Interrupt driver atomicity violation detection method based on partial order guide event graph

Abstract

The invention discloses an interrupt drive program atomicity violation detection method based on a partial order guide event graph, which comprises the following steps: acquiring a symbolized memory event in a program to be detected, and extracting a partial order of the symbolized memory event; based on the partial sequence, identifying a potential atomic violation event group from the symbolized memory events to obtain a key rf sequence; generating a skeleton of the event graph based on the partial sequence, and expanding edges of the event graph to obtain a stable event graph; and searching the stable event graph according to the key rf sequence to obtain an actually occurring atomic violation event. According to the method provided by the invention, the event graph of the SME is generated through the partial sequence, and the event graph is searched based on the rf sequence of the potential atomicity violation event group to detect the actually occurring atomicity violation event; the partial order relationship between events is visually represented, so that the interpretability of the detection process can be improved; moreover, the implementation cost is low, the adaptability is good, and the detection precision is high.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of program verification, and particularly relates to an interrupt-driven program atomicity violation detection method based on a partial order guided event graph. BACKGROUND

[0002] The interrupt mechanism is widely used in various computing systems, especially in safety-critical embedded software and high-end information systems. Such systems usually rely on interrupt service routines (ISRs) to interact with hardware to achieve fast response to external events. Although the interrupt-driven architecture can significantly improve the response speed and resource utilization of the system, its non-deterministic characteristics also pose a serious challenge to software development. The difficulty of verifying the interrupt-driven program lies in the unpredictability of the triggering of the interrupt and the asymmetric preemption characteristics. At any moment of program execution, the interrupt service routine may interrupt the running task, modify the shared data, and cause the program to produce unexpected behavior. If the access to the shared data is not properly synchronized and protected, the non-determinism in the interrupt execution process can easily cause concurrent errors, thereby causing logical inconsistency, system crash and other serious security problems.

[0003] Among all concurrent errors, atomicity violation is one of the most common and harmful problems. Specifically, a sequence of operations that should be executed continuously and uninterruptedly will be interrupted by an ISR during execution, and the interrupt modifies the shared data, which will cause a secondary violation. For example, if there are two consecutive read operations on the same variable in the main task or a certain interrupt, if a higher-priority interrupt preempts execution between the two reads and modifies the value of the variable, the atomicity of the read sequence will be broken, thereby causing an atomicity violation problem.

[0004] Although a variety of methods for detecting atomicity violation in multi-threaded programs have been proposed, due to the differences in synchronization methods and preemption mechanisms between interrupt-driven programs, these methods are difficult to apply directly. At present, the representative methods for detecting atomicity violation in interrupt-driven programs include intAtom, CPA4AV and NIChecker, etc. Among them, intAtom adopts a multi-stage static analysis, but lacks precise reachability analysis, making it difficult to handle complex interrupt interleaving; NIChecker relies on manual specification of violation types, has low automation degree, and the verification method of inserting assertions is prone to false positives in large programs, so it is difficult to apply to the verification of actual programs.

[0005] Therefore, the current methods for detecting atomicity violation have the problems of poor explainability, low automation degree and large detection error. SUMMARY

[0006] The embodiment of the present application provides an interrupt-driven program atomicity violation detection method based on a partial order boot event graph, and the above technical problems can be solved.

[0007] In a first aspect, the embodiment of the present application provides an interrupt-driven program atomicity violation detection method based on a partial order boot event graph, and the method comprises the following steps: Obtaining symbolic memory events in a program to be detected, and extracting a partial order sequence of the symbolic memory events; Based on the partial order sequence, identifying a potential atomicity violation event group from the symbolic memory events, and obtaining a key read-from sequence; The key read-from sequence is a read-from sequence of the potential atomicity violation event, the read-from sequence is used for indicating a dependency relationship of an effective read event, and a read variable value of the effective read event must be written before the effective read event occurs; Generating a skeleton of an event graph based on the partial order sequence, and extending edges of the event graph, to obtain a stable event graph, wherein the stable event graph comprises nodes corresponding to the symbolic memory events in one-to-one correspondence, and a direction of an edge between nodes is used for indicating an execution sequence between events corresponding to the nodes; Searching the stable event graph according to the key read-from sequence, to obtain an actually occurring atomicity violation event.

