Model checking for weakly consistent libraries

Abstract

We present GenMC, a model checking algorithm for concurrent programs that is parametric in the choice of memory model and can be used for verifying clients of concurrent libraries. Subject to a few basic conditions about the memory model, our algorithm is sound, complete and optimal, in that it explores each consistent execution of the program according to the model exactly once, and does not explore inconsistent executions or embark on futile exploration paths. We implement GenMC as a tool for verifying C programs. Despite the generality of the algorithm, its performance is comparable to the state-of-art specialized model checkers for specific memory models, and in certain cases exponentially faster thanks to its coarse partitioning of executions.CCS Concepts: • Theory of computation → Verification by model checking; • Software and its engineering → Software testing and debugging.

Effective lock handling in stateless model checking

“…When this is the case, following Abdulla et al [2018] and Kokologiannakis et al [2019], we only keep the following events in this additional execution: (1) r itself (e.g., a := x), (2) the events that were added before r (e.g., lock(l) in the left thread), (3) w itself (e.g., x := 2), and (4) the events that led to w (e.g., lock(l) and b := x in the right thread). In other words, we remove all events that were added after r but did not lead to w (e.g., the x := 1 and unlock(l) in the left thread).…”

“…However, several more recent DPOR algorithms [Abdulla et al 2018;Aronis et al 2018;Chalupa et al 2017;Kokologiannakis et al 2017Kokologiannakis et al , 2019 do not consider all orderings on the writes of the same location unless this order is observable. As such, since the value of x is not read in w+w, the order of the writes cannot possibly be observable, and thus these techniques explore only one execution for w+w, ignoring the order in which the writes are executed.…”

“…Our model checking algorithm for locks, LAPOR, can be built as an extension of any (D)POR algorithm, as long as it calculates its alternative exploration options at each step and not at the end of each execution. For concreteness, here we present a version of LAPOR built on top of the GenMC model checking algorithm by Kokologiannakis et al [2019]. Basing LAPOR over GenMC enables our algorithm to be parametric with respect to the memory model and allows us to prove its correctness and optimality (see ğ4.2).…”

“…Intuitively, CGL simplifies reasoning about concurrent programs because it reduces the number of interleavings that a programmer or an automated verifier has to consider. Somewhat surprisingly, however, CGL has the opposite effect on verification using the state-of-the-art stateless model checking (SMC) tools (e.g., [Abdulla et al 2014[Abdulla et al , 2018Aronis et al 2018;Kokologiannakis et al 2017Kokologiannakis et al , 2019). More specifically, CGL increases the verification cost significantly because it inhibits the most important optimization of SMC, which makes the approach scalable, namely (dynamic) partial order reduction (POR) [Abdulla et al 2014;Flanagan and Godefroid 2005].…”

“…(ğ4) We describe LAPOR in detail, and show that it is sound (produces no false positives), complete (explores all possible behaviours), and optimal (explores each behaviour exactly once), and that it can be applied to any memory model that satisfies a few basic assumptions. (ğ5) We implement LAPOR over the state-of-the-art GenMC model checker [Kokologiannakis et al 2019] and evaluate its performance. We show that LAPOR is significantly faster than the state of the art for programs with coarse-grained locks, while incurring only a small overhead for programs with fine-grained locks, and negligible overhead for programs without locks.…”