automated bug detection for pointers and memory accesses
play

Automated Bug Detection for Pointers and Memory Accesses in - PowerPoint PPT Presentation

Apr 23, 2023 •236 likes •637 views

Automated Bug Detection for Pointers and Memory Accesses in High-Level Synthesis Compilers Pietro Fezzardi Fabrizio Ferrandi pietro.fezzardi@polimi.it fabrizio.ferrandi@polimi.it Dipartimento di Elettronica, Informazione e Bioingegneria

  1. Automated Bug Detection for Pointers and Memory Accesses in High-Level Synthesis Compilers Pietro Fezzardi Fabrizio Ferrandi pietro.fezzardi@polimi.it fabrizio.ferrandi@polimi.it Dipartimento di Elettronica, Informazione e Bioingegneria Politecnico di Milano Milano, Italy FPL 2016 – Lausanne – 01/09/2016

  2. Outline Introduction and Motivation Background and Assumptions Automated Bug Detection for Pointers Evaluated Tools, Experiments and Results Conclusion and Future Work

  3. Motivation Adoption of High-Level Synthesis is increasing HLS tools are becoming increasingly complex Memory optimizations bring substantial improvements Memory bugs introduced by HLS tools are hard to debug A methodology to automatically find memory bugs introduced by the compiler would: • Make existing memory allocation and optimizations more reliable • Ease development and deployment of new memory architectures in HLS • Speed up testing of new memory optimizations in HLS • Make easier for HLS developers and users to isolate the cause of bugs P.Fezzardi – pietro.fezzardi@polimi.it 1 FPL 2016 – Lausanne – 01/09/2016

  4. Goals General Ideas • Take advantage of HLS information to support all compiler optimizations • Automatically isolate the wrong signal, failing operation and component • Automatically backtrack the error to the original source code • Avoid user interaction to enable massive automated testing in production Goals Related to Pointers • Specifically target memory bugs involving pointers and addresses • Completely support C standard pointer based descriptions • Support different memory technologies and partitioning patterns • Independent of memory optimizations P.Fezzardi – pietro.fezzardi@polimi.it 2 FPL 2016 – Lausanne – 01/09/2016

  5. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  6. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  7. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation DEBUGGING compilation + STEPS execution SW Traces P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  8. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation DEBUGGING compilation cycle accurate RTL simulation + STEPS execution SW Traces HW Traces (VCD) P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  9. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation DEBUGGING compilation cycle accurate RTL simulation + STEPS execution SW Traces HW Traces (VCD) DISCREPANCY ANALYSIS P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  10. Discrepancy Analysis Debug Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation DEBUGGING compilation cycle accurate RTL simulation + STEPS execution SW Traces HW Traces (VCD) DISCREPANCY ANALYSIS INFORMATION first mismatch between faulty module DEBUG HW and SW executions in HW design state of FSM hierachical path and value of the name of the wrong signal wrong signal failed operation in C start and end time value of the of the failed operation related C variable SW call stack trace P.Fezzardi – pietro.fezzardi@polimi.it 3 FPL 2016 – Lausanne – 01/09/2016

  11. Memory Locations Memory Location A Memory Location � M i , B i , S i � is an unambiguous representation of a position in memory In HW In SW ◦ M i : unique identifier for a memory module ◦ M i : can be omitted ◦ B i : an offset in the memory module identified by M i ◦ B i : address in main memory ◦ S i : size of the memory location ◦ S i : size of the memory location Similar to Location Sets [Wilson and Lam; PLDI’95] [S´ em´ eria and De Micheli; TCAD’01] Abstract concepts, independent of the target memory architecture HW Memory Locations are not addresses but can be directly translated to addresses Evaluated HLS compilers (Bambu, LegUp, Commercial Tool) use equivalent representations P.Fezzardi – pietro.fezzardi@polimi.it 4 FPL 2016 – Lausanne – 01/09/2016

  12. Memory Allocation For memory allocation, HLS tools take mainly two decisions: which variables have to be allocated in memory • usually global, static , volatile , arrays, and struct s • possibly others, according to alias analysis the location where every memory-mapped variable is stored • depends on HLS implementation • depends on memory architecture of the generated design • depends on the memory optimizations and partitioning P.Fezzardi – pietro.fezzardi@polimi.it 5 FPL 2016 – Lausanne – 01/09/2016

