MISRA-C2012

11 minute read

Overview

XWOS code is generally written in compliance with MISRA-C:2012 standards. However, some MISRA-C:2012 rules are not conducive to writing an operating system, so XWOS code tends to prefer better performance and the use of newer language features.

This document describes in detail the method for MISRA-C:2012 checking and the degree of compliance with the MISRA-C:2012 standard.

MISRA-C:2012 Checking Method

Use the misra plugin of the cppcheck tool.

cppcheck -I. -I$(XWOS_ARCH_DIR) -I$(XWOS_CPU_DIR) -I$(XWOS_SOC_DIR) -I$(XWOS_BRD_DIR) \
  --force --addon=misra --cppcheck-build-dir=$(CPPCHECK_OUT) \
  --template=gcc --inline-suppr --suppressions-list=xwbs/util/cppcheck/misra-c2012-suppressions.txt
  -i ignore_path src_path

Degree of Compliance with MISRA-C:2012

Globally Disabled Rules

uninitvar
- Reason for disabling: False positive. In practice, uninitialized variables are treated as errors by the compiler.
misra-c2012-1.4: Emergent language features shall not be used
- Reason for disabling: As a long-term continuously maintained project, XWOS tends to introduce new language features in new versions.
misra-c2012-2.3: A project should not contain unused type declarations
- Reason for disabling: The operating system, as a basic environment of an ecosystem, defines types, macros, functions, and symbols that may be used in various derivative projects.
misra-c2012-2.4: A project should not contain unused tag declarations
- Reason for disabling: The operating system, as a basic environment of an ecosystem, defines types, macros, functions, and symbols that may be used in various derivative projects.
misra-c2012-2.5: A project should not contain unused macro declarations
- Reason for disabling: The operating system, as a basic environment of an ecosystem, defines types, macros, functions, and symbols that may be used in various derivative projects.
misra-c2012-3.1: The character sequences /* and // shall not be used within a comment
- Reason for disabling: XWOS uses doxygen to extract comments for documentation generation. URLs in documentation inevitably contain //, for example https://.... Apart from this case, // is prohibited in comments.
misra-c2012-5.9: Identifiers that define objects or functions with internal linkage should be unique
- Reason for disabling: When header files containing static inline functions are used in multiple places, the inline functions are considered duplicate definitions.
misra-c2012-8.7: Functions and objects should not be defined with external linkage if they are referenced in only one translation unit
- Reason for disabling: APIs provided by XWOS are not necessarily used by itself. For MISRA-C2012 checking tools, they may report an error because a symbol is only found once.
misra-c2012-8.9: An object should be defined at block scope if its identifier only appears in a single function
- Reason for disabling: Some data is defined as global in order to be placed in specific sections during linking.
misra-c2012-11.3: A cast shall not be performed between a pointer to object type and a pointer to a different object type
- Reasons for disabling:
  - 1. XWOS’s various types of atomic operations and bit operations are implemented by converting to 8-bit, 16-bit, 32-bit, and 64-bit basic types based on bit width;
  - 1. Dynamic memory management;
  - 1. C language object-oriented programming.
misra-c2012-11.4: A conversion should not be performed between a pointer to object and an integer type
- Reasons for disabling:
  - 1. Code at the instruction and register level;
  - 1. Implementation of the xwcc_derof() macro;
  - 1. Dynamic memory management;
  - 1. C language object-oriented programming.
misra-c2012-11.5: A conversion should not be performed from pointer to void into pointer to object
- Reasons for disabling:
  - 1. Dynamic memory management;
  - 1. Variable-length messages in communication protocols;
  - 1. Callback function user parameters are generic pointers.
misra-c2012-11.6: A cast shall not be performed between pointer to void and an arithmetic type
- Reasons for disabling:
  - 1. XWOS treats pointer values from -1 to -4095 as error code pointers. However, pointers are unsigned integers. They are therefore represented in two’s complement form. -1 is 0xFFFFFFFF, -4095 is 0xFFFFF001.
  - 1. Dynamic memory management.
misra-c2012-15.1: The goto statement should not be used
- Reason for disabling: XWOS only uses goto in the following two cases:
  - 1. Some core algorithms within XWOS (e.g., red-black trees) use goto to improve efficiency.
    - 1.1. Because these types of code are heavily used throughout the kernel, efficiency is the primary consideration;
    - 1.2. These types of code have been the most thoroughly verified and have the highest stability and safety.
  - 1. XWOS uses goto to handle error return paths in code.
    - 2.1. If code contains a large number of operations, each with a return value, using if...else... would result in deeply nested code. Using goto makes the code more elegant and readable;
    - 2.2. If code contains a large number of operations, each with a corresponding undo operation, where operations and undo operations must follow a LIFO “stack” structure, using if...else... can easily lead to missing undo operations or incorrect ordering. Using goto perfectly solves this problem.

