MISRA C & OpenSource

[legacy]

hi guys
I am looking for a Misra C checker, I know there are commercial solutions which include a Misra C checker, I'd like to know if an open source alternative exists, and if not, I might think to implement a Misra C checker as - yet another Clang toy -

thank you in advance

[coppice]

hi guys
I am looking for a Misra C checker, I know there are commercial solutions which include a Misra C checker, I'd like to know if an open source alternative exists, and if not, I might think to implement a Misra C checker as - yet another Clang toy -

thank you in advance

I was looking for an open source Misra checker a few months ago. I found a couple of abandoned projects, but nothing useful.

[nctnico]

AFAIK GCC can do several of the checks by settings some options. Maybe there are no specific tools because the tool already exists.
For example: Try and find a GUI based CD/DVD to ISO image program for Linux. There aren't any because the dd command is so simple to use for this purpose.

[richardman]

AFAIK GCC can do several of the checks by settings some options. Maybe there are no specific tools because the tool already exists.
For example: Try and find a GUI based CD/DVD to ISO image program for Linux. There aren't any because the dd command is so simple to use for this purpose.

If only :-)

Some MISRA checks are fairly simple. Some require whole program analysis and is not trivial.

[neslekkim]

AFAIK GCC can do several of the checks by settings some options. Maybe there are no specific tools because the tool already exists.
For example: Try and find a GUI based CD/DVD to ISO image program for Linux. There aren't any because the dd command is so simple to use for this purpose.

http://www.k3b.org/
http://sourceforge.net/projects/gnomebaker/

took me 1sec, I could find lots more if I needed..

[legacy]

plenty of good reasons, I guess i'd better implement a code checker from scratch. Clang is good for that: I can allocate 3 months to the task

gcc can enforce its (ANSI-compliance) checks if invoked with

Code: [Select]

-ansi -pedantic -Wall -W


[legacy]

I forget, i need MISRA-2004 && MISRA 2012

[legacy]

looking for advice: some good commercial static analyzer?

[paf]

Not commercial, but free:
http://www.splint.org

Also free, more Windows oriented:
http://cppcheck.sourceforge.net


If you can run your C/C++ code under Unix, you should use Valgrind:
http://valgrind.org

[ale500]

We use lint, but which one, I have to look again. It is ok. But good ?....
There is QAC for instance... or klocwork I think is called, that one is a bit better and integrates with eclipse, but for multi-person teams with a versioning system... there is a bit more work needed.

One of the "strong" points of the rules are enforcing strong types, something C does not have, you should check if -ansi and -pedantic catch them.... but lint is a good start...

[coppice]

Confluence picks up quite a lot of dumb stuff that most people miss.

[paf]

Confluence picks up quite a lot of dumb stuff that most people miss.

I think the name you want is Coverity:
http://www.coverity.com

[coppice]

Confluence picks up quite a lot of dumb stuff that most people miss.

I think the name you want is Coverity:
http://www.coverity.com

AH, yes. There have been some name changes, purely to make things confusing. 

Coverity is available for free for some open source projects, and I have used it to good effect in that way. The measure of these tools is not so much what they spot, but the number of false alarms. A flood of false alarms is a dreadful time waster, and drives people away. Coverity is very good on that front.

[paf]

More stuff that may help.


LLVM static  analyzer:
http://clang-analyzer.llvm.org/checker_dev_manual.html
How to Write a Checker in 24 Hours - Clang Static Analyzer
http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf
http://linuxplumbersconf.org/2015/ocw//system/presentations/3237/original/2015-LPC-Clang-static-analyzer-kernel.pdf

 
Or something like this: 
http://frama-c.com/support.html

[ehughes]

http://www.gimpel.com/html/pcl.htm

Ask yourself what you are worth and if writing your own will be more than $389 of your time.     

If you are trying to do real MISRA check compliance for an external customer,   they will not generally accept checks from half baked tools.

[semir-t]

Hello,

Today I started using cppcheck because I need a free tool to check if my code complies with MISRA standard. I wrote simple program and I can't seem to solve this issue that I have. So for this code, a get the [main.c:19] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2].

