Automatic Verification of RMA Programs via Abstraction Extrapolation - - PowerPoint PPT Presentation

▶
automatic verification of rma programs via
SMART_READER_LITE
LIVE PREVIEW

Automatic Verification of RMA Programs via Abstraction Extrapolation - - PowerPoint PPT Presentation

Jan 11, 2024 145 likes •766 views

Automatic Verification of RMA Programs via Abstraction Extrapolation Cedric Baumann 1 , Andrei Marian Dan 1 , Yuri Meshman 2 , Torsten Hoefler 1 , Martin Vechev 1 1 Department of Computer Science, ETH Zurich, Switzerland 2 IMDEA Software Institute,

slide-1
SLIDE 1

Automatic Verification of RMA Programs via Abstraction Extrapolation

Cedric Baumann1, Andrei Marian Dan1, Yuri Meshman2, Torsten Hoefler1, Martin Vechev1

1 Department of Computer Science, ETH Zurich, Switzerland 2 IMDEA Software Institute, Madrid, Spain

1

slide-2
SLIDE 2

Remote Memory Access (RMA) Networks

2

High-Performance Computing Modern datacenters

Widely supported (Cray Aries and Gemini, Infiniband, IBM Blue Gene and Percs)

slide-3
SLIDE 3

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

3

slide-4
SLIDE 4

X = get(Y, P2);

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

4

slide-5
SLIDE 5

X = get(Y, P2);

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

5

slide-6
SLIDE 6

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

6

slide-7
SLIDE 7

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

7

slide-8
SLIDE 8

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y)

8

slide-9
SLIDE 9

Remote Memory Access (RMA) Networks

MEMORY MEMORY NIC PCIe CPU NIC PCIe CPU (X) (Y) Low latency High bandwidth

9

slide-10
SLIDE 10

Goal

Given an infinite-state program P running on an RMA network and a safety specification S, does P satisfy S under RMA? P ⊨RMA S

10

RMA asynchronous executions determine a weak-consistency memory model, more relaxed than x86 TSO, PSO, RMO

slide-11
SLIDE 11

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

11

slide-12
SLIDE 12

Sequential Consistency (SC) Yes

12

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

slide-13
SLIDE 13

Sequential Consistency (SC) Yes Remote Memory Access (RMA) No

13

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

slide-14
SLIDE 14

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

Sequential Consistency (SC) Yes Remote Memory Access (RMA) No

14

slide-15
SLIDE 15

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); flush(P1); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

15

slide-16
SLIDE 16

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); flush(P1); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

Remote Memory Access (RMA) Yes

16

slide-17
SLIDE 17

Process 1: shared X = 1; Process 2: shared Y = 2, Z = 0; local a; put(X, P1, Y); flush(P1); store Y = 3; Z = get(X, P1); load a = Z; assert final (a != 3);

Remote Memory Access (RMA) Yes

17

slide-18
SLIDE 18

This work

Main steps:

  • 1. Prove that P satisfies S under SC:

P ⊨SC S

  • 2. Construct P’ under SC that captures all behaviors of P under RMA:

P’ ⊨SC S ⇒ P ⊨RMA S

  • 3. Prove that P’ ⊨SC S

18

slide-19
SLIDE 19

This work

Key Idea: Extrapolate the abstraction of P under SC to an abstraction of P under RMA Main steps:

  • 1. Prove that P satisfies S under SC:

P ⊨SC S

  • 2. Construct P’ under SC that captures all behaviors of P under RMA:

P’ ⊨SC S ⇒ P ⊨RMA S

  • 3. Prove that P’ ⊨SC S

19

slide-20
SLIDE 20

Predicate Abstraction

Successful for sequential program analysis: Original by Graf and Saidi (CAV '96) Used by Microsoft's SLAM for device drivers (PLDI '01) Work for SC concurrent programs and weak memory models (x86 TSO, PSO): Kroening et al. (CAV '11), Gupta et al. (CAV '11), Dan et al. (SAS '13)

20

slide-21
SLIDE 21

Classic Predicate Abstraction

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex

Build a boolean program B that over-approximates the behaviors of P: B ⊨SC S ⇒ P ⊨SC S

21

slide-22
SLIDE 22

Classic Predicate Abstraction

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex

Build a boolean program B that over-approximates the behaviors of P: B ⊨SC S ⇒ P ⊨SC S Using an abstract model checker, verify that B satisfies S: B ⊨SC S

22

slide-23
SLIDE 23

Step 1: Verify program P under SC

Assume the RMA statements execute synchronously

put(Y, P1, X); Y = X;