/* If there are many operations, using `if...else...` will make the code lines too long,
 * and anti_operationX() is easily misplaced or omitted.
 */
int func1(void)
{
        rc = operation1();
        if (0 == rc) {
                rc = operation3();
                if (0 == rc) {
                        rc = operation8();
                        if (0 == rc) {
                                rc = operation2();
                                if (0 == rc) {
                                        rc = operation6();
                                        if (0 == rc) {
                                                rc = operation5();
                                                if (0 == rc) {
                                                } else {
                                                        anti_operation6();
                                                }
                                        } else {
                                                anti_operation2();
                                        }
                                } else {
                                        anti_operation8();
                                }
                        } else {
                                anti_operation3();
                        }
                } else {
                    anti_operation1();
                }
        } else {
        }
        return rc;
}

/* Using `goto` avoids the two problems of `if...else...` described above. */
int func2(void)
{
        rc = operation1();
        if (rc < 0) {
                goto err_operation1;
        }
        rc = operation3();
        if (rc < 0) {
                goto err_operation3;
        }
        rc = operation8();
        if (rc < 0) {
                goto err_operation8;
        }
        rc = operation2();
        if (rc < 0) {
                goto err_operation2;
        }
        rc = operation6();
        if (rc < 0) {
                goto err_operation6;
        }
        rc = operation5();
        if (rc < 0) {
                goto err_operation5;
        }
        return rc;

        anti_operation5();
err_operation5:
        anti_operation6();
err_operation6:
        anti_operation2();
err_operation2:
        anti_operation8();
err_operation8:
        anti_operation3();
err_operation3:
        anti_operation1();
err_operation1:
        return rc;
}

misra-c2012-17.1: The features of <stdarg.h> shall not be used
- Reason for disabling: Language features should not be completely prohibited.
misra-c2012-18.8: Variable-length array types shall not be used
- Reason for disabling: Variable-length arrays are a feature introduced in the C99 standard. XWOS tends to introduce new language features in new versions.
misra-c2012-19.2: The union keyword should not be used
- Reason for disabling: When writing an operating system, it is inevitably necessary to convert memory addresses to pointers of different types. Using union can avoid direct conversion of void *, improving readability.
misra-c2012-20.9: All identifiers used in the controlling expression of #if or #elif preprocessing directives shall be #define’d before evaluation
- Reason for disabling: The checking tool gives false positives, but XWOS code follows this rule.
misra-c2012-21.1: #define and #undef shall not be used on a reserved identifier or reserved macro name
- Reason for disabling: The C language reserves any symbol starting with _. However, some symbols come from compiler extended syntax, such as __attribute__((x)). They are usually defined as macros starting with two underscores to show their difference from normal variables, functions, and macros.
misra-c2012-21.3: The memory allocation and deallocation functions of <stdlib.h> shall not be used
- Reason for disabling: Completely prohibiting dynamic memory management is not conducive to introducing high-level languages. Dynamic memory management should only be prohibited when the safety level is very high, in which case some features such as the Lua language also cannot be used.
misra-c2012-21.6: The Standard Library input/output functions shall not be used
- Reason for disabling: Functions from stdio.h have been redefined within XWOS.
misra-c2012-21.10: The Standard Library time and date functions shall not be used
- Reason for disabling: Functions from time.h have been redefined within XWOS.

