Mining and checking paired functions in device drivers using characteristic fault injection

BaiJia-Ju,WangYu-Ping,LiuHu-Qiu,HuShi-Min

2016-01-01

Abstract:ContextDevice drivers often call specific kernel interface functions in pairs to allocate and release resources, and these functions can be called as paired functions. But due to poor documentation...

What problem does this paper attempt to address?

Mining and Checking Paired Functions in Device Drivers Using Characteristic Fault Injection.

Jia-Ju Bai,Yu-Ping Wang,Hu-Qiu Liu,Shi-Min Hu

DOI: https://doi.org/10.1016/j.infsof.2016.01.018

IF: 3.9

2016-01-01

Information and Software Technology

Abstract:Context: Device drivers often call specific kernel interface functions in pairs to allocate and release resources, and these functions can be called as paired functions. But due to poor documentation and carelessness, developers sometimes misuse paired functions in drivers, which causes resource-usage violations.Objective: Many dynamic approaches have been proposed to mine API rules and check resource usage for user-mode applications, but they are rarely applied to kernel-mode device drivers due to their designs. Meanwhile, most existing dynamic approaches lack systematic mechanisms to cover error handling code, which limits their availability and scalability. Our goal is to improve dynamic analysis to solve these problems.Method: In this paper, we propose PairCheck, a novel approach for mining and checking paired functions in device drivers, using three techniques. Firstly, we design a characteristic fault injection framework to generate test cases, which simulates occasional errors and covers most error handling code with little effort. Secondly, complete runtime information is recorded through call interception during test-case execution. Thirdly, we mine and check paired functions based on collected runtime information, name patterns and statistical analysis.Result: To validate the availability of PairCheck, we evaluate it on 11 Linux Ethernet card drivers. PairCheck mines 37 and 43 real paired functions in Linux 3.1.1 and 3.17.2, respectively. With these mined paired functions, it finds 10 violations in Linux 3.1.1 which have been fixed in 3.17.2, and 35 new violations in 3.17.2. The replies from developers indicate the false positive rate is low. Compared to normal execution, code coverage increases by 8.3% on average.Conclusion: Our work shows that it is possible to precisely mine API rules of resource usage by using characteristic fault injection. The mined rules are useful for improving the reliability of device drivers. (C) 2016 Elsevier B.V. All rights reserved.
Pairminer: mining for paired functions in Kernel extensions

Hu-Qiu Liu,Jia-Ju Bai,Yu-Ping Wang,Zhe Bian,Shi-Min Hu

DOI: https://doi.org/10.1109/ISPASS.2015.7095788

2015-01-01

Abstract:Drivers use kernel extension functions to manage devices, and there are often many rules on how they should be used. Among the rules, utilization of paired functions, which means that the functions must be called in pairs between two different functions, is extremely complex and important. However, such pairing rules are not well documented, and these rules can be easily violated by programmers when they unconsciously ignore or forget about them. Therefore it is useful to develop a tool to automatically extract paired functions in the kernel source and detect incorrect usages. We put forward a method called PairMiner in this paper. Heuristic and statistical mechanisms are adopted to associate with the special structure of drivers??? source code, to find out paired functions between relative operations, and then to detect violations with extracted paired functions. In the experiment evaluation, we have successfully found 1023 paired functions in Linux 3.10.10. The utility of PairMiner was evaluated by analyzing the source code of Linux 2.6.38 and 3.10.10. PairMiner located 265 bugs about paired function violations in 2.6.38 which have been fixed in 3.10.10. We also have identified 1994 paired function violations which have not yet been fixed in 3.10.10. We have reported some violations as potential bugs with emails to the developers, 27 developers have replied the emails and 20 bugs have been confirmed so far, 2 violations are confirmed as false positive.
Runtime Checking for Paired Functions in Device Drivers

Jia-Ju Bai,Hu-Qiu Liu,Yu-Ping Wang,Shi-Min Hu

DOI: https://doi.org/10.1109/apsec.2014.66

2014-01-01

Abstract:Device drivers usually invoke functions to allocate resources for managing hardware devices and communicating with the kernel, and these resources should be released by functions when the work is finished. Thus allocating functions and releasing functions must be invoked in pairs. However, many developers ignore this vital rule, and some allocated resources are not released in time, which may cause resource related problems like deadlocks and memory leak. For improving the resource management of device drivers, we propose an approach named Pair Dyn to check these paired functions during runtime. When the driver runs, Pair Dyn records the runtime information of allocating functions such as key parameters and return value, and dynamically detects whether the relevant releasing functions are invoked to free allocated resources during runtime. Before the driver exits, Pair Dyn automatically attempts to invoke the related releasing functions which are lacked in runtime, in order to free the allocated resources of the operation system. We have implemented Pair Dyn with the LLVM compiler infrastructure, and make the evaluation with four real device drivers in Linux version 3.10.1. The experimental result shows that with the low extra overhead, Pair Dyn can provide effective runtime checking for allocate-release paired functions. Moreover, 9 potential bugs are found in the four drivers, which are all fixed automatically before exiting. Finally, no manual modification of the source code is needed with Pair Dyn.
BP-Miner: Mining Paired Functions from the Binary Code of Drivers for Error Handling

