A Register Access Conflict Detection Method for Interrupt-Driven Programs
By transforming register access operations into array variable operations and combining static analysis and program verification, the challenge of detecting register access conflicts in interrupt-driven programs is solved, achieving efficient and accurate conflict detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NAT UNIV OF DEFENSE TECH
- Filing Date
- 2022-08-09
- Publication Date
- 2026-08-04
AI Technical Summary
Existing static analysis and program verification techniques are difficult to effectively detect register access conflicts in interrupt-driven programs. In particular, due to the diversity and non-determinism of register access operations and the complexity of interrupt switching operations, the false alarm rate of the detection results is high.
The register access operations are transformed into read and write operations of register array variables. Potential conflicts are initially detected through static analysis, and actual conflicts are screened out using program verification methods. Finally, the conflict conditions are precisely analyzed by combining interrupt sequentialization technology.
It achieves accurate detection of register access conflicts in interrupt-driven programs, reduces false alarm rate, and improves detection accuracy and efficiency.
Smart Images
Figure CN115495208B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of embedded program defect analysis and correctness assurance technology, specifically involving a register access conflict detection method for interrupt-driven programs. Background Technology
[0002] Interrupt-driven programs respond to and process external events through interrupt mechanisms and are widely used in various embedded systems such as aerospace, automotive electronics, and traffic management. In these programs, when an interrupt source sends an interrupt request to the CPU, the CPU suspends the current program and responds to the interrupt request with a higher priority, executing the interrupt service routine corresponding to that interrupt request. After the interrupt service routine completes, the CPU returns to the breakpoint in the current program and continues execution.
[0003] In an interrupt-driven program, the entire program consists of a main task and various interrupt service routines with different priorities. If we consider the main task and each interrupt service routine as different task flows, then the entire program is composed of task flows with different priorities, with the task flow corresponding to the main task having the lowest priority. Higher-priority task flows can preempt lower-priority task flows; that is, if a higher-priority task flow occurs while a lower-priority task flow is executing, the system will pause the execution of the lower-priority task flow and execute the higher-priority task flow. Once the higher-priority task flow completes, execution will return to the breakpoint of the lower-priority task flow and continue. Different task flows communicate by sharing data; that is, global data variables are defined in the embedded interrupt-driven program, and each task flow can read and write to this data.
[0004] Data access conflicts are a typical defect in interrupt-driven programs, and many quality problems in security-critical software are caused by them. In interrupt-driven programs, a data access conflict occurs when a low-priority task flow is accessing shared data, and a high-priority task flow also accesses the same shared data, with at least one of the access operations being a write operation. This situation often produces unexpected behavior, leading to serious consequences. Therefore, conducting data access conflict analysis for interrupt-driven programs is crucial for ensuring the correctness of embedded software. However, the non-deterministic timing of interrupts presents a significant challenge to data access conflict analysis. In interrupt-driven programs, even for the same input, different executions can produce completely different results.
[0005] Register access conflicts are an important type of data access conflict. In this type, the shared resource involved in the access conflict is a register in the system. A register access conflict occurs when two task flows of different priorities both access a register resource. If both access operations access the same address, and at least one of them is a write operation, then a register access conflict occurs. Because register resources are usually accessed using register addresses, developers and testers often find it difficult to detect access conflicts between different task flows, making register access conflicts a significant factor causing code defects in practical engineering. Studying register access conflicts in interrupt-driven programs is of great significance for ensuring the correctness of embedded software.
[0006] Static analysis is a commonly used data access conflict detection technique. This technique employs methods such as syntax analysis, control flow analysis, and data flow analysis to perform a systematic scan of the entire code without running the program. However, to achieve rapid analysis of large-scale code, this method often ignores the precise values of each variable, resulting in a high number of false positives in the static analysis results. Furthermore, existing static analysis techniques primarily target data access conflicts in standard C programs and shared variables; effective analysis of register access conflicts in interrupt-driven programs is currently limited. Program verification is an effective technique for precise code analysis. This method achieves precise analysis of program behavior by traversing all possible states and paths, theoretically capable of analyzing all possible program behaviors. However, due to the explosion of program state and path space, existing program verification techniques have a limited capacity to handle large-scale programs. Additionally, expressing the nondeterministic semantics of interrupt-driven programs in program verification is a current research challenge. Therefore, both existing static analysis and program verification techniques still struggle to effectively analyze register access conflicts in interrupt drivers. Summary of the Invention
[0007] Research has revealed three main challenges in detecting register access conflicts in embedded interrupt-driven programs: First, how to represent the semantics of register access operations during analysis. Register access operations typically involve reading and writing register addresses in specific ways. Existing program analysis tools primarily support analyzing read / write operations on shared variables, not register access operations. Therefore, it is necessary to implement the semantics of register access operations based on existing program analysis tools and techniques to provide a foundation for register access conflict detection. Second, how to determine whether different register operations access the same address. In register access operations, the accessed register address may be an expression, not a constant. Whether different expressions can take the same value determines whether two register access operations will access the same address. The value of an expression can only be determined when the program is running, and it may take different values under different conditions. Third, how to accurately consider the execution conditions of register access operations, including interrupt on / off operations in embedded programs. During the development of interrupt-driven programs, developers typically take protective measures to avoid data access conflicts, including enabling / disabling interrupts and implementing custom mutual exclusion operations. Therefore, in the process of analyzing register access conflicts, it is necessary to consider whether a data access conflict will actually occur. That is, it is necessary to consider whether the execution conditions of different register access operations can be met simultaneously. Otherwise, a large number of false alarms will be generated.
