MISRA C & OpenSource - Page 1
Forum section: electronics / general

author: legacy
author_rank: Super Contributor
timestamp: November 18, 2015, 07:13:49 am
content: hi guysI am looking for a Misra C checker, I know there are commercial solutions which include a Misra C checker, I'd like to know if an open source alternative exists, and if not, I might think to implement a Misra C checker as - yet another Clang toy -thank you in advance

author: coppice
author_rank: Super Contributor
timestamp: November 18, 2015, 07:22:00 am
content: Quote from: legacy on November 18, 2015, 07:13:49 amI was looking for an open source Misra checker a few months ago. I found a couple of abandoned projects, but nothing useful.

author: nctnico
author_rank: Super Contributor
timestamp: November 18, 2015, 07:49:18 am
content: AFAIK GCC can do several of the checks by settings some options. Maybe there are no specific tools because the tool already exists.For example: Try and find a GUI based CD/DVD to ISO image program for Linux. There aren't any because the dd command is so simple to use for this purpose.

author: richardman
author_rank: Frequent Contributor
timestamp: November 18, 2015, 08:00:18 am
content: Quote from: nctnico on November 18, 2015, 07:49:18 amIf only :-)Some MISRA checks are fairly simple. Some require whole program analysis and is not trivial.

author: neslekkim
author_rank: Super Contributor
timestamp: November 18, 2015, 09:10:26 am
content: Quote from: nctnico on November 18, 2015, 07:49:18 amhttp://www.k3b.org/http://sourceforge.net/projects/gnomebaker/took me 1sec, I could find lots more if I needed..

author: legacy
author_rank: Super Contributor
timestamp: November 18, 2015, 09:40:54 am
content: plenty of good reasons, I guess i'd better implement a code checker from scratch. Clang is good for that: I can allocate 3 months to the taskgcc can enforce its (ANSI-compliance) checks if invoked withCode:-ansi -pedantic -Wall -W

author: legacy
author_rank: Super Contributor
timestamp: November 18, 2015, 09:41:36 am
content: I forget, i need MISRA-2004 && MISRA 2012

author: legacy
author_rank: Super Contributor
timestamp: November 19, 2015, 12:46:44 pm
content: looking for advice: some good commercial static analyzer?

author: paf
author_rank: Regular Contributor
timestamp: November 19, 2015, 02:17:28 pm
content: Not commercial, but free:http://www.splint.orgAlso free, more Windows oriented:http://cppcheck.sourceforge.netIf you can run your C/C++ code under Unix, you should use Valgrind:http://valgrind.org

author: ale500
author_rank: Frequent Contributor
timestamp: November 19, 2015, 04:53:44 pm
content: We use lint, but which one, I have to look again. It is ok. But good ?....There is QAC for instance... or klocwork I think is called, that one is a bit better and integrates with eclipse, but for multi-person teams with a versioning system... there is a bit more work needed.One of the "strong" points of the rules are enforcing strong types, something C does not have, you should check if -ansi and -pedantic catch them.... but lint is a good start...

author: coppice
author_rank: Super Contributor
timestamp: November 19, 2015, 04:56:54 pm
content: Confluence picks up quite a lot of dumb stuff that most people miss.

author: paf
author_rank: Regular Contributor
timestamp: November 19, 2015, 05:39:31 pm
content: Quote from: coppice on November 19, 2015, 04:56:54 pmI think the name you want is Coverity:http://www.coverity.com

author: coppice
author_rank: Super Contributor
timestamp: November 20, 2015, 12:02:03 am
content: Quote from: paf on November 19, 2015, 05:39:31 pmAH, yes. There have been some name changes, purely to make things confusing.Coverity is available for free for some open source projects, and I have used it to good effect in that way. The measure of these tools is not so much what they spot, but the number of false alarms. A flood of false alarms is a dreadful time waster, and drives people away. Coverity is very good on that front.

