Fast and Precise Symbolic Analysis of Concurrency Bugs in Device Drivers (T)

Deligiannis, Pantazis; Donaldson, Alastair F.; Rakamarić, Zvonimir

doi:10.1109/ase.2015.30

Cited by 30 publications

(12 citation statements)

References 45 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Second, handling an interrupt may change not only data in memory but also some peripheral states, leading to inconsistency issues between the actual peripheral and what the application assumes it is. These two problems are not new [27], [28], [29], but we need to address them in the specific context of NVRAM-based transiently-powered systems. Third, interrupts carry some data such as, for instance, the origin of the interrupt or the data located in peripheral memory.…”

Section: Interrupt Handling Problemmentioning

confidence: 99%

Sytare: A Lightweight Kernel for NVRAM-Based Transiently-Powered Systems

Berthou

Delizy

Marquet

et al. 2019

IEEE Trans. Comput.

View full text Add to dashboard Cite

In a near future, energy harvesting is expected to replace batteries in ultra-low-power embedded systems. Research prototypes of such systems have recently been proposed. As the power harvested in the environment is very low, such systems need to cope with frequent power outages. They are referred to as transiently-powered systems (TPS). In order to execute non-trivial applications, TPS need to retain information between power losses. To achieve this goal, emerging nonvolatile memory (NVM) technologies are a key enabler: they provide a lightweight solution to retain, between power outages, the state of an application and of its peripheral devices. These include sensors, serial interface or radio devices for instance. Existing works have described various checkpointing mechanisms to adapt embedded applications to TPS but the use of peripherals was not yet handled. in these works. This paper proposes a solution for embedded applications using any peripheral device to run despite transient power. We follow a kerneloriented approach resulting in minimal impact on the programming model of the application. We implement the new concepts in our lightweight kernel called Sytare, running on an MSP430FR5739 micro-controller and we analyze the cost of the proposed solution.

show abstract

Section: Interrupt Handling Problemmentioning

confidence: 99%

Sytare: A Lightweight Kernel for NVRAM-Based Transiently-Powered Systems

Berthou

Delizy

Marquet

et al. 2019

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…When exploring code paths, symbolic execution can perform a lockset analysis and detect data races. For example, WHOOP [49] is a symbolic execution approach of detecting data races in device drivers. It uses over-approximation and a symbolic pairwise lockset analysis to attempt to prove a driver race-free.…”

Section: Symbolic Executionmentioning

confidence: 99%

Detecting Data Races Caused by Inconsistent Lock Protection in Device Drivers

Chen

Bai

Jiang

et al. 2019

2019 IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER)

View full text Add to dashboard Cite

Data races are often hard to detect in device drivers, due to the non-determinism of concurrent execution. According to our study of Linux driver patches that fix data races, more than 38% of patches involve a pattern that we call inconsistent lock protection. Specifically, if a variable is accessed within two concurrently executed functions, the sets of locks held around each access are disjoint, at least one of the locksets is non-empty, and at least one of the involved accesses is a write, then a data race may occur. In this paper, we present a runtime analysis approach, named DILP, to detect data races caused by inconsistent lock protection in device drivers. By monitoring driver execution, DILP collects the information about runtime variable accesses and executed functions. Then after driver execution, DILP analyzes the collected information to detect and report data races caused by inconsistent lock protection. We evaluate DILP on 12 device drivers in Linux 4.16.9, and find 25 real data races.

show abstract

“…sequentialization) для последующей проверки ее обычными инструментами статической верификации [30][31][32]. Один из примеров является WHOOP [33], который использует эту технику трансформации и не учитывает взаимодействие потоков. Более того, он сильно использует алгоритм Lockset и не может быть расширен какими-нибудь другими анализами.…”

Section: обзор похожих работunclassified

Analysis of correct synchronization of operating system components

Andrianov¹

2019

Proceedings of ISP RAS

View full text Add to dashboard Cite

Аннотация. Большинство современных инструментов статической верификации плохо масштабируются на сложное программное обеспечение. Целью работы была разработка инструмента, который станет золотой серединой между точными и медленными инструментами статической верификации и быстрыми, но менее точными инструментами статического анализа. Основной идеей подхода является абстракция от точного взаимодействия потоков и анализ каждого потока отдельно от всех остальных, но в некотором окружении, которое моделирует влияние потоков друг на друга. Окружение содержит описание возможных действий над разделяемыми данными и примитивами синхронизации, а также условий их применения. Варьируя точность построения окружения, можно добиваться необходимого баланса между скоростью и точностью анализа в целом. Формальное описание предлагаемого подхода было сделано с использованием теории адаптивного статического анализа. Это позволило сформулировать условия и доказать корректность предлагаемого подхода в этих условиях. Для эффективного поиска состояний гонки используется специальная модель памяти, которая позволяет разделять области памяти на непересекающиеся регионы, соответствующие типам данных. Реализация предложенного подхода во фреймворке CPAchecker позволяет переиспользовать существующие техники анализа с минимальными изменениями. А реализация дополнительных техник анализа в рамках предложенной теории позволяет повысить точность анализа. Результаты проведенных экспериментов на двух наборах тестовых задач позволяют заключить о масштабируемости и практической применимости метода.

show abstract

Fast and Precise Symbolic Analysis of Concurrency Bugs in Device Drivers (T)

Cited by 30 publications

References 45 publications

Sytare: A Lightweight Kernel for NVRAM-Based Transiently-Powered Systems

Sytare: A Lightweight Kernel for NVRAM-Based Transiently-Powered Systems

Detecting Data Races Caused by Inconsistent Lock Protection in Device Drivers

Analysis of correct synchronization of operating system components

Contact Info

Product

Resources

About