[0008] In a second aspect, the embodiment of the present application provides an interrupt-driven program atomicity violation detection device based on a partial order boot event graph, and the device comprises the following modules: A partial order sequence extraction module is configured to obtain symbolic memory events in a program to be detected, and extract a partial order sequence of the symbolic memory events; A key read-from sequence extraction module is configured to identify a potential atomicity violation event group from the symbolic memory events based on the partial order sequence, and obtain a key read-from sequence; wherein the key read-from sequence is a read-from sequence of the potential atomicity violation event, the read-from sequence is used for indicating a dependency relationship of an effective read event, and a read variable value of the effective read event must be written before the read event occurs; An event graph construction module is configured to generate a skeleton of an event graph based on the partial order sequence, and extend edges of the event graph, to obtain a stable event graph, wherein the stable event graph comprises nodes corresponding to the symbolic memory events in one-to-one correspondence, and a direction of an edge between nodes is used for indicating an execution sequence between events corresponding to the nodes; a detection module configured to search the stable event graph according to the key read-from order to obtain a real atomic violation event.

[0009] Compared with the prior art, the embodiment of the present application has the beneficial effects that: according to the method provided by the present application, the event graph of SME is generated through the partial order, and the event graph is searched based on the read-from order of the potential atomic violation event group to detect the real atomic violation event; the partial order relationship between events is visually represented, which can increase the explainability of the detection process; and since the present application automatically detects the atomic violation event based on the partial order and the event graph, the user does not need to manually specify the violation type, so the present application has low implementation cost, good adaptability and high detection precision. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1 An implementation flowchart of the atomic violation detection method of the interrupt driver based on the partial order guided event graph is provided for the embodiment of the present application; Figure 2 A schematic diagram of different types of potential atomic violation event groups is provided for the embodiment of the present application; Figure 3 A construction scene schematic diagram of the skeleton of the event graph is provided for the embodiment of the present application; Figure 4 A scene schematic diagram of the extended event graph is provided for the embodiment of the present application; Figure 5 A structure schematic diagram of the atomic violation detection device of the interrupt driver based on the partial order guided event graph is provided for the embodiment of the present application. DETAILED DESCRIPTION

[0011] In the following description, specific details are set forth, such as a particular system architecture, techniques, etc., in order to provide a thorough understanding of the embodiments of the present application. However, persons skilled in the art should understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary details.

[0012] It should be understood that when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0013] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items, and that the term "at least one of' as used herein means "one, two, three, four, or more" and that the term "one or more of as used herein means "at least one, two, three, four, or more."

[0014] As used in the description of the application and the appended claims, the term "if' can be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted to mean "upon determining" or "in response to determining" or "upon detecting [the described condition or event]" or "in response to detecting [the described condition or event]," depending on the context.

[0015] In addition, the description in the specification of the application and the appended claims uses the terms "first," "second," "third," etc. to refer to the features described, but these terms are used only to distinguish a reference between two or more big features that have the same name and are described in the claims. They are not necessarily used to indicate or imply relative importance of an associated part.

[0016] The description in the specification of the application uses the phrase "one embodiment" or "some embodiments" etc. to mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in additional embodiments," etc. in various places in the specification are not necessarily all referring to the same embodiment, unless otherwise specifically noted. The terms "comprise," "comprising," "has," "having," "includes," "including," "contains" and "containing" are used in the specification to mean "including but not limited to," unless otherwise specifically noted.

[0017] The application will be further described below in connection with specific embodiments, but the embodiments of the application are not limited thereto.

[0018] The method for detecting violation of atomicity of interrupt driver based on partial order guided event graph provided by the embodiments of the application can be applied to electronic devices such as mobile terminals, personal notebook computers, supercomputers, etc. The embodiments of the application do not make any limitation on the specific type of electronic devices.