author: paf
author_rank: Regular Contributor
timestamp: November 23, 2015, 06:15:33 pm
content: More stuff that may help.LLVM static analyzer:http://clang-analyzer.llvm.org/checker_dev_manual.htmlHow to Write a Checker in 24 Hours - Clang Static Analyzerhttp://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdfhttp://linuxplumbersconf.org/2015/ocw//system/presentations/3237/original/2015-LPC-Clang-static-analyzer-kernel.pdfOr something like this:http://frama-c.com/support.html

author: ehughes
author_rank: Frequent Contributor
timestamp: November 24, 2015, 06:07:24 pm
content: http://www.gimpel.com/html/pcl.htmAsk yourself what you are worth and if writing your own will be more than $389 of your time.If you are trying to do real MISRA check compliance for an external customer, they will not generally accept checks from half baked tools.

author: semir-t
author_rank: Regular Contributor
timestamp: October 14, 2021, 02:14:39 pm
content: Hello,Today I started using cppcheck because I need a free tool to check if my code complies with MISRA standard. I wrote simple program and I can't seem to solve this issue that I have. So for this code, a get the [main.c:19] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2].Code:#include <stdint.h>int getValue (int p);int main(void){uint8_t k = 0;uint8_t p;while(1){int res = getValue(k);k++;p = 5;}return 0;}int getValue (int p){int k = 0;switch(p){case(1):{k = p;break;}case(2):{k = 55;break;}default{break;}}return 0;}I get the following report from the cppcheck:Code:python misra.py --rule-texts=MISRA_C_2012.txt main.c.dumpChecking main.c.dump...Checking main.c.dump, config ...[main.c:19] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2][main.c:6] (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2]MISRA rules violations found:Required: 2MISRA rules violated:misra-c2012-8.2 (-): 2

author: RoGeorge
author_rank: Super Contributor
timestamp: October 14, 2021, 02:29:56 pm
content: Isn't the main() function supposed to be typed last, at the end of the C source file?

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 02:55:56 pm
content: Quote from: RoGeorge on October 14, 2021, 02:29:56 pmIs that a MISRA C requirement?In general, the answer is no.The diagnostic is quite strange, as the function is declared with a prototype with a named parameter, it matches the definition, and it's visible both at the point of use and at the definition.

author: RoGeorge
author_rank: Super Contributor
timestamp: October 14, 2021, 04:21:20 pm
content: Quote from: newbrain on October 14, 2021, 02:55:56 pmThat was only a guess of mine, so I've asked to clarify, thanks for the answer.

author: nctnico
author_rank: Super Contributor
timestamp: October 14, 2021, 04:27:58 pm
content: First: the parameter of main isn't named. If there is no parameter, then it should be empty. Secondly the case statement has the wrong syntax.. It should be case <value>:

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 04:58:07 pm
content: Quote from: nctnico on October 14, 2021, 04:27:58 pmWhat?No - wrong on both counts!First:A function declaration with an empty parameter list is not a prototype (just a declarator, see C11 §6.7.6.3, and specifically the examples in paragraph 16).For a prototype to specify no parameters you MUST use void, as an empty parameter list makes no statement about the arguments the function takes.In fact, this is perfectly standard C - but bad practice (and of course not MISRA compliant!):Code:int f();int f(int i){/* My function body */}Misra C makes an explicit note that for functions taking no arguments void must be used.Second:The syntax is not "case <value>:" and it's described in "6.8.4.2 The switch statement" as (paragraph 3):QuoteI hope you agree that (1) is a perfectly cromulent integer constant expression, as is e.g. (0xFF - 5*8 ).

author: nctnico
author_rank: Super Contributor
timestamp: October 14, 2021, 05:18:43 pm
content: But the OP is putting code through a syntax checking tool with a specific rule set so all bets are off... If someone uses case(1) in code I start to doubt that person's coding skills.

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 05:23:27 pm
content: Quote from: RoGeorge on October 14, 2021, 04:21:20 pm"main" is obviously a very special function*, but in this respect behaves just like any other function.It might be practical to put it a the end so that one needs not provide prototypes for functions, used in its body and defined in the same translation unit.*Invoked at startup, possible to define with different prototypes but you should not provide one, falling off the end is equivalent to "return 0;" etc.