[0008] The technical problem to be solved by this invention is to provide a register access conflict detection method for interrupt-driven programs, which addresses the above-mentioned problems in the prior art. This invention can solve the main challenges in detecting register access conflicts in embedded interrupt-driven programs, including being able to represent the semantics of register operation access during the analysis process, determining whether different register operations access the same address, and accurately considering the execution conditions of register access operations, such as interrupt switching operations in embedded programs.
[0009] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:
[0010] A register access conflict detection method for interrupt-driven programs includes:
[0011] 1) For a given embedded interrupt-driven program containing register access operations, introduce a register array variable into the code of the embedded interrupt-driven program, and transform the register access operation in the code into a read / write operation on a certain element of the register array variable, thereby completing the semantic representation of register access operation based on register array variable and obtaining the transformed interrupt-driven program.
[0012] 2) For the converted embedded interrupt-driven program, conduct a preliminary analysis of register access conflicts based on static analysis to obtain a set of potential register access conflict problems;
[0013] 3) For the converted embedded interrupt-driven program, conduct an accurate analysis of register access conflicts based on program verification to screen out real access conflicts from the set of potential register access conflict problems, thereby obtaining a set of real register access conflict problems.
[0014] Optionally, when converting the register access operations in the code into read and write operations on an element of a register array variable in step 1), each register read operation is represented by a triple reg_op_r := <addr, size, var>, where addr represents the address of the register being read, size represents the size of the data being read, and var represents the program variable into which the read data is to be stored; each register write operation is represented by a triple reg_op_w := <addr, size, data>, where addr represents the address of the register being written, size represents the size of the data being written, and data represents the content of the data being written.
[0015] Optionally, the register array variable introduced in step 1) is a character-type register array variable REG_BUF[REGS_SIZE], where REGS_SIZE represents the register space size of the register array variable; converting the register access operations in the code into read and write operations on an element of the register array variable in step 1) includes: for each register read operation reg_op_r := <addr, size, var>, converting the register read operation reg_op_r := <addr, size, var> into copying size bytes from the address of the addr-th element of the register array variable REG_BUF[REGS_SIZE] to var; for each register write operation reg_op_w := <addr, size, data), converting the register write operation reg_op_w := <addr, size, data> into copying size bytes from the address where data is located to the address of the addr-th element of the register array variable REG_BUF[REGS_SIZE].
[0016] Optionally, step 2) includes:
[0017] 2.1) Extract the read and write access operations on the register array variable in each task flow through function expansion, and initialize the set of potential register access conflict problems to be empty;
[0018] 2.2) Using a pairwise extraction method, two task flows with different priorities that contain read and write access operations to register array variables are extracted to form a task flow pair;
[0019] 2.3) Using a two-by-two extraction method, one read / write access operation to the register array variable is extracted from each of the two task flows of different priorities in the current task flow pair to form a read / write access operation pair. For each read / write access operation pair obtained through the traversal, it is determined whether it may constitute a data access conflict. If a data access conflict is constituted, the current read / write access operation pair is added to the set of potential register access conflict problems.
[0020] 2.4) Determine whether the task flow pair has been traversed. If it has not been traversed, jump to step 2.2); otherwise, output the set of potential register access conflict problems.
[0021] Optionally, in step 2.3), determining whether a data access conflict may occur means determining whether at least one of the current read / write access operations is a write operation. If so, the current read / write access operation pair may constitute a register access conflict, and the current read / write access operation pair is added to the set of potential register access conflict problems.