23

slide-24
SLIDE 24

Step 1: Verify program P under SC

Assume the RMA statements execute synchronously

put(Y, P1, X); Y = X;

Find a set of predicates V Build the boolean program B that over-approximates P, using V Verify that B satisfies the property S under sequential consistency

24

slide-25
SLIDE 25

Step 2: Encode RMA effects into the program

Program P Reduction Program P’ Reduce the problem of verifying P under RMA to the problem of verifying P’ under SC P’ ⊨SC S ⇒ P ⊨RMA S

25

slide-26
SLIDE 26

Step 2: Encode RMA effects into the program

put(Y, P1, X);

Program P Reduction Program P’

26

slide-27
SLIDE 27

Step 2: Encode RMA effects into the program

put(Y, P1, X); if (!putActive) //boolean flag putActive = true ; XSet = {X}; //set variable else addToSet(XSet, X); //adds X to XSet

Program P Reduction Program P’

27

slide-28
SLIDE 28

Process 2: shared Y = 0; local r; load r = Y;

Example program P under RMA semantics

Process 1: shared X = 0; put(Y, P2, X); store X = 1;

28

slide-29
SLIDE 29
  • Theorem. P’ under SC soundly approximates P under RMA.

Process 1: shared X = 0; //put(Y, P2, X); putActive = true ; XSet = {X}; //store X = 1; store X = 1; addToSet(Xset, X); Process 2: shared Y = 0; local r; //nondeterministic op if (*) Y = randomElem(XSet); putActive = false; //load r = Y; load r = Y;

Example: Reduced program P’ under SC that captures the behaviors of P under RMA

29

slide-30
SLIDE 30

Step 3: Prove that P’ ⊨SC S

Find new predicates for program P’ Predicates for the boolean flags:

(putActive == true)

30

slide-31
SLIDE 31

Step 3: Prove that P’ ⊨SC S

Find new predicates for program P’ Predicates for the boolean flags:

(putActive == true)

Predicates for the set variables?

31

slide-32
SLIDE 32

Step 3: Prove that P’ ⊨SC S

Idea: Discover predicates for P’ using the predicates for program P under SC. Preds V Pred Extrapolation Preds V’

32

slide-33
SLIDE 33

Step 3: Prove that P’ ⊨SC S

Idea: Discover predicates for P’ using the predicates for program P under SC.

(X < 0)

Preds V Pred Extrapolation Preds V’

33

slide-34
SLIDE 34

Step 3: Prove that P’ ⊨SC S

Idea: Discover predicates for P’ using the predicates for program P under SC.

(X < 0) (XSet < 0)

Preds V Pred Extrapolation Preds V’

34

slide-35
SLIDE 35

Step 3: Prove that P’ ⊨SC S

Idea: Discover predicates for P’ using the predicates for program P under SC.

(X < 0) (XSet < 0)

Preds V Pred Extrapolation Preds V’

(X < Y) (XSet < Y) (X < YSet)

35

slide-36
SLIDE 36

Logic of the predicates (first attempt)

(XSet < 0) true, ∀ e ∈ XSet | e < 0 *, otherwise false, ∃ e ∈ XSet | e ≥ 0

36

slide-37
SLIDE 37

Logic of the predicates (first attempt)

(XSet < 0) true, ∀ e ∈ XSet | e < 0 *, otherwise false, ∃ e ∈ XSet | e ≥ 0

Problem: Would have to add the predicate (XSet ≥ 0) to track whether all elements of the set are greater than 0.

37

slide-38
SLIDE 38

Logic of the predicates for the set variables

(XSet < 0) true, ∀ e ∈ XSet | e < 0 *, otherwise false, ∀ e ∈ XSet | e ≥ 0

Solution: Refine the case when the predicate is false

38

slide-39
SLIDE 39

So far

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

Prove that P ⊨SC S

39

slide-40
SLIDE 40

Problem

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

2x 3x Prove that P ⊨SC S

40

slide-41
SLIDE 41

Problem

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

2x

Predicate Abstraction

Timeout 3x Prove that P ⊨SC S

41

slide-42
SLIDE 42

Problem

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

2x

Predicate Abstraction

Timeout Most time used by the SMT solver, computing the abstract transformers 3x Prove that P ⊨SC S

42

slide-43
SLIDE 43

Core problem: computing abstract transformers

∀ st ∈ Statements ∀ p ∈ V’ ∀ c ∈ Cubes(V’) if c ⇒ wp(p, st) //SMT call add c to the transformer Literals q = p or q = ￢p, p ∈ V’ Cubes(V’) = {q1 ∧ … ∧ qj} |Cubes(V’)| = 3|V’|

