Context-Bounded Analysis for POWER

Abstract

Abstract. We propose an under-approximate reachability analysis algorithm for programs running under the POWER memory model, in the spirit of the work on context-bounded analysis intitiated by Qadeer et al. in 2005 for detecting bugs in concurrent programs (supposed to be running under the classical SC model). To that end, we first introduce a new notion of context-bounding that is suitable for reasoning about computations under POWER, which generalizes the one defined by Atig et al. in 2011 for the TSO memory model. Then, we provide a polynomial size reduction of the context-bounded state reachability problem under POWER to the same problem under SC: Given an input concurrent program P, our method produces a concurrent program P such that, for a fixed number of context switches, running P under SC yields the same set of reachable states as running P under POWER. The generated program P contains the same number of processes as P, and operates on the same data domain. By leveraging the standard model checker CBMC, we have implemented a prototype tool and applied it on a set of benchmarks, showing the feasibility of our approach.

Promising-ARM/RISC-V: a simpler and faster operational concurrency model

“…There are a number of existing concurrency model checking tools, none of which, however, apply to ARMv8 or RISC-V. Alglave et al [8] develop a model checking tool based on axiomatic models for some weaker models including RMO and Power, but not ARMv8, and it does not integrate a substantial ISA model. Abdulla et al [3][4][5] describe efficient model-checking algorithms for hardware models (TSO, PSO, and Power), proved sound for Power. They do not handle ARMv8; for their Nidhugg tool, ARM support is called "partial", under-approximating the behaviours [1], and they do not handle a (Power or ARM) ISA model, but a simple calculus.…”

Using Shared Memory Abstractions to Design Eager Sequentializations for Weak Memory Models

“…We used the files from the sub-categories shown in Table 1; each row shows the corresponding number of files and lines of code. Table 1 shows the results for the SV-COMP16 versions of CBMC [5], CIVL [26], Lazy-CSeq [13,14], the SV-COMP15 version of MU-CSeq [21], 2 and of IMU-CSeq on these benchmarks. We indicate with pass the number of correctly found bugs, with fail the number of unsuccessful analyses including tool crashes, memory limit hits, and timeouts, and with time the average time in seconds to find the bug.…”

“…The notion of IMU exactly captures the coherence relation that is often used in the description of memory models (see [6,2]). In our setting, we achieve the reordering of the statements that are observed in the relaxed memory models by guessing the timestamps and then checking their consistency with the expected behaviours.…”

“…We plan to extend our approach to other memory models such as POWER. POWER relaxes PSO (and thus TSO) in two key aspects (see [2]): (i) the propagation of a write in the shared memory by a thread can be asynchronous, i.e., each thread can see the write at a different time; (ii) the order of execution of the statements of a thread can be rearranged liberally (w.r.t. the program order) provided that the dependency relations such as data-flow, address, control and isync are respected.…”

The Decidability of Verification under PS 2.0

“…Given the high complexity for PS 2.0-rlx and the undecidability of PS 2.0-ra, we next consider a bounded version of the reachability problem. To this end, we propose a parametric under-approximation in the spirit of context bounding [9,33,21,26,24,29,1,3]. The aim of context bounding is to restrict the otherwise unbounded interaction between processes, and has been shown experimentally in the case of SC programs to maintain enough behaviour coverage for bug detection [24,29].…”