Towards Verifying Android Apps for the Absence of No-Sleep Energy Bugs

Transcription

1 Towards Verifying Android Apps for the Absence of No-Sleep Energy Bugs Panagiotis Vekris Ranjit Jhala, Sorin Lerner, Yuvraj Agarwal University of California, San Diego 1

2 2

3 Software Energy Bugs 3

4 Software Energy Bugs 4

5 Power Manager Concept Opportunistic suspend WakeLock API App developer directives Keep a device component awake 5

6 WakeLock Use Lock Based Mechanism PowerManager pm = getsystemservice(power); WakeLock l = pm.newwakelock( SCREEN ); //... screen stays on... 6

7 WakeLock Use Lock Based Mechanism PowerManager pm = getsystemservice(power); WakeLock l = pm.newwakelock( SCREEN ); //... screen stays on... No-sleep bugs Misuse of WakeLock API Screen on indefinitely Screen Awake => 25% battery drain per hour [Pathak 12] 7

8 Static Analysis Track No-Sleep Bugs Pathak [MobiSys 12] Reaching definitions dataflow analysis Detect known instances & find new ones Our Work Define policies => Verify absence of bug Track asynchronous calls Precise dataflow analysis 8

9 Activity A screen to interact with Application Component Building block Entry point Stack Model Top of stack = visible activity 9

10 Activity States oncreate() Created/ Background onforeground() onbackground() Foreground Callbacks Called by system on state transitions 10

11 oncreate() { Create a WakeLock super.oncreate(); Associate with screen // setting up l = newwakelock( SCREEN ); } onforeground() onbackground() 11

12 oncreate() { super.oncreate(); // setting up l = newwakelock( SCREEN ); } onforeground() { //... } Acquire WakeLock l onbackground() 12

13 oncreate() { super.oncreate(); // setting up l = newwakelock( SCREEN ); } onforeground() { //... } onbackground() On Foreground with Screen WakeLock held 13

14 oncreate() { super.oncreate(); // setting up l = newwakelock( SCREEN ); } onforeground() { //... } onbackground() { //... } Release WakeLock l 14

15 oncreate() { super.oncreate(); // setting up l = newwakelock( SCREEN ); } onforeground() { //... } onbackground() { //... } Correct Use At Background with Screen WakeLock released 15

16 oncreate() { super.oncreate(); // setting up l = newwakelock(cpu); } izen Lite V2.3 Acquire CPU WakeLock //unimplemented onforeground(); Application in background //unimplenented onbackground(); 16

17 oncreate() { super.oncreate(); // setting up l = newwakelock(cpu); } izen Lite V2.3 Acquire CPU WakeLock //unimplemented onforeground(); //unimplenented onbackground(); Application in background holds CPU WakeLock 17

18 oncreate() { super.oncreate(); // setting up l = newwakelock(cpu); } izen Lite V2.3 Acquire CPU WakeLock //unimplemented onforeground(); //unimplenented onbackground(); Application in background holds CPU WakeLock without doing useful work Incorrect Use 18

19 Policies Rule Invisible Activities should not hold resources Policy Activity.onBackground( ) should release all WakeLocks 19

20 Policies Rule Invisible Activities should not hold resources Component Policy Activity.onBackground( ) should release all WakeLocks 20

21 Policies Rule Invisible Activities should not hold resources Callback Policy Activity.onBackground( ) should release all WakeLocks 21

22 Policies Rule Invisible Activities should not hold resources Policy Activity.onBackground( ) should release all WakeLocks Expected State 22

23 Policies WakeLocks Used in any component - Not only Activities Their effects cross component boundaries General policies Component Callback Expected WakeLock state We defined policies for basic components Conservative for the rest Static Analysis to enforce them 23

24 Tool Overview Uses a precise Dataflow algorithm [RHS 95] State: Set of WakeLocks that may be held at given program point Validate Check if state complies to policies 24

25 How our tool works onforeground() { } l = newwakelock(cpu); if (random() % 2 == 0) Connection point l = newwakelock(cpu) random() % 2 == 0 onbackground() { if (random() % 2 == 0) } random() % 2 == 0 25