Rules Disabled for Specific Files

misra-c2012-2.7: There should be no unused parameters in functions
- Reason for disabling: This header file contains functions at the CPU architecture instruction level. These functions are written using inline assembly syntax. At the C syntax level, some parameters appear unused, but in practice, these parameters are used through registers according to EABI rules.
  - Applicable scope:
    - xwcd/soc/arm/v6m/armv6m_isa.h
    - xwcd/soc/arm/v7m/armv7m_isa.h
    - xwcd/soc/powerpc/e200x/e200x_isa.h
    - xwcd/soc/riscv/nuclei/riscv_isa.h
misra-c2012-5.7: A tag name shall be a unique identifier
- Reason for disabling: Anonymous structures being considered as duplicate tag name is a false positive.
  - Applicable scope:
    - xwcd/soc/arm/v6m/armv6m_isa.h
    - xwcd/soc/arm/v7m/armv7m_isa.h
    - xwcd/soc/powerpc/e200x/e200x_isa.h
    - xwcd/soc/riscv/nuclei/riscv_isa.h
    - xwcd/ds/uart/common.h
    - xwcd/ds/uart/controller.h
    - xwcd/ds/soc/chip.h
    - xwos/lib/xwbop.c
    - xwos/mp/skd.h
    - xwos/up/skd.h
    - xwos/mp/thd.h
    - xwos/up/thd.h
    - xwos/mp/sync/obj.h
    - xwos/up/sync/obj.h
    - xwos/mm/mempool/objcache.h
    - xwos/mm/mempool/page.h
    - xwmd/isc/xwssc/protocol.h
    - xwmd/libc/newlibac/lock.c
    - xwmd/libc/picolibac/lock.c
- Reason for disabling: Symbols required by libc
  - Applicable scope:
    - xwmd/libc/newlibac/lock.c
    - xwmd/libc/picolibac/lock.c
misra-c2012-5.8: A tag name shall be a unique identifier
- Reason for disabling: Member names within structures are in the structure’s namespace and will not conflict with external symbols.
  - Applicable scope:
    - xwmd/isc/xwssc/hwifal.h
    - xwos/mm/mempool/i_allocator.h
    - xwmd/libc/picolibcac/mem.c
    - xwos/mm/mempool/page.h
- Reason for disabling: Rewriting standard libc functions.
  - Applicable scope:
    - xwmd/libc/picolibcac/fops.c
misra-c2012-8.4: A compatible declaration shall be visible when an object or function with external linkage is defined
- Reason for disabling: False positive
  - Applicable scope:
    - xwos/ospl/xwosplcb.c
- Reason for disabling: Rust’s ffi is not linked at the C language level.
  - Applicable scope:
    - xwmd/xwrust/ffi/*.c
misra-c2012-8.5: An external object or function shall be declared once in one and only one file
- Reason for disabling: xwos/ospl/soc/*.h is the code of the OS port layer. Symbols are re-declared for summarization and emphasis, reminding users that definitions for these symbols must be provided during porting.
  - Applicable scope:
    - xwos/ospl/soc/*.h
    - xwos/lib/xwbop.h
    - xwos/lib/lfq.h
- Reason for disabling: False positive
  - Applicable scope:
    - xwmd/libc/newlibac/*.c
    - xwmd/libc/picolibcac/*.c
misra-c2012-8.6: An identifier with external linkage shall have exactly one external definition
- Reason for disabling: False positive
  - Applicable scope:
    - xwmd/libc/newlibac/*.c
    - xwmd/libc/picolibcac/*.c
misra-c2012-8.14: The restrict type qualifier shall not be used
- Reason for disabling: Rewriting standard libc functions.
  - Applicable scope:
    - xwmd/libc/newlibac/string.c
    - xwmd/libc/picolibcac/string.c
    - xwmd/libc/newlibac/time.c
    - xwmd/libc/picolibcac/time.c
misra-c2012-9.2: The initializer for an aggregate or union shall be enclosed in braces
- Reason for disabling: False positive
  - Applicable scope:
    - xwmd/libc/newlibac/fops.c
    - xwmd/libc/picolibcac/fops.c
misra-c2012-9.3: Arrays shall not be partially initialized
- Reason for disabling: False positive
  - Applicable scope:
    - xwmd/libc/newlibac/fops.c
    - xwmd/libc/picolibcac/fops.c
misra-c2012-10.8: The value of a composite expression shall not be cast to a different essential type category or a wider essential type
- Reason for disabling: Macro-defined expressions are composite expressions, requiring the use of explicit type casts.
  - Applicable scope:
    - xwos/mm/mempool/page.c
misra-c2012-11.1: Conversions shall not be performed between a pointer to a function and any other type
- Reason for disabling: Necessary conversion from the OS abstraction layer to the implementation layer.
  - Applicable scope:
    - xwos/osal/thd.h
    - xwos/osal/swt.h
misra-c2012-12.3: The comma operator should not be used
- Reason for disabling: XWOS’s linked list (xwos/lib/bclst.h) iteration operation macros must use comma expressions for their definitions.
  - Applicable scope:
    - xwos/mp/skd.c
    - xwos/up/skd.c
misra-c2012-14.2: A for loop shall be well-formed
- Reason for disabling: XWOS’s linked list (xwos/lib/bclst.h) iteration operations are too complex, so macros are used to simplify the code.
  - Applicable scope:
    - xwos/mp/skd.c
    - xwos/up/skd.c
misra-c2012-15.2: The goto statement shall jump to a label declared later in the same function
