Pluggable abstract domains for analyzing embedded software

Abstract

Many abstract value domains such as intervals, bitwise, constants, and value-sets have been developed to support dataflow analysis. Different domains offer alternative tradeoffs between analysis speed and precision. Furthermore, some domains are a better match for certain kinds of code than others. This paper presents the design and implementation of cXprop, an analysis and transformation tool for C that implements "conditional X propagation," a generalization of the well-known conditional constant propagation algorithm where X is an abstract value domain supplied by the user. cXprop is interprocedural, context-insensitive, and achieves reasonable precision on pointer-rich codes. We have applied cXprop to sensor network programs running on TinyOS, in order to reduce code size through interprocedural dead code elimination, and to find limited-bitwidth global variables. Our analysis of global variables is supported by a novel concurrency model for interruptdriven software. cXprop reduces TinyOS application code size by an average of 9.2% and predicts an average data size reduction of 8.2% through RAM compression.

Dataflow analysis for concurrent programs using datarace detection

“…The pointer analysis of [22] is interprocedural but matching par-begin and par-end constructs must be in the same function. Recently, [3] proposed an analysis framework for optimizing embedded programs written in NESC [8]. This framework is tailored to NESC's interrupt-based concurrency and explicit atomic sections.…”

Efficient type and memory safety for tiny embedded systems

“…Concurrency analysis: Instead of relying on nesC's concurrency analysis, as we previously did [2], we implemented our own race condition detector that is conservative (nesC's analysis does not follow pointers) and slightly more precise. The results of this analysis, in addition to supporting sound analysis of concurrent code, supports the elimination of nested atomic sections and the avoidance of the need to save the state of the interrupt-enable bit for non-nested atomic sections.…”

“…Finally, cXprop [2] is an aggressive whole-program dataflow analyzer that we developed for C. It understands the TinyOS concurrency model, and in our toolchain, we use cXprop to optimize the safe programs produced by CCured. Like CCured, cXprop is based on CIL [7].…”

Deriving State Machines from TinyOS Programs Using Symbolic Execution

“…cXprop [9] is an abstract interpreter built over CIL [24], designed for TinyOS. It allows users to define their own value-propagation analyses in the spirit of conditional constant propagation, using abstract value domains.…”

“…The second has been to develop run-time monitoring (e.g., Sympathy [27]) and debugging tools (e.g., Nucleus [30], Clairvoyant [32]) that can simplify the process of discovering program errors. The third has been to develop compiletime program analysis tools [28,9,8] for catching program errors before execution.…”