26 State: l = newwakelock(cpu) WakeLocks that may be held. Initially empty set random() % 2 == 0 random() % 2 == 0 26

27 State: l = newwakelock(cpu) Annotation: l -> CPU random() % 2 == 0 l is associated with CPU random() % 2 == 0 27

28 State: l = newwakelock(cpu) Annotation: l -> CPU random() % 2 == 0 State is propagated to both branches random() % 2 == 0 28

29 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: l -> CPU random() % 2 == 0 29

30 State: l = newwakelock(cpu) random() % 2 == 0 random() % 2 == 0 Annotation: l -> CPU Virtual method call to acquire Performed on WakeLock object l 30

31 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: A l -> CPU random() % 2 == 0 A U { l } 31

32 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: l -> CPU random() % 2 == 0 Acquire introduces l to set 32

33 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: A l -> CPU B random() % 2 == 0 Join Statement A B 33

34 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: l -> CPU random() % 2 == 0 Union of input sets 34

35 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: A l -> CPU random() % 2 == 0 A-{ l } 35

36 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: l -> CPU random() % 2 == 0 Release removes l from set Union of input sets 36

37 State: l = newwakelock(cpu) random() % 2 == 0 Annotation: l -> CPU random() % 2 == 0 WakeLock l may be held at the end of the code 37

38 Path Sensitivity //... critical operation if (l.isheld()) //... Wakelock released l.isheld() true false 38

39 Path Sensitivity l.isheld() true false l is not held Remove it from set State empty in the end 39

40 Context Sensitive Method Calls { l } myrelease(); myrelease() { { } if (l.isheld()) { l } } myrelease(); return; { l } A A-{ l } myrelease() If l is held in { the before calling if (l.isheld()) myrelease } A Method Summary return; It will be released after A-{ l } 40

41 Context Sensitive Method Calls { l } myrelease(); { } { l } myrelease(); { l } A myrelease() { if (l.isheld()) return; } A-{ l } 41

42 Handling Asynchrony Intent calls Asynchronous messages among components Threaded execution Java Threads Posted on Message Queue (Android)

43 Handling Asynchrony Component A Component B start(b); 43

44 Handling Asynchrony Component A Component B WakeLock set is preserved at component call start(b); Empty state is propagated back to caller component 44

45 Handling Asynchrony Component A start(b); Component B Component A exits in released state So does Component B 45

46 Handling Asynchrony Component A Component B start(b); Component B does not operate on WakeLock l 46

47 Handling Asynchrony Component A Component B start(b); Component A exits with released state Component B does not operate on WakeLock l Policies will not be checked against it 47

48 Handling Asynchrony Component Helper Thread { } { } Start(); Race Condition {l<async>} {l<async>} Release does not remove asynchronously acquired lock 48

49 Handling Asynchrony Component Helper Thread { } { } Start(); Race Condition {l<async>} {l<async>} Policy violated 49

50 Handling Asynchrony Component Helper Thread { } { } Start(); Race Condition { } {l<async>} 50

51 Tool Workflow Apk (Dalvik Bytecode Java Bytecode) 740 apps with wakelocks (out of 2718) Ded/Dex2jar Input to WALA/ our tool Retargeted Java Bytecode Optimized Java Bytecode 328 correctly decompiled Soot 51

52 Analysis Results for 328 apps No Policy Violations Policy Violations 44% 56% Many bugs in real apps or Too imprecise analysis Manual inspection of 31 violating apps 52

53 True Positives Apps confirmed to contain a bug: 14 of 31 Lifecycle Abuse 10 Incorrect release conditions Not all paths released

54 False Positives Correct apps flagged as buggy: 17 of 31 Complex release conditions Too strict policies 7 Unresolved Intent calls Wrapper with parameter Unrecognized callback

55 Soundness WALA Conservative at handling exception edges Foo() {... a.f; Null pointer Exception Edge Keep analysis precise: Exception edges bypass release operations }... return; Kill state over exception edges 56

56 Future work Soundness Exception edges Precision Add path sensitivity Asynchronous calls -> precise points-to analysis Refine policies Retarget Dalvik effectively 57

57 Conclusion No-sleep bugs are real We presented a tool that: Uses static analysis Guarantees for absence of no-sleep bugs Tracks asynchronous calls 58