Automatic analysis of DMA races using model checking and k-induction

Abstract

Modern multicore processors, such as the Cell Broadband Engine, achieve high performance by equipping accelerator cores with small "scratch-pad" memories. The price for increased performance is higher programming complexity -the programmer must manually orchestrate data movement using direct memory access (DMA) operations. Programming using asynchronous DMA operations is error-prone, and DMA races can lead to nondeterministic bugs which are hard to reproduce and fix. We present a method for DMA race analysis in C programs. Our method works by automatically instrumenting a program with assertions modeling the semantics of a memory flow controller. The instrumented program can then be analyzed using state-of-the-art software model checkers. We show that bounded model checking is effective for detecting DMA races in buggy programs. To enable automatic verification of the correctness of instrumented programs, we present a new formulation of k-induction geared towards software, as a proof rule operating on loops. Our techniques are implemented as a tool, SCRATCH, which we apply to a large set of programs supplied with the IBM Cell SDK, in which we discover a previously unknown bug. Our experimental results indicate that our k-induction method performs extremely well on this problem class. To our knowledge, this marks both the first application of k-induction to software verification, and the first example of software model checking in the context of heterogeneous multicore processors.

Tightening Test Coverage Metrics: A Case Study in Equivalence Checking Using k-Induction

“…Recently, kinduction has also been applied in the verification of imperative software [12,13]. In this paper, we consider applying the software formulation of k-induction proposed in [12,13] to detect mutant equivalence in the C programs generated via the technique described in Sect. 2.3.…”

“…In prior work [12,13] we investigated a direct lifting of k-induction from transition systems to the level of program loops, in order to prove partial correctness of software programs with respect to assertions appearing in the program text. Because we translate Simulink designs into C, it is this formulation of kinduction, rather than the transition system-level formulation outlined in §3.1 and §3.2, that we use to implement k-induction for detection of equivalent mutants.…”

“…Besides hardware verification, k-induction has been used to analyse synchronous programs [18,16], SystemC designs [17] and imperative software [12,13]. A combination of the k-induction rule of [12,13], abstract interpretation, and domain-specific invariant strengthening techniques for race analysis is the topic of [10].…”

Making Software Verification Tools Really Work

“…Bounded model checking tools such as CBMC [21] and F-SOFT [35] are effective at finding bugs in system-level software, and have been applied in the automotive domain [41]. Recent applications of the kinduction method [43] to software verification [25] have facilitated the use of BMC for verification, not just falsification, of race-freedom properties in software for the Cell BE processor [27].…”

Engineering a Static Verification Tool for GPU Kernels

“…To avoid quantifiers and the associated theorem proving burden, we originally devised a non-deterministic representation of sets [8], based on [17]. Let s and t denote the arbitrary threads considered by the two-thread reduction.…”