Hu-Qiu Liu,Jia-Ju Bai,Yu-Ping Wang,Shi-Min Hu

DOI: https://doi.org/10.1109/apsec.2014.67

2014-01-01

Abstract:Kernel extension functions are provided as interfaces for drivers to manage devices and resources, and there are many implicit rules about their usages. One of the most important rules is that many functions should be called in pairs. That is to say, when an error occurs in a function, the driver should call related functions to handle it and release the acquired resources before returning, and we name these functions between normal execution paths and error handling paths as paired functions. However, many developers are unaware of them, which causes lots of bugs. Therefore, it is highly significant to automatically extract paired functions and detect violations for drivers. This paper proposes an efficient tool named BP-Miner, which can extract paired functions from binary code of driver modules and detect violations for error handling in drivers with extracted paired functions. BP-Miner constructs control flow graph (CFG) based on basic blocks of binary code, and locates potential execution paths to extract paired functions. We have evaluated BP-Miner with Linux drivers 2.6.38 and 3.13.0-rc7. 76 bugs are reported by BP-Miner in 2.6.38 which have been fixed in the current latest version 3.13.0-rc7. BP-Miner spends about 90 minutes handling 3653 module files for 3.13.0-rc7, and 859 violations have been detected with 1167 extracted paired functions. As it works on the binary code, it can be utilized to check close-source drivers.
Testing Error Handling Code In Device Drivers Using Characteristic Fault Injection

Jia-Ju Bai,Yu-Ping Wang,Jie Yin,Shi-Min Hu

2016-01-01

Abstract:Device drivers may encounter errors when communicating with OS kernel and hardware. However, error handling code often gets insufficient attention in driver development and testing, because these errors rarely occur in real execution. For this reason, many bugs are hidden in error handling code. Previous approaches for testing error handling code often neglect the characteristics of device drivers, so their efficiency and accuracy are limited. In this paper, we first study the source code of Linux drivers to find useful characteristics of error handling code. Then we use these characteristics in fault injection testing, and propose a novel approach named EH-Test, which can efficiently test error handling code in drivers. To improve the representativeness of injected faults, we design a pattern-based extraction strategy to automatically and accurately extract target functions which can actually fail and trigger error handling code. During execution, we use a monitor to record runtime information and pair checkers to check resource usages. We have evaluated EH-Test on 15 real Linux device drivers and found 50 new bugs in Linux 3.17.2. The code coverage is also effectively increased. Comparison experiments to previous related approaches also show the effectiveness of EH-Test.
Pf-Miner: A New Paired Functions Mining Method for Android Kernel in Error Paths

Huqiu Liu,Yuping Wang,Lingbo Jiang,Shimin Hu

DOI: https://doi.org/10.1016/j.jss.2016.02.007

IF: 3.5

2016-01-01

Journal of Systems and Software

Abstract:Drivers are significant components of the operating systems(OSs), and they run in kernel mode. Generally, drivers have many errors to handle, and the functions called in the normal execution paths and error handling paths are in pairs, which are named as paired functions. However, some developers do not handle the errors completely as they forget about or are unaware of releasing the acquired resources, thus memory leaks and other potential problems can be easily introduced. Therefore, it is highly valuable to automatically extract paired functions for these problems and detect violations for the programmers. This paper proposes an efficient tool named PF-Miner, which can automatically extract paired functions and detect violations between normal execution paths and error handling paths from the source code of C program with the data mining and statistical methods. We have evaluated PF-Miner on different versions of Android kernel 2.6.39 and 3.10.0, and 81 bugs reported by PF-Miner in 2.6.39 have been fixed before the latest version 3.10.0. PF-Miner only needs about 150 seconds to analyze the source code of 3.10.0, and 983 violations have been detected from 546 paired functions that have been extracted. We have reported the top 51 violations as potential bugs to the developers, and 15 bugs have been confirmed.
Hardware/Software Co-monitoring

