Method and system for monitoring and verifying software drivers using system resources including memory allocation and access

• US 7,111,307 B1
• Filed: 11/23/1999
• Issued: 09/19/2006
• Est. Priority Date: 11/23/1999
• Status: Expired due to Term

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Landy
• Primary Examiner(s): Thomson, William
• Assistant Examiner(s): ANYA, CHARLES E
• Application Number:
  US09/447,501
• Time in Patent Office: 2,492 Days
• Field of Search: 717124-135, 711 1-173, 714178-723, 719321-327, 718/104
• US Class Current: 719/321
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22

Abstract

A method and system for verifying computer system drivers such as kernel mode drivers. A driver verifier sets up tests for specified drivers and monitors the driver'"'"'s behavior for selected violations that cause system crashes. In one test, the driver verifier allocates a driver'"'"'s memory pool allocations from a special pool bounded by inaccessible memory space for testing the driver'"'"'s accessing memory outside of the allocation. The driver verifier also marks the space as inaccessible when it is deallocated, detecting a driver that accesses deallocated space. The driver verifier may also provide extreme memory pressure on a specific driver, or randomly fail requests for pool memory. The driver verifier also checks call parameters for violations, performs checks to ensure a driver cleans up timers when deallocating memory and cleans up memory and other resources when unloaded. An I/O verifier is also described for verifying drivers use of I/O request packets.

Claims

1. In a computer system, a method, comprising:

receiving a request from a kernel mode driver, wherein the request is a function call in a kernel component of an operating system;

determining that the kernel mode driver is to be monitored, wherein determining that the kernel mode driver is to be monitored includes checking a registry setting;

re-vectoring the request to a kernel mode driver verifier; and

taking action in the kernel mode driver verifier to actively test the kernel mode driver for errors, wherein the kernel mode driver verifier is capable of testing the kernel mode driver by simulating a low resource condition including failing requests for memory pool allocation.

2. The method of claim 1 wherein the request from the kernel mode driver includes a memory allocation request, and wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes allocating memory space thereto from a special pool of memory.

3. The method of claim 1 wherein the request from the kernel mode driver includes a memory allocation request, and wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes marking memory bounding the memory space to detect improper access of the memory bounding the memory space.

4. The method of claim 1 wherein the request from the kernel mode driver includes a memory deallocation request, and wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes marking deallocated memory space to detect improper access of the deallocated memory space.

5. The method of claim 1 wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes maintaining allocation information in at least one data structure associated with the kernel mode driver.

6. The method of claim 5 wherein the request from the kernel mode driver includes a memory allocation request, and wherein maintaining allocation information includes adding data corresponding to the allocation request to the data structure.

7. The method of claim 5 wherein the request from the kernel mode driver includes a memory deallocation request, and wherein maintaining allocation information includes removing data corresponding to the allocation request from the data structure.

8. The method of claim 5 further comprising providing the allocation information to a user interface.

9. The method of claim 1 wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes validating call parameters.

10. The method of claim 1 wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes checking for resources allocated to the kernel mode driver at kernel mode driver unload.

11. The method of claim 1 wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes simulating a low resource condition.

12. The method of claim 11 wherein simulating the low resource condition includes invalidating kernel mode driver code and data.

13. The method of claim 1 wherein taking action in the kernel mode driver verifier to test the kernel mode driver includes checking for timers in deallocated pooled memory.

14. A computer-readable medium having computer-executable instructions, comprising instructions for:

receiving a request from a kernel mode driver for allocation of memory space;

determining that the kernel mode driver is to be monitored, wherein determining that the kernel mode driver is to be monitored includes checking a registry setting;

determining a location of memory space to allocate;

re-vectoring the request to a kernel mode driver verifier;

in the kernel mode driver verifier, testing the kernel mode driver including marking the memory bounding the memory space to detect improper access of the memory bounding the memory space;

allocating the memory space;

and monitoring the areas bounding the location for an access violation using the kernel mode driver verifier.

15. The computer-readable medium of claim 14 having further computer-executable instructions, comprising, instructions for detecting an access violation.

16. The computer-readable medium of claim 14 having further computer-executable instructions, comprising instructions for

receiving a request from kernel mode driver for deallocation of the memory space;

restricting access to deallocated memory space, wherein any access request to the deallocated memory space results in an access violation; and

monitoring the deallocated memory space for an access violation.

