Proof Spaces for Unbounded Parallelism Zachary Kincaid University - PowerPoint PPT Presentation

Proof Spaces for Unbounded Parallelism Zachary Kincaid University of Toronto January 16, 2015 Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg

• Single template T executed by every thread • Goal: prove that a given program is free of (certain types of) errors. Multi-threaded program verification T Property Yes No Verifier Program N times T T T T N Diverge • Unbounded/unknown number of threads • E.g., webservers, computations parallelized over N processors, ...

• Goal: prove that a given program is free of (certain types of) errors. Multi-threaded program verification T Property Yes No Verifier Program N times Diverge • Unbounded/unknown number of threads • E.g., webservers, computations parallelized over N processors, ... • Single template T executed by every thread T N = T ∥ T ∥· · · ∥ T � �� �

Multi-threaded program verification Program T Property Yes No Verifier N times Diverge • Unbounded/unknown number of threads • E.g., webservers, computations parallelized over N processors, ... • Single template T executed by every thread T N = T ∥ T ∥· · · ∥ T � �� � • Goal: prove that a given program is free of (certain types of) errors.

Multi-threaded program verification Program T Property Yes No Verifier N times Diverge • Unbounded/unknown number of threads • E.g., webservers, computations parallelized over N processors, ... • Single template T executed by every thread T N = T ∥ T ∥· · · ∥ T � �� � • Goal: prove that a given program is free of (certain types of) errors.

global t : int // ticket counter global s : int // service counter local m : int // my ticket m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter init s ≤ t

Proving correctness of a trace of a multi-threaded program is easy. • Re-use sequential verification! Proving correctness of a multi-threaded program is hard. Program is correct each of its traces are correct. ∀ i , j ∈ Thread . pc ( i ) ̸ = init ∧ pc ( j ) ̸ = init ∧ m ( i ) = m ( j ) ⇒ i = j

Proving correctness of a multi-threaded program is hard. Program is correct each of its traces are correct. ∀ i , j ∈ Thread . pc ( i ) ̸ = init ∧ pc ( j ) ̸ = init ∧ m ( i ) = m ( j ) ⇒ i = j Proving correctness of a trace of a multi-threaded program is easy. • Re-use sequential verification!

Proving correctness of a multi-threaded program is hard. ∀ i , j ∈ Thread . pc ( i ) ̸ = init ∧ pc ( j ) ̸ = init ∧ m ( i ) = m ( j ) ⇒ i = j Proving correctness of a trace of a multi-threaded program is easy. • Re-use sequential verification! Program is correct ⇐ ⇒ each of its traces are correct.

Proof Spaces

init m := t++ by construction or approximation of fixpoints. POPL’77. P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 // bump service counter s++ // critical section } until (m <= s) // busy wait do { // acquire ticket // my ticket wait local m : int // service counter global s : int // ticket counter global t : int s++ [m > s] [m <= s] m := t++ exit crit P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15. init s ≤ t

init m := t++ by construction or approximation of fixpoints. POPL’77. P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 // bump service counter s++ // critical section } until (m <= s) // busy wait do { // acquire ticket // my ticket wait local m : int // service counter global s : int // ticket counter global t : int s++ [m > s] [m <= s] m := t++ exit crit P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15. init s ≤ t

init [m <= s] : 1 by construction or approximation of fixpoints. POPL’77. P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 Thread IDs Commands [m <= s] : 2 m := t++ : 2 wait m := t++ : 1 s++ [m > s] [m <= s] m := t++ exit crit P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15. Error trace ∈ (Σ × N ) ∗

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

init m by construction or approximation of fixpoints. POPL’77. P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 ... Dual narrowing, Abstract post, Craig interpolation, Intermediate assertions [m <= s] : 2 m m m s [m <= s] : 1 m wait m crit exit m := t++ [m <= s] [m > s] s++ m := t++ : 1 s m m t m := t++ : 2 s P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15. { s ≤ t } { false }

init m := t++ : 1 by construction or approximation of fixpoints. POPL’77. ... Intermediate assertions [m <= s] : 2 wait m := t++ : 2 [m <= s] : 1 m := t++ [m <= s] s++ crit [m > s] exit { s ≤ t } { s ≤ m (1) ∧ m (1) < t } Craig interpolation, 1 { s ≤ m (1) ∧ m (1) < m (2) } Abstract post, 2 Dual narrowing, 3 { s ≤ m (1) ∧ m (1) < m (2) } { false } 1 T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 2 P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs 3 P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.

“Small theorems” from sequential verifiers m := t++ : 1 m := t++ : 1 m := t++ : 2 [m <= s] : 2 s++ : 1 { s ≤ t } { s ≤ m (1) } { s ≤ m (1) ∧ m (1) < m (2) } { true } { false } { m (1) < t } { s ≤ m (1) ∧ m (1) < m (2) } { m (1) < t } { s ≤ m (2) } { m (1) < m (2) }

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

Sequencing m := t++ : 1 m := t++ : 2 s t m := t++ : 1; m := t++ : 2 m m { s ≤ t } { m (1) < t } { m (1) < t } { m (1) < m (2) }

Sequencing m := t++ : 1 m := t++ : 2 m := t++ : 1; m := t++ : 2 { s ≤ t } { s ≤ t } { m (1) < t } { m (1) < t } { m (1) < m (2) } { m (1) < m (2) }

Symmetry N times [m <= s] : 2 T N = T ∥ T ∥· · · ∥ T � �� � { s ≤ m (1) ∧ m (1) < m (2) } { false }

Symmetry N times [m <= s] : 2 [m <= s] : 1 T N = T ∥ T ∥· · · ∥ T � �� � { s ≤ m (1) ∧ m (1) < m (2) } { s ≤ m (2) ∧ m (2) < m (1) } [1 �→ 2] [2 �→ 1] { false } { false }

Symmetry N times [m <= s] : 2 [m <= s] : 3 T N = T ∥ T ∥· · · ∥ T � �� � { s ≤ m (1) ∧ m (1) < m (2) } { s ≤ m (2) ∧ m (2) < m (3) } [1 �→ 2] [2 �→ 3] { false } { false }

Conjunction m := t++ : 3 m := t++ : 3 m t m t m := t++ : 3 m m m m { m (1) < t } { m (2) < t } { m (1) < m (3) } { m (2) < m (3) }

Conjunction m := t++ : 3 m := t++ : 3 m := t++ : 3 { m (1) < t } { m (2) < t } { m (1) < m (3) } { m (2) < m (3) } { m (1) < t ∧ m (2) < t } { m (1) < m (3) ∧ m (2) < m (3) }