How to Cook an Automated System for Linux Driver Verification

Abstract

Abstract-We present the preliminary results of our work on designing an automatic toolset for verification of Linux kernelspace drivers. By now the toolset includes three components:• a library of verification models; each model is a formal description of some safety property to be checked; • a preprocessor unit; it is intended for simulating an environment of a driver; • a verification unit BLAST; it is a general-purpose toolkit intended for automatic program verification based on Boolean abstraction and counter-example guided abstraction refinements techniques. We discuss in some details how our system operates and outline the directions for future work.Operating system (OS) is the key component of every computer system including automatic control system of power station, bank information system, or just a cheap cell phone. The faults occurred in OS may result in fatal consequences: damage of the objects under the control of computer, material losses, data leakage. For the most part program errors do not exceed the bounds of erroneous software components; they can be easily localized, checked and corrected. But if a software component operates in a kernel mode then its erroneous behaviour has far-reaching implications and tends to failure many other elements of computer system. The empirical data indicate (see [10], [21]) that bugs in kernel-space device drivers cause 85% of the system crashes. Therefore verification of OS drivers is the topical problem in software designing.The most generally employed approach to detecting bugs in application programs is testing. But in the case of OS testing encounter with a number of limitations that drastically deteriorate its effectiveness. When testing OS components one checks the correctness of their behaviour only on some specific configurations depending on the state of main and peripheral hardware, distribution of internal and external events, etc. The number of such configurations in incredibly large and even small difference in configurations may cause in significant variances in OS behaviour. That is why no reasonable test set could cover a high proportion of traces in OS code to detect all possible errors. Certainly, a highly skilled expert is able to reveal the most critical parts of OS code and thus guide the detection of errors, but in this case the reliability of a driver becomes a subject to human factor.In this paper we report on the attempts to implement a new approach to driver verification which would be able to cope pure automatically with checking the most common errors occurred in OS drivers. When verification of drivers is concerned, it should be noticed that the most important issue which need to be checked is the safety of interaction between a driver and the other components of OS. A vast amount of drivers employ only some bounded set of conventional means for interacting with the environment. Close inspection of means and templates that are used by designers of drivers makes its possible to settle in formal terms the requirements (rules) that sho...

Experience of improving the blast static verification tool

“…Since the elements of the symbolic store lattice, unlike predicates, do not form a powerset domain (simply speaking, this means that this domain not always contains an element for representing the union of several other elements), this termination operator could cut off some satisfiable paths contain ing, among others, real errors. The number of such cases increased when using certain environment mod els-automatically generated main functions for the analysis of kernel drivers (see [3]). Therefore, we implemented another termination operator (stop sep) checking the termination of lattice elements of regions at each vertex separately.…”

“…To construct an open automated verifier for Linux drivers, described in [3], an industrial level tool of static analysis is required. However, the same paper describes BLAST as a tool "intended for academic research in software verification."…”

“…

The BLAST static verification tool is one of the open source verifiers of software written in C. The paper describes principles of BLAST implementation, the limitations revealed in the course of its prac tical use in the verification of the Linux operating system drivers, and an attempt to improve BLAST in the framework of the Linux Driver Verification (LDV) project [3].

…”

Static Verification Under The Hood: Implementation Details and Improvements of BLAST

“…To build an open automated system for Linux device drivers described in [13], we needed a verification tool, and that article outlines BLAST as a tool "intended for academic research in software verification". The experiments demonstrated that its potential may spread beyond mere academic application, serving as a verification engine in an intensive driver checking workflow, as well as provide a ground for research in the domain of static analysis.…”

“…Environment models are "main" functions generated based on templates for Linux device drivers. For more see[13] 7. Predicate equality was tested via BDDs that stored them 8.…”