Verifying Local Transformations on Relaxed Memory Models

Abstract

Abstract. The problem of locally transforming or translating programs without altering their semantics is central to the construction of correct compilers. For concurrent shared-memory programs this task is challenging because (1) concurrent threads can observe transformations that would be undetectable in a sequential program, and (2) contemporary multiprocessors commonly use relaxed memory models that complicate the reasoning.In this paper, we present a novel proof methodology for verifying that a local program transformation is sound with respect to a specific hardware memory model, in the sense that it is not observable in any context. The methodology is based on a structural induction and relies on a novel compositional denotational semantics for relaxed memory models that formalizes (1) the behaviors of program fragments as a set of traces, and (2) the effect of memory model relaxations as local trace rewrite operations.To apply this methodology in practice, we implemented a semiautomated tool called Traver and used it to verify/falsify several compiler transformations for a number of different hardware memory models.

A formal hierarchy of weak memory models

“…in S. Burckhardt et al's work [19] or R. Ferreira et al's [23]. This line of research specifies weak memory models as program transformations.…”

Verifying Fence Elimination Optimisations

“…Most studies of this problem [26,2,6] have mostly been in terms of hypothetical program executions and, unlike our work, have not been integrated in a working compiler.…”

“…Work in this area goes back at least to that of Shasha and Snir [26] (and more recently [2,6,23]), but most of this is in terms of transformations of hypothetical program executions rather than the transformations of code that are implemented (without proof) in actual compilers.…”

Automatically comparing memory consistency models

“…Since optimisations should not introduce new behaviours, this problem is related to monotonicity (Q3). On the automation side, the Traver tool [21] uses an automated theorem prover to verify/falsify a given program transformation against a non-SC MCM. Unlike our work, Traver does not support multi-threaded optimisations such as linearisation.…”