面向企业级数据库管理——介绍Sybase的Adaptive Server Enterprise(三)

扩展存储过程 ASE支持系统定义和用户定义的“扩展存储过程”,它提供了一种方法,能够在Adaptive Server中调用过程语言编写的函数。这样Adaptive Server不仅能识别T-SQL,而且能识别其他的过程语言。扩展存储过程能够象ASE中其它存储过程一样被使用,可包括输入/输出参数,还可返回结果集和状态值。每一个扩展存储过程与一个外部函数对应,这些外部函数可在Adaptive Server中被激活。     

一种缓冲区溢出攻击的实时检测方法

根据攻击者通常通过修改函数返回地址或函数入口地址来改变程序流程的特点以及ELF文件的结构特点,在调用函数和函数调用返回时对某些特定信息进行处理,以检测出攻击行为。依靠动态程序监控平台pin提供的API函数来编写程序运行时监控工具,提出缓冲区溢出攻击实时检测的方法。实例分析表明该方法具有无需对现有的软、硬件系统进行修改的特点。     

内存家族面面观（之三）：成员户籍卡

4．高位存储区（HMA）：是指1024K以上的第一个64K，即1024－1088K之间的存储区，严格讲它不算是内存的一个分类，只是扩展内存中的一个小区域，为了DOS自身对内存的需要，可用DOS＝HIGH配置命令使DOS直接使用这部分内存（当DOS在扩展内存中运行时，它使用的是第一个64K字节的指定区域，所以我们称为高地址内存区或HMA）。如图4：在使用DEVICE＝C：＼DOS＼HIMEM．SYSDOS＝HIGH把DOS内核程序送到高位存储区HMA中时，应该注意设置缓冲区的个数一定要适当，不可过多也不可过少，下面仍以486DX／40内存机器为例：Config…     

二进制翻译中的函数返回类型恢复技术

函数返回类型恢复分为库函数和用户函数返回类型恢复两类。分析IA-64体系结构在函数调用和返回方面的特性得知,用户函数返回类型恢复不是只能从调用者的角度进行分析，还可从被调用者的角度进行分析。综合两种分析方法的优缺点,提出了一种全新的函数返回类型恢复方法。介绍了静态二进制翻译系统ITA中基于控制流和数据流分析的函数返回类型恢复技术，并给出相应的实现算法。由IA-64体系结构的实例验证证明，该方法是一种实用的函数返回类型恢复方法。     

一种C程序内存访问缺陷自动化检测方法研究

符号执行是目前较为行之有效的软件缺陷自动化检测方法,计算代价昂贵与程序执行路径爆炸是两个影响其性能的关键问题.提出了一种针对C语言程序内存访问缺陷的符号执行检测方法,该方法可通过自动化构造的测试用例发现程序内部的内存访问缺陷,如缓冲区溢出、跨界访问和指针异常等.使用符号跟踪缓冲区长度的方法,一方面减少了符号变量的数量,另一方面由此精确抽象C语言库中字符串操作函数的行为,解决了符号执行过程间函数调用的步进问题;使用动态切片的方法,裁减路径探索过程中的冗余路径,从而解决在程序内部路径搜索时发生的路径爆炸问题.实验表明,提供的检测方法不但可行,而且验证代价较小,具有较强的实用性.     

微机内存分布

一般而言,微机的内存可分为四个基本部分:常规内存、上位内存、扩展内存和扩充内存(如图1所示)。通常,这后三种内存的概念容易混淆,而正确了解并掌握这三种内存的概念对于我们用DOS高版本优化微机系统内存的使用,提高微机的运行速度是很有好处的。     

微机内存分布

一般而言,微机的内存可分为四个基本部分:常规内存、上位内存、扩展内存和扩充内存(如图1所示)。通常,这后三种内存的概念容易混淆,而正确了解并掌握这三种内存的概念对于我们用DOS高版本优化微机系统内存的使用,提高微机的运行速度是很有好处的。     

在Linux 2.6.11中进程调用malloc函数的情景分析

在Linux系统中用户调用malloc函数的过程实际上是一个间接调用brk函数的过程,brk函数在内核中的实现为sysbrk函数。详细探讨了Linux内核2．6．11版本中内存管理与分配的细节,重点分析了sysbrk函数的代码,并提供了do_munmap和do_brk0这两个主要的函数的流程图。sys_brk函数可以用来分配空间,即把动态分配区底部的边界往上推,也可以用来释放内存,即归还空间。因此它的代码也大致上分成两部分,对相关函数调用与流程作了详细的分析。     

