29 research outputs found
Safety Verification of Parameterized Systems under Release-Acquire
We study the safety verification problem for parameterized systems under the
release-acquire (RA) semantics. It has been shown that the problem is
intractable for systems with unlimited access to atomic compare-and-swap (CAS)
instructions. We show that, from a verification perspective where approximate
results help, this is overly pessimistic. We study parameterized systems
consisting of an unbounded number of environment threads executing identical
but CAS-free programs and a fixed number of distinguished threads that are
unrestricted.
Our first contribution is a new semantics that considerably simplifies RA but
is still equivalent for the above systems as far as safety verification is
concerned. We apply this (general) result to two subclasses of our model. We
show that safety verification is only \pspace-complete for the bounded model
checking problem where the distinguished threads are loop-free. Interestingly,
we can still afford the unbounded environment. We show that the complexity
jumps to \nexp-complete for thread-modular verification where an unrestricted
distinguished `ego' thread interacts with an environment of CAS-free threads
plus loop-free distinguished threads (as in the earlier setting). Besides the
usefulness for verification, the results are strong in that they delineate the
tractability border for an established semantics
Overcoming Memory Weakness with Unified Fairness
We consider the verification of liveness properties for concurrent programs
running on weak memory models. To that end, we identify notions of fairness
that preclude demonic non-determinism, are motivated by practical observations,
and are amenable to algorithmic techniques. We provide both logical and
stochastic definitions of our fairness notions and prove that they are
equivalent in the context of liveness verification. In particular, we show that
our fairness allows us to reduce the liveness problem (repeated control state
reachability) to the problem of simple control state reachability. We show that
this is a general phenomenon by developing a uniform framework which serves as
the formal foundation of our fairness definition and can be instantiated to a
wide landscape of memory models. These models include SC, TSO, PSO,
(Strong/Weak) Release-Acquire, Strong Coherence, FIFO-consistency, and RMO.Comment: 32 pages. To appear in Proc. 35th International Conference on
Computer Aided Verification (CAV) 202
The Decidability of Verification under Promising 2.0
In PLDI'20, Lee et al. introduced the \emph{promising } semantics PS 2.0 of
the C++ concurrency that captures most of the common program transformations
while satisfying the DRF guarantee. The reachability problem for finite-state
programs under PS 2.0 with only release-acquire accesses is already known to be
undecidable. Therefore, we address, in this paper, the reachability problem for
programs running under PS 2.0 with relaxed accesses together with promises. We
show that this problem is undecidable even in the case where the input program
has finite state. Given this undecidability result, we consider the fragment of
PS 2.0 with only relaxed accesses allowing bounded number of promises. We show
that under this restriction, the reachability is decidable, albeit very
expensive: it is non-primitive recursive. Given this high complexity with
bounded number of promises and the undecidability result for the RA fragment of
PS 2.0, we consider a bounded version of the reachability problem. To this end,
we bound both the number of promises and the "view-switches", i.e, the number
of times the processes may switch their local views of the global memory. We
provide a code-to-code translation from an input program under PS 2.0, with
relaxed and release-acquire memory accesses along with promises, to a program
under SC. This leads to a reduction of the bounded reachability problem under
PS 2.0 to the bounded context-switching problem under SC. We have implemented a
prototype tool and tested it on a set of benchmarks, demonstrating that many
bugs in programs can be found using a small bound
UCLID5: Multi-Modal Formal Modeling, Verification, and Synthesis
UCLID5 is a tool for the multi-modal formal modeling, verification,and synthesis of systems. It enables one to tackle verification problems for heterogeneous systems such as combinations of hardware and software, or those that have multiple, varied specifications, or systems that require hybrid modes of modeling. A novel aspect of UCLID5 is an emphasis on the use of syntax-guided and inductive synthesis to automate steps in modeling and verification. This toolpaper presents new developments in the UCLID5 tool including new language features, integration with new techniques for syntax-guided synthesis and satisfiability solving, support for hyperproperties and combinations of axiomatic and operational modeling, demonstrations on new problem classes, and a more robust implementation
Recommended from our members
PipeSynth: Automated Synthesis of Microarchitectural Axioms for Memory Consistency