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 05:28:41 pm
content: Quote from: nctnico on October 14, 2021, 05:18:43 pmI also would not write that way (when using a simple literal) but it's not wrong.Still, none of the diagnostics was referring to the switch statement - one was for main and one for the other function.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 06:20:52 pm
content: Didn't realize it was an old resurected thread when I started replying...cppcheck has partial coverage:https://cppcheck.sourceforge.io/misra.php(It's not particularly Windows-oriented, cppcheck builds fine on Linux/MacOS and is even available as a plugin in a number of automated build tools and IDEs. It's just that there is GUI front-end for Windows, but the CLI version is perfectly adequate.)cppcheck is quite useful in general. But as you saw, it doesn't have full MISRA-C 2012 coverage. The status is probably better than what it was in 2015 though. AFAIK, if you want FULL coverage, there aren't many open source tools and you might need to look at commercial ones.

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 06:23:47 pm
content: So, just for kicks, I compiled cppcheck and tested OP's code.I get a violation for 8.4 (note that I don't have a file with the rules' text): maybe we have different versions, I simply compiled the latest master branch.If the function is declared as static in the prototype, the check gives a clean result - though the actual violated rule should have been 8.7:Quote"cppcheck --addon misra main.c" of course reports the out of bound access to p[].While we use cppcheck (and other tools) at work, we do not use the MISRA addon, so I cannot say how reliable it is.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 06:53:13 pm
content: Quote from: newbrain on October 14, 2021, 05:28:41 pmI do not get the diagnostic here either. Can't see what's wrong. But I suspect the problem is with the misra check semir-t is using here. As I said, MISRA-C support is not complete at this point in Cppcheck. And, I don't know what version they are using either...Digging a bit deeper, it looks like MISRA-C support is not just incomplete in Cppcheck, but it doesn't give you exact messages either, apparently for licensing reasons if I got it right, but I dunno.Not sure where semir-t got the rules file 'MISRA_C_2012.txt' from. It doesn't seem to be directly provided by Cppcheck. It does have a MISRA-C addon though, but won't give you detailed messages without this file.Anyway... Running the latest Cppcheck this way on this piece of code:Code:cppcheck --addon=misra misrac1.cGives the following - which is not the same...Code:misrac1.c:14:4: error: Array 'p' accessed at index 100, which is out of bounds. p = 5;^misrac1.c:4:5: style: misra violation (use --rule-texts=<file> to get proper output) [misra-c2012-8.4]int getValue (int p);^Yes, invoking cppcheck directly instead of the python script misra.py - which will be or is already deprecated - will give you other checks apart from MISRA-C rules. And it does spot an out-of-bounds access.And the only violated MISRA-C rule it finds is different: 8.4. But I still don't understand it here.Point is: MISRA-C in Cppcheck is probably rather buggy. You may want to contact the author. Unfortunately, they host the project on Sourceforge, which makes collaborating and raising issues a lot less convenient than with, say, github...

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 06:54:24 pm
content: Quote from: newbrain on October 14, 2021, 06:23:47 pmDang, you did the exact same thing as I did, as I was writing my previous post!

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 07:13:57 pm
content: Quote from: SiliconWizard on October 14, 2021, 06:54:24 pmgreat minds waste their time alike!Quote from: SiliconWizard on October 14, 2021, 06:53:13 pmYes, the official position of MISRA is that a tool (open source or not) can just use the rule numbers, as the text is copyrighted and needs licensing (the standard is quite cheap, as standards go: 15£) the do not endorse any specific tool, and they suggest to do exactly what cppcheck is doing to be in the clean.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 07:25:52 pm
content: Quote from: newbrain on October 14, 2021, 07:13:57 pmAhah yeah. But it's not a complete waste of time, as I too use Cppcheck - just not with MISRA-C rules - and routinely recommend it. At least we now know where it stands regarding MISRA-C. And it doesn't look that good so far. Point is, people having to comply with MISRA-C are likely to work in environments that will hardly tolerate false positives, as they often rely on automated systems that won't tolerate any rule violation.

author: newbrain
author_rank: Super Contributor
timestamp: October 14, 2021, 07:55:27 pm
content: Quote from: SiliconWizard on October 14, 2021, 07:25:52 pmAbsolutely not - I was also curious and it has quite a bit of relevance with (a part of) my work.We use thisopen source checker from Ericsson, based on clang-tidy and clang-analyzer but that can include and store the results from many others tools (cppcheck included) and has some pretty visualization.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 07:59:32 pm
content: Quote from: newbrain on October 14, 2021, 07:55:27 pmI'll check it out.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2021, 08:14:29 pm
content: And anyone interested, there is an official example suite for MISRA-C 2012:https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-SuiteThat gives examples of compliant and non-compliant code for every rule.