Li Lei,Kai Cong,Zhenkun Yang,Bo Chen,Fei Xie

DOI: https://doi.org/10.48550/arXiv.1905.03915

2019-05-10

Abstract:Hardware/Software (HW/SW) interfaces, mostly implemented as devices and device drivers, are pervasive in various computer systems. Nowadays HW/SW interfaces typically undergo intensive testing and validation before release, but they are still unreliable and insecure when deployed together with computer systems to end users. Escaped logic bugs, hardware transient failures, and malicious exploits are prevalent in HW/SW interactions, making the entire system vulnerable and unstable. We present HW/SW co-monitoring, a runtime co-verification approach to detecting failures and malicious exploits in device/driver interactions. Our approach utilizes a formal device model (FDM), a transaction-level model derived from the device specification, to shadow the real device execution. Based on the co-execution of the device and FDM, HW/SW co-monitoring carries out two-tier runtime checking: (1) device checking checks if the device behaviors conform to the FDM behaviors; (2) property checking detects invalid driver commands issued to the device by verifying system properties against driver/device interactions. We have applied HW/SW co-monitoring to five widely-used devices and their Linux drivers, discovering 9 real bugs and vulnerabilities while introducing modest runtime overhead. The results demonstrate the major potential of HW/SW co-monitoring in improving system reliability and security.

Software Engineering,Cryptography and Security
Mining Frequent Patterns from Software Defect Repositories for Black-Box Testing

Ning Li-,Zhanhuai Li,Lijun Zhang

DOI: https://doi.org/10.1109/IWISA.2010.5473578

2010-01-01

Abstract:Software defects are usually detected by inspection, black-box testing or white-box testing. Current software defect mining work focuses on mining frequent patterns without distinguishing these different kinds of defects, and mining with respect to defect type can only give limited guidance on software development due to overly broad classification of defect type. In this paper, we present four kinds of frequent patterns from defects detected by black-box testing (called black-box defect) based on a kind of detailed classification named ODC-BD (Orthogonal Defect Classification for Blackbox Defect). The frequent patterns include the top 10 conditions (data or operation) which most easily result in defects or severe defects, the top 10 defect phenomena which most frequently occur and have a great impact on users, association rules between function modules and defect types. We aim to help project managers, black-box testers and developers improve the efficiency of software defect detection and analysis using these frequent patterns. Our study is based on 5023 defect reports from 56 large industrial projects and 2 open source projects.
A Model Driven Approach for Device Driver Development.

Yunwei Dong,Yuanyuan He,Yin Lu,Hong Ye

DOI: https://doi.org/10.1109/qrs-c.2017.27

2017-01-01

Abstract:In order to facilitate the development and maintenance of device drivers integrated into the operating system, a model driven approach is proposed in this pater for driver design and verification before codding. Architecture model and behavior model are created to illustrate both static and dynamic characteristics of device drivers, in company with device model and device-driver-O.S. interaction model that are used to describe the execution environment of device drivers. Principles and functions of these models are discussed in detail in the major part of the paper, together with a solution of how to perform model-level verification and code-level emulation. Formula descriptions are built up and methods are proposed to implement model-based design, verification and emulation. Finally, in the end of the paper, a UART device driver in the Linux system is taken as an example to show how to perform MDA methods in the development of device drivers.
Fault Injection Scheme for Embedded Systems at Machine Code Level and Verification

Ang Jin,Jian-hui Jiang

DOI: https://doi.org/10.1109/PRDC.2009.68

2009-01-01

Abstract:In order to evaluate software from the third party whose source codes are not available, after a careful analysis of the statistic data sorted by orthogonal defect classification, and the corresponding relation between patterns of high level language programs and machine codes, we propose a fault injection scheme at machine code level suitable respectively to the IA32 ARM and MIPS architecture, which takes advantage of mutating machine code. To prove the feasibility and validity of this scheme, two sets of programs are chosen as our experimental target: Set I consists of two different versions of triangle testing algorithms, and Set II is a subset of the Mibench which is a collection of performance benchmark programs designed for embedded systems; we inject both high level faults into the source code written in C language and the corresponding machine code level faults directly into the executables, and monitor their running on Linux. The results from experiments show that at least 96% of total similarity degree is obtained. Therefore, we conclude that the effect of injecting corresponding faults on both the source code level and machine code level are mostly the same. Therefore, our scheme is rather useful in analyzing system behavior under faults.
A Common Software Fault Injection Method for VxWorks Systems

FAN Wen-hao,MA Jie-zhong,SUN Jiang-yan

DOI: https://doi.org/10.3969/j.issn.1000-8829.2011.04.026

2011-01-01

Abstract:A common software fault injection method for VxWorks-based systems is given.It has framework of fault injection tool and fault model.The fault injection tool uses TCP/IP protocol to communication and injects fault by property of interruption.It resides a part of program in target system.Experiments are done on VMware virtual machine.The result indicates that the method can inject fault effectively into VxWorks-based equipment for evaluation and improvement of fault tolerance.
A Parallel Memory Fault Detection Scheme Combined with Hardware Characteristic

