Rule 11.1 states as following: "Conversions shall not be performed between a pointer to a function and any other type."
The conversion from unsigned long or (void *) to a function pointer is safe in Xen because the architectures it supports (e.g., x86 and ARM) guarantee compatible representations between these types. Configure Eclair to avoid reporting violations for conversions from unsigned long or (void *) to a function pointer. Add a compile-time assertion to the file 'xen/common/version.c' to confirm this conversion compatibility across all target platforms (assuming this file is common for all platforms). Signed-off-by: Dmytro Prokopchuk <dmytro_prokopch...@epam.com> --- Test CI pipeline: https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/1991940822 RFC thread: https://patchew.org/Xen/8cbc9e6d881661d0d7a1055cbcef5a65e20522be.1755109168.git.dmytro._5fprokopch...@epam.com/ --- automation/eclair_analysis/ECLAIR/deviations.ecl | 8 ++++++++ docs/misra/deviations.rst | 10 ++++++++++ docs/misra/rules.rst | 8 +++++++- xen/common/version.c | 11 +++++++++++ 4 files changed, 36 insertions(+), 1 deletion(-) diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl b/automation/eclair_analysis/ECLAIR/deviations.ecl index 7f3fd35a33..0083c9c505 100644 --- a/automation/eclair_analysis/ECLAIR/deviations.ecl +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl @@ -375,6 +375,14 @@ constant expressions are required.\"" } -doc_end +-doc_begin="The conversion from unsigned long or (void *) to a function pointer is safe because the architectures Xen supports (e.g., x86 and ARM) guarantee compatible representations between these types." +-config=MC3A2.R11.1,casts+={safe, + "from(type(canonical(builtin(unsigned long)||pointer(builtin(void))))) + &&to(type(canonical(__function_pointer_types))) + &&relation(definitely_preserves_value)" +} +-doc_end + -doc_begin="The conversion from a function pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour." -config=MC3A2.R11.1,casts+={safe, "from(type(canonical(__function_pointer_types))) diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst index 2119066531..74540e0565 100644 --- a/docs/misra/deviations.rst +++ b/docs/misra/deviations.rst @@ -370,6 +370,16 @@ Deviations related to MISRA C:2012 Rules: to store it. - Tagged as `safe` for ECLAIR. + * - R11.1 + - The conversion from unsigned long or (void \*) to a function pointer does + not lose any information or violate type safety assumptions if unsigned + long or (void \*) type is guaranteed to be the same bit size as a + function pointer. This ensures that the function pointer can be fully + represented without truncation or corruption. The macro BUILD_BUG_ON is + integrated into xen/common/version.c to confirm conversion compatibility + across all target platforms. + - Tagged as `safe` for ECLAIR. + * - R11.1 - The conversion from a function pointer to a boolean has a well-known semantics that do not lead to unexpected behaviour. diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst index a2e4e9f4ff..ff48a90963 100644 --- a/docs/misra/rules.rst +++ b/docs/misra/rules.rst @@ -431,7 +431,13 @@ maintainers if you want to suggest a change. - All conversions to integer types are permitted if the destination type has enough bits to hold the entire value. Conversions to bool and void* are permitted. Conversions from 'void noreturn (*)(...)' - to 'void (*)(...)' are permitted. + to 'void (*)(...)' are permitted. Conversions from unsigned long or + (void \*) to a function pointer are permitted if the source type has + enough bits to restore function pointer without truncation or corruption. + Example:: + + unsigned long func_addr = (unsigned long)&some_function; + void (*restored_func)(void) = (void (*)(void))func_addr; * - `Rule 11.2 <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_02.c>`_ - Required diff --git a/xen/common/version.c b/xen/common/version.c index 553b97ba9b..7091a6d440 100644 --- a/xen/common/version.c +++ b/xen/common/version.c @@ -217,6 +217,17 @@ void __init xen_build_init(void) #endif /* CONFIG_X86 */ } #endif /* BUILD_ID */ + +static void __init __maybe_unused build_assertions(void) +{ + /* + * To confirm conversion compatibility between unsigned long, (void *) + * and function pointers for all supported architectures. + */ + BUILD_BUG_ON(sizeof(unsigned long) != sizeof(void (*)(void))); + BUILD_BUG_ON(sizeof(void *) != sizeof(void (*)(void))); +} + /* * Local variables: * mode: C -- 2.43.0
