. Is it an offset in bytes or in 32-bit words? I might use unsigned char* rather than uint8_t* -- though they're nearly equivalent on any system where uint8_t exists. Commented Oct 28, 2016 at 20:01
  • Guys, reg_base comes from a higher layer and it's an 64-bit address (e.g: 0xffffff8001218000). FOO_REG_OFFSET is offset in bytes.
    – AndreiSS
    Commented Oct 29, 2016 at 8:45

1 Answer 1

1

OK a few things here - first of all, your definition for READ_REG is missing a volatile -- it should be something like

#define READREG(address)    (*(uint32_t volatile *)(address))

Secondly - and this is CPU-specific of course - generally speaking, reading a 32-bit value from an odd address (offset 0x123) won't work - at a minimum it will be slow (multiple bus cycles), and on many architectures, you'll hit a processor exception. (BTW, please note that pointer arithmetic doesn't come into play here, since the 2 values are added before being cast to a pointer.)

To answer your original question:

what is the best/appropriate way to access memory and get rid of MISRA warnings

Well -- you are violating a MISRA rule (you have to in this case, we've all been there...) so you will get a warning.

So what you need to do is suppress the warning(s) in a disciplined, systematic and easily identifiable way. In my opinion, there is no better example and explanation of this than in the Quantum Platform (QP) Event-driven framework's code, which is open source. Specifically:

  • Check out the QP's MISRA Compliance matrix for examples of how this is handled -- for example, just search the PDF for the Q_UINT2PTR_CAST macro
  • Check out the QP's actual source code - for example, the macro that wraps/encapsulates such "int to ptr" casts (this way they are done in a manner that is easy to identify, and easy to change/suppress warnings for in a single place)
  • Lastly, check out the PC-Lint config file qpc.lnt, where you can see how/where the warnings are suppressed in a single place. THis is explained in this app note, section 6.3:

6.3 Rule 5-2-8(req)

An object with integer type or pointer to void type shall not be converted to an object with pointer type.

The QP/C++ applications might deviate from rule 5-2-8 when they need to access specific hard-coded hardware addresses directly. The QP/C++ framework encapsulates this deviation in the macro Q_UINT2PTR_CAST(). The following code snippet provides a use case of this macro: #define QK_ISR_EXIT() . . . \ *Q_UINT2PTR_CAST(uint32_t, 0xE000ED04U) = \

I don't have time to talk about MISRA warning suppresions, compliance issues, etc. but the above gives you everything you need.

P.S. Not sure which MISRA guidelines you are referring to -- for C, there are the 2004 & 2012 guidelines, and for C++, there are the 2008 guidelines (I know, it's almost 2017!)

2
  • #define FOO_REG_OFFSET 0x00000123 was just an example. Of course I don't have odd offsets.
    – AndreiSS
    Commented Oct 31, 2016 at 7:22
  • @AndreiSS - of course you don't. You also don't have an accepted answer for this question.
    – Dan
    Commented Dec 4, 2016 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.