Bitwise operations are commonly used in low-level systems code to access multiple data fields that have been packed into a single word. Program analysis tools that reason about such programs must model the semantics of bitwise operations precisely in order to capture program control and data flow through these operations. We present a type system for subword data structures that explitictly tracks the flow of bit values in the program and identifies consecutive sections of vits as logical entities manipulated atomically by the programmer. Our type inference algorithm tags each integer value of the program with a {\em bitvector type} that identifies the data layout at the subword level. These types are used in a translation phase to remove bitwise operations from the program. We have applied our bitvector type inference algorithm to generate program documentation for a virtual memory subsystem of an OS kernel, and to verify Linux drivers and a memory protection system. For the verification, we have used a software model checker to check properties of the translated program. The resulting verification runs could prove many more properties than the naive model checker that did not reason about bitvectors, and could prove properties much faster than a model checker that did reason about bitvectors. While we have applied the type system mainly for program understanding and verification, bitvector types also have applications to better variable ordering heuristics in boolean model checking and memory optimizations in embedded compilers.
Proceedings of the 14th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE), 2006 (to appear)