Understanding Modern Device Drivers

1 Understanding Modern Device DriversAsim Kadav and Michael M. SwiftComputer Sciences Department, University of Wisconsin-Madison{kadav, Drivers are the single largest contributor to operating-systemkernel code with over 5 million lines of code in the linux kernel ,and cause significant complexity, bugs and development costs. Re-cent years have seen a flurry of research aimed at improving the re-liability and simplifying the development of Drivers . However, littleis known about what constitutes this huge body of code beyond thesmall set of Drivers used for this paper, we study the source code of linux Drivers to un-derstand what Drivers actually do, how current research applies tothem and what opportunities exist for future research.}

2 We deter-mine whether assumptions made by driver research, such as thatall Drivers belong to a class, are indeed true. We also analyze drivercode and abstractions to determine whether Drivers can benefit fromcode re-organization or hardware trends. We develop a set of static-analysis tools to analyze driver code across various axes. Broadly,our study looks at three aspects of driver code (i) what are the char-acteristics of driver code functionality and how applicable is driverresearch toalldrivers, (ii) how do Drivers interact with the kernel , devices , and buses, and (iii) are there similarities that can be ab-stracted into libraries to reduce driver size and complexity?

3 We find that many assumptions made by driver research do notapply to all Drivers . At least 44% of Drivers have code that is notcaptured by a class definition, 28% of Drivers support more thanone Device per driver, and 15% of Drivers do significant computa-tion over data. From the driver interactions study, we find that theUSB bus offers an efficient bus interface with significant standard-ized code and coarse-grained access, ideal for executing Drivers inisolation. We also find that Drivers for different buses and classeshave widely varying levels of Device interaction, which indicatesthat the cost of isolation will vary by class. Finally, from our driversimilarity study, we find 8% of all driver code is substantially sim-ilar to code elsewhere and may be removed with new abstractionsor and Subject [Operating Systems]:Organization and DesignGeneral TermsMeasurement, DesignKeywordsDevice Drivers , MeasurementPermission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page.

4 To copy otherwise, to republish, to post on servers or to redistributeto lists, requires prior specific permission and/or a 12, March 3 7, 2012, London, England, 2012 ACM 978-1-4503-0759-8/12 $ .1. IntroductionModern computer systems are communicating with an increasingnumber of devices , each of which requires a driver. For example, amodern desktop PC may have tens of devices , including keyboard,mouse, display, storage, and USB controllers. Device Drivers con-stitute 70% of the linux code base [32], and likely are a greaterfraction of the code written for the Windows kernel , which sup-ports many more devices . Several studies have shown that driversare the dominant cause of OS crashes in desktop PCs [14, 28].

5 Asa result, there has been a recent surge of interest in techniques totolerate faults in Drivers [12, 38, 39, 47], to improve the quality ofdriver code [20]; and in creating new driver architectures that im-prove reliability and security [4, 15, 21, 23, 24, 31, 44].However, most research on Device Drivers focuses on a smallsubset of devices , typically a network card, sound card, and storagedevice, all using the PCI bus. These are but a small subset of alldrivers, and results from these devices may not generalize to thefull set of Drivers . For example, many devices for consumer PCsare connected over USB. Similarly, the devices studied are fairlymature and have standardized interfaces, but many other devicesmay have significant functionality , it is important to study all Drivers to review how the driverresearch solutions being developed are applicable to all classes ofdrivers.

6 In addition, a better Understanding of driver code can leadto new abstractions and interfaces that can reduce driver complexityand improve paper presents a comprehensive study of all the Drivers inthe linux kernel in order to broadly characterize their code. Wefocus on (i) what driver code does, including where driver develop-ment work is concentrated, (ii) the interaction of driver code withdevices, buses, and the kernel , and (iii) new opportunities for ab-stracting driver functionality into common libraries or use two static analysis tools to analyze driver code. To under-stand properties of driver code, we developed DrMiner, which per-forms data-flow analyses to detect properties of Drivers at the granu-larity of functions.

7 We also developed the DrComp tool, which usesgeometric shape analysis [3] to detect similar code across maps code to points in coordinate space based on thestructure of individual driver functions, and similar functions areat nearby contributions of this paper are as follows: First, we analyze what driver code does in order to verify com-mon assumptions about driver code made by driver show that while these assumptions hold for most Drivers ,there are a significant number of Drivers that violate these as-sumptions. We also find that several rapidly growing driverclasses are not being addressed by driver research. Second, we study driverinteractionswith the kernel and de-vices, to find how existing driver architecture can adapt to aworld of multicore processors, devices with high-power pro-cessors and virtualized I/O.

8 We find that Drivers vary widely8788 ImprovementtypeSystemDriver classes testedDriverstestedNewfunctionalityShado w drivermigration [19]net1 RevNIC [6]net4 Reliability(H/WProtection)CuriOS [9]serial port, NOR flash2 Nooks [39]net, sound6 Palladium [7]custom packet filter1 Xen [12]net, sound2 Reliability(Isolation)BGI [5]net, sound, serial,ramdisk, libs16 ShadowDrivers [38]net, sound, IDE13 XFI [40]ram disk, dummy2 SpecificationDevil [25]scsi, video2 Dingo [32]net2 Laddie [45]net, UART, rtc3 Nexus [44]net, sound, USB-mouse,USB-storage4 Termite [33]net, mmc2 Static analysistoolsCarburizer [18]All/netAll/3 Cocinelle [29]VariousAllSDV [2]basic ports, storage,USB, 1394-interface,126mouse, keyboard, PCIbatteryType safetyDecafDrivers [31]net, sound, USB con-troller, mouse5 Safedrive [47]net, USB, sound, video6 Singularity [37]Disk1 User-leveldevice driversMicro- Drivers [15]net, sound, USB con-troller4 SUD [4]

9 Net, wireless, sound,USB controllers, USB6/1 User-leveldrivers [21]net, disk (ata)2 Table projects on Drivers , the improvement type, and thenumber and class of Drivers used to support the claim end to end. Fewprojects test all driver interfaces thoroughly. Static analysis tools thatdo not require driver modifications are available to check many moredrivers. Also, some solutions, like Carburizer [18], and SUD [4] supportthe performance claims on fewer interactionsClass membership: Drivers belong to common set of classes, and theclass completely determines their calls: Drivers always communicate with the kernel throughprocedure state:The state of the Device is completely captured by state: Drivers may assume that devices are in the correct architectureI/O:Driver code functionality is only dedicated to converting requestsfrom the kernel to the : Drivers typically support one or a few Device Bound: Drivers do little processing and mostly act as a libraryfor binding different interfaces.

10 Drivers execute only in response to kernel and devicerequests, and to not have their own assumptions made in Device driver [38]. However, network cards that do TCP-offload mayhave significant protocol state that is only available in the Device ,and cannot be captured by monitoring the kernel /driver recent projects assume that Drivers support a singlechipset, such as efforts at synthesizing Drivers from a formalspecification [33]. However, many Drivers support more than onechipset. Hence, synthesizing the replacement for a single drivermay require many more Drivers . Similarly, enforcing safety proper-ties for specific devices [44] may be cumbersome if many chipsetsmust be supported for each driver.