[0022] Optionally, step 3) includes: for the converted embedded interrupt-driven program, the verification problem of each potential register access conflict in the potential register access conflict set is transformed into a serial program verification problem by using the interrupt sequentialization method, to obtain a serially converted embedded interrupt-driven program, and the serially converted embedded interrupt-driven program is input into a program verification tool for verification to filter out the real access conflicts in the potential register access conflict set, thereby obtaining the real register access conflict problem set.
[0023] Optionally, when transforming the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem through interrupt sequentialization, the following steps are included: adding an assert statement to the read / write operation e2 of each potential register access conflict belonging to the high-priority task flow T2: assert(!((addr1≤addr2&&addr1+size1≥addr2)||(addr2≤addr1&&addr2+size2≥addr1))), so that after the serially converted embedded interrupt-driven program is input into the program verification tool, if the assert statement is triggered and a path that can reach the read / write operation e2 is returned, it is determined that the two read / write operations e1 and e2 of the potential register access conflict can occur simultaneously in the execution path and can access the same address; introducing an integer interrupt enable variable INTEnableList, where the value of the i-th bit represents the status of the i-th interrupt service routine, called the enable flag of the i-th interrupt service routine, and the value of the enable flag can be 0 or 1 and 0 represent the closed state, and 1 represents the open state. For the converted embedded interrupt-driven program, a condition for its enable flag is added at the beginning of each interrupt service routine. If the enable flag is 0, the contents of the interrupt service routine are not executed, and the program returns directly. Then, when an interrupt switch function is encountered in the embedded interrupt-driven program, if the i-th interrupt service routine is enabled, the i-th bit of the interrupt enable variable INTEnableList is set to 1; if the i-th interrupt service routine is disabled, the i-th bit of the interrupt enable variable INTEnableList is set to 0. Thus, if an interrupt service routine is disabled, its enable flag is set to 0, and the program will exit directly when executing the corresponding interrupt service routine, without executing the statements in the interrupt service routine. When the serially converted embedded interrupt-driven program is input into the program verification tool for verification, the program verification tool selects potential register access conflicts that occur simultaneously and can access the same address, and whose corresponding interrupt service routines are not disabled, as the real access conflicts, thereby obtaining the real set of register access conflict problems.
[0024] Optionally, when the method of interrupt-sequencing is used to transform the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem, the following steps are taken: add an assert statement: assert(false) to the read / write operation e2 of each potential register access conflict belonging to the high-priority task flow T2. This makes it possible that after the serially converted embedded interrupt-driven program is input into the program verification tool, if the assert statement is triggered and a path that can reach the read / write operation e2 is returned, then it is determined that the two read / write operations e1 and e2 of the potential register access conflict can occur simultaneously in the execution path.
[0025] Furthermore, the present invention also provides a register access conflict detection system for interrupt-driven programs, including a microprocessor and a memory interconnected thereto, the microprocessor being programmed or configured to execute the steps of the register access conflict detection method for interrupt-driven programs.
[0026] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program for being programmed or configured by a microprocessor to perform the steps of the register access conflict detection method for interrupt-driven programs.
[0027] Compared with the prior art, the present invention has the following advantages: The register access conflict detection method for interrupt-driven programs in this embodiment first converts the register access operations into equivalent access operations to register array variables, accurately identifies the read and write access operations to register array variables in each task flow, and matches and searches for potential register access conflicts in the program according to the priority of different task flows and data access conflict patterns without considering the program execution conditions and register access addresses. Finally, for each potential register access conflict, the program verification method verifies whether there is a path that causes the two access operations in the conflict to occur simultaneously and access the same address, thereby enabling automatic detection of register access conflicts and accurate analysis of register access conflicts. Attached Figure Description
[0028] Figure 1 This is a schematic diagram illustrating the basic principle of the method in an embodiment of the present invention.
[0029] Figure 2 This is a schematic diagram of the implementation process of step 2) of the present invention. Detailed Implementation
[0030] like Figure 1 As shown, the register access conflict detection method for interrupt-driven programs in this embodiment includes:
[0031] 1) For a given embedded interrupt-driven program containing register access operations, introduce a register array variable into the code of the embedded interrupt-driven program, and transform the register access operation in the code into a read / write operation on a certain element of the register array variable, thereby completing the semantic representation of register access operation based on register array variable and obtaining the transformed interrupt-driven program.
[0032] 2) For the converted embedded interrupt-driven program, a preliminary analysis of register access conflicts based on static analysis is performed to obtain a set of potential register access conflict problems;
[0033] 3) For the converted embedded interrupt-driven program, perform precise analysis of register access conflicts based on program verification to filter out the real access conflicts from the set of potential register access conflict problems, thereby obtaining the real set of register access conflict problems.
