AoU: ETAS_RTACAR_SM_OS_222
**************************

This AoU checks that forbidden OS API calls are not made within a critical section protected by GetResource()/ReleaseResource(), according to the ETAS_RTACAR_SM_OS_222 requirement and ISO 17356.

The validation procedure ensures that the following OS API calls are forbidden within a GetResource/ReleaseResource critical section:

- TerminateTask()
- ChainTask()
- Schedule()
- WaitEvent()

All other OS API calls are permitted within this critical section.

.. include:: os_api_name_expansion.rst


.. include:: restricted_os_regions_common_rationale.rst

The tool analyzes the code to:

  - Detect the boundaries of GetResource/ReleaseResource critical sections.
  - Check that no forbidden OS API calls are made within these sections.
  - Report issues if forbidden calls are found.
  - Report warnings, as a result indicating human review need, if section identification is not possible due to conditional statements, tool limitations, or the call graph contains unsupported function calls (ie. call by pointer).

.. important:: Os API call region delimiters

   The tool detects the start of a critical region when a call to the **GetResource()** function is made. 
   The end of the critical region is detected when a corresponding call to **ReleaseResource()** is made.


.. attention:: Resource and Section Identification Limitations

   The identification of the resources passed as parameter to GetResource() and ReleaseResource() calls is not performed. The analysis assumes that GetResource() and ReleaseResource() calls are correctly nested, so the identification of their parameters is not needed.
   The call to GetResource() or ReleaseResource() can occur in any function of the code base, so the analysis is not limited to specific functions only.
   Since GetResource() and ReleaseResource() can be called from various constructs, the static analysis tool may not always be able to determine the exact code section relevant for analysis. For example, conditional statements may obscure the boundaries of these sections. In such cases, the tool will report that section identification is not possible. The tool does not perform full data flow analysis and will not attempt to resolve these ambiguities.


Function macro delimiters
=========================
The following couples of function macros are detected as critical region delimiters:

   - **Rte_GetResource()** / **Rte_ReleaseResource()**
   - **Rte_RealGetResource()** / **Rte_RealReleaseResource()**
   - **Rte_Enter_\*()** / **Rte_Exit_\*()**

When the region starts/ends due to a function macro call, the tool will consider the entire macro body as part of the region delimiter, so no further analysis will be performed within the expansion code of the macros.

.. attention::

    The tool recognizes only the listed macros as critical region delimiters. In case of usage of unsupported macros, or new macros mapped to the supported ones, the detection process will be downgraded to the analysis of the call graph considering the full expansion of the macro.

.. note:: Macro Delimiters verification

    Before considering a macro as region delimiter, a check to the macro expansion code is performed: only when, inside the body of the macro expansion, a call to the expected Os API delimiter functions is found, the macro itself is considered as region delimiter.
    This approach helps to cover cases where the macros Rte_GetResource()/Rte_ReleaseResource() are defined by invoking functions 
    that act on interrupts instead of resources.


.. include:: ../rules/ETAS_RTACAR_SM_OS_222.rst