[0019] Embodiment 1 Figure 1 An implementation flowchart of a method for detecting violation of atomicity of interrupt driver based on partial order guided event graph provided by the embodiments of the application is shown. As an example but not limitation, the method can be applied to the above-mentioned electronic devices. The method can include steps S101-S104, which will be described below.

[0020] S101, obtaining symbolic memory events in a program to be detected, and extracting a partial order of the symbolic memory events.

[0021] In some embodiments, since only read and write events that may affect the value of shared variables are related to atomicity violations, the program to be tested, such as a C interrupt driver, can be converted into a static single assignment (SSA) form, and the symbolic memory events (SMEs) therein can be identified through the SSA form of the program to be tested; then, the partial order of the SMEs is extracted to provide a basis for subsequent atomicity violation detection.

[0022] In a possible implementation, in the program to be detected in SSA form, no matter it is a read operation or a write operation, each occurrence of a variable is represented by a unique index and variable value.

[0023] For example, in the original program to be tested, there is a ", which can be expressed as " ", the next time the original program accesses the variable " The read operation performed by " can be expressed in SSA form as " ",in, Indicates read. Although and The values ​​are equal, both represent shared variables , but in SSA form it will be represented by a unique identifier.

[0024] Exemplarily, the shared variables in the program to be detected in the SSA format may be encoded according to the priority and execution sequence of the tasks.

[0025] For example, the same for shared variables For read operations, the higher priority code is , the lower priority code is .

[0026] Specifically, in the SSA form of the program to be tested, the statement " " will generate two SMEs, namely ( ) ( Rx )and( ) ( Wy ). These two SMEs stated that in the event Reading a memory location x (ie the variables in the original program x , whose symbol value is ) ; after the event at memory location y is written the symbolic value .

[0027] In one possible implementation, the partial order relations can include program order, read-from order, write-serialisation order and from-read order.

[0028] By way of example, program order refers to the textual order of the SME in the program under test. Under program order, the execution order of any task is considered to be consistent with the program code order.

[0029] By way of example, read-from order is used to indicate the dependency relationship of valid read events, which requires the value of the variable read by the valid read event to be written before the valid read event occurs. For example, there are write events , read events executed in sequence, and the value read by the read event is written in the write event , then there is a read-from order between them pointed by to .

[0030] By way of example, write-serialisation order is used to indicate the relative order between multiple write operations performed on the same variable.

[0031] By way of example, from-read order is used to indicate the order relationship between a read event and a subsequent write event.

[0032] Specifically, any read event in the extracted partial order must satisfy that the value it reads is exactly obtained from the write event that accesses the same variable, so as to ensure the consistency of memory operations. That is , where represents the read event, represents the write event, represents the value read by the event , represents the value written by the event , rf variable represents the event read the value written by the event , , and , respectively, are the memory locations operated by the event , represents the event guard condition, , conjunctive symbol, disjunctive symbol, representing events preceding at all times.

[0033] In one example, since the write-serialisation order, from-read order can be dynamically derived by the event graph in the subsequent procedure, when extracting the partial order, only the program order and read-from order can be extracted, reducing the memory footprint.

[0034] Exemplarily, the extracted partial order can be displayed and encoded to represent the partial order constraints between SMEs of the shared variable.

[0035] S102, based on the partial order, identifying a potential atomicity violation event group from the symbolic memory events, obtaining a critical read-from order.

[0036] In some embodiments, based on the partial order, the low-priority events can be grouped according to the memory access locations, obtaining a low-priority event group; based on the memory access locations of the low-priority event group, searching for a high-priority event that has access interleaving with the low-priority event group, obtaining a potential atomicity violation event group; then, based on the partial order, extracting the read-from order of the potential atomicity violation event group, obtaining a critical read-from order.

[0037] In one possible implementation, the types of potential atomicity events can include: read-write-read mode, write-write-read mode, write-read-write mode. The potential atomicity violation event group can include two low-priority events and one high-priority event with the same memory access location that may cause atomicity violation.

[0038] Exemplarily, the read-write-read mode indicates that the high-priority write event occurs between the two low-priority read events; see Figure 2 , the write-write-read mode indicates that the high-priority write event occurs between the low-priority write event and the read event, and the write-read-write mode indicates that the high-priority read event occurs between the two low-priority write events.