  13. Assumptions for Address Discrepancy Analysis General Assumption I Every HW Memory Location must be associated to a single memory-mapped variable The inverse mapping of high-level variables onto HW Memory Locations must be known It is simply the inverse of the mapping computed by memory allocation in HLS � General Assumption II It has to be possible to identify the signals representing pointer variables in HW Previous results show that this is possible � P.Fezzardi – pietro.fezzardi@polimi.it 6 FPL 2016 – Lausanne – 01/09/2016

  14. Address Space Translation Scheme Address Space Translation Scheme (ASTS) Hardware Address Table (HAT) Software Address Table (SAT) � M i , B i , S i � � CB i , CS i � i j i i : variable identifier j : SW Call Context ID � M i , B i , S i � : HW Memory Location � CB i , CS i � : SW Memory Location i : variable identifier P.Fezzardi – pietro.fezzardi@polimi.it 7 FPL 2016 – Lausanne – 01/09/2016

  15. The Software Call Context Identifier In HW fun a The HAT is computed by memory allocation during HLS Memory Locations in HW are defined once ahead of time In SW Local variables are allocated on the stack &d = fun b 0xFFFF1234 Different Memory Location at every function call An ID is necessary to distinguish between calls &d = 0xFFFF4321 An ID uniquely identifies a path on the call graph Function calls are instrumented in the C code fun c int d; Context ID and memory mapping are printed at runtime P.Fezzardi – pietro.fezzardi@polimi.it 8 FPL 2016 – Lausanne – 01/09/2016

  16. The Extended Address Discrepancy Analysis Flow CONTROL ORIGINAL FINITE HARDWARE DATA DATA SOURCE STATE DESCRIPTION FRONTEND FLOW HLS PATH BACKEND CODE MACHINE LANGUAGE GRAPH (DP) ( C ) (FSM) (HDL) (CDFG) INFORMATION EXTRACTED FSM optimizations source level chaining information pipelining resource sharing list of signals instrumented to collect C code in SSA scheduling HW traces after frontend binding optimizations allocation DEBUGGING compilation cycle accurate RTL simulation + STEPS execution SW Traces HW Traces (VCD) DISCREPANCY ANALYSIS INFORMATION first mismatch between faulty module DEBUG HW and SW executions in HW design state of FSM hierachical path and value of the name of the wrong signal wrong signal failed operation in C start and end time value of the of the failed operation related C variable SW call stack trace P.Fezzardi – pietro.fezzardi@polimi.it 9 FPL 2016 – Lausanne – 01/09/2016

Recommend

Tag-Protector: An Effective and Dynamic Detection of Out-of-bound Memory Accesses Ahmed Saeed,

Tag-Protector: An Effective and Dynamic Detection of Out-of-bound Memory Accesses Ahmed Saeed,

Tag-Protector: An Effective and Dynamic Detection of Out-of-bound Memory Accesses Ahmed Saeed, Ali Ahmadinia Mike Just School of Engineering and Built Environment School of Mathematics and Glasgow Caledonian University, United Kingdom

310 views • 15 slides
Pointers and Dynamic Memory Allocation Pointers 2 Pointers Pointer-type variables allow

Pointers and Dynamic Memory Allocation Pointers 2 Pointers Pointer-type variables allow

Pointers and Dynamic Memory Allocation Pointers 2 Pointers Pointer-type variables allow accessing memory in an indirect way. Memory Memory a a p int a; int a; int *p; a=10; p=&a; *p=10; 3 Operators * and &

325 views • 17 slides
Analyzing Memory Accesses in x86 Executables Gogul Balakrishnan Thomas Reps University of

Analyzing Memory Accesses in x86 Executables Gogul Balakrishnan Thomas Reps University of

Analyzing Memory Accesses in x86 Executables Gogul Balakrishnan Thomas Reps University of Wisconsin Motivation Basic infrastructure for language-based security buffer-overrun detection information-flow vulnerabilities . . .