[0034] This embodiment of the register access conflict detection method for interrupt-driven programs can solve the main challenges of register access conflict detection in embedded interrupt-driven programs. It can represent the semantics of register operation access during the analysis process, determine whether different register operations access the same address, and accurately consider the execution conditions of register access operations, thereby realizing automatic detection of register access conflicts.
[0035] Given an embedded interrupt-driven program containing register access operations, step 1) first scans and identifies the register access operations in the program. Register access operations typically include two types: register read operations and register write operations. Register read operations read data from a register into a program variable, while register write operations write data into a register. If the register is considered as a shared register array variable, then reading or writing to a specific address in the register can be seen as reading or writing to a specific element of that array variable. Based on this idea, a register array variable is introduced into the code, and the register access operations in the code are transformed into read / write operations to specific elements of the register array variable. After this step, an interrupt-driven program containing register array variable read / write operations is obtained.
[0036] The following section describes several typical register access operation methods in embedded programs.
[0037] Register access operation mode 1:
[0038] #defineIRA(*(volatile unsigned int*)0x23c4a872)
[0039] IRA == data;
[0040] Register access operation mode 2:
[0041] volatile unsigned int*PIRA=(unsigned int*)0x23c4a872;
[0042] *PIRA=data;
[0043] Register access operation mode 3:
[0044] #define ulBase 0x23c4a872
[0045] int offset = ...;
[0046] CANRegWrite(ulBase+offset,data);
[0047] Register access operation methods 1 and 2 directly write to register address 0x23c4a872, writing an unsigned integer (data) to that address. Register access operation method 3 writes data to the address ulBase+offset (composed of base address ulBase and offset) using the register operation function CANRegWrite(). Other methods directly operate on special function registers, but they are essentially all register address access operations. Summarizing the above register access operations, three main problems can be identified: First, register access operations are diverse, requiring the correct identification of various register operation methods; second, the register access address may not be a constant, making it impossible to confirm its specific operation address in static analysis; third, the space of register access operations is also related to the data type read or written to that address—reading or writing an integer will write four bytes of data consecutively to that address. Although register operations are diverse, they are essentially all about reading or writing a certain amount of data to a specific address in the register space. Therefore, in step 1) of this embodiment, when converting the register access operation in the code into a read / write operation on a certain element of the register array variable, it includes using a triplet reg_op_r :=<addr,size,var> Let represent the register write operation, where addr represents the address of the register to be read, size represents the size of the data to be read, and var represents the program variable where the read data will be stored. Each register write operation is represented by a triple reg_op_w :=<addr,size,data> Let represent , where addr represents the register address to be written, size represents the size of the data to be written, and data represents the content of the data to be written.
[0048] Existing program analysis techniques and tools primarily target standard C programs and do not yet support register access operations. To detect register access conflicts, a register array variable is introduced into the embedded interrupt-driven program, and register access operations in the program are transformed into read / write operations on the array. In this embodiment, the register array variable introduced in step 1) is a character-type register array variable REG_BUF[REGS_SIZE], where REGS_SIZE represents the register space size of the register array variable; transforming the register access operations in the code into read / write operations on a specific element of the register array variable in step 1) includes: for each register read operation reg_op_r :=<addr,size,var> The register read operation reg_op_r :=<addr,size,var> This is transformed into copying size bytes from the address of the addr-th element of the register array variable REG_BUF[REGS_SIZE] to var; and performing a write operation reg_op_w := for each register.<addr,size,data> Write the register operation reg_op_w :=<addr,size,data> This is transformed into copying `size` bytes from the address where `data` is located to the address of the `addr`th element of the register array variable `REG_BUF[REGS_SIZE]`. In this way, while preserving the semantics of register access operations, register access operations are transformed into equivalent shared array variable operations. In this embodiment, the character-type register array variable `REG_BUF[REGS_SIZE]` is defined as follows:
[0049] char_REG_BUF[REGS_SIZE]
[0050] The storage space of registers is simulated by defining a shared register array variable REG_BUF[REGS_SIZE]. The conversion rule for register access operations to register array variable access operations can be expressed as follows:
[0051]
[0052] Here, memcpy is the memory copy operation, and the parentheses following it contain the parameters for memcpy.