Die HU,Jun-min WU

DOI: https://doi.org/10.3969/j.issn.1000-3428.2014.03.066

2014-01-01

Abstract:March algorithms are designed very complex, and they are designed to be used to test memory chips, does not apply to the user. In order to solve above problems, this paper presents a parallel memory test method which utilizes the hardware features. It includes two parallel methods:one is chips-level parallel method which is designed according to the working principle of DDR2, and it can detect several memory chips. The other is Local Memory Controller(LMC)-level parallel method which is designed according to the working principle of memory controller, and it can detect several DDR2 memories. For chips-level parallel method, if more chips can be tested, the test time is faster. From testing one chip to eight chips, the test time is almost linearly decreasing. For LMC-level method, if there are more LMCs, the time is faster. From one LMC to two LMCs, the test time is reduced by almost doubled. Experimental results show that this method can greatly reduce the test time of the two algorithms, while still allow users to test memory.
Hardware Fault Injection Tool Based on JTAG

XUE Lixing,ZHANG Zhan,ZUO Decheng,YANG Xiaozong,LUO Zongyang

DOI: https://doi.org/10.3969/j.issn.2095-2163.2011.04.009

2011-01-01

Abstract:Reliability is an important performance evaluation of fault-tolerant computer,Evaluation of system reliability in the computer system design and implementation phases is important.Fault Injection is a common method of reliability evaluation.This paper describes a CPU fault-injection tool implemented by hardware based on the common JTAG debugging techniques,and simulation experiments are done to validate the tool.The tool is based on IEEE standards,and fault injection can be done,as long as the boudary scan chain of target chip is known.At the same time,the work of fault injection is done by hardware,which is transparent to operating systems,it can break through the protections of operating systems.
A PIN-Based Dynamic Software Fault Injection System

Ang Jin,Jianhui Jiang,Jiawei Hu,Jungang Lou

DOI: https://doi.org/10.1109/ICYCS.2008.329

2008-01-01

Abstract:Fault injection plays a critical role in the verification of fault-tolerant mechanism, software testing and dependability benchmarking for computer systems. In this paper, according to the characteristics of software faults, we propose a new fault injection design pattern based on the PIN framework provided by Intel company, and develop a PIN-based dynamic software fault injection system (PDSFIS). Faults can be injected by PDSFIS without the source code of target applications under assessment, nor does the injection process involve interruption or software traps. Experimental assessment results of an Apache Web server obtained by the dependability benchmarking are presented to demonstrate the potentials of PDSFIS.
Design and implementation of a fault injection system for 1553B fault-tolerant bus controller

Hongwei Liu,Lei Chi,Yanning Wang,Jian Dong

2009-01-01

Abstract:With the comprehensive application of the 1553B bus in the fields of aerospace, exigent demands for the reliability have been brought forward, and the information transmission bottleneck of the 1553B bus is the bus controller, so it is necessary to develop a 1553B fault-tolerant bus controller. In order to evaluate the reliability of fault-tolerant system and provide an effective debugging tool in the development stage of fault-tolerant system, a Fault Injection System is designed and implemented with embedded hardware fault injection method. The system achieves communication between host and the fault injector by using RS232 Serial Port. Users can inject many types of faults into the tri-modular redundant fault tolerant system, such as permanent failures and transient failures, and real-time display the status of the target system. The experimental results show that the design scheme is feasible, and the system function can meet users' requirements.
A Software Fault Injection Tool for Evaluation of the Dependability of Onboard System

Jun-jie PENG,Qing-cheng HUANG,Bing-rong HONG,Rui LI,Cheng-jun YUAN

DOI: https://doi.org/10.3321/j.issn:1000-1328.2005.06.030

2005-01-01

Abstract:With the applications of computers being more wide,many traditional fault injection techniques and tools are confronted with new challenges in some of new fields.In this paper,a new software implemented fault injection tool SFIOS,which aims at evaluation of the dependability of onboard system developed by our research group is introduced.This is an easy use tool when,location and event are adopted as fault trigger conditions.Using this tool,not only faults close to the realistic environment onboard system runs can be easily emulated,but no modification to the onboard application tasks is needed.It has minimum interference with tasks running on the onboard system.Experimental results show there are many advantages and potential using the fault injection tool to evaluate the dependability of onboard system.
Study on Software Fault Injection Based on Onboard System

