synthesizing memory models framework sketches · 2018-08-25 · framework sketches deﬁne a class...

Synthesizing Memory Models from Framework Sketches and Litmus TestsJames BornholtEmina Torlak University of Washington

Memory consistency models define memory reordering behaviors on mul>processors


…correctness of my compiler…

Compiler writers!



Compiler writers!

…rules to verify against…

Verifica@on tools🤖



Compiler writers!



…possible low-level behaviors…

Kernel/library developers#


Litmus tests and prose


Compiler writers!







∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

Formalspecifica@ons


Compiler writers!







∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

Formalspecifica@ons


Compiler writers!





x86 [Sewell et al, CACM’10]

PowerPC [Alglave et al, CAV’10, etc]

ARM [Flur et al, POPL’16]

Litmus tests Formalspecifica@ons

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth


Synthesize specifica>ons∀

∃ ∈∧

∨

∩∪⊂

⋈⇒

MemSynth


Synthesize specifica>ons

Framework sketch

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth



Detect ambigui>es

Framework sketch

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth


Framework sketch


Detect ambigui>es

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth

MemSynth


Detect ambigui>es

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth

Framework sketches define a class of memory models


Detect ambigui>es

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth


MemSynth engine verifica@on, equivalence, synthesis, ambiguity


Detect ambigui>es

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

MemSynth



Results synthesize real-world memory model specs


Detect ambigui>es

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒

Memory models and framework sketches

Litmus tests illustrate memory model behaviorThread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?

Sequen>al consistency: no


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


x86: yes!


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


x86: yes!

A memory model M is a set of constraints that define the possible execu@ons (outcomes) of a program.


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


x86: yes!


Memory model M allows litmus test T if there exists an execu@on that sa@sfies M’s constraints.


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


x86: yes!


MeMemory model M allows test T:

∃ E. M(T,E)

Memory models, formallyCommon formaliza@ons based on rela>onal logic

Example for sequen>al consistency:

no ^(ws + fr + po + rf + fences) & iden

[Alglave et al, CAV’10]

Memory model M allows test T:

∃ E. M(T,E)






∃ E. M(T,E)

Binary rela@ons over program instruc@ons

happens-before order






∃ E. M(T,E)


happens-before order is acyclic






∃ E. M(T,E)







From program syntax


∃ E. M(T,E)







From program syntax


∃ E. M(T,E)

Thread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?







po = {( , ), ( , )}3 421

Program order:

From program syntax


∃ E. M(T,E)

Thread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?







po = {( , ), ( , )}3 421

Program order:

From program syntax

Part of execu@on; implicitly existen@ally quan@fied


∃ E. M(T,E)

Thread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?



Framework sketchesA framework sketch defines the search space for synthesizing a memory model M by including holes in constraints



Expression holes for a synthesizer to complete

?? ?? ??




Framework sketches are the key design tool for synthesizing memory model specifica@ons — they define the “interes@ng” candidate models

?? ?? ??

Memory model frameworks



?? ?? ??


no ^(ws + fr + ppo + grf + fences) & iden


Preserved program order (same-thread reorderings)

Global reads from (inter-thread order)

Fence cumula>vity (for Power, ARM, etc)




Sequen>al consistency




po rf ∅




Sequen>al consistency




po rf ∅

Total store order (x86)

po - (Wr→Rd) rf & SameThd ∅

Memory model frameworks are common

Global @me rela@onal model


Axioma@c “must-not-reorder”

func@ons [Mador-Haim et al,

DAC’11]

Exexcutable distributed

consistency models [Yang et al, IPDPS’04]

…

Ocelot: rela>onal logic with holesA rela>onal logic DSL with synthesis support

no ^(ws + fr + ppo + grf + fences) & iden?? ?? ??


Built on the Roseoe solver-aided language [Torlak & Bodik, PLDI’14]

Available as a Racket package: raco pkg install ocelot




Comple@ons are expressions in rela@onal logic with chosen operators, terminals, and depth.








operators = {+, &}

terminals = {po, ws}

depth = 1







operators = {+, &}

terminals = {po, ws}

depth = 1

po ws

po + ws po & ws


Queries‣ Verifica@on ‣ Equivalence ‣ Synthesis ‣ Ambiguity

Verifica>on and equivalenceMemory model M allows test T:

∃ E. M(T,E)Common queries for automated memory model reasoning tools

Herd [Alglave et al, CAV’10]; MemAlloy [Wickerson et al, POPL’17]; etc.




