CDSchecker

Abstract

Writing low-level concurrent software has traditionally required intimate knowledge of the entire toolchain and often has involved coding in assembly. New language standards have extended C and C++ with support for low-level atomic operations and a weak memory model, enabling developers to write portable and efficient multithreaded code.Developing correct low-level concurrent code is wellknown to be especially difficult under a weak memory model, where code behavior can be surprising. Building reliable concurrent software using C/C++ low-level atomic operations will likely require tools that help developers discover unexpected program behaviors.In this paper we present CDSCHECKER, a tool for exhaustively exploring the behaviors of concurrent code under the C/C++ memory model. We develop several novel techniques for modeling the relaxed behaviors allowed by the memory model and for minimizing the number of execution behaviors that CDSCHECKER must explore. We have used CDSCHECKER to exhaustively unit test several concurrent data structure implementations on specific inputs and have discovered errors in both a recently published C11 implementation of a work-stealing queue and a single producer, single consumer queue implementation.

Robustness against release/acquire semantics

“…We note that Trencher can be used in parallel to Rocker for verifying robustness against RA: a violation detected by Trencher implies non-robustness against RA. 53ś55], which require manual proofs, and (bounded) model checkers, e.g., [3,34,48], which provide limited guarantees for programs with loops. These methods can be used to verify programs that are not necessarily robust against RA.…”

Effective lock handling in stateless model checking

“…Following the success of tools such as Verisoft [Godefroid 1997] and CHESS [Musuvathi et al 2008] paving the way for Stateless Model Checking, the literature of DPOR algorithms grew rapidly [Abdulla et al 2014;Flanagan and Godefroid 2005;Kokologiannakis et al 2017]. Initially, DPOR algorithms partitioned the state space based on Mazurkiewicz traces [Mazurkiewicz 1987] under sequential consistency [Abdulla et al 2014;Flanagan and Godefroid 2005], or based on Shasha-Snir traces [Shasha and Snir 1988] 3 under weak memory models [Abdulla et al 2015[Abdulla et al , 2016Kokologiannakis et al 2017;Norris and Demsky 2013;Zhang et al 2015]. Subsequently, algorithms that use coarser equivalence partitioning were proposed first for SC [Aronis et al 2018;Chalupa et al 2017], and later for Release-Acquire [Abdulla et al 2018].…”

HMC

“…Models in this category include SC [30], TSO [33], PSO [40], and RC11 [29]. Verification under porf-acyclic models has been studied extensively and there exist efficient verification tools that support them (e.g., [1,32,15,26,4,27]).…”

“…and restrict to a fragment of the memory model for the sake of efficiency, e.g., [26,27], or they sacrifice scalability by naively emulating all the possible out-of-order executions that could arise in a program, e.g., [3,32,36].…”

“…In this paper, we develop HMC (Hardware-memory Model Checker), the first efficient SMC algorithm that supports dependency-tracking models. In HMC, we do not try to directly emulate out-of-order execution as the prior work [32,36] does. We instead extend the approach of GenMC [27] to lift its assumption of porf-acyclicity.…”