The Benefits of Duality in Verifying Concurrent Programs under TSO - PowerPoint PPT Presentation

Potentially Bad Behaviours - Dekker Initially: x = y = 0 P0 P1 write: x = 1 write: y = 1 mfence mfence read: y = 0 read: x = 0 critical section critical section P0 x = 1 y = 1 P1 TSO 46

Potentially Bad Behaviours - Dekker Initially: x = y = 0 P0 P1 write: x = 1 write: y = 1 mfence mfence read: y = 0 read: x = 0 critical section critical section P0 x = 1 y = 1 P1 TSO 47

Potentially Bad Behaviours - Dekker At most one process Initially: x = y = 0 P0 executes its CS P1 at any time write: x = 1 write: y = 1 mfence mfence read: y = 0 read: x = 0 critical section critical section P0 x = 1 y = 1 P1 TSO 48

Verification and Correction 49

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 50

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 51

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 52

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 53

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 54

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 55

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no no reordering program correct program incorrect = bug not due to memory model 56

Verification and Correction find reordering and prevent it specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no program correct program incorrect 57

Verification and Correction specification insert fences yes program yes reachability execution reachable? preventable? analysis analysis no no try again program correct program incorrect optimality = smallest set of fences 58 needed for correctness

Verification under TSO is Difficult while (1) write: x=1 P0: write: x = 1 x = 0 P0 P0: write: x = 1 y = 0 … P0: write: x = 1 … 59

Verification under TSO is Difficult while (1) write: x=1 P0: write: x = 1 x = 0 P0 x=1 P0: write: x = 1 y = 0 … P0: write: x = 1 … 60

Verification under TSO is Difficult while (1) write: x=1 P0: write: x = 1 x = 0 P0 x=1 x=1 P0: write: x = 1 y = 0 … P0: write: x = 1 … 61

Verification under TSO is Difficult while (1) write: x=1 P0: write: x = 1 x = 0 … P0 x=1 x=1 x=1 P0: write: x = 1 y = 0 … P0: write: x = 1 … unbounded infinite state buffer space 62

Verification under TSO is Difficult Existing Methods • Under approximation 😟 miss bugs: under-fencing • Over approximation 😟 spurious bugs: over-fencing • Exact verification techniques 😁 find real bugs iff they exist: optimal fencing 63

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering • Monotonic transition system WQO for TSO • Sub-word ordering on store buffers: • monotone? y=1 y=2 x=1 read: y = 2 not possible ⊑ read: y = 2 y=2 x=1 possible 64

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering Monotonicity • Monotonic transition system s 1 s 2 ⊑ WQO for TSO s 3 s 4 • Sub-word ordering on store buffers: • monotone? x = 0 y=1 P0 x=1 y = 0 ⊑ x = 0 P0 x=1 y = 0 65

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering • Monotonic transition system WQO for TSO • Sub-word ordering on store buffers: • monotone? x = 0 y=1 P0 x=1 y = 0 ⊑ x=1 x = 0 P0 y = 0 66

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering • Monotonic transition system WQO for TSO • Sub-word ordering on store buffers: • monotone? x = 0 y=1 P0 x=1 y = 0 ⊑ x = 1 P0 y = 0 67

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering • Monotonic transition system WQO for TSO • Sub-word ordering on store buffers: • monotone? NO! x = 0 y=1 P0 x=1 y = 0 ⊑ x = 1 P0 y = 0 68

Exact Verification Techniques Well-Quasi Ordering (WQO) Framework • ordering on state space: • Well-quasi ordering • Monotonic transition system WQO for TSO • Sub-word ordering on store buffers? • Not monotone! • WQO cannot be applied easily to TSO 69

Semantics 2: Single Buffer Model [TACAS’12+13] P1: P1: view pending memory pointer update content P1 P0: write: x = 2 P0 x=1 x=0 P1: write: y = 3 y=1 y=1 P1 … x,P0 y,P1 writing memory written process snapshot variable 70

Semantics 2: Single Buffer Model [TACAS’12+13] P0: P0: view memory no pending pointer content update P0 P1 P0: write: x = 2 P0 x=1 x=0 P1: write: y = 3 y=1 y=1 P1 … x,P1 y,P0 writing memory written process snapshot variable 71

Semantics 2: Single Buffer Model [TACAS’12+13] P0 P1 P0: write: x = 2 P0 x=1 x=0 P1: write: y = 3 y=1 y=1 P1 … x,P1 y,P0 72

Semantics 2: Single Buffer Model [TACAS’12+13] P0 P1 P0: write: x = 2 P0 x=2 x=1 x=0 P1: write: y = 3 y=1 y=1 y=1 P1 … x,P0 x,P1 y,P0 73

Semantics 2: Single Buffer Model [TACAS’12+13] P0 P1 P0: write: x = 2 P0 x=2 x=2 x=1 x=0 P1: write: y = 3 y=3 y=1 y=1 y=1 P1 … y,P1 x,P0 x,P1 y,P0 74

