Termination proofs for systems code

TLDR

Program termination is central to ensuring that systems code can always react. The authors present a new path‑ and context‑sensitive program termination prover capable of analyzing large code fragments and demonstrate its effectiveness on Windows device driver routines. The prover performs path‑sensitive, context‑aware analysis, shifting the burden from constructing to checking termination arguments via binary reachability analysis. Experimental results on Windows device driver routines show that checking termination arguments is the harder step.

Abstract

Program termination is central to the process of ensuring that systems code can always react. We describe a new program termination prover that performs a path-sensitive and context-sensitive program analysis and provides capacity for large program fragments (i.e. more than 20,000 lines of code) together with support for programming language features such as arbitrarily nested loops, pointers, function-pointers, side-effects, etc.We also present experimental results on device driver dispatch routines from theWindows operating system. The most distinguishing aspect of our tool is how it shifts the balance between the two tasks of constructing and respectively checking the termination argument. Checking becomes the hard step. In this paper we show how we solve the corresponding challenge of checking with binary reachability analysis.