Sebastian Burckhardt
ABSTRACT
Concurrency libraries can facilitate the development of multi-threaded programs by providing concurrent implementations of familiar data types such as queues or sets. There exist many optimized algorithms that can achieve superior performance on multiprocessors by allowing concurrent data accesses without using locks. Unfortunately, such algorithms can harbor subtle concurrency bugs. Moreover, they requirememory ordering fences to function correctly on relaxed memory models.
To address these difficulties, we propose a verification approach that can exhaustively check all concurrent executions of a given test program on a relaxed memory model and can verify that they are observationally equivalent to a sequential execution. Our CheckFence prototype automatically translates the C implementation code and the test program into a SAT formula, hands the latter to a standard SAT solver, and constructs counter example traces if there exist incorrect executions. Applying CheckFence to five previously published algorithms, we were able to (1) find several bugs (some not previously known), and (2) determine how to place memory ordering fences for relaxed memory models.
References
- M. Abadi, C. Flanagan, and S. Freund. Types for safe locking: Static race detection for Java. ACM Trans. Program. Lang. Syst., 28(2):207--255, 2006. Google Scholar
- S. Adve and K. Gharachorloo. Shared memory consistency models: a tutorial. Computer, 29(12):66--76, 1996. Google Scholar
- H.-J. Boehm. Threads cannot be implemented as a library. In Programming Language Design and Implementation (PLDI), pages 261--268, 2005. Google Scholar
- S. Burckhardt, R. Alur, and M. Martin. Bounded verification of concurrent data types on relaxed memory models: a case study. In Computer-Aided Verification (CAV), LNCS 4144, pages 489--502. Springer, 2006. Google Scholar
- E. Clarke, D. Kroening, and F. Lerda. A tool for checking ANSI-C programs. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS), LNCS 2988, pages 168--176. Springer, 2004.Google Scholar
- R. Colvin, L. Groves, V. Luchangco, and M. Moir. Formal verification of a lazy concurrent list-based set algorithm. In Computer--Aided Verification (CAV), LNCS 4144, pages 475--488. Springer, 2006. Google Scholar
- Compaq Computer Corporation. Alpha Architecture Reference Manual, 4th edition, January 2002.Google Scholar
- D. Detlefs, C. Flood, A. Garthwaite, P. Martin, N. Shavit, and G. Steele. Even better DCAS-based concurrent deques. In Conference on Distributed Computing (DISC), LNCS 1914, pages 59--73. Springer, 2000. Google Scholar
- D. Dill, S. Park, and A. Nowatzyk. Formal specification of abstract memory models. In Symposium on Research on Integrated Systems, pages 38--52. MIT Press, 1993. Google Scholar
- S. Doherty, D. Detlefs, L. Grove, C. Flood, V. Luchangco, P. Martin, M. Moir, N. Shavit, and G. Steele. DCAS is not a silver bullet for nonblocking algorithm design. In Symposium on Parallel Algorithms and Architectures (SPAA), pages 216--224, 2004. Google Scholar
- X. Fang, J. Lee, and S. Midkiff. Automatic fence insertion for shared memory multiprocessing. In International Conference on Supercomputing (ICS), pages 285--294, 2003. Google Scholar
- C. Flanagan and S. Freund. Type-based race detection for Java. In Programming Language Design and Implementation (PLDI), pages 219--232, 2000. Google Scholar
- B. Frey. PowerPC Architecture Book v2.02. International Business Machines Corporation, 2005.Google Scholar
- H. Gao and W. Hesslink. A formal reduction for lock-free parallel algorithms. In Computer--Aided Verification (CAV), LNCS 3114, pages 44--56. Springer, 2004.Google Scholar
- G. Gopalakrishnan, Y. Yang, and H. Sivaraj. QB or not QB: An efficient execution verification tool for memory orderings. In Computer-Aided Verification (CAV), LNCS 3114, pages 401--413, 2004.Google Scholar
- T. Harris. A pragmatic implementation of non-blocking linked-lists. In Conference on Distributed Computing (DISC), LNCS 2180, pages 300--314. Springer, 2001. Google Scholar
- T. Harris, K. Fraser, and I. Pratt. A practical multi-word compare-and swap operation. In Conference on Distributed Computing (DISC), LNCS 2508, pages 265--279. Springer, 2002. Google Scholar
- S. Heller, M. Herlihy, V. Luchangco, M. Moir, W. Scherer, and N. Shavit. A lazy concurrent list-based set algorithm. In Principles of Distributed Systems (OPODIS), 2005. Google Scholar
- T. Henzinger, R. Jhala, and R. Majumdar. Race checking by context inference. In Programming language design and implementation (PLDI), pages 1--13, 2004. Google Scholar
- Intel Corporation. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A, November 2006.Google Scholar
- Intel Corporation. Intel Itanium Architecture Software Developer's Manual, Book 2, rev. 2.2, January 2006.Google Scholar
- Intel Corporation. Intel Threading Building Blocks, September 2006.Google Scholar
- International Business Machines Corporation. Architecture Principles of Operation, first edition, December 2000.Google Scholar
