Partial-coherence abstractions for relaxed memory models

Abstract

We present an approach for automatic verification and fence inference in concurrent programs running under relaxed memory models. Verification under relaxed memory models is a hard problem. Given a finite state program and a safety specification, verifying that the program satisfies the specification under a sufficiently relaxed memory model is undecidable. For stronger models, the problem is decidable but has non-primitive recursive complexity.In this paper, we focus on models that have store-buffer based semantics, e.g., SPARC TSO and PSO. We use abstract interpretation to provide an effective verification procedure for programs running under this type of models. Our main contribution is a family of novel partial-coherence abstractions, specialized for relaxed memory models, which partially preserve information required for memory coherence and consistency. We use our abstractions to automatically verify programs under relaxed memory models. In addition, when a program violates its specification but can be fixed by adding fences, our approach can automatically infer a correct fence placement that is optimal under the abstraction. We implemented our approach in a tool called BLENDER and applied it to verify and infer fences in several concurrent algorithms.

Counter-Example Guided Fence Insertion under TSO

“…Furthermore, some of our examples may generate an arbitrary number of messages inside the buffers and they may have sequential inconsistent behaviors. To the best of our knowledge, only the approaches in [19] and in [22] are potentially able to handle such general classes of problems. However, the approach of [22] does not guarantee termination.…”

“…However, the approach of [22] does not guarantee termination. The work in [19] abstracts away the order between buffer messages, and hence it cannot handle examples where the order of messages sent to the buffer is crucial (such as the "Increasing Sequence" example in the …”

“…However, they are not able to check all possible traces and can therefore not tell whether the generated set of fences is sufficient for correctness. Recent techniques based on over-approximations [19] are valuable for showing correctness; however they are not complete and might not be able to prove correctness although the program satisfies its specification. Hence, the computed set of fences need not be minimal.…”

Context-Bounded Analysis for POWER

“…These are widespread medium-sized benchmarks that are used by many tools for analyzing concurrent programs running under weak memory models (e.g. [24,12,15,10,40,2,37,13,3,8,22,7,4,14]). We divide our results in two sets.…”

“…There has been a lot of work on automatic program verification under weak memory models, based on precise, under-approximate, and abstract analyses, e.g., [29,23,24,12,36,37,18,5,8,15,16,13,14,39,2,40,20,10,38,26,19]. While most of these works concern TSO, only a few of them address the safety verification problem under POWER (e.g., [6,10,36,9,11]).…”