Code: [Select]

#include <stdint.h>


int getValue (int p);

int main(void)
{
uint8_t k = 0;
uint8_t p[10];
while(1)
{
int res = getValue(k);
k++;
p[100] = 5;
}
return 0;
}

int getValue (int p)
{
int k = 0;
switch(p)
{
case(1):
{
k = p;
break;
}
case(2):
{
k = 55;
break;
}
default
{

break;
}
}
return 0;
}


I get the following report from the cppcheck:

Code: [Select]

python misra.py --rule-texts=MISRA_C_2012.txt main.c.dump
Checking main.c.dump...
Checking main.c.dump, config ...
[main.c:19] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2]
[main.c:6] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2]

MISRA rules violations found:
Required: 2

MISRA rules violated:
misra-c2012-8.2 (-): 2



[RoGeorge]

Isn't the main() function supposed to be typed last, at the end of the C source file?

[newbrain]

Isn't the main() function supposed to be typed last, at the end of the C source file?

Is that a MISRA C requirement?

In general, the answer is no.

The diagnostic is quite strange, as the function is declared with a prototype with a named parameter, it matches the definition, and it's visible both at the point of use and at the definition.

[RoGeorge]

Isn't the main() function supposed to be typed last, at the end of the C source file?

Is that a MISRA C requirement?

In general, the answer is no.

That was only a guess of mine, so I've asked to clarify, thanks for the answer.

[nctnico]

First: the parameter of main isn't named. If there is no parameter, then it should be empty. Secondly the case statement has the wrong syntax.. It should be case <value>:

[newbrain]

First: the parameter of main isn't named. If there is no parameter, then it should be empty. Secondly the case statement has the wrong syntax.. It should be case <value>:

What?
No - wrong on both counts!

First:
A function declaration with an empty parameter list is not a prototype (just a declarator, see C11 §6.7.6.3, and specifically the examples in paragraph 16).
For a prototype to specify no parameters you MUST use void, as an empty parameter list makes no statement about the arguments the function takes.
In fact, this is perfectly standard C - but bad practice (and of course not MISRA compliant!):

Code: [Select]

int f();

int f(int i)
{
     /* My function body */
}Misra C makes an explicit note that for functions taking no arguments void must be used.

Second:
The syntax is not  "case <value>:" and it's described in "6.8.4.2  The switch statement" as (paragraph 3):

The expression of each case label shall be an integer constant expression [...]

I hope you agree that (1) is a perfectly cromulent integer constant expression, as is e.g. (0xFF - 5*8 ).

[nctnico]

But the OP is putting code through a syntax checking tool with a specific rule set so all bets are off... If someone uses case(1) in code I start to doubt that person's coding skills.

[newbrain]

That was only a guess of mine, so I've asked to clarify, thanks for the answer.

"main" is obviously a very special function*, but in this respect behaves just like any other function.
It might be practical to put it a the end so that one needs not provide prototypes for functions, used in its body and defined in the same translation unit.

*Invoked at startup, possible to define with different prototypes but you should not provide one, falling off the end is equivalent to "return 0;" etc.

[newbrain]

But the OP is putting code through a syntax checking tool with a specific rule set so all bets are off... If someone uses case(1) in code I start to doubt that person's coding skills.

I also would not write that way (when using a simple literal) but it's not wrong.
Still, none of the diagnostics was referring to the switch statement - one was for main and one for the other function. 

[SiliconWizard]

Didn't realize it was an old resurected thread when I started replying...

cppcheck has partial coverage: https://cppcheck.sourceforge.io/misra.php
(It's not particularly Windows-oriented, cppcheck builds fine on Linux/MacOS and is even available as a plugin in a number of automated build tools and IDEs. It's just that there is GUI front-end for Windows, but the CLI version is perfectly adequate.)

cppcheck is quite useful in general. But as you saw, it doesn't have full MISRA-C 2012 coverage. The status is probably better than what it was in 2015 though. AFAIK, if you want FULL coverage, there aren't many open source tools and you might need to look at commercial ones.

[newbrain]

So, just for kicks, I compiled cppcheck and tested OP's code.

I get a violation for 8.4 (note that I don't have a file with the rules' text):  maybe we have different versions, I simply compiled the latest master branch.

If the function is declared as static in the prototype, the check gives a clean result - though the actual violated rule should have been 8.7:

Functions and objects should not be defined with external linkage if they are referenced in only one translation unit

"cppcheck --addon misra main.c" of course reports the out of bound access to p[].

While we use cppcheck (and other tools) at work, we do not use the MISRA addon, so I cannot say how reliable it is.

[SiliconWizard]

But the OP is putting code through a syntax checking tool with a specific rule set so all bets are off... If someone uses case(1) in code I start to doubt that person's coding skills.