17. The computer-readable medium of claim 16 having further computer-executable instructions, comprising, instructions for detecting an access violation in the deallocated memory space.

18. A computer-readable medium having computer-executable instructions, comprising instructions for:

receiving a plurality of requests from a kernel mode driver for allocation of various distinct sets of memory;

allocating the memory;

determining that the kernel mode driver is to be monitored, wherein determining that the kernel mode driver is to be monitored includes checking a registry setting;

tracking the memory allocated to the kernel mode driver on each request;

receiving requests for deallocation of at least one of the sets of memory allocated to the kernel mode driver;

tracking the memory deallocated in each received deallocation request;

determining from the tracking whether memory remains allocated to the kernel mode driver at a time when the driver should have no memory allocated thereto;

and generating an error at the time if memory remains allocated.

19. A system for monitoring, kernel mode drivers, comprising:

an operating system component including an interface for receiving requests from kernel mode drivers;

a re-vectoring component for examining the requests to determine whether requesting kernel mode drivers are to be monitored, wherein the determining whether the requesting kernel mode drivers are to be monitored is based on a setting in a registry; and

a kernel mode driver verifier component operably connected to the re-vectoring component, the driver verifier receiving information from the re-vectoring component for a kernel mode driver that is to be monitored and executing at least one test to monitor the kernel mode driver, wherein in response to a request for memory from the kernel mode driver, the kernel mode driver verifier component allocates memory for the kernel mode driver to use from a pool of memory other than a memory pool normally allocated from when the driver is operating unmonitored.

20. The system of claim 19 wherein the operating system component comprises a kernel component.

21. The system of claim 19 further comprising a user interface for writing driver information to the registry.

22. The system of claim 19 wherein a request from the kernel mode driver includes a memory allocation request, and wherein a test by the kernel mode driver verifier includes allocating memory space thereto from a special pool of memory, and marking memory bounding the memory space to detect improper access of the memory bounding the memory space.

23. The system of claim 19 wherein a request from the kernel mode driver includes a memory deallocation request, and wherein a test by the kernel mode driver verifier includes deallocating the memory space, and marking the deallocated memory space to detect improper access thereof.

24. The system of claim 19 wherein a test by the kernel mode driver verifier includes examining resources allocated to the kernel mode driver.

25. The system of claim 24 wherein examining resources allocated to the kernel mode driver includes tracking outstanding memory allocated to the kernel mode driver.

26. The system of claim 24 wherein examining resources allocated to the kernel mode driver includes reviewing lists maintained by the operating system component for information therein associated with the kernel mode driver.

27. The system of claim 19 wherein a test performed by the kernel mode driver includes validating call parameters.

28. The system of claim 19 wherein a test performed by the kernel mode driver includes failing requests for memory pool allocation.

29. The system of claim 19 wherein a test performed by the kernel mode driver includes invalidating driver code and data.

30. The system of claim 19 wherein a test performed by the kernel mode driver includes checking for timers in deallocated pooled memory.

31. In a computer system, a method for verifying a plurality of kernel mode drivers, comprising:

selecting one or more tests for verifying functionality of one of the kernel mode drivers;

determining that one of the kernel mode driver is to be monitored, wherein determining that the kernel mode driver is to be monitored includes checking a registry setting;

modifying a request for system services by re-vectoring the request to include execution of the selected tests to a kernel mode driver verifier, wherein one of the tests includes restricting access to a resource, such that an attempted access to the resource causes an access violation;

executing the modified request; and

generating errors for any test failures.

32. The method of claim 31 wherein the kernel mode driver comprises a device driver.

33. The method of claim 31 further comprising applying a test condition designed to detect a specific error.

34. The method of claim 33 wherein applying the test condition includes restricting available system resources.

35. A computer-readable medium having computer-executable instructions, comprising instructions for verifying kernel mode drivers:

selecting one or more tests for verifying functionality of one of the kernel mode drivers;

determining that the kernel mode driver is to be monitored, wherein determining that the kernel mode driver is to be monitored includes checking a registry setting;

modifying a request for system services by re-vectoring the request to include execution of the selected tests to a kernel mode driver verifier, wherein one of the tests includes restricting access to a resource, such that an attempted access to the resource causes an access violation;

executing the modified request;

and generating errors for any test failures.