931 views • 39 slides
CS162 - POINTERS Lecture: Pointers and Dynamic Memory What are pointers Why dynamically

CS162 - POINTERS Lecture: Pointers and Dynamic Memory What are pointers Why dynamically

CS162 - POINTERS Lecture: Pointers and Dynamic Memory What are pointers Why dynamically allocate memory How to dynamically allocate memory What about deallocation? Walk thru pointer exercises CS162 Pointers 1 CS162 -

477 views • 27 slides
Pointers and dynamic objects Topics Pointers Memory addresses Declaration

Pointers and dynamic objects Topics Pointers Memory addresses Declaration

Pointers and dynamic objects Topics Pointers Memory addresses Declaration Dereferencing a pointer Pointers to pointer Static vs. dynamic objects new and delete Computer Memory Each variable is assigned a memory

636 views • 48 slides
Memory Systems Survey on the Off-Chip Scheduling of Memory Accesses in the Memory Interface of

Memory Systems Survey on the Off-Chip Scheduling of Memory Accesses in the Memory Interface of

IEE5008 Autumn 2012 Memory Systems Survey on the Off-Chip Scheduling of Memory Accesses in the Memory Interface of GPUs Garrido Platero, Luis Angel EECS Graduate Program National Chiao Tung University luis.garrido.platero@gmail.com Luis

891 views • 36 slides
Memory Protection ability to avoid unwanted memory accesses management Sharing

Memory Protection ability to avoid unwanted memory accesses management Sharing

Requirements Relocation ability to change process image position Memory Protection ability to avoid unwanted memory accesses management Sharing ability to share memory portions among processes Logical organization

504 views • 15 slides
Pointers & Dynamic Memory Review C Pointers Introduce C++ Pointers Data Abstractions

Pointers & Dynamic Memory Review C Pointers Introduce C++ Pointers Data Abstractions

Pointers & Dynamic Memory Review C Pointers Introduce C++ Pointers Data Abstractions CSCI-2320 Dr. Tom Hicks Computer Science Department 2 Printing! Use Computer Science Printers Only For Your Computer Science Homework!!!! Print

1.19k views • 37 slides
Memory and I/O buses I/O bus 1880Mbps 1056Mbps Memory CPU Crossbar CPU accesses physical

Memory and I/O buses I/O bus 1880Mbps 1056Mbps Memory CPU Crossbar CPU accesses physical

Memory and I/O buses I/O bus 1880Mbps 1056Mbps Memory CPU Crossbar CPU accesses physical memory over a bus Devices access memory over I/O bus with DMA Devices can appear to be a region of memory 1 / 41 Realistic ~2005 PC

1.54k views • 50 slides
Pointers Eric McCreath Introduction Pointers in c are basically memory addresses, they provide a

Pointers Eric McCreath Introduction Pointers in c are basically memory addresses, they provide a

Pointers Eric McCreath Introduction Pointers in c are basically memory addresses, they provide a simple and flexible way of your program referencing data. All parameters in C are passed by making copies of the arguments to the function call.

271 views • 7 slides
Pointers Pointers are integer values that refer to addresses in memory scanf(

Pointers Pointers are integer values that refer to addresses in memory scanf(

Pointers Pointers are integer values that refer to addresses in memory scanf( "%d", &v ); address of operator Principles of Computer Science II Nadeem Abdul Hamid int * ==> pointer to int type CSC121A -

905 views • 3 slides
Pointers Ch 9 & 13.1 Highlights - pointers - dynamic arrays - new & delete object vs

Pointers Ch 9 & 13.1 Highlights - pointers - dynamic arrays - new & delete object vs

Pointers Ch 9 & 13.1 Highlights - pointers - dynamic arrays - new & delete object vs memory address An object is simply a box in memory and if you pass this into a function it makes a copy A memory address is where a box is located

457 views • 41 slides
Dangling Pointers Periklis Akritidis --2010 Use-after-free Vulnerabilities Accessing Memory

Dangling Pointers Periklis Akritidis --2010 Use-after-free Vulnerabilities Accessing Memory

Cling: A Memory Allocator to Mitigate Dangling Pointers Periklis Akritidis --2010 Use-after-free Vulnerabilities Accessing Memory Through Dangling Pointers Techniques : Heap Spraying, Feng Shui Manual memory management is error prone

574 views • 35 slides
Topic 7 1. Defining and using pointers 2. Arrays and pointers 3. C and C++ strings 4.

Topic 7 1. Defining and using pointers 2. Arrays and pointers 3. C and C++ strings 4.