I also would not write that way (when using a simple literal) but it's not wrong.
Still, none of the diagnostics was referring to the switch statement - one was for main and one for the other function. 

I do not get the diagnostic here either. Can't see what's wrong. But I suspect the problem is with the misra check semir-t is using here. As I said, MISRA-C support is not complete at this point in Cppcheck. And, I don't know what version they are using either...

Digging a bit deeper, it looks like MISRA-C support is not just incomplete in Cppcheck, but it doesn't give you exact messages either, apparently for licensing reasons if I got it right, but I dunno.
Not sure where semir-t got the rules file 'MISRA_C_2012.txt' from. It doesn't seem to be directly provided by Cppcheck. It does have a MISRA-C addon though, but won't give you detailed messages without this file.

Anyway... Running the latest Cppcheck this way on this piece of code:

Code: [Select]

cppcheck --addon=misra misrac1.cGives the following - which is not the same...

Code: [Select]

misrac1.c:14:4: error: Array 'p[10]' accessed at index 100, which is out of bounds. [arrayIndexOutOfBounds]
  p[100] = 5;
   ^
misrac1.c:4:5: style: misra violation (use --rule-texts=<file> to get proper output) [misra-c2012-8.4]
int getValue (int p);
    ^

Yes, invoking cppcheck directly instead of the python script misra.py - which will be or is already deprecated - will give you other checks apart from MISRA-C rules. And it does spot an out-of-bounds access.
And the only violated MISRA-C rule it finds is different: 8.4. But I still don't understand it here.

Point is: MISRA-C in Cppcheck is probably rather buggy. You may want to contact the author. Unfortunately, they host the project on Sourceforge, which makes collaborating and raising issues a lot less convenient than with, say, github...

[SiliconWizard]

So, just for kicks, I compiled cppcheck and tested OP's code.

I get a violation for 8.4 (note that I don't have a file with the rules' text):  maybe we have different versions, I simply compiled the latest master branch.

If the function is declared as static in the prototype, the check gives a clean result - though the actual violated rule should have been 8.7:

Functions and objects should not be defined with external linkage if they are referenced in only one translation unit

"cppcheck --addon misra main.c" of course reports the out of bound access to p[].

While we use cppcheck (and other tools) at work, we do not use the MISRA addon, so I cannot say how reliable it is.

Dang, you did the exact same thing as I did, as I was writing my previous post!

[newbrain]

Dang, you did the exact same thing as I did, as I was writing my previous post!

great minds waste their time alike!

it doesn't give you exact messages either, apparently for licensing reasons if I got it right, but I dunno.
Not sure where semir-t got the rules file 'MISRA_C_2012.txt' from. It doesn't seem to be directly provided by Cppcheck. It does have a MISRA-C addon though, but won't give you detailed messages without this file.

Yes, the official position of MISRA is that a tool (open source or not) can just use the rule numbers, as the text is copyrighted and needs licensing (the standard is quite cheap, as standards go: 15£) the do not endorse any specific tool, and they suggest to do exactly what cppcheck is doing to be in the clean.

[SiliconWizard]

Dang, you did the exact same thing as I did, as I was writing my previous post!

great minds waste their time alike!

Ahah yeah. But it's not a complete waste of time, as I too use Cppcheck - just not with MISRA-C rules - and routinely recommend it. At least we now know where it stands regarding MISRA-C. And it doesn't look that good so far. Point is, people having to comply with MISRA-C are likely to work in environments that will hardly tolerate false positives, as they often rely on automated systems that won't tolerate any rule violation.

[newbrain]

But it's not a complete waste of time, as I too use Cppcheck - just not with MISRA-C rules - and routinely recommend it.

Absolutely not - I was also curious and it has quite a bit of relevance with (a part of) my work.
We use this open source checker from Ericsson, based on clang-tidy and clang-analyzer but that can include and store the results from many others tools (cppcheck included) and has some pretty visualization.

[SiliconWizard]

We use this open source checker from Ericsson, based on clang-tidy and clang-analyzer but that can include and store the results from many others tools (cppcheck included) and has some pretty visualization.

I'll check it out.

[SiliconWizard]

And anyone interested, there is an official example suite for MISRA-C 2012: https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite
That gives examples of compliant and non-compliant code for every rule.

[JPortici]

yeeeeah... CppCheck gives a number of bogus warnings regarding misra, also can't recognize interrupt functions (probably because it ignores nonstandard features like __attribute__)  so i get bogus warnings about unused functions.
And i haven't been able to produce a rules file from the standard, i don't understand what you need to do (and all the just use/just do on the support forum don't work with the copy protected PDFs of the standard) so i used the modified cppcheck in MPLABX.