[0039] For example, potential atomicity violation of read-write-read pattern can occur when a financial system performs a memory audit process. For example, a read event is performed to read the initial value of a transaction counter, for example, 100 times, at this time, a write event of a high priority shared variable is performed, and the value of the counter is updated to 120 times. When the audit process is completed, another read event is performed to read the transaction counter in the subsequent verification period, and the transaction count of 120 is read, and the audit process is verified to be incorrect. However, in fact, the calculation result of the audit process is correct, and the atomicity violation occurs.

[0040] In one example, three events in a potential atomicity violation event group and the read-from order between the events, the critical rf variable record in the set PVset , for subsequent calls to view.

[0041] S103, generating the skeleton of the event graph based on the partial order, and expanding the edges of the event graph to obtain a stable event graph.

[0042] In some embodiments, nodes corresponding to symbolic memory events can be generated according to the encoded partial order first, and PG edges can be added between the nodes based on the program order, and RF edges can be added on the nodes corresponding to the events in the potential atomicity violation event group based on the critical read-from order; then, WS edges and FR edges can be added on the nodes corresponding to the events in the potential atomicity violation event group according to the Write-Serialization rule and the from-read rule; then, NI edges representing the priority order can be added between the nodes; finally, whether there is a self-loop in the expanded event graph is checked, and if there is, the expanded edges are checked back step by step until all self-loops are eliminated, and a stable event graph without loop is obtained.

[0043] In one possible implementation, referring to Figure 3 , after the nodes are generated, PG edges can be added to connect the nodes in turn according to the program order, and every time a PG edge is generated, the implicit indirect order can be derived through the current PG edge, and a transmission edge can be added between the nodes to obtain the skeleton of the event graph.

[0044] For example, referring to (a) in Figure 3 , there are 8 SME events, and there is a group of events with higher priority , , , , and a group of events with lower priority , , , There is a program order between events within the same priority, and PG edges are added in program order (see solid arrows in Figure 3 ).

[0045] For example, referring to (b) in Figure 3 , event happens before event , and event happens before event , it can be deduced that event happens before event , and a transfer edge from event to event can be added (see dashed arrow in Figure 3 ); after all transfer edges and PG edges are added, the skeleton of the event graph can be obtained (see (b) in Figure 3 ).

[0046] Optionally, the event graph can be constructed by a satisfiability solver, such as a MiniSat solver, which includes first-order logic formulas of partial order constraints (e.g., pg variable, rf variable, and PVset ).

[0047] In one possible implementation, for each potential atomicity violation event group, the critical variable therein can be assigned a value of "true" first, assuming that the read-from order thereof is established, and a corresponding RF edge is generated; then the ordinary variable is assigned a value. The WS edge, FR edge, and NI edge are added, and the construction of the event graph of the potential atomicity violation event group is completed, and whether the potential atomicity violation event group actually occurs is determined through the constructed event graph.

[0048] For example, referring to Figure 4 , there is a potential atomicity violation event group , , , and RF edges, WS edges, and NI edges are added for the critical variable therein, and no FR edge exists in the event group because there is no write event of a shared variable after the read event .

[0049] In one example, WS edges for representing write-serialisation order can be added between nodes based on the write-serialisation rule and the read-from order.

[0050] Specifically, the write-serialisation rule means that for write events with a read-from order, and read events , if there is another write event The memory access address is 、 The same, then in order to make Read The value of , events that write to the same variable, such as , which must happen in Before; that is .

[0051] For example, a WS edge may be added between a node corresponding to a previous write event and an RF write event with the same memory access address. The RF write event is a write event with a read-from order.

[0052] For example, see Figure 4 (a) in the event There is an RF edge on it, which is an RF write event, and the write event Occurred in the event Before, and the access address is x, you can add the event Pointing to events WS edge (see Figure 4 yellow arrow in the figure).

[0053] In one example, FR edges for representing a from-read order may be added between nodes based on a from-read rule and a read-from order.

