Towards automatic software model checking of thousands of Linux modules—a case study with Avinux

Modular software model checking of large real‐world systems is known to require extensive manual effort in environment modelling and preparing source code for model checking. Avinux is a tool chain that facilitates the automatic analysis of Linux and especially of Linux device drivers. The tool chain is implemented as a plugin for the Eclipse IDE, using the source code bounded model checker CBMC as its backend. Avinux supports a verification process for Linux that is built upon specification annotations with SLICx (an extension of the SLIC language), automatic data environment creation, source code transformation and simplification, and the invocation of the verification backend. In this paper technical details of the verification process are presented: Using Avinux on thousands of drivers from various Linux versions led to the discovery of six new errors. In these experiments, Avinux also reduced the immense overhead of manual code preprocessing that other projects incurred. Copyright © 2008 John Wiley & Sons, Ltd.

[1]  James C. Corbett,et al.  Bandera: extracting finite-state models from Java source code , 2000, ICSE.

[2]  David A. Wagner,et al.  Model Checking One Million Lines of C Code , 2004, NDSS.

[3]  Sriram K. Rajamani,et al.  SLIC: A Specification Language for Interface Checking (of C) , 2002 .

[4]  Wolfgang Küchlin,et al.  Automatic data environment construction for static device drivers analysis , 2006, SAVCBS '06.

[5]  Arie Shoshani,et al.  System Deadlocks , 1971, CSUR.

[6]  Zijiang Yang,et al.  F-Soft: Software Verification Platform , 2005, CAV.

[7]  Koushik Sen,et al.  CUTE: a concolic unit testing engine for C , 2005, ESEC/FSE-13.

[8]  Gerald Lüttgen,et al.  Blasting Linux Code , 2006, FMICS/PDMC.

[9]  Sriram K. Rajamani,et al.  Thorough static analysis of device drivers , 2006, EuroSys.

[10]  Dawson R. Engler,et al.  Static Analysis versus Software Model Checking for Bug Finding , 2004, VMCAI.

[11]  George C. Necula,et al.  CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs , 2002, CC.

[12]  Dinghao Wu,et al.  KISS: keep it simple and sequential , 2004, PLDI '04.

[13]  Orna Grumberg,et al.  Bounded Model Checking of Concurrent Programs , 2005, CAV.

[14]  Alex Groce,et al.  Modular verification of software components in C , 2003, 25th International Conference on Software Engineering, 2003. Proceedings..

[15]  Daniel Kroening,et al.  A Tool for Checking ANSI-C Programs , 2004, TACAS.

[16]  David A. Wagner,et al.  MOPS: an infrastructure for examining security properties of software , 2002, CCS '02.

[17]  Sagar Chaki,et al.  Verifying Concurrent Message-Passing C Programs with Recursive Calls , 2006, TACAS.

[18]  Clark W. Barrett,et al.  cascade: C Assertion Checker and Deductive Engine , 2006, CAV.

[19]  Dawson R. Engler,et al.  Model Checking Large Network Protocol Implementations , 2004, NSDI.

[20]  Daniel Kroening,et al.  Model checking concurrent linux device drivers , 2007, ASE.

[21]  Armin Biere,et al.  Symbolic Model Checking without BDDs , 1999, TACAS.