Multi-architecture Value Analysis for Machine Code

Hugues Cassé (1, 2) , Florian Birée (1) , Pascal Sainrat (1)

1 IRIT-TRACES - Groupe de Recherche en Architecture et Compilation pour les systèmes embarqués
2 UT3 - Université Toulouse III - Paul Sabatier

Safety verification of critical real-time embedded systems requires Worst Case Execution Time information (WCET). Among the existing approaches to estimate the WCET, static analysis at the machine code level has proven to get safe results. A lot of different architectures are used in real-time systems but no generic solution provides the ability to perform static analysis of values handled by machine instructions. Nonetheless, results of such analyses are worth to improve the precision of other analyzes like data cache, indirect branches, etc. This paper proposes a semantic language aimed at expressing semantics of machine instructions whatever the underlying instruction set is. This ensures abstraction and portability of the value analysis or any analysis based on the semantic expression of the instructions. As a proof of concept, we adapted and refined an existing analysis representing values as Circular-Linear Progression (CLP), that is, as a sparse integer interval effective to model pointers. In addition, we show how our semantic instructions allow to build back conditions of loop in order to refine the CLP values and improve the precision of the analysis. Both contributions have been implemented in our framework, OTAWA, and experimented on the Malardalen benchmark to demonstrate the effectiveness of the approach.

Mots clés: Machine code; Static analysis; Value analysis; Semantics

Domaines: Réseaux et télécommunications [cs.NI]; Système d'exploitation [cs.OS]; Architectures Matérielles [cs.AR]; Systèmes embarqués

Hugues Cassé, Florian Birée, Pascal Sainrat. Multi-architecture Value Analysis for Machine Code. 13th International Workshop on Worst-Case Execution Time Analysis - WCET 2013, Jul 2013, Paris, France. pp. 42-52. ⟨hal-01148808⟩