[0053] After transforming the analysis of register access conflicts into the analysis of access conflicts for register array variables in step 1), this embodiment employs a static analysis method in step 2) to analyze access conflicts for register array variables. First, a syntactic and semantic analysis is performed on the entire interrupt routine, accurately identifying read and write access operations to register array variables by each task flow through methods such as function expansion. Then, register access conflicts in the program are matched and searched based on the priority of different task flows and data access conflict patterns. Considering that the read / write address can be a variable or an expression when performing read / write operations on registers, and the specific read / write address cannot be determined during static analysis, this stage treats all access operations to the same array variable in different priority task flows as register access conflicts, regardless of the specific access address or the specific execution conditions of the program. The access conflicts analyzed in this stage are called potential register access conflicts. Theoretically, this stage can analyze all possible register access conflicts.
[0054] A register access conflict occurs when a low-priority task is performing a read / write operation on a register address, and a high-priority task interrupts the execution of the low-priority task. Simultaneously, the high-priority task also performs read / write operations on the same register address, and at least one of the register operations is a write operation. In step 1), the register access operations are transformed into operations on register array variables. The next task is to analyze the access conflicts of these register array variables in the program. In this embodiment, static analysis will be used in step 2) to analyze the access conflicts of register array variables. See [link to documentation]. Figure 2 In this embodiment, step 2) includes:
[0055] 2.1) Extract the read and write access operations of register array variables in each task flow through function expansion, and initialize the set of potential register access conflict issues to empty;
[0056] 2.2) Using a pairwise extraction method, two task flows with different priorities that contain read and write access operations to register array variables are extracted to form a task flow pair;
[0057] 2.3) Using a two-by-two extraction method, one read / write access operation to the register array variable is extracted from each of the two task flows of different priorities in the current task flow pair to form a read / write access operation pair. For each read / write access operation pair obtained through the traversal, it is determined whether it may constitute a data access conflict. If a data access conflict is constituted, the current read / write access operation pair is added to the set of potential register access conflict problems.
[0058] 2.4) Determine whether the task flow pair has been traversed. If it has not been traversed, jump to step 2.2); otherwise, output the set of potential register access conflict problems.
[0059] In this embodiment, function expansion is used to extract read and write access operations on register array variables from each task flow. Since register access conflicts occur between two task flows with different priorities, each pair of task flows containing read and write access operations on register array variables is analyzed. For each such task flow pair, one read and write access operation on the register array variable is extracted from each of the two task flows. If at least one of these operations is a write operation, it is considered that there may be a register access conflict between the two, and therefore it is added to the potential register access conflict set. In this way, all possible register access conflicts can be analyzed and obtained.
[0060] According to the definition of register access conflict, in step 2.3) of this embodiment, determining whether a data access conflict may occur means determining whether at least one of the current read-write access operations is a write operation. If it is, the current read-write access operation pair is determined to be a potential register access conflict, and the current read-write access operation pair is added to the set of potential register access conflict problems.
[0061] In step 2), since the specific semantics of the program are not analyzed, it is impossible to determine whether different register access operations read or write to the same address, nor can it determine whether there is a real execution path that causes the access conflict to actually occur. To address this issue, step 2) does not consider the register access address or its execution conditions; any read or write operation on a register array variable is reported. Therefore, the potential register access conflict set obtained from the analysis may contain a large number of false positives. Further filtering and optimization are needed through step 3).
[0062] In the register access conflict analysis stage (step 2), because the specific register access addresses and program execution conditions were not considered, a large number of false positives were reported among the potential register access conflicts. Program verification is an effective method for accurate program analysis. In step 3), program verification is adopted. For each potential register access conflict, the questions of whether different register access operations in the conflict access the same address and whether a feasible path exists that allows the conflict to actually occur are transformed into a serial program verification problem. Then, existing program verification methods and tools are used for verification. If an execution path can be found where different operations access the same address and the conflict can actually occur, then the potential access conflict is a real register access conflict. Otherwise, the potential access conflict is a false positive. Specifically, step 3) in this embodiment includes: for the converted embedded interrupt-driven program, transforming the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem using an interrupt sequentialization method, resulting in a serially converted embedded interrupt-driven program. This serially converted embedded interrupt-driven program is then input into a program verification tool for verification to filter out real access conflicts from the potential register access conflict set, thereby obtaining a real set of register access conflict problems. In the previous analysis, due to the inability to accurately consider the semantics of the program, the analysis results contained a large number of false positives. Program verification is currently an effective means of accurately analyzing the semantics of program code, and accurate analysis of register access conflicts can be achieved based on program verification methods and techniques. Current program verification methods and techniques mainly analyze serial programs, but the verification problem of each potential register access conflict can be transformed into a serial program verification problem using an interrupt sequentialization method.
[0063] In this embodiment, the process of transforming the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem by interrupting the sequentialization method includes:
[0064] (1) Determine whether different operations can occur simultaneously.