But all in all it helped me from time to time, would recommend as it also gives lots of warnings that GCC doesn't (or i'd rather have to say the GCC version i am bound to use, which is 4.2.8 or something)

But it's not a complete waste of time, as I too use Cppcheck - just not with MISRA-C rules - and routinely recommend it.

Absolutely not - I was also curious and it has quite a bit of relevance with (a part of) my work.
We use this open source checker from Ericsson, based on clang-tidy and clang-analyzer but that can include and store the results from many others tools (cppcheck included) and has some pretty visualization.

but this looks really cool. i have to check it out

[semir-t]

Thank you for your answers.
 
Because this is my first encounter with the cppcheck, the idea behind my code was to try to trigger cppcheck and see what kind of error/warning messages I would get. And all of the stuff that you mentioned that are used in the code are deliberate (access array out of boundaries etc...). But what puzzled me is the error message  (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2], because for each function I have named parameters (in definition and declaration).

Yes, I assume that commercial applications are way better and we do have one in mind. Problem is that this application is linked to the PC, so only one person can use it. So our idea was to try to get some free version that would help our team develop the code  which will be as closely as possible compliant with the MISRA standard.  Frequently we would use commercial app to solve all the issues.

[JPortici]

for example, both GCC (version included in XC16 v1.70 is 4.5.1) and CPPCheck are failing to recognize that this statement

Code: [Select]

flashStatus.flags.writeSetupPending;has not effect. This was making me crazy.

definition

Code: [Select]

typedef volatile struct {
  union {
    uint16_t word;
    struct {
      unsigned readSetupPending:1;  //Setup Read pending
      unsigned eraseSetupPending:1; //Setup Erase pending
      unsigned writeSetupPending:1; //Setup Write pending
      unsigned :2;
      unsigned readUDIDPending:1;   //UDID Read Pending
      unsigned :6;
      unsigned resetPending:1;      //Reset Pending after Page Erase
      unsigned setupDataReady:1;    //Setup Data Ready
      unsigned setupUpdated:1;      //Setup Updated
      unsigned error:1;             //Flash Programming Error
    };
  } flags;
  int16_t flashSaveCnt;
} flashStatus_t;

[newbrain]

for example, both GCC (version included in XC16 v1.70 is 4.5.1) and CPPCheck are failing to recognize that this statement

Code: [Select]

flashStatus.flags.writeSetupPending;has not effect. This was making me crazy.

definition

Code: [Select]

typedef volatile struct {
[...]
} flashStatus_t;

But it has an effect!
Since the typedef is volatile, the expression statement represents a read access to writeSetupPending and the volatile semantic forces the access to happen.

Removing volatile, gcc and clang warn about the statement having no effect, if one uses -Wall, or the specific -Wunused-value flag.

[JPortici]

for example, both GCC (version included in XC16 v1.70 is 4.5.1) and CPPCheck are failing to recognize that this statement

Code: [Select]

flashStatus.flags.writeSetupPending;has not effect. This was making me crazy.

definition

Code: [Select]

typedef volatile struct {
[...]
} flashStatus_t;

But it has an effect!
Since the typedef is volatile, the expression statement represents a read access to writeSetupPending and the volatile semantic forces the access to happen.

Removing volatile, gcc and clang warn about the statement having no effect, if one uses -Wall, or the specific -Wunused-value flag.

Ah, of course.
Disregard this particular example then

[SiliconWizard]

Yes, I assume that commercial applications are way better and we do have one in mind. Problem is that this application is linked to the PC, so only one person can use it. So our idea was to try to get some free version that would help our team develop the code  which will be as closely as possible compliant with the MISRA standard.  Frequently we would use commercial app to solve all the issues.

As you can see, the MISRA addon of Cppcheck gives a lot of false positives. You can actually run it on the official MISRA examples I linked to, and see for yourself. It does spot a lot of true violations, but also find ones that aren't... May still be kind of useful as first check, but it's likely to make you waste a lot of time.

If you use Eclipse (which I don't), there is a plugin that you may try as well: https://github.com/stkim123/kr.ac.jbnu.ssel.misrac

[Kalvin]

In C, the switch statement's default is supposed to be followed by a colon. A syntax error like this may/will affect the parser/analyzer, so all syntax errors need to be fixed first before analyzing the actual analyzer output.