使用扩展存储器的实例程序

IBMPC/AT或286以上机器一般具有多于1MB的内存．其CPU有两种工作模式：实地址模式和保护模式．在实模式下24位地址总线只用了20位，寻址空间仍只能达1MB．在保护模式下，可直接寻址16MB的存储空间，而且还提供存储保护特性．然而DOS的各种版本都不直接支持保护模式，因此目前所有286／386机型上的DOS系统均工作在实模式下．尽管系统配置了多于1MB的存储空间．用户也不能存储访问它们．一种解决的办法是利用DOS系统的BIOS提供的INT15H的子功能-87H、88H。其中，88H子功能用于扩展存储器，它返回扩展存储器的总容量，87H号子…     

关于缓冲区溢出漏洞的解决方法

为了免去以往手工检查源程序缓冲区溢出漏洞的繁琐和不全面性,利用LINUX下的两个重要软件LEX和YACC,编写C语言的词法和语法分析程序,并在其中添加相关语句的语意动作代码,以达到在对C源程序进行语法分析的同时,输出里边的函数调用关系的目的。此外,所生成的函数关系调用表将被放到数据库里边,进行列表、查询和统计;以便进行程序的维护。     

Trace Semantics and Algebraic Laws for Total Store Order Memory Model

Modern multiprocessors deploy a variety of weak memory models(WMMs).Total Store Order(TSO) is a widely-used weak memory model in SPARC implementations and x86 architecture.It omits the store-load constraint by allowing each core to employ a write buffer.In this paper,we apply Unifying Theories of Programming(abbreviated as UTP) in investigating the trace semantics for TSO,acting in the denotational semantics style.A trace is expressed as a sequence of snapshots,which records the changes in registers,write buffers and the shared memory.All the valid execution results containing reorderings can be described after kicking out those that do not satisfy program order and modification order.This paper also presents a set of algebraic laws for TSO.We study the concept of head normal form,and every program can be expressed in the head normal form of the guarded choice which is able to model the execution of a program with reorderings.Then the linearizability of the TSO model is supported.Furthermore,we consider the linking between trace semantics and algebraic semantics.The linking is achieved through deriving trace semantics from algebraic semantics,and the derivation strategy under the TSO model is provided.     

Verifying parallel programs with dynamic communication structures

We address the verification problem of networks of communicating pushdown systems modeling communicating parallel programs with procedure calls. Processes in such networks can read the control state of the other processes according to a given communication structure (specifying the observability rights between processes). The reachability problem of such models is undecidable in general. First, we define a class of networks that effectively preserves recognizability (hence, its reachability problem is decidable). Then, we consider networks where the communication structure can change dynamically during the execution according to a phase graph. The reachability problem for these dynamic networks being undecidable in general, we define a subclass for which it becomes decidable. Then, we consider reachability when the switches in the communication structures are bounded. We show that this problem is undecidable even for one switch. We define a natural class of models for which this problem is decidable. This class can be used in the definition of an efficient semi-decision procedure for the analysis of the general model of dynamic networks. Our techniques allowed to find bugs in two versions of a Windows NT Bluetooth driver.     

Decidability of linearizabilities for relaxed data structures

Many recent implementations of concurrent data structures relaxed their linearizability requirements for better performance and scalability. Quasi-linearizability, k-linearizability and regular-relaxed linearizability are three quantitative relaxation variants of linearizability that have been proposed as correctness conditions of relaxed data structures, yet preserving the intuition of linearizability. Quasi-linearizability has been proved undecidable. In this paper, we first show that k-linearizability is undecidable for a bounded number of processes, by reducing quasi-linearizability into it. We then show that regular-relaxed linearizability is decidable for a bounded number of processes. We also find that the number of the states of a relaxed specification is exponential to the number of the states of the underlying specification automaton (representing its relaxation strategy), and polynomial to the number of the states of the underlying quantitative sequential specification and the number of operations.     

Reachability results for timed automata with unbounded data structures

Systems of Data Management Timed Automata (SDMTAs) are networks of communicating timed automata with structures to store messages and functions to manipulate them. We prove the decidability of the reachability problem for a subclass of SDMTAs which assumes an unbounded knowledge, and we analyze the expressiveness of the model and the considered subclass. In particular, while SDMTAs can simulate a Turing machine, and hence the reachability problem is in general undecidable, the subclass for which reachability is decidable, when endowed with a concept of recognized language, accepts languages that are not regular. As an application, we model and analyze a variation of the Yahalom protocol.     