Semantics 2: Single Buffer Model [TACAS’12+13] update view of P0 P0 P1 P0: write: x = 2 P0 x=2 x=2 x=1 x=0 P1: write: y = 3 y=3 y=1 y=1 y=1 P1 … y,P1 x,P0 x,P1 y,P0 75

Semantics 2: Single Buffer Model [TACAS’12+13] P0 P1 P0: write: x = 2 P0 x=1 x=2 x=1 x=0 P1: write: y = 3 y=3 y=1 y=1 y=1 P1 … y,P1 x,P0 x,P1 y,P0 equivalent to classical TSO modulo reachability Sub-word relation on the content of the single buffer is a monotonic WQO 76

Semantics 2: Single Buffer Model [TACAS’12+13] memory costly snapshot overhead cannot be directly viewing ID of writing applied to parameterized pointer process verification 77

Parameterized Verification unbounded number of processes P P P P P P correctness: P lock taken by at most P one process P P P P P example: mutual exclusion protocols 78

Semantics 3: Dual-TSO • Store buffers are replaced by load buffers • Equivalent to classical TSO Exact Verification Technique • Efficient analysis technique based on WQO • Applicable to parameterized verification 79

Semantics 3: Dual-TSO load self buffer message Store Buffers ☛ Load Buffers P0 • Write operations immediately x,1,self x = 1 update the memory y = 0 P1 x,1,other • Load buffers contain expected read operations other message 80

Semantics 3: Dual-TSO P0 x = 0 P0: write: x = 1 y = 0 P0: read: y = 0 P1 81

Semantics 3: Dual-TSO adds self writes to message the memory P0 x,1,self x = 1 P0: write: x = 1 y = 0 P0: read: y = 0 P1 82

Semantics 3: Dual-TSO propagates from the memory P0 x,1,self x = 1 P0: write: x = 1 y = 0 P0: read: y = 0 P1 x,1,other 83

Semantics 3: Dual-TSO propagates from the memory P0 x,1,self y,0,other x = 1 P0: write: x = 1 y = 0 P0: read: y = 0 P1 x,1,other 84

Semantics 3: Dual-TSO deletes the oldest message P0 x,1,self y,0,other x = 1 P0: write: x = 1 y = 0 P0: read: y = 0 P1 x,1,other 85

Semantics 3: Dual-TSO reads the oldest message P0 y,0,other x = 1 P0: write: x = 1 y = 0 P0: read: y = 0 P1 x,1,other 86

Semantics 3: Dual-TSO Theorem The Dual-TSO semantics is equivalent to the TSO semantics with respect to the reachability problem. 87

Outline • Classical TSO semantics • New semantics (Dual-TSO) allows: - Efficient verification - Parameterised verification • Verification under Dual-TSO • Experimental Results • Conclusions 88

WQO under Dual-TSO partition of load buffer x,2,self y,1,self x,1,other y,0,self x,0,other newest self newest self Old New message on x message on y 89

WQO under Dual-TSO Extension of sub-word ordering x,2,self y,1,self x,1,other y,0,self x,0,other = = x,2,self y,0,self x,0,other y,1,self 90

WQO under Dual-TSO Extension of sub-word ordering x,2,self y,1,self x,1,other y,0,self x,0,other ⊑ ⊑ = = x,2,self y,0,self x,0,other y,1,self 91

WQO under Dual-TSO P0 P1 WQO for Dual-TSO … … … … • Same local states of processes • Same shared memory P0 x,1,self x = 1 • Sub-word relation on load buffers y = 0 P1 x,1,other 92

WQO under Dual-TSO P0 P1 WQO for Dual-TSO … … … … • Same local states of processes • Same shared memory P0 x,1,self x = 1 • Sub-word relation on load buffers y = 0 P1 x,1,other 93

WQO under Dual-TSO P0 P1 WQO for Dual-TSO … … … … • Same local states of processes • Same shared memory P0 x,1,self x = 1 • Sub-word relation on load buffers y = 0 P1 x,1,other 94

Dual-TSO vs Single Buffer Dual-TSO Single Buffer efficient NO memory snapshot Need memory snapshot No viewing pointer, ID of Need viewing pointers, IDs of processes process Several channels: one Only one channel channel per process Buffers have read Buffers have write operations operations can be applied to parameterised verification

Outline • Classical TSO semantics • New semantics (Dual-TSO) allows: - Efficient verification - Parameterised verification • Verification under Dual-TSO • Experimental Results • Conclusions 96

Experimental Results Single buffer approach (exact method [TACAS12+13]) Dual-TSO vs Memorax • Running time • Memory consumption 97 https://www.it.uu.se/katalog/tuang296/dual-tso

Experimental Results Dual-TSO vs Memorax • Running time • Memory consumption standard benchmarks: litmus tests and mutual algorithms 98

running time Experimental Results in seconds Dual-TSO vs Memorax • Running time • Memory consumption 99

generated Experimental Results configurations Dual-TSO vs Memorax • Running time • Memory consumption Dual-TSO is faster and uses less memory in most of examples 100