- B. Jacobs, J. Smans, F. Piessens, and W. Schulte. A simple sequential reasoning approach for sound modular verification of mainstream multithreaded programs. In TV'06 Workshop, Federated Logic Conference (FLoC), pages 66--77, 2006.Google Scholar
- L. Lamport. How to make a multiprocessor computer that correctly executes multiprocess programs. IEEE Trans. Comp., C-28(9):690--691, 1979.Google Scholar
- L. Lamport. Checking a multithreaded algorithm with +CAL. In Conference on Distributed Computing (DISC), LNCS 4167, pages 151--163. Springer, 2006. Google Scholar
- D. Lea. The java.util.concurrent synchronizer framework. In PODC Workshop on Concurrency and Synchronization in Java Programs (CSJP), 2004.Google Scholar
- V. Luchangco. Personal communications, October 2006.Google Scholar
- J. Manson, W. Pugh, and S. Adve. The Java memory model. In Principles of Programming Languages (POPL), pages 378--391, 2005. Google Scholar
- M. Martin, D. Sorin, H. Cain, M. Hill, and M. Lipasti. Correctly implementing value prediction in microprocessors that support multithreading or multiprocessing. In International Symposium on Microarchitecture (MICRO), pages 328--337, 2001. Google Scholar
- M. Michael. Scalable lock-free dynamic memory allocation. In Programming Language Design and Implementation (PLDI), pages 35--46, 2004. Google Scholar
- M. Michael and M. Scott. Correction of a memory management method for lock-free data structures. Technical Report TR599, University of Rochester, 1995. Google Scholar
- M. Michael and M. Scott. Simple, fast, and practical non-blocking and blocking concurrent queue algorithms. In Principles of Distributed Computing (PODC), pages 267--275, 1996. Google Scholar
- M. Moir. Practical implementations of non-blocking synchronization primitives. In Principles of distributed computing (PODC), pages 219--228, 1997. Google Scholar
- M. Moskewicz, C. Madigan, Y. Zhao, L. Zhang, and S. Malik. Chaff: Engineering an efficient SAT solver. In Design Automation Conference (DAC), pages 530--535, 2001. Google Scholar
- M. Naik, A. Aiken, and J. Whaley. Effective static race detection for Java. In Programming Language Design and Implementation (PLDI), pages 308--319, 2006. Google Scholar
- G. Necula, S. McPeak, S. Rahul, and W. Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In Conf. on Compiler Constr. (CC), 2002. Google Scholar
- S. Park and D. Dill. An executable specification, analyzer and verifier for RMO. In Symposium on Parallel Algorithms and Architectures (SPAA), pages 34--41, 1995. Google Scholar
- P. Pratikakis, J. Foster, and M. Hicks. LOCKSMITH: contextsensitive correlation analysis for race detection. In Programming Language Design and Implementation (PLDI), pages 320--331, 2006. Google Scholar
- I. Rabinovitz and O. Grumberg. Bounded model checking of concurrent programs. In Computer-Aided Verification (CAV), LNCS 3576, pages 82--97. Springer, 2005. Google Scholar
- S. Savage, M. Burrows, G. Nelson, P. Sobalvarro, and T. Anderson. Eraser: A dynamic data race detector for multithreaded programs. ACM Trans. Comp. Sys., 15(4):391--411, 1997. Google Scholar
- D. Shasha and M. Snir. Efficient and correct execution of parallel programs that share memory. ACM Trans. Program. Lang. Syst., 10(2):282--312, 1988. Google Scholar
- H. Sundell and P. Tsigas. Fast and lock-free concurrent priority queues for multi-thread systems. J. Parallel Distrib. Comput., 65(5):609--627, 2005. Google Scholar
- H. Sutter and J. Larus. Software and the concurrency revolution. ACM Queue, 3(7):54--62, 2005. Google ScholarDigital Library
- O. Trachsel, C. von Praun, and T. Gross. On the effectiveness of speculative and selective memory fences. In International Parallel and Distributed Processing Symposium (IPDPS), 2006. Google Scholar
- V. Vafeiadis, M. Herlihy, T. Hoare, and M. Shapiro. Proving correctness of highly-concurrent linearisable objects. In Principles and Practice of Parallel Programming (PPoPP), pages 129--136, 2006. Google Scholar
- C. von Praun, T. Cain, J. Choi, and K. Ryu. Conditional memory ordering. In International Symposium on Computer Architecture (ISCA), 2006. Google Scholar
- D. Weaver and T. Germond, editors. The SPARC Architecture Manual Version 9. PTR Prentice Hall, 1994. Google Scholar
- M. Xu, R. Bodik, and M. Hill. A serializability violation detector for shared-memory server programs. In Programming Language Design and Implementation (PLDI), 2005. Google Scholar
- E. Yahav and M. Sagiv. Automatically verifying concurrent queue algorithms. Electr. Notes Theor. Comput. Sci., 89(3), 2003.Google Scholar
- Y. Yang, G. Gopalakrishnan, G. Lindstrom, and K. Slind. Nemos: A framework for axiomatic and executable specifications of memory consistency models. In International Parallel and Distributed Processing Symposium (IPDPS), 2004.Google Scholar
Index Terms
CheckFence: checking consistency of concurrent data types on relaxed memory models
Comments