Tracing of Zephyr RTOS System Calls by LLVM IR Interpretation

• Typ der Arbeit: Bachelorarbeit
• Status der Arbeit: laufend
• Projekte: AHA
• Betreuer: Andreas Kässens, Daniel Lohmann
• Bearbeiter: Andreas Lebedyuk

[Generated with AI]

Context

Within the AHA project, we focus on optimizing embedded systems by specialization of the OS itself. Using the Automatic Real-time Analyzer (ARA), we perform static analysis to find interactions between different tasks, resulting in a State Transition Graph (STG)¹. This information can be used to calculate effects of the system calls and tailor the implementation to the specific needs of the application. With the execution of Zephyr system calls on IR level during analysis, we are able to follow their control flow with all arguments within a system call. This allows tracing of the complete RTOS internals to understand the system behavior, without running the hardware and external debuggers.

Problem

The Zephyr RTOS interface and internals are complex--the influence of Linux kernel development leads to excessive use of #ifdef-directives, preprocessor macros, deep function nesting and inlining. All those features complicate developing or understanding the control flow in system calls, making application-specific specialization and optimization difficult. Zephyr already brings some tooling to improve understanding of the control flow: tracing², instrumentation³, and perf profiling⁴, which all require execution of binary code on hardware/emulator and have their own pitfalls. Additionally, using puncover⁵ allows for static analysis of worst case stack usage, but does not show the real execution.

Goal

In this thesis, the student shall use the results of IRx LLVM interpreter to extract a detailed trace of Zephyr RTOS system calls. In particular, the call hierarchy of system calls related to OS objects like mutexes, queues and the scheduler itself shall be examined.

As a result, system calls (in a given application/system configuration) can be fully visualized, e.g. using call stacks, flame graphs, control flow charts or timing diagrams. There are existing formats for such traces, which can be compared, reused or converted to.

The following steps are required for a bachelor's thesis:

• Use IRx on small LLVM example applications to understand how it works
• Extend the IR interpreter to export a structured trace of system call stack (and arguments)
• Apply IRx on a set of Zephyr test applications with system calls
• Visualize the trace with existing tools
• Evaluate the results by comparing them to existing tracing and debugging tools in Zephyr or optionally tools from other operating systems

Optionally, the timing behavior of functions can be estimated using the IR code. Using simple and generic execution model heuristics, a system call timing diagram could be approximated.

Disclaimer: The ARA framework and IRx are quite complex with a steep learning curve. Familiarity with compilation steps, LLVM, and C can be helpful for working with this project.

Topics: Static Analysis, Real-Time, C++, Python, LLVM

References

OSPERT Workshop B
IRx: RTOS-Aware Abstract Interpretation using an LLVM-based Interpreter

Andreas Kässens, Vitali Fendel, Daniel LohmannProceedings of the 19th Annual Workshop on Operating Systems Platforms for Embedded Real-Time Applications (OSPERT '25)2025.
PDF Slides [BibTex]

BibTex Entry

@inproceedings{kaessens:25:ospert,
author = {Andreas Kässens and Vitali Fendel and Daniel Lohmann},
booktitle = {Proceedings of the 19th Annual Workshop on Operating Systems Platforms for Embedded Real-Time Applications (OSPERT '25)},
entrysubtype = {Workshop},
month = {July},
title = {{IRx}: {RTOS}-Aware Abstract Interpretation using an {LLVM}-based Interpreter},
venue = {Brussels, Belgium},
year = {2025},
}

Controlling the Kite: Static Control-Flow System Analysis for Embedded Controllers with Zephyr RTOS in ARA

The ARA toolchain shall support the system-state enumeration for Zephyr-based embedded applications.

---

 

Typ

Masterarbeit

---

 

Status

abgeschlossen

---

 

Supervisors

Andreas Kässens
Gerion Entrup
Daniel Lohmann

---

 

Project

AHA

---

 

Bearbeiter

Vitali Fendel (abgegeben: 03. Dec 2024)