Effective Program Verification for Relaxed Memory Models

Abstract

Program verification for relaxed memory models is hard. The high degree of nondeterminism in such models challenges standard verification techniques. This paper proposes a new verification technique for the most common relaxation, store buffers. Crucial to this technique is the observation that all programmers, including those who use low-lock techniques for performance, expect their programs to be sequentially consistent. We first present a monitor algorithm that can detect the presence of program executions that are not sequentially consistent due to store buffers while only exploring sequentially consistent executions. Then, we combine this monitor with a stateless model checker that verifies that every sequentially consistent execution is correct. We have implemented this algorithm in a prototype tool called Sober and present experiments that demonstrate the precision and scalability of our method. We find relaxed memory model bugs in several programs, including two previously unknown bugs in a production-level concurrency library that would have been difficult to find by other means.

Context-Bounded Analysis for POWER

“…These are widespread medium-sized benchmarks that are used by many tools for analyzing concurrent programs running under weak memory models (e.g. [24,12,15,10,40,2,37,13,3,8,22,7,4,14]). We divide our results in two sets.…”

“…There has been a lot of work on automatic program verification under weak memory models, based on precise, under-approximate, and abstract analyses, e.g., [29,23,24,12,36,37,18,5,8,15,16,13,14,39,2,40,20,10,38,26,19]. While most of these works concern TSO, only a few of them address the safety verification problem under POWER (e.g., [6,10,36,9,11]).…”

Generating Litmus Tests for Contrasting Memory Consistency Models

“…The second case study for our technique was debugging the axiomatic specification of TSO used by SOBER [5]. SOBER is a technique for detecting potential SC violations in software.…”

“…SOBER uses an axiomatically defined memory model that is intended to be equivalent to SPARC's TSO. The authors stated that their axiomatic definition is equivalent to their operational specification of TSO [6]. However, Burnim et al [7] discovered that SOBER's axiomatic specification and TSO are, in fact, not equivalent.…”

“…We developed a specification of a non-storeatomic variant of PSO, which illustrates that the tool quickly identifies subtle specification mistakes. In another case study, we contrasted SOBER's axiomatic specification of TSO [5] with an operational specification of TSO and showed our technique detects a recently discovered specification error [7].…”