Topic 7 1. Defining and using pointers 2. Arrays and pointers 3. C and C++ strings 4. Dynamic memory allocation 5. Arrays and vectors of pointers 6. Problem solving: draw a picture 7. Classes of objects 8. Pointers and objects

613 views • 21 slides
Before we begin Any questions? Function Pointers Recall: Program Memory Function pointers

Before we begin Any questions? Function Pointers Recall: Program Memory Function pointers

Before we begin Any questions? Function Pointers Recall: Program Memory Function pointers The memory used by a program is generally Provides access to executable code section. separated into the following sections: Function

669 views • 7 slides
Pointers and memory Ch 9 & 13.1 Highlights - new & delete Pointers A pointer is used

Pointers and memory Ch 9 & 13.1 Highlights - new & delete Pointers A pointer is used

Pointers and memory Ch 9 & 13.1 Highlights - new & delete Pointers A pointer is used to store a memory address and denoted by a * (star!) Here variable xp is a integer pointer The * goes from address to variable (much like when you

514 views • 14 slides
Problem Failure-Oblivious Computing Memory Errors and Memory Corruption Buffer Overflow

Problem Failure-Oblivious Computing Memory Errors and Memory Corruption Buffer Overflow

Enhancing Server Availability and Security Through Problem Failure-Oblivious Computing Memory Errors and Memory Corruption Buffer Overflow Out of Bounds Array Accesses Invalid Pointer Accesses Importance Martin Rinard,

340 views • 4 slides
Automated fault detection for Automated fault detection for Autosub6000: Autosub6000: What we've

Automated fault detection for Automated fault detection for Autosub6000: Autosub6000: What we've

Automated fault detection for Automated fault detection for Autosub6000: Autosub6000: What we've achieved in a year? TSEM talk @ Institute of Cybernetics, Tallinn, Estonia Juhan Ernits, March 9, 2010 Overview of todays talk Overview of today s

490 views • 26 slides
Pointers and Arrays Pointers and Arrays We've seen examples of both of these in our LC-3

Pointers and Arrays Pointers and Arrays We've seen examples of both of these in our LC-3

Chapter 16 Pointers and Arrays Pointers and Arrays We've seen examples of both of these in our LC-3 programs; now we'll see them in C. Pointer Address of a variable in memory Allows us to indirectly access variables in other words,

1.1k views • 29 slides
Why Use Scheduling? Sequential accesses to DRAM Memory Access are wasteful Scheduler

Why Use Scheduling? Sequential accesses to DRAM Memory Access are wasteful Scheduler

Why Use Scheduling? Sequential accesses to DRAM Memory Access are wasteful Scheduler Improve latency and bandwidth of memory requests Matthew Cohen, Alvin Lin Order requests to take advantage 6.884 Complex Digital Systems of

91 views • 5 slides
Data, memory, pointer Pointers and arrays 1-1 Data, memory memory address: every byte

Data, memory, pointer Pointers and arrays 1-1 Data, memory memory address: every byte

Data, memory, pointer Pointers and arrays 1-1 Data, memory memory address: every byte is identified by a numeric address in the memory. once a variable is defined , one cannot predict its memory address, entirely determined by

976 views • 70 slides
Pointers Ch 9 & 13.1 Highlights - pointers object vs memory address An object is simply a

Pointers Ch 9 & 13.1 Highlights - pointers object vs memory address An object is simply a

Pointers Ch 9 & 13.1 Highlights - pointers object vs memory address An object is simply a box in memory and if you pass this into a function it makes a copy A memory address is where a box is located and if you pass this into a function,

471 views • 17 slides
Fundamentals of Programming Lecture 15 Hamed Rasifard 1 Outline Types of Pointers

Fundamentals of Programming Lecture 15 Hamed Rasifard 1 Outline Types of Pointers

Fundamentals of Programming Lecture 15 Hamed Rasifard 1 Outline Types of Pointers Arrays of Pointers Multiple Indirection Initializing Pointers Pointers to Functions Dynamic Memory Allocation 2 Types of Pointers

199 views • 19 slides
Pointers about pointers Announcements Midterm next week pointer is a memory address

Pointers about pointers Announcements Midterm next week pointer is a memory address

Pointers about pointers Announcements Midterm next week pointer is a memory address Material covered up until June 18 (last week, is 4 bytes like an unsigned int signals) can address up to 2^32 bytes = 4 gb Allowed to have

321 views • 10 slides

More recommend