43

slide-44
SLIDE 44

Key Idea

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

Prove that P ⊨SC S

44

slide-45
SLIDE 45

Key Idea

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’

Prove that P ⊨SC S

45

slide-46
SLIDE 46

Key Idea

Program P Preds V Predicate Abstraction Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’ Bool Prog Extrapolation Bool Prog B’

Prove that P ⊨SC S

Bool Prog B

46

slide-47
SLIDE 47

Boolean Program Extrapolation

Extrapolate the abstract transformers from the boolean program of the SC proof. Zero calls to the SMT solver for building the boolean program

  • Theorem. The boolean program B’ soundly approximates of the boolean

program PredicateAbstraction(P’, V’).

47

slide-48
SLIDE 48

Program P’ Preds V Preds V’ (X>0), (Y>Z), (Z>0) (X>0), (Y>Z), (Z>0) (YSet>Z), ...

Abstract transformer for randomElem

48

Program P Bool Prog B Bool Prog B’ addElem(Yset, Y)

?

slide-49
SLIDE 49

Program P’ Preds V Preds V’ (X>0), (Y>Z), (Z>0) (X>0), (Y>Z), (Z>0) (YSet>Z), ...

Abstract transformer for randomElem

49

Program P Bool Prog B Bool Prog B’ addElem(Yset, Y) (YSet>Z) = true, (YSet>Z) ∧ (Y>Z) false, ￢(YSet>Z) ∧ ￢(Y>Z) *, otherwise

slide-50
SLIDE 50

Program P’ X = randomElem(YSet) Preds V Preds V’ (X>0), (Y>Z), (Z>0) (X>0), (Y>Z), (Z>0) (YSet>Z), ...

Abstract transformer for randomElem

50

Program P Bool Prog B Bool Prog B’

?

slide-51
SLIDE 51

Program P’ X = randomElem(YSet) Preds V Preds V’ (X>0), (Y>Z), (Z>0) (X>0), (Y>Z), (Z>0) (YSet>Z), ...

Abstract transformer for randomElem

51

Program P X = Y Bool Prog B (X>0) = true, (Y>Z) ∧ (Z>0) false, ￢(Y>Z) ∧ ￢(Z>0) *, otherwise Bool Prog B’

?

slide-52
SLIDE 52

Program P’ X = randomElem(YSet) Preds V Preds V’ (X>0), (Y>Z), (Z>0) (X>0), (Y>Z), (Z>0) (YSet>Z), ...

Abstract transformer for randomElem

52

Program P X = Y Bool Prog B (X>0) = true, (Y>Z) ∧ (Z>0) false, ￢(Y>Z) ∧ ￢(Z>0) *, otherwise Bool Prog B’ (X>0) = true, (YSet>Z) ∧ (Z>0) false, ￢(YSet>Z) ∧ ￢(Z>0) *, otherwise

slide-53
SLIDE 53

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’ Bool Prog Extrapolation Bool Prog B’ Abstract Model Checker Verified Counter Ex

Prove that P ⊨SC S Prove that P ⊨RMA S

53

slide-54
SLIDE 54

Implementation

Predicate Abstraction: cone of influence, Z3 SMT solver 3-valued model checker: Fender Benchmarks: 14 concurrent algorithms, 2-3 processes, 25-85 lines of code, several have infinite number of states Specifications: mutual exclusion or reachability invariants Flush search: start with flush after each remote statement, and try removing

54

slide-55
SLIDE 55

SC Predicate Abstraction RMA Predicate Abstraction Algorithm |V| B (s) B (loc) |V’| B’ (loc) Fender (s) Min flush Dekker 11 1 498 29 2068 294 4/12 Peterson 10 1 356 21 1045 3 4/7 ABP 16 1 485 20 662 1 2/2 Pc1 18 2 658 35 3797 65 2/7 Pgsql 12 1 418 18 1549 1 2/4 Qw 13 2 487 29 1544 1345 4/5 Sober 23 7 831 48 8466 4 0/9 Kessel 18 3 534 36 1621 45 4/10 Loop2_TLM 29 66 1068 43 1986 2204 2/4 Szymanski 34 228 1182 64 7081 316 7/14 Queue 13 35 572 22 1104 14 1/2 Ticket 17 117 640 43 3615 3493 5/6 Bakery 19 337 828 41 2947 203 6/10 RMA Lock 24 50 763 60 5932 65679 9/18

