Termination Proofs for Systems Code

Program termination is central to the process of ensuring that reactive systems can always react. We describe a new interprocedural, path-sensitive and context-sensitive program termination prover that provides capacity for large program fragments (i.e. more than 20,000 lines of code) together with support for programming lan-guage features such as arbitrarily nested loops, pointers, function-pointers, side-effects, etc. We also present experimental results on device driver dispatch routines from the Windows operating system. The most distinguishing aspect of our tool is how it shifts the balance between the two tasks of constructing and respectively checking the termination argument. Checking becomes the hard step. In this paper we show how we solve the corresponding challenge of checking with binary reachability analysis