⇒ MemSynth: automated programming for memory consistency models Litmus tests Memory models Synthesis as rela`ons as constraints via sketches ∨ ∀ ⋈ ∃ ∈ 1 2 3 ∩ ∧ ⊂ ∪ Litmus tests Formal and prose specifica`ons
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 if Y == 0: if X == 0: 2 4 print “hello” print “goodbye” All variables initialized to 0
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 r0 = Y r1 = X 2 4 All variables initialized to 0
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 r0 = Y r1 = X 2 4 All variables initialized to 0 Encode programs and behaviors as relations in relational logic (like Alloy)
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 r0 = Y r1 = X 2 4 All variables initialized to 0 Encode programs and behaviors as relations in relational logic (like Alloy) Program relations extracted from program text: po = {( , ), ( , )} 1 2 3 4 Program order : ( a , b ) ∈ po if b is aoer a on the same thread
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 r0 = Y r1 = X 2 4 All variables initialized to 0 Encode programs and behaviors as relations in relational logic (like Alloy) Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order : Reads-from : ( a , b ) ∈ po if b is aoer a on ( r , w ) ∈ rf if r reads the the same thread value wripen by w
Litmus tests as relations Thread 1 Thread 2 X = 1 Y = 1 1 3 r0 = Y r1 = X 2 4 All variables initialized to 0 Encode programs and behaviors as relations in relational logic (like Alloy) Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order : Reads-from : ( a , b ) ∈ po if b is aoer a on ( r , w ) ∈ rf if r reads the the same thread value wripen by w
Memory models as relational constraints Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order Reads-from A memory model constrains the allowed executions of a program Written as a predicate in relational logic
Memory models as relational constraints Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order Reads-from A memory model constrains the allowed executions of a program Written as a predicate in relational logic M ( T , E ) ≜
Memory models as relational constraints (&& Program relations Execution relations (&& (&& extracted from program text: describe dynamic behavior: (in rf (& (-> Writes Reads) (join loc (~ loc)) (join data (~ data)))) (no (- (join rf (~ rf)) iden)) (all ((r4 (- Reads (join Writes rf)))) (= (join r4 data) Zero))) (&& po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 (in ws (& (-> Writes Writes) (join loc (~ loc)))) (no (& iden ws)) (in (join ws ws) ws) (all Program order Reads-from ((r5 Writes)) (all ((r6 (- (& Writes (join loc (join r5 loc))) r5))) (or (in (-> r5 r6) ws) (in (-> r6 r5) ws)))) (in ws (join loc (~ loc))))) (no (& (^ (+ A memory model constrains the allowed executions of a program (+ rf ws (+ (join (~ rf) ws) (& (-> (- Reads (join Writes rf)) Writes) (join loc (~ loc))))) (& po (join loc (~ loc))))) iden)) (no (& (^ (+ po rf)) iden)) (all Written as a predicate in relational logic ((r7 Writes)) (=> (&& (in r7 (- (join univ ws) (join ws univ))) (some (join (join r7 loc) finalValue))) (= (join r7 data) (join (join r7 loc) finalValue)))) (no (& (^ (+ (& po dp) ws (+ (join (~ rf) ws) (& (-> (- Reads (join Writes rf)) Writes) (join loc (~ loc)))) (-> none none) M ( T , E ) ≜ (+ (^ (+ (+ (join (:> po Syncs) po) (join (join (:> po Syncs) po) rf)) (join rf (join (:> po Syncs) po)))) (^ (+ (+ (& (join (:> po Lwsyncs) po) (+ (-> Writes Writes) (-> Reads MemoryEvent))) (:> (join rf (& (join (:> po Lwsyncs) po) (+ (-> Writes Writes) (-> Reads MemoryEvent)))) Writes)) (<: Reads (join (& (join (:> po Lwsyncs) po) (+ (-> Writes Writes) (-> Reads MemoryEvent))) rf))))))) iden)))
Memory models as relational constraints Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order Reads-from A memory model constrains the allowed executions of a program Written as a predicate in relational logic M ( T , E ) ≜ ( no (& (^ (+ po rf)) iden))
Memory models as relational constraints Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order Reads-from A memory model constrains the allowed executions of a program Written as a predicate in relational logic M ( T , E ) ≜ ( no (& (^ (+ po rf)) iden)) …by forbidding cycles Constraining the possible involving rf ∪ po values of rf …
Memory models as relational constraints Program relations Execution relations extracted from program text: describe dynamic behavior: po = {( , ), ( , )} rf = {( , ), ( , )} 1 2 3 4 2 3 4 1 Program order Reads-from A memory model constrains the allowed executions of a program Written as a predicate in relational logic A memory model allows a test T if there exists an execu`on E that sa`sfies the predicate M ( T , E ) ≜ ( no (& (^ (+ po rf)) iden)) …by forbidding cycles Constraining the possible involving rf ∪ po values of rf …