[0054] Specifically, from-read refers to a write event that has a read-from sequence. and read events , if there is another write event The memory access address is 、 Same, that is , in order to Read The value of Subsequent write operations to the same variable, such as , should occur in Afterwards; that is .

[0055] For example, an FR edge may be added between nodes corresponding to a write event and an RF read event that occur later and have the same memory access address. The RF read event is a read event with a read-from sequence.

[0056] For example, referring to (b) in FIG. 7, event Figure 4 has an RF edge to event , which is an RF read event, and event occurs after event , then an NI edge from event to event can be added (see the purple arrow in FIG. 7). Figure 4

[0057] In one example, an NI edge indicating the priority order can be added between events of different priorities based on the Nested-Interrupt rule.

[0058] Specifically, the Nested-Interrupt rule refers to that if there are two tasks and in a program to be detected, and the priority Pri ( ) of the task Pri is less than the priority ( ) of the task , and event belongs to , event belongs to , and the last event in is , then the priority of event is higher than the priority of event

[0059] .

[0060] For example, referring to (b) in FIG. 7, event Figure 4 is the last task in the high-priority task, and occurs before the low-priority event , an NI edge from event to event can be added. Event occurs after event , then event must also occur before event , an NI edge from event to event can be added (see the blue arrow in FIG. 7). Figure 4

[0061] ​In one possible implementation, the transitive closure of the event graph can be computed every time a new edge is added to the event graph, to derive more transitive edges and refine the order relationship between any two events. When no more edges can be derived, the graph is considered to have reached a stable state. At this point, a feasibility check can be performed to detect whether there is a loop formed by directed edges in the graph. If a loop is detected, the loop is considered invalid and a conflict handling mechanism is triggered to backtrack the extended edges, undo the variable assignments that caused the conflict and the edges derived from them, and restore the graph to a loop-free stable state. If no loop is detected, the event graph is extended with assignments. Eventually, when a stable and loop-free event graph is constructed, it indicates that a valid program execution path has been found, and step S104 will confirm whether there is a real atomicity violation based on the path.

[0062] For example, referring to (c) in Figure 4 , when extending edges of the event graph based on a potential atomicity violation event group , , , a loop of occurs at - - - event - event, which eventually leads to a self-loop of -

[0063] event event, and a backtracking operation is needed to undo the extended edges and rebuild the event graph.

[0064] Optionally, after detecting the self-loop, a conflict clause can be generated and returned to the SAT solver to avoid the same conflict from happening again.

[0065] read-from S104, according to the critical read-from order, search for a stable event graph to obtain a real atomicity violation event.

[0066] In some embodiments, although the confirmation of atomicity violation is performed for each valid program execution path, not all paths necessarily contain a violation. Therefore, by prioritizing the critical rf order, the detection process can focus on paths that are more likely to contain a real violation, thereby effectively reducing the exploration of the overall state space.

[0067] In one possible implementation, the first low node, the second low node, and the high node in the potential atomicity violation event group can be located in the stable event graph according to the key read-from order; whether the first low node and the second low node meet the position proximity requirement is determined according to the variable attributes between the two, and whether the key sequentiality requirement is met according to the edge on the high node; if there is any unsatisfied requirement, it is determined that the potential atomicity violation event group is not a real atomicity violation; otherwise, the potential atomicity violation event group is output as a real atomicity violation event.

[0068] Exemplarily, the variable attribute is used to represent the memory access location of the event corresponding to the node.

[0069] Optionally, in the event graph, nodes corresponding to events with the same memory access location may be filled with the same color.

[0070] In one example, whether the first low node and the second low node events meet the location proximity requirement may be determined through location proximity detection.

[0071] For example, if the type of the potential atomicity violation event group is a read-write-read pattern or a write-write-read pattern, the triple event is recorded as ( , , ), the event graph above rf Variables are written by high priority events Points to low priority read events In this case, the proximity detection can be performed from the read event (i.e. the second lowest node) Search forward and find the nearest reachable access event to the same variable in the same task chain The corresponding node (i.e. the first low node) detects the event by determining whether there is a node with the same variable attribute (such as the same color) between the two nodes Whether it occurs in The last feasible event that operates on the same variable. and There is another feasible event that operates on the same variable, then and The proximity condition between them is violated, and the potential atomicity violation does not hold.