author: JPortici
author_rank: Super Contributor
timestamp: October 15, 2021, 05:32:43 am
content: yeeeeah... CppCheck gives a number of bogus warnings regarding misra, also can't recognize interrupt functions (probably because it ignores nonstandard features like __attribute__) so i get bogus warnings about unused functions.And i haven't been able to produce a rules file from the standard, i don't understand what you need to do (and all the just use/just do on the support forum don't work with the copy protected PDFs of the standard) so i used the modified cppcheck in MPLABX.But all in all it helped me from time to time, would recommend as it also gives lots of warnings that GCC doesn't (or i'd rather have to say the GCC version i am bound to use, which is 4.2.8 or something)Quote from: newbrain on October 14, 2021, 07:55:27 pmbut this looks really cool. i have to check it out

author: semir-t
author_rank: Regular Contributor
timestamp: October 15, 2021, 06:29:00 am
content: Thank you for your answers.Because this is my first encounter with the cppcheck, the idea behind my code was to try to trigger cppcheck and see what kind of error/warning messages I would get. And all of the stuff that you mentioned that are used in the code are deliberate (access array out of boundaries etc...). But what puzzled me is the error message (style) Function types shall be in prototype form with named parameters (Required) [misra-c2012-8.2], because for each function I have named parameters (in definition and declaration).Yes, I assume that commercial applications are way better and we do have one in mind. Problem is that this application is linked to the PC, so only one person can use it. So our idea was to try to get some free version that would help our team develop the code which will be as closely as possible compliant with the MISRA standard. Frequently we would use commercial app to solve all the issues.

author: JPortici
author_rank: Super Contributor
timestamp: October 15, 2021, 08:18:08 am
content: for example, both GCC (version included in XC16 v1.70 is 4.5.1) and CPPCheck are failing to recognize that this statementCode:flashStatus.flags.writeSetupPending;has not effect. This was making me crazy.definitionCode:typedef volatile struct {union {uint16_t word;struct {unsigned readSetupPending:1; //Setup Read pendingunsigned eraseSetupPending:1; //Setup Erase pendingunsigned writeSetupPending:1; //Setup Write pendingunsigned :2;unsigned readUDIDPending:1; //UDID Read Pendingunsigned :6;unsigned resetPending:1; //Reset Pending after Page Eraseunsigned setupDataReady:1; //Setup Data Readyunsigned setupUpdated:1; //Setup Updatedunsigned error:1; //Flash Programming Error};} flags;int16_t flashSaveCnt;} flashStatus_t;

author: newbrain
author_rank: Super Contributor
timestamp: October 15, 2021, 09:48:16 am
content: Quote from: JPortici on October 15, 2021, 08:18:08 amBut ithasan effect!Since the typedef is volatile, the expression statement represents a read access to writeSetupPending and the volatile semantic forces the access to happen.Removing volatile, gcc and clang warn about the statement having no effect, if one uses -Wall, or the specific -Wunused-value flag.

author: JPortici
author_rank: Super Contributor
timestamp: October 15, 2021, 11:15:24 am
content: Quote from: newbrain on October 15, 2021, 09:48:16 amAh, of course.Disregard this particular example then

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 16, 2021, 08:23:15 pm
content: Quote from: semir-t on October 15, 2021, 06:29:00 amAs you can see, the MISRA addon of Cppcheck gives a lot of false positives. You can actually run it on the official MISRA examples I linked to, and see for yourself. It does spot a lot of true violations, but also find ones that aren't... May still be kind of useful as first check, but it's likely to make you waste a lot of time.If you use Eclipse (which I don't), there is a plugin that you may try as well:https://github.com/stkim123/kr.ac.jbnu.ssel.misrac

author: Kalvin
author_rank: Super Contributor
timestamp: October 19, 2021, 06:11:06 am
content: In C, the switch statement's default is supposed to be followed by a colon. A syntax error like this may/will affect the parser/analyzer, so all syntax errors need to be fixed first before analyzing the actual analyzer output.