55

slide-56
SLIDE 56

56

SC Predicate Abstraction RMA Predicate Abstraction Algorithm |V| B (s) B (loc) |V’| B’ (loc) Fender (s) Min flush Dekker 11 1 498 29 2068 294 4/12 Peterson 10 1 356 21 1045 3 4/7 ABP 16 1 485 20 662 1 2/2 Pc1 18 2 658 35 3797 65 2/7 Pgsql 12 1 418 18 1549 1 2/4 Qw 13 2 487 29 1544 1345 4/5 Sober 23 7 831 48 8466 4 0/9 Kessel 18 3 534 36 1621 45 4/10 Loop2_TLM 29 66 1068 43 1986 2204 2/4 Szymanski 34 228 1182 64 7081 316 7/14 Queue 13 35 572 22 1104 14 1/2 Ticket 17 117 640 43 3615 3493 5/6 Bakery 19 337 828 41 2947 203 6/10 RMA Lock 24 50 763 60 5932 65679 9/18

slide-57
SLIDE 57

57

SC Predicate Abstraction RMA Predicate Abstraction Algorithm |V| B (s) B (loc) |V’| B’ (loc) Fender (s) Min flush Dekker 11 1 498 29 2068 294 4/12 Peterson 10 1 356 21 1045 3 4/7 ABP 16 1 485 20 662 1 2/2 Pc1 18 2 658 35 3797 65 2/7 Pgsql 12 1 418 18 1549 1 2/4 Qw 13 2 487 29 1544 1345 4/5 Sober 23 7 831 48 8466 4 0/9 Kessel 18 3 534 36 1621 45 4/10 Loop2_TLM 29 66 1068 43 1986 2204 2/4 Szymanski 34 228 1182 64 7081 316 7/14 Queue 13 35 572 22 1104 14 1/2 Ticket 17 117 640 43 3615 3493 5/6 Bakery 19 337 828 41 2947 203 6/10 RMA Lock 24 50 763 60 5932 65679 9/18

slide-58
SLIDE 58

58

SC Predicate Abstraction RMA Predicate Abstraction Algorithm |V| B (s) B (loc) |V’| B’ (loc) Fender (s) Min flush Dekker 11 1 498 29 2068 294 4/12 Peterson 10 1 356 21 1045 3 4/7 ABP 16 1 485 20 662 1 2/2 Pc1 18 2 658 35 3797 65 2/7 Pgsql 12 1 418 18 1549 1 2/4 Qw 13 2 487 29 1544 1345 4/5 Sober 23 7 831 48 8466 4 0/9 Kessel 18 3 534 36 1621 45 4/10 Loop2_TLM 29 66 1068 43 1986 2204 2/4 Szymanski 34 228 1182 64 7081 316 7/14 Queue 13 35 572 22 1104 14 1/2 Ticket 17 117 640 43 3615 3493 5/6 Bakery 19 337 828 41 2947 203 6/10 RMA Lock 24 50 763 60 5932 65679 9/18

slide-59
SLIDE 59

59

SC Predicate Abstraction RMA Predicate Abstraction Algorithm |V| B (s) B (loc) |V’| B’ (loc) Fender (s) Min flush Dekker 11 1 498 29 2068 294 4/12 Peterson 10 1 356 21 1045 3 4/7 ABP 16 1 485 20 662 1 2/2 Pc1 18 2 658 35 3797 65 2/7 Pgsql 12 1 418 18 1549 1 2/4 Qw 13 2 487 29 1544 1345 4/5 Sober 23 7 831 48 8466 4 0/9 Kessel 18 3 534 36 1621 45 4/10 Loop2_TLM 29 66 1068 43 1986 2204 2/4 Szymanski 34 228 1182 64 7081 316 7/14 Queue 13 35 572 22 1104 14 1/2 Ticket 17 117 640 43 3615 3493 5/6 Bakery 19 337 828 41 2947 203 6/10 RMA Lock 24 50 763 60 5932 65679 9/18

slide-60
SLIDE 60

Program P Program P’ Preds V Preds V’ Bool Prog B Bool Prog B’ Reduction

Conclusion

Pred Extrapolation Bool Prog Extrapolation

P ⊨SC S P ⊨RMA S

60

slide-61
SLIDE 61

Program P Preds V Predicate Abstraction Bool Prog B Abstract Model Checker Verified Counter Ex Program P Preds V Reduction Pred Extrapolation Program P’ Preds V’ Bool Prog Extrapolation Bool Prog B’ Abstract Model Checker Verified Counter Ex

Prove that P ⊨SC S Prove that P ⊨RMA S

61