- Reason for disabling: This part of the code is critical for XWOS’s low interrupt latency. Real-time performance and efficiency must be prioritized, so goto had to be used.
  - Applicable scope:
    - xwos/mp/tt.c
    - xwos/up/tt.c
- Reason for disabling: False positive.
  - Applicable scope:
    - xwmd/isc/xwssc/mif.c
misra-c2012-15.4: There should be no more than one break or goto statement used to terminate any iteration statement
- Reason for disabling: This part of the code is critical for XWOS’s low interrupt latency. Real-time performance and efficiency must be prioritized, so goto had to be used.
  - Applicable scope:
    - xwos/mp/tt.c
    - xwos/up/tt.c
- Reason for disabling: Using only one break or goto in high-usage code affects efficiency.
  - Applicable scope:
    - xwos/up/skd.c
    - xwos/mp/sync/evt.c
    - xwos/up/sync/evt.c
    - xwmd/isc/xwssc/hwifal.c
    - xwmd/isc/xwssc/protocol.c
misra-c2012-15.5: A function should have a single point of exit at the end
- Reason for disabling: Function parameter validation code is defined as a macro that contains a return.
  - Applicable scope:
    - xwmd/isc/xwssc/mif.c
misra-c2012-17.2: Functions shall not call themselves, either directly or indirectly
- Reason for disabling: This part of the code is key to XWOS’s innovative interrupt-enabled scheduling technique, requiring recursive functions for its implementation. This code has been verified thoroughly enough that its stability and safety are not a concern.
  - Applicable scope:
    - xwos/mp/skd.c
    - xwos/up/skd.c
misra-c2012-17.7: The value returned by a function having non-void return type shall be used
- Reason for disabling: C library functions like memset() and memcpy() have return values, but they are not used here.
  - Applicable scope:
    - xwos/mp/rtrq.c
    - xwos/up/rtrq.c
    - xwos/mp/sync/evt.c
    - xwos/up/sync/evt.c
    - xwmd/isc/xwcq/xwcq.c
    - xwmd/isc/xwssc/hwifal.c
    - xwmd/isc/xwssc/mif.c
    - xwmd/isc/xwssc/protocol.c
    - xwmd/libc/newlibac/mif.c
    - xwmd/libc/picolibcac/mif.c
    - xwmd/libc/newlibac/mem.c
    - xwmd/libc/picolibcac/mem.c
- Reason for disabling: Use of cppcheck-suppress [misra-c2012-17.7] annotation where return values are determined not to be used.
  - Applicable scope:
    - xwos/init.c
    - xwos/mp/lock/mtx.c
    - xwos/up/lock/mtx.c
    - xwos/mp/lock/spinlock.c
    - xwos/up/lock/seqlock.c
    - xwmd/isc/xwssc/mif.c
    - xwmd/isc/xwssc/protocol.c
    - xwos/mm/mempool/objcache.c
    - xwos/mm/mempool/allocator.c
    - xwos/mm/mempool/page.c
misra-c2012-17.8: A function parameter should not be modified
- Reason for disabling: To pursue efficiency and memory usage, this rule is not followed.
  - Applicable scope:
    - xwos/lib/xwbop.c
    - xwos/mm/bma.c
    - xwos/mm/mempool/objcache.c
    - xwos/mm/mempool/page.c
    - xwos/mm/mempool/allocator.c
    - xwos/mp/lock/mtx.c
    - xwos/up/lock/mtx.c
    - xwmd/isc/xwssc/protocol.c
    - xwmd/libc/newlibac/string.c
    - xwmd/libc/picolibcac/string.c
misra-c2012-20.7: Expressions resulting from the expansion of macro parameters shall be enclosed in parentheses
- Reason for disabling: This part of the code uses macros to emulate C++ function templates, where type name parameters cannot be enclosed in parentheses.
  - Applicable scope:
    - xwos/lib/xwaop.h
    - xwos/lib/xwbop.h
- Reason for disabling: This part of the code uses macros to define arrays, where array name parameters cannot be enclosed in parentheses.
  - Applicable scope:
    - xwos/mm/bma.h
    - xwos/mm/mempool/allocator.h
    - xwmd/isc/xwssc/mif.h
    - xwmd/isc/xwcq/mif.h
misra-c2012-20.10: The # and ## preprocessor operators should not be used
- Reason for disabling: This part of the code uses macros to emulate C++ function templates, requiring the use of # and ##.
  - Applicable scope:
    - xwos/lib/xwaop.h
    - xwos/lib/xwbop.h
misra-c2012-20.12: A macro parameter used as an operand to the # or ## operators, which is itself subject to further macro replacement, shall only be used as an operand to these operators
- Reason for disabling: This part of the code uses macros to emulate C++ function templates.
  - Applicable scope:
    - xwos/lib/xwaop.h
    - xwos/lib/xwbop.h
misra-c2012-21.2: A reserved identifier or macro name shall not be declared
- Reason for disabling: Rewriting standard libc functions.
  - Applicable scope:
    - xwmd/libc/newlibac/string.c
    - xwmd/libc/picolibcac/string.c
    - xwmd/libc/picolibcac/fops.c
    - xwmd/libc/picolibcac/mem.c
misra-c2012-21.4: The standard header file <setjmp.h> shall not be used
- Reason for disabling: Language features should not be completely prohibited. XWOS provides support for <setjmp.h>.
  - Applicable scope:
    - xwmd/libc/newlibac/setjmp.c
    - xwmd/libc/picolibcac/setjmp.c

Last modified July 7, 2026: chore: :tade: 创建玄武操作系统网站 (1c12f7d)