Reconfigurable distributed storage for dynamic networks

This paper presents a new algorithm for implementing a reconfigurable distributed shared memory in an asynchronous dynamic network. The algorithm guarantees atomic consistency (linearizability) in all executions in the presence of arbitrary crash failures of the processing nodes, message delays, and message loss. The algorithm incorporates a classic quorum-based algorithm for read/write operations, and an optimized consensus protocol, based on Fast Paxos for reconfiguration, and achieves the design goals of: (i) allowing read and write operations to complete rapidly and (ii) providing long-term fault-tolerance through reconfiguration, a process that evolves the quorum configurations used by the read and write operations. The resulting algorithm tolerates dynamism. We formally prove our algorithm to be correct, we present its performance and compare it to existing reconfigurable memories, and we evaluate experimentally the cost of its reconfiguration mechanism.     

A game approach to the parametric control of real-time systems

We consider parametric reachability control problems for real-time systems. We model the plant as an extension of parametric timed automata in which the timing constraints on these clocks can make use of parameters. This extension, which we call parametric game automata (PGAs), allows for partitioning the actions in the model between two antagonistic entities: the controller and the environment. The most general problem we study then consists in synthesising both a controller and values for the parameters such that some control location of the automaton is reachable. This problem is undecidable and we therefore provide a subclass of PGA called L/U game automata for which it is decidable. We then consider a backward fixed-point semi-algorithm for solving timed games with reachability objective allowing to compute the most permissive winning strategy. We argue the relevance of this approach and demonstrate its practical usability with a small case-study.     

Analyzing Automata with Presburger Arithmetic and Uninterpreted Function Symbols

We study a class of extended automata defined by guarded commands over Presburger arithmetic with uninterpreted functions. On the theoretical side, we show that the bounded reachability problem is decidable in this model. On the practical side, the class is useful for modeling programs with unbounded data structures, and the reachability procedure can be used for symbolic simulation, testing, and verification.     

BMC via on-the-fly determinization

This paper develops novel bounded model checking (BMC) techniques for asynchronous parallel systems. The aim is to increase the efficiency of BMC by exploiting the inherent concurrency in such systems. This added efficiency is gained by covering more reachable states within a given bound using two techniques. Firstly, a nonstandard execution model, step executions, where multiple actions can take place simultaneously is applied. Secondly, the number of executions the system can have is reduced by modeling the execution of the system components as if they were determinized. This determinization technique also enables the removal of the internal transitions of the components. Step executions can be further restricted to a subclass called process executions without losing any reachable states.The paper presents a translation scheme for BMC of reachability properties. The translation is from an asynchronous system where the components are modeled as labeled transition systems (LTSs) to a propositional formula. The models of the formula correspond to the step executions of the original system where each component is replaced with its determinized counterpart. The formula for step executions can be easily extended in such a way that its models correspond to the process executions of the system. The translation scheme has been implemented and some experimental comparisons performed. The results show that the bound needed to detect a violation of a reachability property is, for step and process executions, in most cases lower than in interleaving executions and that the running time of the model checker using process executions is smaller than of that using steps. Moreover, the performance compares favorably to a state-of-the-art interleaving BMC implementation in the NuSMV system.     

On the decidability of fragments of the asynchronous π-calculus

We study the decidability of a reachability problem for various fragments of the asynchronous π-calculus. We consider the combination of three main features: name generation, name mobility, and unbounded control. We show that the combination of name generation with either name mobility or unbounded control leads to an undecidable fragment. On the other hand, we prove that name generation without name mobility and with bounded control is decidable by reduction to the coverability problem for Petri Nets.     

An abort-aware model of transactional programming

There has been a lot of recent research on transaction-based concurrent programming, aimed at offering an easier concurrent programming paradigm that enables programmers to better exploit the parallelism of modern multi-processor machines, such as multi-core microprocessors. We introduce Transactional State Machines (TSMs) as an abstract finite-data model of transactional shared-memory concurrent programs. TSMs are a variant of concurrent boolean programs (or concurrent extended recursive state machines) augmented with additional constructs for specifying potentially nested transactions. Namely, some procedures (or code segments) can be marked as transactions and are meant to be executed “atomically”, and there are also explicit commit and abort operations for transactions. The TSM model is non-blocking and allows interleaved executions where multiple processes can simultaneously be executing inside transactions. It also allows nested transactions, transactions which may never terminate, and transactions which may be aborted explicitly, or aborted automatically by the run-time environment due to memory conflicts. We show that concurrent executions of TSMs satisfy a correctness criterion closely related to serializability, which we call stutter-serializability, with respect to shared memory. We initiate a study of model checking problems for TSMs. Model checking arbitrary TSMs is easily seen to be undecidable, but we show it is decidable in the following case: when recursion is exclusively used inside transactions in all (but one) of the processes, we show that model checking such TSMs against all stutter-invariant ω-regular properties of shared memory is decidable.