[0072] For example, see Figure 4 (a) in which the event ( 、 、 ) constitutes a potential atomicity violation event group of a write-write-read pattern. Event and events There are no nodes with the same variable attributes between the corresponding nodes, so the event can be determined. and events Satisfy location proximity requirements.

[0073] For example, if the type of the potential atomicity violation event group is a write-read-write pattern, the triple event is also recorded as ( , , ), the event graph above rf Variables are written by low priority events Points to high priority read events In this case, the proximity detection can also be performed from the write event Start searching forward to identify write events Is it a write event? The first feasible write event that operates on the same shared variable after . If so, then the group of potential atomicity violation events meets the location proximity requirement.

[0074] For example, see Figure 4 (b) in which the event ( 、 、 ) constitutes a potential atomicity violation event group of a write-read-write pattern, and the event and events If there is no node with the same variable attributes between the corresponding nodes, then the potential atomicity violation event group meets the location proximity requirement.

[0075] In one example, whether there is an edge connecting the first low node and the high node may be determined by critical sequence edge detection.

[0076] For example, if the type of the potential atomicity violation event group is a read-write-read pattern or a write-write-read pattern, whether the potential atomicity violation event group meets the critical sequentiality requirement can be determined by detecting whether there is an edge from the first low node to the high node.

[0077] For example, see Figure 4 (a) in which the event ( 、 、 ) constitutes a potential atomicity violation event group of a write-write-read pattern. Event and events There are events between the corresponding nodes Pointing to events If the type of the potential atomicity violation event group is write-read-write pattern, whether the potential atomicity violation event group satisfies the requirement of critical order relationship can be determined by detecting whether there is an edge from the high node to the second low node.

[0078] For example, if the type of the potential atomicity violation event group is write-read-write pattern, whether the potential atomicity violation event group satisfies the requirement of critical order relationship can be determined by detecting whether there is an edge from the high node to the second low node.

[0079] For example, referring to (b) in FIG. 1, Figure 4 , events (a), (b) and (c) constitute a potential atomicity violation event group of write-read-write pattern, and if there is an FR edge from node a to node b, the potential atomicity violation event group satisfies the requirement of critical order relationship, and since the above example has determined that the potential atomicity violation event group also satisfies the requirement of location proximity, the potential atomicity violation event group is a real atomicity violation event. According to the method provided by the present application, the event graph of SME is generated by partial order sequence, and the event graph is searched based on the read-from order of potential atomicity violation event group to detect real atomicity violation event; the partial order sequence relationship between events is visually represented, which can increase the explainability of the detection process; and since the present application automatically detects atomicity violation event based on partial order sequence and event graph, the user does not need to manually specify the violation type, so the present application has low implementation cost, good adaptability and high detection precision.

[0080]

[0081] Figure 5 The structure schematic diagram of the atomicity violation detection device of the interrupt driver program based on partial order guided event graph provided by the embodiment of the present application is shown. As an example but not limitation, the device can include partial order sequence extraction module, critical read-from order extraction module, event graph construction module and detection module.

[0082] ​​​​​Exemplarily, the partial order extraction module is used to obtain the symbolic memory events in the program to be detected and extract the partial order of the symbolic memory events; the key read-from order extraction module is used to identify the potential atomicity violation event group from the symbolic memory events based on the partial order and obtain the key read-from order; wherein, the key read-from order is the read-from order of the potential atomicity violation event, and the read-from order is used to indicate the dependency relationship of the valid read event, and the variable value read by the valid read event must be written before the read event occurs; the event graph construction module is used to generate the skeleton of the event graph based on the partial order and expand the edges of the event graph to obtain a stable event graph, wherein the stable event graph includes nodes corresponding one-to-one to the symbolic memory events, and the direction of the edges between the nodes is used to indicate the execution order between the events corresponding to the nodes; the detection module is used to search the stable event graph according to the key read-from order to obtain the actual atomicity violation event.