[0065] For each potential register access conflict in the set of potential register access conflicts, add an assert statement: assert(false) at the read / write operation e2 of the high-priority task flow T2. This ensures that when the serial-converted embedded interrupt-driven program is input into the program verification tool, if the assert statement is triggered and a path leading to read / write operation e2 is returned, then it is determined that the two read / write operations e1 and e2 of the potential register access conflict can occur simultaneously within that execution path. Assume that in a potential register access conflict, the two read / write operations causing the conflict are e1 and e2, where e1 belongs to the low-priority task flow T1, e2 belongs to the high-priority task flow T2, and at least one of e1 and e2 is a write operation. A conflict between e1 and e2 means that there exists a real execution path such that when T1 executes to e1, T2 occurs, and within T2, e2 is executed. To verify the existence of such a path, insert the interrupt service routine corresponding to the high-priority task flow T2 into the e1 operation of T1, so that when T1 executes to e1, T2 occurs. To verify whether `e2` will be executed within `T2`, an assertion statement `assert(false)` is added at the point of operation `e2`. During program verification, if a real path exists leading to `e2`, this assertion statement will be triggered, and a path leading to `e2` will be returned. Since `e2` occurs within this path, `T2` must have been executed within this path. Furthermore, since `T2` is called when `e1` is executed, `e1` must also have occurred within this path. Thus, a path has been found where `e1` and `e2` can occur simultaneously, indicating that the two read / write operations `e1` and `e2` can occur concurrently within this execution path.
[0066] (2) Determine whether different operations access the same address.
[0067] For each read / write access operation to each register array variable _REG_BUF, there is an access address `addr` and a size of the data to be read or written `size`. Assume the two read / write operations that cause a register access conflict are `e1 :=`.<addr1,size1,var1> and e2:=<addr2,size2,var2> Here, e1 belongs to a low-priority task flow, and e2 belongs to a high-priority task flow. The access address and read / write data size of e1 are addr1 and size1, respectively, and the access address and read / write data size of e2 are addr2 and size2, respectively. If addr1 ≤ addr2, then e1 and e2 access the same address if and only if addr1 + size1 ≥ addr2; if addr2 ≤ addr1, then e1 and e2 access the same address if and only if addr2 + size2 ≥ addr1. Therefore, to verify whether two read / write operations e1 and e2 with a potential register access conflict access the same address in program verification: in this embodiment, an assert statement is added to the read / write operation e2 of the high-priority task flow T2 for each potential register access conflict in the potential register access conflict set.
[0068] assert(!((addr1≤addr2&&addr1+size1≥addr2)||(addr2≤addr1&&addr2+size2≥addr1))),
[0069] This allows the embedded interrupt-driven program, which performs serial conversion, to be input into the program verification tool. If the `assert` statement is triggered and returns a path leading to the read / write operation `e2`, it indicates that the two read / write operations `e1` and `e2`, which potentially conflict with the register access, can occur simultaneously and access the same address within that execution path. In the simplest case, if `addr1` and `addr2` are equal, the assertion is definitely false. With this assertion, if it is triggered, the execution path will definitely reach `e2`, therefore the previous `assert(false)` assertion is no longer needed and can be deleted.
[0070] (3) Representation of interrupt switch semantics.
[0071] In embedded driver programs, developers can enable / disable interrupt service routines using interrupt switch functions. While an interrupt service routine is disabled, it will not occur, and its register access operations will not conflict with register access operations in other task flows. To express this semantic, this embodiment introduces an integer interrupt enable variable INTEnableList, where the value of the i-th bit represents the state of the i-th interrupt service routine, called the enable flag of the i-th interrupt service routine. The enable flag can be 0 or 1, where 0 indicates the disabled state and 1 indicates the enabled state. For the converted embedded interrupt driver program, a condition is added at the beginning of each interrupt service routine to check its enable flag. If the enable flag is 0, the interrupt service routine is not executed, and the program returns directly. An example of the function after adding the enable flag check to the i-th interrupt service routine's INTHandle is as follows:
[0072]
[0073]
[0074] Then, when an interrupt switch function is encountered in the embedded interrupt-driven program, if the i-th interrupt service routine is enabled, the i-th bit of the interrupt enable variable INTEnableList is set to 1; if the i-th interrupt service routine is disabled, the i-th bit of the interrupt enable variable INTEnableList is set to 0. Thus, if an interrupt service routine is disabled, its enable flag is set to 0, and the program will exit directly when executing the corresponding interrupt service routine, without executing the statements in the interrupt service routine, thereby realizing the semantics of the interrupt switch operation. When the serially converted embedded interrupt-driven program is input into the program verification tool for verification, the program verification tool uses potential register access conflicts that occur simultaneously and can access the same address and whose corresponding interrupt service routines are not disabled as the filtered real access conflicts, thereby obtaining the real set of register access conflict problems.
