AoU: ETAS_RTACAR_SM_OS_221

This AoU checks that all resources acquired via GetResource() are released before a task or Category 2 ISR terminates, according to the ETAS_RTACAR_SM_OS_221 requirement.

The validation procedure simulates a resource stack along all feasible paths leading to task or ISR termination and verifies that the stack is empty at every termination boundary. Termination boundaries considered include:

• Explicit termination calls: TerminateTask(), ChainTask() , Os_TerminateTask(), Os_ChainTask()

• Implicit return from a task main function

• Return from a Category 2 ISR function

The check is applied only to functions identified as task or Category 2 ISR implementations (i.e., functions matching the TASK or ISR macro patterns).

Rationale for the validation

The validation process follows these steps:

1. Generation of the base code call graph

   1. Collection of source code files to be analyzed, as specified by the compile_commands.json file.

   2. Generation of the Abstract Syntax Tree (AST) for each source file.

   3. Processing of the AST to identify function implementations and related calls.

   4. Resolution of all the calls to the linkable target implementation.

2. Inspection of the complete call graph to detect restricted regions.

   1. Detect the start point of each restricted region.

   2. Detect the end point of each restricted region.

3. Inspection of the call graph contained within the restricted regions.

   1. Identify all function calls within the restricted regions.

   2. Check each function call against the list of prohibited calls.

Known Limitations

During the generation of the call graph and the collection of source code files to be analyzed, files with the following extensions are ignored:

• .cpp

• .hpp

• .s

• .S

• .asm

• .inc

The generation of the call graph is based on static analysis of the source code. This means that the tool analyzes the code without executing it, which can lead to certain limitations:

• It may not capture all dynamic behaviors, such as those resulting from runtime conditions or external inputs.

• It cannot account for all possible execution paths, especially in the presence of complex control flows.

• The accuracy of the call graph is dependent on the completeness and correctness of the source code being analyzed.

Important

Link Os as external library functions

This behavior is important for maintaining the integrity of the analysis process. The tool expects that the functions implementing the OS are linked as external library functions, and therefore does not expect the source code for these functions to be available within the analyzed base code.

The tool’s ability to detect function calls is limited by the information available from the source code, and it’s possible that the tool encounters limitations:

Important

Handling of External Functions

The tool may be unable to resolve function calls if their implementations are not available in the analyzed source code, such as functions provided by the OS, RTE, or external libraries.

Important

Analysis Limitations

The tool’s static analysis may not detect all function calls, particularly in cases involving complex code structures or the use of function pointers.

When the start or the end point of a restricted region is contained inside a conditional construct, it may lead to uncertainties in the identification of the restricted region due to the potential for the condition to affect the execution flow.

Example: Restricted region within a conditional construct

Consider the following C code snippet, where the start of a restricted region is inside an if statement:

void example_function(void)
{
    if (condition)
    {
        // Start of restricted region
        startRegion();
    }
    // End of restricted region
    endRegion();
}

This example illustrates how the static analysis tool may struggle to accurately identify the boundaries of restricted regions, when they are nested within conditional constructs.

The tool may not be able to determine all possible execution paths, leading to uncertainty in identifying the exact boundaries of the restricted region. A result indicating a human review may be reported if the analysis cannot definitively establish the boundaries.

Example: Restricted region within the same conditional construct

Consider the following C code snippet, where both the start and end points of a restricted region are inside the if statement:

void example_function(void)
{
    if (condition)
    {
        // Start of restricted region
        startRegion();
        // End of restricted region
        endRegion();
    }
}

In this case, the static analysis tool may have an easier time determining the boundaries of the restricted region, as both the start and end points are clearly defined within the same conditional construct.

The static analysis tool may leverage this information to more accurately identify the restricted region and its boundaries, potentially reducing the need for human review.

When the tool detects a limitation in its analysis, it shall report the issue to the user for manual review, indicating the specific code section that requires attention. Please refer to the OS reviews section for more information on how to handle such cases.

Important

Os API call region delimiters

The tool detects resource acquisition when a call to Os_GetResource() (or GetResource()) is made and resource release when a corresponding call to Os_ReleaseResource() (or ReleaseResource()) is made.

Attention

Resource identifier resolution

The tool does not resolve resource identifiers during analysis. Rules that require matching a specific resource identifier are therefore applied without identifier verification. This is a known limitation; the tool reports the affected path result as ambiguous when call targets are unresolved.

Rule Id	ETAS_RTACAR_SM_OS_221
Title	All resources locked by a task or category 2 ISR must be unlocked before termination.
Description	This rule verifies that all resources acquired via GetResource are released before a task or Category 2 ISR terminates.

Message Description

id_000

Id	id_000
Message	Issue detected while executing the verification.
Kind	Open
Level	None
Description	An internal exception occurred during the execution. This can happen if there are insufficient resources available on the host machine. For more details, please consult the RTA-SQF log file.
How To Fix	Restart the command to exclude any internal exceptions. Alternatively, please contact ETAS GmbH support for assistance. When reporting the error, include a sample configuration and command line that reproduces the issue.

id_001

Id	id_001
Message	The function implementation was fully checked and GetResource() calls were properly matched with ReleaseResource() calls.
Kind	Pass
Level	None
Description	All resources acquired within the task or ISR are properly released before every termination point.
How To Fix	Everything is in order. No action is required.

id_002

Id	id_002
Message	The GetResource/ReleaseResource nesting was checked and improper nesting was found.
Kind	Review
Level	None
Description	The analysis detected an improperly nested or unbalanced GetResource/ReleaseResource pair on one or more execution paths.
How To Fix	Please review the code to ensure GetResource() and ReleaseResource() calls are correctly paired and nested.

id_003

Id	id_003
Message	The GetResource/ReleaseResource nesting could not be determined due to the presence of a conditional statement. The tool does not perform data flow analysis, manual review is required.
Kind	Review
Level	None
Description	A conditional statement obscures the resource locking boundaries. The tool cannot statically determine the nesting.
How To Fix	Please manually review the code to verify that GetResource/ReleaseResource calls are correctly paired along all conditional execution paths.

id_004

Id	id_004
Message	The tool could not fully analyze a code pattern due to the presence of unresolved call targets.
Kind	Review
Level	None
Description	The call graph contains unresolved call targets (e.g., function pointers or indirect calls) that prevent complete nesting analysis.
How To Fix	Please manually review the affected code path to ensure GetResource/ReleaseResource calls are correctly paired.

id_005

Id	id_005
Message	No resource locking activity was found on the analyzed function.
Kind	Pass
Level	None
Description	No GetResource() or ReleaseResource() calls were detected in the analyzed task or ISR function.
How To Fix	Everything is in order. No action is required.

id_006

Id	id_006
Message	The analysis of the source file is not supported due to the file extension. The file was skipped and shall be reviewed manually.
Kind	Review
Level	None
Description	The source file has an extension that is not supported by the analysis tool and was skipped.
How To Fix	Please manually review the skipped file to ensure GetResource/ReleaseResource calls are correctly paired.