Formal verification can help ensure the correctness of today's processors. However, such formal verification requires formal specifications of the processors being verified. Today, these specifications are mostly written by hand, which is tedious and error-prone. Furthermore, architects and hardware engineers generally do not have formal methods experience, making it even harder for them to write formal specifications. Existing methods for the automated synthesis of formal microarchitectural specifications utilise RTL implementations of processors for their synthesis, preventing their usage until RTL implementation of the processor has completed. This hampers the effectiveness of formal verification for processors, as catching design bugs pre-RTL can reduce verification overhead and overall development time. In response, we present PipeSynth, an automated formal methodology and tool for the synthesis of ÎŒspec microarchitectural ordering axioms from small example programs (litmus tests) and microarchitectural execution traces. PipeSynth helps architects automatically generate formal specifications for their microarchitectures before RTL is even written, enabling greater use of formal verification on today's microarchitectures. We evaluate PipeSynth's capability to synthesise single axioms and multiple axioms at the same time across four microarchitectures. Our evaluated microarchitectures include an out-of-order processor and one with a non-traditional coherence protocol. In single-axiom synthesis, PipeSynth is capable of synthesising replacement axioms for 42 out of 46 axioms from our evaluated microarchitectures in under 2 hours per axiom. When doing multi-axiom synthesis, we are able to synthesise an entire microarchitectural specification for the in-order Multi-V-scale processor in under 1 hour, and can synthesise at least 4 nontrivial axioms at the same time for our other microarchitectures
Controlling a population
International audienceWe introduce a new setting where a population of agents, each modelled by a finite-state system, are controlled uniformly: the controller applies the same action to every agent. The framework is largely inspired by the control of a biological system, namely a population of yeasts, where the controller may only change the environment common to all cells. We study a synchronisation problem for such populations: no matter how individual agents react to the actions of the controller, the controller aims at driving all agents synchronously to a target state. The agents are naturally represented by anon-deterministic finite state automaton (NFA), the same for every agent, and the whole system is encoded as a 2-player game. The first player (Controller) chooses actions, and the second player (Agents) resolves non-determinism for each agent. The game with m agents is called the m-population game. This gives rise to a parameterized control problem (where control refers to 2 player games), namely the population control problem: can Controller control the m-population game for all m â N whatever Agents does? In this paper, we prove that the population control problem is decidable, and it is a EXPTIME-complete problem. As far as we know, this is one of the first results on the control of parameterized systems. Our algorithm, which is not based on cut-off techniques, produces winning strategies which are symbolic, that is, they do not need to count preciselyhow the population is spread between states. The winning strategies produced by our algorithm are optimal with respect to the synchronisation time: the maximal number of steps before synchronisation of all agents in the target state is at most polynomial in the number of agents m, and exponential in the size of the NFA. We also show that if there is no winning strategy, then there is a population size M such that Controller wins them-population game if and only if m †M. Surprisingly, M can be doubly exponential in the number of states of the NFA, with tight upper and lower bounds
Controlling a population
We introduce a new setting where a population of agents, each modelled by a
finite-state system, are controlled uniformly: the controller applies the same
action to every agent. The framework is largely inspired by the control of a
biological system, namely a population of yeasts, where the controller may only
change the environment common to all cells. We study a synchronisation problem
for such populations: no matter how individual agents react to the actions of
the controller, the controller aims at driving all agents synchronously to a
target state. The agents are naturally represented by a non-deterministic
finite state automaton (NFA), the same for every agent, and the whole system is
encoded as a 2-player game. The first player (Controller) chooses actions, and
the second player (Agents) resolves non-determinism for each agent. The game
with m agents is called the m -population game. This gives rise to a
parameterized control problem (where control refers to 2 player games), namely
the population control problem: can Controller control the m-population game
for all m in N whatever Agents does
Probabilistic Total Store Ordering
We present Probabilistic Total Store Ordering (PTSO) - a probabilistic extension of the classical TSO semantics. For a given (finite-state) program, the operational semantics of PTSO induces an infinite-state Markov chain. We resolve the inherent non-determinism due to process schedulings and memory updates according to given probability distributions. We provide a comprehensive set of results showing the decidability of several properties for PTSO, namely (i) Almost-Sure (Repeated) Reachability: whether a run, starting from a given initial configuration, almost surely visits (resp. almost surely repeatedly visits) a given set of target configurations. (ii) Almost-Never (Repeated) Reachability: whether a run from the initial configuration, almost never visits (resp. almost never repeatedly visits) the target. (iii) Approximate Quantitative (Repeated) Reachability: to approximate, up to an arbitrary degree of precision, the measure of runs that start from the initial configuration and (repeatedly) visit the target. (iv) Expected Average Cost: to approximate, up to an arbitrary degree of precision, the expected average cost of a run from the initial configuration to the target. We derive our results through a nontrivial combination of results from the classical theory of (infinite-state) Markov chains, the theories of decisive and eager Markov chains, specific techniques from combinatorics, as well as, decidability and complexity results for the classical (non-probabilistic) TSO semantics. As far as we know, this is the first work that considers probabilistic verification of programs running on weak memory models