Litmus test

Memory modelVERIFY

SAT or UNSAT




Litmus test

Memory modelVERIFY

SAT or UNSAT

Reduces to SAT (since litmus tests are loop-free)




Litmus test

Memory modelVERIFY

SAT or UNSAT

EQUIVLitmus test or UNSATMemory model MB

Memory model MA





Litmus test

Memory modelVERIFY

SAT or UNSAT

EQUIVLitmus test or UNSATMemory model MB

Memory model MA


UNSAT = bounded equivalence (“equivalent up to tests of size k”)

SynthesisFind a memory model consistent with a set of litmus tests

Memory modelSYNTH

Framework sketch

Allowed litmus tests

Forbidden litmus tests


SYNTH

Framework sketch


SYNTH

Framework sketchx86


SYNTH

Framework sketch

53

2 allowed tests

1 2 4 6 7 8 9 10

8 forbidden tests

x86


SYNTH

Framework sketch

53

2 allowed tests

1 2 4 6 7 8 9 10

8 forbidden tests

Total store order

x86

SynthesisFind a memory model consistent with a set of litmus tests Memory model

M allows test T: ∃ E. M(T,E)



Framework sketchM

T+

T-Memory model





Framework sketchM

T+

T-

∃ E. M(T,E)⋀T∈T+

Memory model





Framework sketchM

T+

T-

∃ E. M(T,E)⋀T∈T+

∀ E. ¬M(T,E)⋀T∈T-

Memory model





Framework sketchM

T+

T-

∃ E. M(T,E)⋀T∈T+

∀ E. ¬M(T,E)⋀T∈T-

Memory model

Solved incrementally, like counterexample-guided induc@ve synthesis (CEGIS)

AmbiguityFind a dis@nguishing litmus test that exposes an ambiguity in a model

AMBIG

Key idea: axer synthesis, is there a different memory model that explains the tests?


AMBIG





AMBIG




Memory model MA


AMBIG

Framework sketch




Memory model MA


AMBIG

Framework sketch




Memory model MALitmus test

Memory model MB


AMBIG

Framework sketch




Memory model MALitmus test

Memory model MB

The new memory model must be seman>cally different from the input: MA and MB must disagree about a new test T

Similar to oracle-guided synthesis [Jha et al, ICSE’10]


AMBIG


✓Thread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


AMBIG


✓

Is there another seman>cally different memory model that also allows this test?Thread 1 Thread 2

X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


AMBIG


Par@al store order (SPARC)✓


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0?


AMBIG


Par@al store order (SPARC)

✓ PSO ✗ TSO

✓


X = 11

r1 = Y2

Y = 13

r2 = X4

Can r1 = 0 ∧ r2 = 0? Thread 1 Thread 2

X = 11

Y = 12

r1 = Y3

r2 = X4

Can r1 = 1 ∧ r2 = 0?

The Synthesis-Ambiguity Cycle

53

1 2 4

Litmus tests


53

1 2 4

Litmus tests

Documenta@on

🎲🎲Random/systema@c

genera@on

%& Architects


53

1 2 4

Litmus tests


53

1 2 4

Litmus tests Memory modelspecifica>on

SYNTH


53

1 2 4


SYNTH

AMBIG

6


53

1 2 4


SYNTH

AMBIGUnique memory model

(within framework sketch)

6

Results

Synthesizing exis>ng memory models

PowerPC

x86


PowerPC

x86

768 tests[Alglave et al, CAV’10]

10 tests

Synthesis


PowerPC

x86


10 tests

✓ 12 seconds

✓ 2 seconds

Search space: 21406

Search space: 2624

Synthesis


PowerPC

x86


10 tests

✓ 12 seconds

✓ 2 seconds

Not equivalent to published model!

Search space: 21406

Search space: 2624

Synthesis


PowerPC

x86


10 tests

✓ 12 seconds

✓ 2 seconds

Not equivalent to TSO!


Search space: 21406

Search space: 2624

Synthesis


PowerPC

x86


10 tests

✓ 12 seconds

✓ 2 seconds

Not equivalent to TSO!

9 new tests

4 new tests

Ambiguity


Search space: 21406

Search space: 2624

sync, lwsync, etc.

mfence, xchg

Other resultsImplemented another framework sketch [Mador-Haim et al, DAC’11]

Found typo in paper; couldn’t fix by hand, but synthesized repair



Order of magnitude faster than the Alloy general-purpose rela>onal solver for verifica@on and equivalence

Ocelot offers finer-grained control over rela@onal constraints



Order of magnitude faster than the Alloy general-purpose rela>onal solver for verifica@on and equivalence

Ocelot offers finer-grained control over rela@onal constraints

Comparable performance to exis@ng custom memory model tool for verifica@on (Herd [Alglave et al, CAV’10])

∀∃ ∈

∧

∨

∩∪⊂

⋈⇒MemSynth



Results synthesize real-world memory model specs

memsynth.uwplse.org

http://memsynth.uwplse.org

synthesizing memory models framework sketches · 2018-08-25 · framework sketches deﬁne a class...

Documents