Blog post

SonarCFamily Now Supports ARM Compilers

Massimo Paladin photo

Massimo Paladin

Developer

TL;DR overview

  • SonarQube's C and C++ analyzer (CFamily) now supports ARM compilers, enabling static analysis of embedded and IoT projects that target ARM-based hardware platforms such as Cortex-M and Cortex-A devices.
  • ARM compiler support extends SonarQube's coverage to a wide range of safety-critical and consumer embedded systems where ARM is the dominant architecture, including automotive, medical, and industrial applications.
  • Developers using ARM compilers for embedded development can now benefit from the same MISRA C/C++, CWE, and CERT security rules available for projects built with GCC, Clang, and MSVC.
  • The addition complements Sonar's broader cross-compiler strategy, which also supports IAR compilers for a wide range of microcontroller families.

For those not familiar with ARM (Advanced RISC Machine), let's start by sharing some numbers: in 2011, the 32-bit ARM architecture was the most widely used architecture in mobile devices and the most popular 32-bit one in embedded systems (see). Moreover in 2013, 10 billion were produced (see) and "ARM-based chips are found in nearly 60 percent of the world’s mobile devices" (see). 

Why ARM is so popular when dealing with embedded systems? Because the RISC architecture typically requires fewer transistors than those with a complex instruction set computing (CISC) architecture (such as the x86 processors found in most personal computers), which reduces cost, power consumption, and heat dissipation. These characteristics are desirable for light, portable, battery-powered devices‍—‌including smartphones, laptops and tablet computers, and other embedded systems.

Most developers targeting this ARM architecture, develop in C or C++ and use a compiler able to produce a binary for ARM machines. Both GCC and Clang support an ARM mode out-of-the-box. But if you want to generate a binary finely tuned to reduce the runtime footprint, you might want to go ahead with the ARM5, ARM6 or Linaro compilers.

SonarCFamily code analyzer version 4.8 adds support for all such compilers, this long-awaited feature finally becomes reality.

Analyzing a C/C++ project targeting the ARM architecture is not different than analyzing any other kind of C/C++ project but as a reminder here are the steps to follow:

# on Windows or on Linux, in a ARM DS-5 enabled environment:
make clean

build-wrapper-[win|linux]-x86-64 --out-dir <output directory> make

# set sonar.cfamily.build-wrapper-output=<output directory> 
# on sonar-project.properties
sonar-scanner

or, on Linux, from a console without ARM environment:

/usr/local/DS-5_v5.26.2/bin/suite_exec -t "ARM Compiler 5 (DS-5 built-in)" make
clean 

build-wrapper-linux-x86-64 --out-dir <output directory> \
/usr/local/DS-5_v5.26.2/bin/suite_exec -t "ARM Compiler 5 (DS-5 built-in)" make

# set sonar.cfamily.build-wrapper-output=<output directory> 
# on sonar-project.properties
sonar-scanner

Once you have analyzed the ARM compiled source code, you got the full power of the analysis available: hundred of rules available to track the nastiest issues, data-flow analysis included!

Of course, SonarCFamily 4.8 is compatible with SonarQube for IDE which means that ARM DS-5 developers using Eclipse or any Eclipse CDT developer will be able to use SonarQube for IDE and get their code analyzed on-the-fly. This enables to shorten the development feedback and catch issues "before they exist"!