A Verification Framework for Assembly Programs Under Relaxed Memory Model Using SMT Solver

In multiprocessors, memory models are introduced to describe the executions of programs among processors. Relaxed memory models, which relax the order of executions, are used in the most of the modern processors, such as ARM and POWER. Due to a relaxed memory model could change the program semantics, the executions of the programs might not be the same as our expectation that should preserve the program correctness. In addition to relaxed memory models, the way to execute an instruction is described by an instruction semantics, which varies among processor architectures. Dealing with instruction semantics among a variety of assembly programs is a challenge for program verification. Thus, this paper proposes a way to verify a variety of assembly programs that are executed under a relaxed memory model. The variety of assembly programs can be abstracted as the way to execute the programs by introducing an operation structure. Besides, there are existing frameworks for modeling relaxed memory models, which can realize program executions to be verified with a program property. Our work adopts an SMT solver to automatically reveal the program executions under a memory model and verify whether the executions violate the program property or not. If there is any execution from the solver, the program correctness is not preserved under the relaxed memory model. To verify programs, an experimental tool was developed to encode the given programs for a memory model into a first-order formula that violates the program correctness. The tool adopts a modeling framework to encode the programs into a formula for the SMT solver. The solver then automatically finds a valuation that satisfies the formula. In our experiments, two encoding methods were implemented based on two modeling frameworks. The valuations resulted by the solver can be considered as the bugs occurring in the original programs. key words: relaxed memory model, model checking, SMT solver, program verification, formalization

[1]  David L. Weaver,et al.  The SPARC Architecture Manual , 2003 .

[2]  Flemming Nielson,et al.  Semantics with Applications: An Appetizer , 2007, Undergraduate Topics in Computer Science.

[3]  Alessandro Armando,et al.  Bounded Model Checking of Software Using SMT Solvers Instead of SAT Solvers , 2006, SPIN.

[4]  Peter Sewell,et al.  A Better x86 Memory Model: x86-TSO , 2009, TPHOLs.

[5]  Ori Lahav,et al.  Owicki-Gries Reasoning for Weak Memory Models , 2015, ICALP.

[6]  Patrick Cousot,et al.  Ogre and Pythia: an invariance proof method for weak consistency models , 2017, POPL.

[7]  Daniel Kroening,et al.  Automatic analysis of DMA races using model checking and k-induction , 2011, Formal Methods Syst. Des..

[8]  Cesare Tinelli,et al.  Satisfiability Modulo Theories , 2021, Handbook of Satisfiability.

[9]  Toshiaki Aoki,et al.  Assembly program verification for multiprocessors with relaxed memory model using SMT solver , 2017, 2017 International Symposium on Theoretical Aspects of Software Engineering (TASE).

[10]  Parosh Aziz Abdulla,et al.  Stateless Model Checking for POWER , 2016, CAV.

[11]  Parosh Aziz Abdulla,et al.  Stateless Model Checking for TSO and PSO , 2015, TACAS.

[12]  Rajeev Alur,et al.  An Axiomatic Memory Model for POWER Multiprocessors , 2012, CAV.

[13]  K. Gharachodoo,et al.  Memory consistency models for shared memory multiprocessors , 1996 .

[14]  Tom Ridge,et al.  A Rely-Guarantee Proof System for x86-TSO , 2010, VSTTE.

[15]  Leslie Lamport,et al.  How to Make a Correct Multiprocess Program Execute Correctly on a Multiprocessor , 1997, IEEE Trans. Computers.

[16]  Sebastian Burckhardt,et al.  CheckFence: checking consistency of concurrent data types on relaxed memory models , 2007, PLDI '07.

[17]  Patrick Cousot,et al.  Syntax and analytic semantics of LISA , 2016, ArXiv.

[18]  Jade Alglave,et al.  Synchronising C/C++ and POWER , 2012, PLDI '12.

[19]  Robert W. Floyd,et al.  Assigning Meanings to Programs , 1993 .

[20]  Daniel Kroening,et al.  Partial Orders for Efficient Bounded Model Checking of Concurrent Software , 2013, CAV.

[21]  Daniel Kroening,et al.  Automatic Analysis of Scratch-Pad Memory Code for Heterogeneous Multicore Processors , 2010, TACAS.

[22]  Jeff Huang,et al.  Maximal causality reduction for TSO and PSO , 2016, OOPSLA.

[23]  Toshiyuki Maeda,et al.  Observation-Based Concurrent Program Logic for Relaxed Memory Consistency Models , 2016, APLAS.

[24]  Daniel Kroening,et al.  Software Verification Using k-Induction , 2011, SAS.

[25]  Jade Alglave,et al.  Herding cats: modelling, simulation, testing, and data-mining for weak memory , 2014, PLDI 2014.

[26]  Patrick Cousot,et al.  Syntax and semantics of the weak consistency model specification language cat , 2016, ArXiv.

[27]  Nikolaj Bjørner,et al.  Z3: An Efficient SMT Solver , 2008, TACAS.

[28]  Jeff Huang,et al.  Stateless model checking concurrent programs with maximal causality reduction , 2015, PLDI.