[0075] Step 3) transforms the precise analysis of a potential register access conflict into a serial program verification problem, precisely considering the execution conditions of different read / write operations, whether different read / write operations access the same address, and the interrupt switching semantics in the embedded program. This serial program is then submitted to an existing program verification tool for verification. If an execution path satisfying all the above conditions is found, it indicates that the potential register access conflict is a real access conflict, thus achieving precise analysis of the register access conflict.
[0076] In summary, this embodiment can achieve accurate detection of register access conflicts in embedded interrupt-driven programs. First, addressing the issue that existing program analysis and verification tools do not support register access analysis, this embodiment transforms register access operations in the program into equivalent access operations to register array variables. Second, considering that static analysis methods struggle to accurately account for program execution conditions, and program verification methods struggle to characterize the semantics of interrupt-driven programs, while also requiring precise consideration of register access addresses and interrupt switch semantics, this embodiment combines static analysis with program verification. First, static analysis is used to preliminarily identify all possible register access conflicts. Then, program verification is used to precisely verify each potential register access conflict, accurately considering program execution conditions, register access addresses, and interrupt switch semantics. Finally, given the embedded interrupt-driven program to be analyzed and the tool implementing this invention, the tool analyzes the program. The tool automatically performs the conversion from register access operations to register array variable access operations, preliminary register access conflict analysis based on static analysis, and precise register access conflict analysis based on program verification. It then feeds back the set of potential register access conflicts and the set of verified register access conflicts to the user. In summary, this embodiment's method comprises three main steps: semantic representation of register access operations based on register array variables, preliminary analysis of register access conflicts based on static analysis, and precise analysis of register access conflicts based on program verification. It is the first to propose an overall framework for register access conflict detection and semantic representation of register access operations based on register array variables; it is also the first to apply static analysis and program verification to the detection of register access conflicts, including determining whether different registers access the same address during program verification, and providing semantic representation methods for interrupt switches. This embodiment provides specific solutions to problems such as determining whether different operations can occur simultaneously, determining whether different operations access the same address, and representing the semantics of interrupt switches during program verification, thereby achieving precise analysis of register access conflicts in embedded interrupt-driven programs.
[0077] Furthermore, this embodiment also provides a register access conflict detection system for interrupt-driven programs, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to perform the steps of the register access conflict detection method for interrupt-driven programs described above.
[0078] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program that is programmed or configured by a microprocessor to perform the steps of the register access conflict detection method for interrupt-driven programs described above.
[0079] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0080] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A register access conflict detection method for interrupt-driven programs, characterized in that... include: 1) For a given embedded interrupt-driven program containing register access operations, introduce a register array variable into the code of the embedded interrupt-driven program, and transform the register access operation in the code into a read / write operation on a certain element of the register array variable, thereby completing the semantic representation of register access operation based on the register array variable and obtaining the transformed interrupt-driven program. 2) For the converted embedded interrupt-driven program, a preliminary analysis of register access conflicts based on static analysis is performed to obtain a set of potential register access conflict problems; 3) For the converted embedded interrupt-driven program, perform precise analysis of register access conflicts based on program verification to filter out the real access conflicts from the set of potential register access conflict problems, thereby obtaining the real set of register access conflict problems; Step 3) includes: For the converted embedded interrupt-driven program, the verification problem of each potential register access conflict in the potential register access conflict set is transformed into a serial program verification problem by the interrupt sequentialization method, resulting in a serialized embedded interrupt-driven program. The serialized embedded interrupt-driven program is then input into a program verification tool for verification to filter out the real access conflicts in the potential register access conflict set, thereby obtaining the real register access conflict problem set. The method of transforming the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem by interrupting the sequentialization method includes: classifying each potential register access conflict in the potential register access conflict set as belonging to a high-priority task flow. Read and write operations In the operation section, add an assert statement: assert(false). This ensures that after the serial conversion embedded interrupt-driven program is input into the program verification tool, if the assert statement is triggered and returns a path that can reach the read / write operation e2, then the two read / write operations that potentially conflict with the register access are considered to have conflicted access. and This can happen simultaneously within this path.
