How to Cook an Automated System for Linux Driver Verification

1
How to Cook an Automated System for Linux Driver
Verification

• Oleg Strikov
• Vadim Mutilin

2
Guinea-pig

• DAC960PD-Ultra a high performance three-channel
  Ultra SCSI disk array controller that uses
  Intel's i960 32-bit microprocessor
• supports disk arrays for RAID levels 0, 1, 5,
  01, and 50
• permits data transfer rates across the PCI bus at
  132MB/sec
• supports Fast-20 data transfer rates of 40MB/sec.
  per channel
• up to 45 drives can be attached to the RAID
  controller
• supports the Global Array Manager
• full device driver support for UNIX, Windows,
  OS/2, NetWare and other operating systems

DAC960
3
Confusing Linux Driver Code
VERIFICATION NEEDED
true
Controller-gtV1.DualModeMemoryMailboxInterface
false
4
Manuscript
5
Mixing Up
DRIVER SOURCE
VERIFICATION MODELS
INSTRUMENTATION TOOL
BLAST
6
BLAST???
Berkeley Lazy Abstraction Software
Verification Tool
BLAST is a software model checker for C programs.
It uses counterexample-driven automatic
abstraction refinement to construct an abstract
model which is model checked for safety
properties.
7
Real World Example

• /drivers/block/DAC960.c

Callback interface procedures registration (not
BLAST acceptable also)
Extra preprocessing tools should be coded
ret pci_register_driver(DAC960_pci_driver)
No explicit calls to linking-level init
procedures (not BLAST acceptable)
module_init(DAC960_init_module) module_exit(DAC96
0_cleanup_module)
8
Conceptual Hack Toolkit
Bash scripting magic
STATUS DOUBLE DUTCH
STATUS BLAST ACCEPTABLE
9
BLAST SHAMANIC RITUAL
Error found! System is unsafe -(
RULE ID0029. CANNOT CALL ALLOC() BEFORE CREATE()
10
HOW IT WORKS
NATURAL LANGUAGE RULE
FORMAL LANGUAGE RULE
ID 0029 Memory regions cannot be allocated from non-existent predecessor pool
TARGET Prevent potential system crash, connected with incorrect pool subsystem function set usage dma_pool_alloc() cannot be called before successful creation of pool with dma_pool_create().
11
RESULTS (in progress)

• 55 COLLECTED
• 24 beyond the scope of BLAST
• 15 has been formalized
• CURRENT TARGETS SUBSYSTEMS
• /usr/src/linux/net /usr/src/linux/drivers/net
• /usr/src/linux/block /usr/src/linux/drivers/bloc
  k
• /usr/src/linux/drivers/char

12
CONTACTS

• OLEG A. STRIKOV
• oleg.strikov_at_ispras.ru
• VADIM S. MUTILIN
• mutilin_at_ispras.ru