Synthesis from a memory model sketch ( no (& (^ (+ po rf)) iden)) M ( T , E ) ≜
Synthesis from a memory model sketch M ( T , E ) ≜ ( no (& (^ (+ ?? ?? )) iden )) ( no (& (^ (+ po rf)) iden)) Expression holes for a synthesizer to complete
Synthesis from a memory model sketch M ( T , E ) ≜ ( no (& (^ (+ ?? ?? )) iden )) ( no (& (^ (+ po rf)) iden)) po Expression holes for rf a synthesizer to po + rf complete po & rf po - rf …
Synthesis from a memory model sketch A sketch specifies things we know (e.g., want a happens- before ordering)… M ( T , E ) ≜ ( no (& (^ (+ ?? ?? )) iden )) ( no (& (^ (+ po rf)) iden)) po Expression holes for rf a synthesizer to po + rf complete po & rf po - rf …
Synthesis from a memory model sketch A sketch specifies things we …and defines the shape of know (e.g., want a happens- the parts we don’t know before ordering)… M ( T , E ) ≜ ( no (& (^ (+ ?? ?? )) iden )) ( no (& (^ (+ po rf)) iden)) po Expression holes for rf a synthesizer to po + rf complete po & rf po - rf …
Memory model frameworks ( no (& (^ (+ ws rf ppo grf )) iden )) M ( T , E ) ≜ [Alglave et al, CAV’10]
Memory model frameworks ( no (& (^ (+ ws rf ppo grf )) iden )) M ( T , E ) ≜ Preserved program order: Global reads-from: same-thread reorderings inter-thread reorderings [Alglave et al, CAV’10]
Memory model frameworks ( no (& (^ (+ ws rf ppo grf )) iden )) M ( T , E ) ≜ Preserved program order: Global reads-from: same-thread reorderings inter-thread reorderings Sequential po rf consistency Total store po - (Wr→Rd) rf & SameThd order (x86) [Alglave et al, CAV’10]
Memory model frameworks ( no (& (^ (+ ws rf ppo grf )) iden )) M ( T , E ) ≜ ?? ?? Preserved program order: Global reads-from: same-thread reorderings inter-thread reorderings Sequential po rf consistency Total store po - (Wr→Rd) rf & SameThd order (x86) [Alglave et al, CAV’10]
Ocelot DSL for relational logic with holes Expression holes for a synthesizer to complete ( no (& (^ (+ ws rf ppo grf )) iden )) M ( T , E ) ≜ ?? ?? Ocelot embeds rela`onal logic in the RoseZe solver-aided language [Torlak & Bodik 2014] Also in use for SQL query synthesis and protocol reasoning http://ocelot.tools
The synthesis query Allowed litmus tests Synth Completed memory model M Forbidden litmus tests ˆ Memory model sketch M
The synthesis query 2 allowed tests 3 5 Synth Total store order 1 2 4 6 7 8 9 10 8 forbidden tests x86 ˆ Memory model sketch M
The synthesis query Allowed litmus tests Synth Completed memory model M Forbidden litmus tests ˆ Memory model sketch M
The synthesis query ∃ M. ∀ T ∈ T + . M allows T Allowed litmus tests Memory model M Forbidden litmus tests ˆ Memory model sketch M
The synthesis query ∃ M. ∀ T ∈ T + . M allows T Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . M forbids T Forbidden litmus tests ˆ Memory model sketch M
The synthesis query Standard exists-forall quan`fier papern for synthesis ∃ M. ∀ T ∈ T + . M allows T Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . M forbids T Forbidden litmus tests ˆ Memory model sketch M
The synthesis query M allows T : Standard exists-forall quan`fier ∃ E . M ( T , E ) papern for synthesis ∃ M. ∀ T ∈ T + . M allows T Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . M forbids T Forbidden litmus tests ˆ Memory model sketch M
The synthesis query M allows T : Standard exists-forall quan`fier ∃ E . M ( T , E ) papern for synthesis ∃ M. ∀ T ∈ T + . ∃ E. M ( T , E ) Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . ∀ E. ¬ M ( T , E ) Forbidden litmus tests ˆ Memory model sketch M
The synthesis query M allows T : Standard exists-forall quan`fier ∃ E . M ( T , E ) papern for synthesis ∃ M. ∀ T ∈ T + . ∃ E. M ( T , E ) Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . ∀ E. ¬ M ( T , E ) Forbidden litmus tests Higher-order quan`fica`on ˆ Memory model sketch M over rela`ons! 😲
The synthesis query M allows T : ∃ E . M ( T , E ) ∃ M. ∀ T ∈ T + . ∃ E. M ( T , E ) Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . ∀ E. ¬ M ( T , E ) Forbidden litmus tests ˆ Memory model sketch M
The synthesis query M allows T : ∃ E . M ( T , E ) ∃ M. ∀ T ∈ T + . ∃ E. M ( T , E ) Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . ∀ E. ¬ M ( T , E ) Forbidden litmus tests Handled by a quan`fied ˆ Memory model sketch M boolean formula (QBF) solver
The synthesis query M allows T : ∃ E . M ( T , E ) ∃ M. ∀ T ∈ T + . ∃ E. M ( T , E ) Allowed litmus tests Memory model M ∃ M. ∀ T ∈ T - . ∀ E. ¬ M ( T , E ) Forbidden litmus tests Handled by incremental Handled by a quan`fied ˆ Memory model sketch M synthesis engine boolean formula (QBF) solver