2. The register access conflict detection method for interrupt-driven programs according to claim 1, characterized in that, In step 1), when converting the register access operations in the code into read / write operations on a certain element of the register array variable, this includes using a triplet for each register read operation. Let represent the register write operation, where addr represents the address of the register to be read, size represents the size of the data to be read, and var represents the program variable where the read data will be stored. Each register write operation is represented by a triplet. Let represent , where addr represents the register address to be written, size represents the size of the data to be written, and data represents the content of the data to be written.
3. The register access conflict detection method for interrupt-driven programs according to claim 2, characterized in that, The register array variable introduced in step 1) is a character-type register array variable REG_BUF[REGS_SIZE], where REGS_SIZE represents the register space size of the register array variable; the conversion of register access operations in the code into read / write operations on a specific element of the register array variable in step 1) includes: read operations on each register. Register read operation Transformed from the register array variable REG_BUF[REGS_SIZE] of the first... Copy `size` bytes from the address of each element to `var`; write to each register. Write operation to register This then translates to copying size bytes from the address where the data is located to the register array variable REG_BUF[REGS_SIZE]. The address where each element is located.
4. The register access conflict detection method for interrupt-driven programs according to claim 1, characterized in that, Step 2) includes: 2.1) Extract the read and write access operations of register array variables in each task flow through function expansion, and initialize the set of potential register access conflict issues to empty; 2.2) Using a pairwise extraction method, two task flows with different priorities that contain read and write access operations to register array variables are extracted to form a task flow pair; 2.3) Using a two-by-two extraction method, one read / write access operation to the register array variable is extracted from each of the two task flows of different priorities in the current task flow pair to form a read / write access operation pair. For each read / write access operation pair obtained through the traversal, it is determined whether it may constitute a data access conflict. If a data access conflict is constituted, the current read / write access operation pair is added to the set of potential register access conflict problems. 2.4) Determine whether the task flow pair has been traversed. If it has not been traversed, jump to step 2.2); otherwise, output the set of potential register access conflict problems.
5. The register access conflict detection method for interrupt-driven programs according to claim 4, characterized in that, In step 2.3), determining whether a data access conflict may occur means determining whether at least one of the current read / write access operations is a write operation. If so, the current read / write access operation pair is determined to be a potential register access conflict, and the current read / write access operation pair is added to the set of potential register access conflict problems.
6. The register access conflict detection method for interrupt-driven programs according to claim 1, characterized in that, The process of transforming the verification problem of each potential register access conflict in the potential register access conflict set into a serial program verification problem through interrupt-sequentialization includes: classifying each potential register access conflict in the potential register access conflict set as belonging to a high-priority task flow. Read and write operations In the operation section, add an assertion statement: ， in and Read and write operations that could potentially cause register access conflicts and address, and Read and write operations that could potentially cause register access conflicts and The size of the read and write data is such that after the serial-converted embedded interrupt-driven program is input into the program verification tool, if an assert statement is triggered and a path that can reach the read / write operation e2 is returned, then the two read / write operations that are suspected of register access conflict are determined to be problematic. and Within this path, events can occur simultaneously and access the same address. An integer interrupt enable variable `INTEnableList` is introduced, where the value of the i-th bit represents the state of the i-th interrupt service routine, called the enable flag for the i-th interrupt service routine. The enable flag can be 0 or 1, where 0 indicates the off state and 1 indicates the on state. For the converted embedded interrupt-driven program, a condition is added at the beginning of each interrupt service routine to check its enable flag. If the enable flag is 0, the interrupt service routine is not executed, and the program returns directly. Then, when an interrupt switch function is encountered in the embedded interrupt-driven program, if the i-th interrupt service routine is enabled, the interrupt enable variable `INTEnableList` is set to... The i-th bit of the interrupt enable variable INTEnableList is set to 1; if the i-th interrupt service routine is disabled, the i-th bit of the interrupt enable variable INTEnableList is set to 0. Thus, if an interrupt service routine is disabled, its enable flag is set to 0, and it will exit directly when executing the corresponding interrupt service routine without executing the statements in the interrupt service routine. When the serially converted embedded interrupt-driven program is input into the program verification tool for verification, the program verification tool uses potential register access conflicts that occur simultaneously in the potential register access conflict set, can access the same address, and whose corresponding interrupt service routines are not disabled as the filtered real access conflicts, thereby obtaining the real register access conflict problem set.
7. A register access conflict detection system for interrupt-driven programs, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to perform the steps of the register access conflict detection method for interrupt-driven programs as described in any one of claims 1 to 6.
8. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to be programmed or configured by a microprocessor to perform the steps of the register access conflict detection method for interrupt-driven programs as described in any one of claims 1 to 6.