[0083] In order to better illustrate the beneficial effects of the present invention, the following simulation experiments were conducted: For example, in the simulation experiment, 25 examples from the open source academic benchmark test set Racebench 2.1 are used (excluding the examples containing only read-write-write ( R , W , W The experiment was conducted on the example of the ) mode, and the experimental results are shown in the following Table 1: Table 1

[0084] Specifically, the first column #ID in Table 1 represents the index of each example in the test set, the second column #LoC represents the number of lines of code for each example, and the third column #Vio represents the number of true atomicity violations contained in the example (not considering ( R , W , W ) mode), the fourth column #WN represents the number of atomicity violations tested by the present invention, the fifth column #TP represents the number of #WN that belong to #Vio (i.e., the number of correct reports), the sixth column #FP represents the number of #WN that does not belong to #Vio (i.e., the number of incorrect reports), the seventh column #FN represents the number of #Vio that does not belong to #WN (i.e., the number of missed reports), and the eighth column #Time represents the test time of this example (in seconds).

[0085] As can be seen from Table 1, the present invention is able to detect all atomicity violations contained in the test set without any missed detections, which indicates that the present invention has good detection accuracy and efficiency.

[0086] Therefore, the application generates an event graph of SMEs through a partial order, and searches the event graph based on a read-from order of a potential atomic violation event group to detect a real atomic violation event; visual representation of the partial order relationship between events can increase the explainability of the detection process; and since the application automatically detects atomic violation events based on the partial order and the event graph, without the need for users to manually specify violation types, the application has low implementation cost, good adaptability and high detection accuracy.

[0087] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

Claims

1. A method for detecting atomicity violation of interrupt driver based on partially ordered guided event graph, characterized in that: include: Obtaining symbolic memory events in the program to be detected, and extracting a partial order of the symbolic memory events; Based on the partial order, identifying a potential atomicity violation event group from the symbolic memory event to obtain a key read-from order; The key read-from sequence is the read-from sequence of the potential atomicity violation event, and the read-from sequence is used to indicate the dependency relationship of a valid read event. The variable value read by the valid read event must be written before the valid read event occurs. Generate a skeleton of an event graph based on the partial order, and expand the edges of the event graph to obtain a stable event graph, wherein the stable event graph includes nodes corresponding to the symbolic memory events one by one, and the directions of the edges between the nodes are used to indicate the execution order between the events corresponding to the nodes; The stable event graph is searched according to the key read-from sequence to obtain the atomicity violation events that actually occurred.

2. The method according to claim 1, characterized in that The obtaining of symbolic memory events in the program to be detected includes: Converting the program to be tested into a static single assignment SSA form to obtain the program to be tested in SSA form; The symbolic memory event is identified from the program to be detected in the SSA form.

3. The method according to claim 1, characterized in that The step of identifying a potential atomicity violation event group from the symbolic memory event based on the partial order and obtaining a key read-from sequence includes: Based on the partial order, grouping the low priority events according to memory access locations to obtain a low priority event group; Based on the memory access location of the low priority event group, searching for high priority events that have access interleaving with the low priority event group to obtain the potential atomicity violation event group; The read-from sequence of the potential atomicity violation event group is extracted to obtain the key read-from sequence.

4. The method according to claim 3, characterized in that The types of potential atomicity events include: read-write-read mode, write-write-read mode, and write-read-write mode. The potential atomicity violation event group includes two low-priority events and one high-priority event at the same memory access location where atomicity violation may occur. Among them, the read-write-read mode indicates that a high-priority write event occurs between two low-priority read events, the write-write-read mode indicates that a high-priority write event occurs between a low-priority write event and a read event, and the write-read-write mode indicates that a high-priority read event occurs between two low-priority write events.

