Automatic Verification of RMA Programs via Abstraction Extrapolation Cedric Baumann 1 , Andrei Marian Dan 1 , Yuri Meshman 2 , Torsten Hoefler 1 , Martin Vechev 1 1 Department of Computer Science, ETH Zurich, Switzerland 2 IMDEA Software Institute, Madrid, Spain 1
Remote Memory Access (RMA) Networks High-Performance Computing Modern datacenters Widely supported ( Cray Aries and Gemini , Infiniband , IBM Blue Gene and Percs ) 2
Remote Memory Access (RMA) Networks CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 3
Remote Memory Access (RMA) Networks X = get (Y, P2); CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 4
Remote Memory Access (RMA) Networks X = get (Y, P2); CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 5
Remote Memory Access (RMA) Networks CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 6
Remote Memory Access (RMA) Networks CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 7
Remote Memory Access (RMA) Networks CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC 8
Remote Memory Access (RMA) Networks CPU CPU MEMORY PCIe PCIe MEMORY (X) (Y) NIC NIC Low latency High bandwidth 9
Goal Given an infinite-state program P running on an RMA network and a safety specification S, does P satisfy S under RMA? P ⊨ RMA S RMA asynchronous executions determine a weak-consistency memory model, more relaxed than x86 TSO, PSO, RMO 10
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); 11
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); Sequential Consistency (SC) Yes 12
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); Sequential Consistency (SC) Yes Remote Memory Access (RMA) No 13
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); Sequential Consistency (SC) Yes Remote Memory Access (RMA) No 14
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); flush (P1); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); 15
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); flush (P1); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); Remote Memory Access (RMA) Yes 16
Process 1: Process 2: shared X = 1; shared Y = 2, Z = 0; local a; put (X, P1, Y); flush (P1); store Y = 3; Z = get (X, P1); load a = Z; assert final (a != 3); Remote Memory Access (RMA) Yes 17
This work Main steps: 1. Prove that P satisfies S under SC: P ⊨ SC S 2. Construct P’ under SC that captures all behaviors of P under RMA: P’ ⊨ SC S ⇒ P ⊨ RMA S 3. Prove that P’ ⊨ SC S 18
This work Main steps: 1. Prove that P satisfies S under SC: P ⊨ SC S 2. Construct P’ under SC that captures all behaviors of P under RMA: P’ ⊨ SC S ⇒ P ⊨ RMA S 3. Prove that P’ ⊨ SC S Key Idea: Extrapolate the abstraction of P under SC to an abstraction of P under RMA 19
Predicate Abstraction Successful for sequential program analysis: Original by Graf and Saidi (CAV '96) Used by Microsoft's SLAM for device drivers (PLDI '01) Work for SC concurrent programs and weak memory models (x86 TSO, PSO): Kroening et al. (CAV '11), Gupta et al. (CAV '11), Dan et al. (SAS '13) 20
Classic Predicate Abstraction Build a boolean program B that over-approximates the Program P Preds V behaviors of P : B ⊨ SC S ⇒ P ⊨ SC S Predicate Abstraction Bool Prog B Abstract Model Checker Counter Ex Verified 21
Classic Predicate Abstraction Build a boolean program B that over-approximates the Program P Preds V behaviors of P : B ⊨ SC S ⇒ P ⊨ SC S Predicate Abstraction Using an abstract model checker, verify that B satisfies S : Bool Prog B B ⊨ SC S Abstract Model Checker Counter Ex Verified 22
Step 1: Verify program P under SC Assume the RMA statements execute synchronously put (Y, P1, X); Y = X; 23
Step 1: Verify program P under SC Assume the RMA statements execute synchronously put (Y, P1, X); Y = X; Find a set of predicates V Build the boolean program B that over-approximates P, using V Verify that B satisfies the property S under sequential consistency 24
