Thorough static analysis of device drivers

Abstract

Bugs in kernel-level device drivers cause 85% of the system crashes in the Windows XP operating system [44]. One of the sources of these errors is the complexity of the Windows driver API itself: programmers must master a complex set of rules about how to use the driver API in order to create drivers that are good clients of the kernel. We have built a static analysis engine that finds API usage errors in C programs. The Static Driver Verifier tool (SDV) uses this engine to find kernel API usage errors in a driver. SDV includes models of the OS and the environment of the device driver, and over sixty API usage rules. SDV is intended to be used by driver developers "out of the box." Thus, it has stringent requirements: (1) complete automation with no input from the user; (2) a low rate of false errors. We discuss the techniques used in SDV to meet these requirements, and empirical results from running SDV on over one hundred Windows device drivers.

Global Software Engineering: The Future of Socio-technical Coordination

“…While not usually considered in the context of requirements or GSD, this sort of analysis has in fact been effective in conveying a very complex API to a number of vendors in different organizations. This, of course, requires a particular kind of analysis tool, i.e., one that needs no input and has an acceptably low rate of false positives [5].…”

Model Checking Büchi Pushdown Systems

“…However, one challenge to this approach is to support the efficient abstraction/refinement, since most loops need to be fully unrolled in liveness property checking. There are two options for future work: (1) implement an aggressive abstraction/refinement algorithm for loop computation in tools such as SLAM [7] (may be insufficient when a ranking function is required); or (2) utilize termination checking tools such as Terminator [9] which analyzes loops by checking termination arguments (i.e., ranking functions).…”

“…CoVer not only verifies LTL properties on the BPDS models represented by Boolean programs [7], but also accepts assumptions in LTL formulae. These assumptions are very helpful in practice to constrain the verification and rule out false positives.…”

An Automata-Theoretic Approach to Hardware/Software Co-verification

“…Ball, et al have shown Boolean programs to be effective abstractions of C programs in the SLAM project [11]. A Boolean program, conceptually a PDS, is essentially a C program in which the only data type available is Boolean.…”