AoU: ETAS_RTACAR_SM_OS_223

This AoU checks that calls to GetResource() and ReleaseResource() are correctly paired and strictly nested along all feasible execution paths, according to the ETAS_RTACAR_SM_OS_223 requirement and ISO 17356.

The validation procedure simulates a resource stack and verifies that:

• Every GetResource() call is matched by a corresponding ReleaseResource() call.

• ReleaseResource() always matches the most-recent outstanding GetResource() for the same resource (LIFO order).

• No path reaches a function exit point with an unmatched GetResource() call still outstanding.

• Nested acquisition of the same resource (e.g., GetResource(R) followed by another GetResource(R)) is flagged as a violation per ISO 17356.

Rationale for the validation

The validation process follows these steps:

1. Generation of the base code call graph

   1. Collection of source code files to be analyzed, as specified by the compile_commands.json file.

   2. Generation of the Abstract Syntax Tree (AST) for each source file.

   3. Processing of the AST to identify function implementations and related calls.

   4. Resolution of all the calls to the linkable target implementation.

2. Inspection of the complete call graph to detect restricted regions.

   1. Detect the start point of each restricted region.

   2. Detect the end point of each restricted region.

3. Inspection of the call graph contained within the restricted regions.

   1. Identify all function calls within the restricted regions.

   2. Check each function call against the list of prohibited calls.

Known Limitations

During the generation of the call graph and the collection of source code files to be analyzed, files with the following extensions are ignored:

• .cpp

• .hpp

• .s

• .S

• .asm

• .inc

The generation of the call graph is based on static analysis of the source code. This means that the tool analyzes the code without executing it, which can lead to certain limitations:

• It may not capture all dynamic behaviors, such as those resulting from runtime conditions or external inputs.

• It cannot account for all possible execution paths, especially in the presence of complex control flows.

• The accuracy of the call graph is dependent on the completeness and correctness of the source code being analyzed.

Important

Link Os as external library functions

This behavior is important for maintaining the integrity of the analysis process. The tool expects that the functions implementing the OS are linked as external library functions, and therefore does not expect the source code for these functions to be available within the analyzed base code.

The tool’s ability to detect function calls is limited by the information available from the source code, and it’s possible that the tool encounters limitations:

Important

Handling of External Functions

The tool may be unable to resolve function calls if their implementations are not available in the analyzed source code, such as functions provided by the OS, RTE, or external libraries.

Important

Analysis Limitations

The tool’s static analysis may not detect all function calls, particularly in cases involving complex code structures or the use of function pointers.

When the start or the end point of a restricted region is contained inside a conditional construct, it may lead to uncertainties in the identification of the restricted region due to the potential for the condition to affect the execution flow.

Example: Restricted region within a conditional construct

Consider the following C code snippet, where the start of a restricted region is inside an if statement:

void example_function(void)
{
    if (condition)
    {
        // Start of restricted region
        startRegion();
    }
    // End of restricted region
    endRegion();
}

This example illustrates how the static analysis tool may struggle to accurately identify the boundaries of restricted regions, when they are nested within conditional constructs.

The tool may not be able to determine all possible execution paths, leading to uncertainty in identifying the exact boundaries of the restricted region. A result indicating a human review may be reported if the analysis cannot definitively establish the boundaries.

Example: Restricted region within the same conditional construct

Consider the following C code snippet, where both the start and end points of a restricted region are inside the if statement:

void example_function(void)
{
    if (condition)
    {
        // Start of restricted region
        startRegion();
        // End of restricted region
        endRegion();
    }
}

In this case, the static analysis tool may have an easier time determining the boundaries of the restricted region, as both the start and end points are clearly defined within the same conditional construct.

The static analysis tool may leverage this information to more accurately identify the restricted region and its boundaries, potentially reducing the need for human review.

When the tool detects a limitation in its analysis, it shall report the issue to the user for manual review, indicating the specific code section that requires attention. Please refer to the OS reviews section for more information on how to handle such cases.

Important

Os API call region delimiters

The tool detects the start of a resource critical region when a call to the Os_GetResource() (or GetResource()) function is made. The end of the critical region is detected when a corresponding call to Os_ReleaseResource() (or ReleaseResource()) is made.

Attention

Resource identifier resolution

The tool does not resolve resource identifiers during analysis. Rules that require matching a specific resource identifier are therefore applied without identifier verification. When call targets are unresolved (function pointers, external calls), the tool marks the affected path result as ambiguous.

Rule Id	ETAS_RTACAR_SM_OS_223
Title	GetResource/ReleaseResource calls must be properly paired and nested.
Description	This rule verifies the correct pairing and nesting of GetResource and ReleaseResource calls along all feasible execution paths.

Message Description

id_000

Id	id_000
Message	Issue detected while executing the verification.
Kind	Open
Level	None
Description	An internal exception occurred during the execution. This can happen if there are insufficient resources available on the host machine. For more details, please consult the RTA-SQF log file.
How To Fix	Restart the command to exclude any internal exceptions. Alternatively, please contact ETAS GmbH support for assistance. When reporting the error, include a sample configuration and command line that reproduces the issue.

id_001

Id	id_001
Message	The GetResource/ReleaseResource nesting was checked and only proper nesting were found.
Kind	Pass
Level	None
Description	All GetResource() and ReleaseResource() calls are correctly paired and strictly nested along all analyzed execution paths.
How To Fix	Everything is in order. No action is required.

id_002

Id	id_002
Message	The GetResource/ReleaseResource nesting was checked and improper nesting was found.
Kind	Review
Level	None
Description	A ReleaseResource() call was found with no matching GetResource() call, or the resource order does not follow LIFO nesting rules.
How To Fix	Please review the code to ensure every ReleaseResource() call matches the most-recent outstanding GetResource() call.

id_003

Id	id_003
Message	The GetResource/ReleaseResource nesting could not be determined due to the presence of a conditional statement. The tool do not perform data flow analysis, manual review is required.
Kind	Review
Level	None
Description	A conditional statement obscures the resource locking boundaries. The tool cannot statically determine the nesting.
How To Fix	Please review the code to ensure every GetResource() call is matched by a corresponding ReleaseResource() call along all execution paths.

id_004

Id	id_004
Message	The GetResource/ReleaseResource nesting could not be fully inspected due to the presence of unresolved call targets.
Kind	Review
Level	None
Description	The call graph contains unresolved call targets (e.g., function pointers or indirect calls) that prevent complete nesting analysis.
How To Fix	Please manually review the code to verify that GetResource/ReleaseResource calls are correctly paired along all conditional execution paths.

id_005

Id	id_005
Message	No resource locking activity was found on the analyzed function.
Kind	Pass
Level	None
Description	The analyzed basecode does not contain any GetResource() or ReleaseResource() calls.
How To Fix	Everything is in order. No action is required.

id_006

Id	id_006
Message	The analysis of the source file is not supported due to the file extension. The file was skipped and shall be reviewed manually.
Kind	Review
Level	None
Description	The source file has an extension that is not supported by the analysis tool and was skipped.
How To Fix	Please manually review the skipped file to ensure GetResource/ReleaseResource calls are correctly paired.