Incremental synthesis T 1 T T T T T T T T Synth Allowed litmus tests Forbidden litmus tests T 2 T T T T T T T T
Incremental synthesis T T T T T T T T T T T T T Synth Allowed litmus tests Forbidden litmus tests T 1 T 2 T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T T T T T T T Synth Allowed litmus tests Forbidden litmus tests T 1 T 2 T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T T T T T T T Synth Allowed litmus tests M’ Forbidden litmus tests T 1 T 2 T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T T T T T T T T Synth Allowed litmus tests M’ Forbidden litmus tests T 1 T 2 T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T Synth Allowed litmus tests M’ Forbidden litmus tests T 1 T 2 T T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T Synth Allowed litmus tests M’ Completed memory model M Forbidden litmus tests T 1 T 2 T T T T T T T T T
Incremental synthesis Handled by a quan`fied boolean formula (QBF) solver T T T T T T T Synth Allowed litmus tests M’ Completed memory model M Forbidden litmus tests T 1 T 2 T T T T T T T T T Empirically, need very few itera`ons to converge
Disambiguating synthesized models Key idea : aoer synthesis, is there a different memory model that also explains the input tests? Ambig
Disambiguating synthesized models Key idea : aoer synthesis, is there a different memory model that also explains the input tests? Allowed litmus tests Ambig Forbidden litmus tests ˆ Memory model sketch M
Disambiguating synthesized models Key idea : aoer synthesis, is there a different memory model that also explains the input tests? Allowed litmus tests Ambig Forbidden litmus tests Completed memory model M ˆ Memory model sketch M
Disambiguating synthesized models Key idea : aoer synthesis, is there a different memory model that also explains the input tests? Allowed litmus tests Completed memory model M 2 Ambig Forbidden litmus tests Litmus test T Completed memory model M ˆ Memory model sketch M
Disambiguating synthesized models Key idea : aoer synthesis, is there a different memory model that also explains the input tests? Allowed litmus tests Completed memory model M 2 Ambig Forbidden litmus tests Litmus test T Completed memory model M Difference between M and M 2 is not just ˆ Memory model sketch M syntac`c: they disagree about test T
Synthesizing existing memory models x86 PowerPC
Synthesizing existing memory models x86 10 tests PowerPC 768 tests [Alglave et al, CAV’10]
Synthesizing existing memory models Synthesis x86 10 tests ✓ 2 seconds PowerPC 768 tests ✓ 12 seconds [Alglave et al, CAV’10]
Synthesizing existing memory models Synthesis x86 10 tests ✓ 2 seconds Not equivalent to TSO! PowerPC 768 tests ✓ 12 seconds [Alglave et al, CAV’10]
Synthesizing existing memory models Synthesis x86 10 tests ✓ 2 seconds Not equivalent to TSO! PowerPC 768 tests ✓ 12 seconds [Alglave et al, CAV’10] Not equivalent to published model!
Synthesizing existing memory models Synthesis Ambiguity x86 10 tests ✓ 2 seconds 4 new tests mfence , xchg Not equivalent to TSO! PowerPC 768 tests ✓ 12 seconds 9 new tests [Alglave et al, CAV’10] sync , lwsync Not equivalent to published model!
⇒ MemSynth: automated programming for memory consistency models x86: 2 seconds PowerPC: 12 seconds Synthesize specifica`ons from litmus tests ∨ ∀ ⋈ ∃ ∈ ∩ ∧ ⊂ ∪ Detect ambigui`es in synthesized models Litmus tests Formal and prose specifica`ons x86: 4 ambigui`es PowerPC: 9 ambigui`es
Automated tools are worth building The case of memory models [PLDI’17] Building them can be made systematic Symbolic profiling [OOPSLA’18] The future is more automation Automating the automated programming stack
Automated tools are worth building The case of memory models [PLDI’17] Building them can be made systematic Symbolic profiling [OOPSLA’18] The future is more automation Automating the automated programming stack
Scaling a synthesis tool is hard work 12 seconds
Scaling a synthesis tool is hard work 12000 9000 Time (secs) 6000 3000 12 seconds 0 January February March April May June
Scaling a synthesis tool is hard work 12000 3 hours 9000 Time (secs) 6000 3000 12 seconds 0 January February March April May June
Scaling a synthesis tool is hard work 12000 3 hours Finding these op`miza`on opportuni`es is the key to good performance and new func`onality 9000 Time (secs) 6000 3000 12 seconds 0 January February March April May June
Symbolic profiling 12000 3 hours A symbolic profiler identifies optimization opportunities in an 9000 automated tool. Time (secs) 6000 3000 12 seconds 0 January February March April May June
Recommend
More recommend