5. The method according to claim 4, characterized in that The searching the stable event graph according to the key read-from sequence includes: Locating a first low-priority node, a second low-priority node, and a high-priority node in the potential atomicity violation event group in the stable event graph according to the key read-from sequence, wherein the first low-priority node, the second low-priority node, and the high-priority node correspond to a low-priority event that occurs first, a low-priority event that occurs later, and a high-priority event in the potential atomicity violation event group, respectively; Based on the stable event graph, determining whether the first low node and the second low node meet a location proximity requirement based on variable attributes of nodes between the first low node and the second low node, and determining whether the high node meets a critical order requirement based on an edge on the high node; wherein the variable attributes are used to represent a memory access location of an event corresponding to the node; If the first low node and the second low node meet the location proximity requirement and the high node meets the critical order requirement, the potential atomicity violation event group is output as an actual atomicity violation event.

6. The method according to claim 5, characterized in that The type of the potential atomicity violation event group is a read-write-read mode or a write-write-read mode; The determining, based on the variable attributes of the nodes between the first low node and the second low node, whether the first low node and the second low node meet the location proximity requirement includes: On the same task chain, determining whether there is a node with the same variable attribute between the first lower node and the second lower node, wherein the priorities of events corresponding to the nodes on the same task chain are the same; If there is a node with the same variable attribute between the first low node and the second low node, then the first low node and the second low node meet the position proximity requirement; The step of determining whether the high node meets the critical sequentiality requirement based on the edge on the high node includes: Determining whether there is an edge from the first low node to the high node; If there is an edge pointing from the first low node to the high node, then the high node meets the critical order requirement.

7. The method according to claim 5, characterized in that The type of the potential atomicity violation event group is a write-read-write pattern; The determining, based on the variable attributes of the nodes between the first low node and the second low node, whether the first low node and the second low node meet the location proximity requirement includes: On the same task chain, determining whether there is a node between the first low node and the second low node that has the same variable attribute and a corresponding event that is a write event, wherein the nodes on the same task chain have the same priority level for the corresponding events; If the first low node and the second low node have the same variable attribute and the corresponding event is a write event, then the first low node and the second low node meet the position proximity requirement; The step of determining whether the high node meets the critical sequentiality requirement according to the edge on the high node includes: Determine whether there is an edge from the high node to the second low node; If there is an edge pointing from the high node to the second low node, then the high node meets the critical order requirement.

8. The method according to claim 1, characterized in that The partial order includes: program order, read-from order, write-serialization order and from-read order; The program order is the textual order of the symbolic memory events in the program to be detected, the write-serialisation order is used to indicate the relative order between multiple write operations performed on the same variable, and the from-read order is used to indicate the sequential relationship between a read event and a subsequent write event.

9. The method according to claim 8, characterized in that Generating a skeleton of an event graph based on the partial order and extending edges of the event graph to obtain a stable event graph includes: Generate nodes corresponding to the symbolic memory events one by one according to the program sequence, and add PG edges representing the program sequence between the nodes to obtain the skeleton of the event graph; Based on the skeleton of the event graph, adding RF edges between nodes for representing the read-from order; Adding a WS edge for representing the write-serialisation order and a FR edge for representing the from-read order between nodes based on the RF edge; NI edges for representing the priority order of events are added between nodes to obtain the stable event graph.

10. A device for detecting atomicity violation of interrupt driver based on partial order guided event graph, characterized in that: include: A partial order extraction module, the partial order extraction module is used to obtain symbolic memory events in the program to be detected and extract the partial order of the symbolic memory events; A key read-from sequence extraction module is configured to identify a group of potential atomicity violation events from the symbolic memory events based on the partial order, and obtain a key read-from sequence; wherein the key read-from sequence is the read-from sequence of the potential atomicity violation events, and the read-from sequence is configured to indicate a dependency relationship of a valid read event, wherein the variable value read by the valid read event must have been written before the read event occurred; An event graph construction module, the event graph construction module is used to generate a skeleton of an event graph based on the partial order, and expand the edges of the event graph to obtain a stable event graph, wherein the stable event graph includes nodes corresponding to the symbolic memory events one by one, and the directions of the edges between the nodes are used to indicate the execution order between the events corresponding to the nodes; A detection module is used to search the stable event graph according to the key read-from sequence to obtain the atomicity violation event that actually occurred.

Images