JJ Peng,BR Hong,CJ Yuan,AG Li,ZH Wei,YQ Qiao

DOI: https://doi.org/10.3321/j.issn:0367-6234.2004.07.029

2004-01-01

Abstract:Fault injection techniques are the effective methods to evaluate the dependability and validate the fault tolerance mechanisms of computer systems. Among the different fault injection techniques, software implemented fault injection technique is regarded as one of the most promising technique for evaluation of the dependability of computer systems. In this paper, combined the advantages of software fault injection and the particularity of onboard system, a new software fault injection model, which can be used to evaluate the dependability and validate the fault tolerance mechanisms of the onboard system, is put forward. To evaluate the dependability of onboard system effectively, the application algorithm on how to use the model is presented. The experimental results show that using the fault injection model and algorithm put forward in this paper, not only most of low-level faults such as processor register faults, memory faults and so on can be injected, but also some high-level faults such as code faults, branch faults etc. can be injected, which can be used to evaluate the dependability of the onboard systems.
Simics-based System Level Fault Injection Platform

Qian HU,Chao WANG,Haixia WANG,Dongsheng WANG

DOI: https://doi.org/10.3969/j.issn.1000-3428.2015.02.012

2015-01-01

Abstract:Fault injection provides an effective method to evaluate the reliability of system,which is a complex topic in multicore situation. There are many simulation-based fault injection tools now,most of which are implemented by Field Programmable Gate Array(FPGA) and Very High Speed Integrated Circuits Hardware Description Language(VHDL), with limited fault models. Based on the widely used system simulator Simics in computer architecture,this paper designs and implements a system level fault injection platform,supporting different firmware,OS and applications. It can inject faults into several components,with different fault models( including transient faults,permanent and intermittent faults) and most fault types. Further more,it integrates fault detection module into the system. After observing of the propagation of hardware faults in system,it analyzes the effect of different components,fault models on system level,inspiring fault detection,and finds that transient faults have a little impact on system, while permanent faults seriously interrupt the running and intermittent faults performs differently on different components.
An Implementation of Simulation-Based Environment for Bus Fault Injection Techniques

Biaobiao Shi,Xiaopeng Gao

DOI: https://doi.org/10.4028/www.scientific.net/amr.756-759.4672

2013-01-01

Advanced Materials Research

Abstract:Reliability is the most important feature in this more and more complex computer system era. Fault injection is dependability validation technique to evaluating the system. Hardware and Software implementations of fault injection have a long history and are much more mature than simulated fault injection. In this paper, we compare the differences between these three types of fault injections at first. Then, we identify and understand the types of fault. We design a low-cost, simulation-based fault injection system and design experiments to verify the correctness.
Linux Device Driver Based on Kernel-mode JVM

CHEN Shan,ZHOU Ling-ling,YING Ren-dong,GE Yi

2008-01-01

Abstract:The buggy codes of device drivers usually account for most of the OS kernel crashes.This paper proposes a prototype of writing Linuxdevice drivers in the type-safe language of Java, which effectively improves the system reliability, analyzes framework of Java device driverprototype, design of kernel-mode Java Virtual Machine(JVM) and writing of Java device driver program.USB Ethernet drivers test shows Javadevice drivers' advantage in improving system reliability.

Mining and checking paired functions in device drivers using characteristic fault injection

Mining and Checking Paired Functions in Device Drivers Using Characteristic Fault Injection.

Pairminer: mining for paired functions in Kernel extensions

Runtime Checking for Paired Functions in Device Drivers

BP-Miner: Mining Paired Functions from the Binary Code of Drivers for Error Handling

Testing Error Handling Code In Device Drivers Using Characteristic Fault Injection

Pf-Miner: A New Paired Functions Mining Method for Android Kernel in Error Paths

Hardware/Software Co-monitoring

Mining Frequent Patterns from Software Defect Repositories for Black-Box Testing

A Model Driven Approach for Device Driver Development.

Fault Injection Scheme for Embedded Systems at Machine Code Level and Verification

A Common Software Fault Injection Method for VxWorks Systems

A Parallel Memory Fault Detection Scheme Combined with Hardware Characteristic

Hardware Fault Injection Tool Based on JTAG

A PIN-Based Dynamic Software Fault Injection System

Design and implementation of a fault injection system for 1553B fault-tolerant bus controller

A Software Fault Injection Tool for Evaluation of the Dependability of Onboard System

Study on Software Fault Injection Based on Onboard System

Simics-based System Level Fault Injection Platform

An Implementation of Simulation-Based Environment for Bus Fault Injection Techniques

Linux Device Driver Based on Kernel-mode JVM