Operational Profiling of OS Drivers

Operating Systems (OS's) constitute the operational core for computing devices. In order to facilitate their applicability to a variety of hardware platforms, OS's have evolved into complex componentized software entities whose key function is to provide applications access to the system resources. Fundamentally, the provided system services inherently depend on the stability of the underlying OS. Within the OS, the key components that dominate the cause of OS failures are the device drivers (DDs), precisely the OS parts designed to enhance the OS's support for hardware. Despite intensive efforts to elevate the DDs' robustness level by employing varied test paradigms, the existing testing approaches still exhibit very high failure rates. Hence, the central premise behind this thesis involves the characterization of the DD's operational profile, and using it for focusing subsequent testing to the functionality areas likely to be exercised over the DD deployment. This thesis develops two novel and distinct methodologies to capture and analyze the operational profile of DDs. The first - termed as the operational profile (OP) - is based on the characterization of the I/O traffic between a selected DD and the rest of the OS kernel. The second - termed execution path profile (EPP) - observes the functional calls made by the respective DD in the operational phase, thus revealing the code paths followed at runtime. Both presented approaches are directly applicable to DD binaries as they do not require source-code level access to any of the involved OS components. This thesis develops the concepts and methodology for effectively profiling the operational behavior of DDs. First, a state model is introduced for describing a DD and its complete state space. Experimentally, we show that the DD's operational state space (OSS) - the subset of states visited at runtime - represents only a small fraction of the total state space, thus highlighting the areas to be tested. Subsequently, occurrence- and duration-based quantifiers are defined for each of the DD states belonging to the OSS. This enables test prioritization and workload comparisons which are the key factors for testing. This conceptual process's effectiveness is tested using extensive case studies including over fifty Windows XP and Vista DDs. The developed EPP is complementary to the OP as it discovers execution hotspots as frequently traversed DD code paths. To highlight the execution hotspots, a DD monitoring and code path analysis methodology is presented and tested using actual Windows DD's. Code paths are identified as call sequences to kernel functions implemented externally to the selected DD. String similarity metrics are used to compute the relative similarity among the inferred code paths. Based on likeness, the code paths are grouped into equivalence classes helping identify execution hotspots. These hotspots constitute primary targets for testing. Overall the thesis develops novel proling approaches for testing generalized OS's. The research is also validated on actual Windows XP and Vista OSs