Effective Abstractions for Verification under Relaxed Memory Models - PowerPoint PPT Presentation

Effective Abstractions for Verification under Relaxed Memory Models Andrei Dan Yuri Meshman Martin Vechev Eran Yahav ETH Zurich Technion ETH Zurich Technion 1

Dekker’s Algorithm initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Sequential Consistency Dekker’s Algorithm initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Sequential Consistency Dekker’s Algorithm initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Sequential Consistency Dekker’s Algorithm Relaxed Model x86 TSO initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Sequential Consistency Dekker’s Algorithm Relaxed Model x86 TSO initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Sequential Consistency Dekker’s Algorithm Relaxed Model x86 TSO initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 2

Correct Dekker’s Algorithm Relaxed Model x86 TSO initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true fence fence while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true fence fence /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 3

Correct Dekker’s Algorithm Relaxed Model x86 TSO initial: flag[0] = false, flag[1] = false, turn = 0 Thread 1: Thread 0: flag[1] := true flag[0] := true fence fence while (flag[1] = true) while (flag[0] = true) if (turn ≠ 0) if (turn ≠ 1) flag[0] := false flag[1] := false while (turn ≠ 0) { } while (turn ≠ 1) { } flag[0] := true flag[1] := true fence fence /* Critical Section */ /* Critical Section */ Spec : mutual exclusion over Critical Section 3

This work Concurrent Program P Memory Model M Specification S

This work Concurrent Program P Source-to-source Concurrent translation Program P M Memory Model M Specification S

This work Concurrent Program P Source-to-source Concurrent translation Program P M Memory Model M Abstract interpreter Program for sequential invariants consistency Specification S

This work Concurrent Program P Source-to-source Concurrent translation Program P M Memory Model M Abstract interpreter Program for sequential invariants consistency Specification SMT Solver S

This work Abstraction-aware translation Concurrent Program P Source-to-source Concurrent translation Program P M Memory Model M Abstract interpreter Program for sequential invariants consistency Specification SMT Solver S

Talk outline Direct translation [SAS ‘14] Abstraction-aware translation: 1. Leverage more refined abstract domain 2. Buffer semantics without shifting [Abstraction] Evaluation 5

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 6

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 7

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence lhs 1 := ‘ X ’; rhs 1 := 1; translated to X := 1 cnt := cnt + 1 Introduce 2 local variables in Thread 0 to encode each location of the finite buffer. Introduce a variable cnt. It represents the number of elements in the buffer: {0 .. k}. 7

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 8

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence Establish a limit k for the size of the buffers for each thread. For example k = 3. Sound abstraction. 8

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 9

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 Flush a := X Y = 0 Flush Y := a + 1 Flush X := a – 1 Flush fence 9

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 10

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence while (cnt > 0 ∧ random) do if (lhs 1 = ‘ X ’) then X := rhs 1 ; translated to Flush if (lhs 1 = ‘ Y ’) then Y := rhs 1 ; cnt := cnt – 1 10

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence 11

Direct translation for x86 TSO [SAS ‘14] Thread 0: Write Buffer 0: Shared Memory: X := 1 X := 1 X = 0 a := X Y = 0 Y := a + 1 X := a – 1 fence if (cnt ≥ 1 ∧ lhs 1 = ‘ X ’) then a := rhs 1 ; translated to a := X else a := X; 11

Analysis with the direct translation Original program: Direct Translation: Numerical abstract interpretation: lhs 1 := ‘ X ’; rhs 1 := 1; translated to X := 1 cnt := cnt + 1 while (cnt > 0 ∧ random) do if (lhs 1 = ‘ X ’) then X := rhs 1 ; translated to Flush if (lhs 1 = ‘ Y ’) then Y := rhs 1 ; cnt := cnt – 1 if (cnt ≥ 1 ∧ lhs 1 = ‘ X ’) then a := rhs 1 ; translated to a := X else a := X; 12

Analysis with the direct translation Original program: Direct Translation: Numerical abstract interpretation: lhs 1 := ‘ X ’; rhs 1 := 1; translated to X := 1 lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = 1 ∧ cnt := cnt + 1 X = 0 while (cnt > 0 ∧ random) do if (lhs 1 = ‘ X ’) then X := rhs 1 ; translated to Flush if (lhs 1 = ‘ Y ’) then Y := rhs 1 ; cnt := cnt – 1 if (cnt ≥ 1 ∧ lhs 1 = ‘ X ’) then a := rhs 1 ; translated to a := X else a := X; 12

Analysis with the direct translation Original program: Direct Translation: Numerical abstract interpretation: lhs 1 := ‘ X ’; rhs 1 := 1; translated to X := 1 lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = 1 ∧ cnt := cnt + 1 X = 0 while (cnt > 0 ∧ random) do if (lhs 1 = ‘ X ’) then X := rhs 1 ; translated to Flush if (lhs 1 = ‘ Y ’) then Y := rhs 1 ; lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = [0, 1] cnt := cnt – 1 ∧ X = [0, 1] if (cnt ≥ 1 ∧ lhs 1 = ‘ X ’) then a := rhs 1 ; translated to a := X else a := X; 12

Analysis with the direct translation Original program: Direct Translation: Numerical abstract interpretation: lhs 1 := ‘ X ’; rhs 1 := 1; translated to X := 1 lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = 1 ∧ cnt := cnt + 1 X = 0 while (cnt > 0 ∧ random) do if (lhs 1 = ‘ X ’) then X := rhs 1 ; translated to Flush if (lhs 1 = ‘ Y ’) then Y := rhs 1 ; lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = [0, 1] cnt := cnt – 1 ∧ X = [0, 1] if (cnt ≥ 1 ∧ lhs 1 = ‘ X ’) then a := rhs 1 ; translated to a := X else a := X; lhs 1 = ‘X’ ∧ rhs 1 = 1 ∧ cnt = [0, 1] ∧ X = [0, 1] ∧ a = [0, 1] 12