Step 2: Encode RMA effects into the program Reduce the problem of verifying P under RMA to Program P the problem of verifying P’ under SC P’ ⊨ SC S ⇒ P ⊨ RMA S Reduction Program P’ 25
Step 2: Encode RMA effects into the program Program P put (Y, P1, X); Reduction Program P’ 26
Step 2: Encode RMA effects into the program Program P put (Y, P1, X); Reduction Program P’ if (!putActive) //boolean flag putActive = true ; XSet = {X}; //set variable else addToSet (XSet, X); //adds X to XSet 27
Example program P under RMA semantics Process 1: Process 2: shared X = 0; shared Y = 0; local r; put (Y, P2, X); store X = 1; load r = Y; 28
Example: Reduced program P’ under SC that captures the behaviors of P under RMA Process 1: Process 2: shared X = 0; shared Y = 0; local r; //put (Y, P2, X); putActive = true ; //nondeterministic op XSet = {X}; if (*) Y = randomElem (XSet); // store X = 1; putActive = false ; store X = 1; addToSet (Xset, X); // load r = Y; load r = Y; Theorem. P’ under SC soundly approximates P under RMA. 29
Step 3: Prove that P ’ ⊨ SC S Find new predicates for program P’ Predicates for the boolean flags: (putActive == true) 30
Step 3: Prove that P ’ ⊨ SC S Find new predicates for program P’ Predicates for the boolean flags: Predicates for the set variables? (putActive == true) 31
Step 3: Prove that P ’ ⊨ SC S Idea: Discover predicates for P ’ using the predicates for program P under SC. Preds V Pred Extrapolation Preds V’ 32
Step 3: Prove that P ’ ⊨ SC S Idea: Discover predicates for P ’ using the predicates for program P under SC. Preds V (X < 0) Pred Extrapolation Preds V’ 33
Step 3: Prove that P ’ ⊨ SC S Idea: Discover predicates for P ’ using the predicates for program P under SC. Preds V (X < 0) Pred Extrapolation Preds V’ (XSet < 0) 34
Step 3: Prove that P ’ ⊨ SC S Idea: Discover predicates for P ’ using the predicates for program P under SC. Preds V (X < 0) (X < Y) Pred Extrapolation Preds V’ (XSet < 0) (XSet < Y) (X < YSet) 35
Logic of the predicates (first attempt) true , ∀ e ∈ XSet | e < 0 false , ∃ e ∈ XSet | e ≥ 0 (XSet < 0) *, otherwise 36
Logic of the predicates (first attempt) true , ∀ e ∈ XSet | e < 0 false , ∃ e ∈ XSet | e ≥ 0 (XSet < 0) *, otherwise Problem: Would have to add the predicate (XSet ≥ 0) to track whether all elements of the set are greater than 0. 37
Logic of the predicates for the set variables true , ∀ e ∈ XSet | e < 0 false , ∀ e ∈ XSet | e ≥ 0 (XSet < 0) *, otherwise Solution: Refine the case when the predicate is false 38
So far Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction Bool Prog B Abstract Model Checker Counter Ex Verified Prove that P ⊨ SC S 39
Problem Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction 3x 2x Bool Prog B Abstract Model Checker Counter Ex Verified Prove that P ⊨ SC S 40
Problem Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction 3x 2x Predicate Bool Prog B Abstraction Abstract Model Timeout Checker Counter Ex Verified Prove that P ⊨ SC S 41
Problem Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction 3x 2x Predicate Bool Prog B Abstraction Abstract Model Timeout Checker Most time used by the Counter Ex Verified SMT solver, computing the abstract transformers Prove that P ⊨ SC S 42
Core problem: computing abstract transformers Literals q = p or q = ￢ p, p ∈ V’ Cubes(V’) = {q 1 ∧ … ∧ q j } | Cubes(V’)| = 3 |V’| ∀ st ∈ Statements ∀ p ∈ V’ ∀ c ∈ Cubes(V’) if c ⇒ wp(p, st) //SMT call add c to the transformer 43
Key Idea Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction Bool Prog B Abstract Model Checker Counter Ex Verified Prove that P ⊨ SC S 44
Key Idea Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction Bool Prog B Abstract Model Checker Counter Ex Verified Prove that P ⊨ SC S 45
Key Idea Program P Preds V Pred Program P Preds V Reduction Extrapolation Predicate Program P’ Preds V’ Abstraction Bool Prog Bool Prog B Extrapolation Abstract Model Bool Prog B’ Checker Counter Ex Verified Prove that P ⊨ SC S 46
Recommend
More recommend
