Automating Deductive Verification for Weak-Memory Programs

Alexander J Summers,Peter Müller

doi:10.1007/978-3-319-89960-2_11

Abstract

Writing correct programs for weak memory models such as the C11 memory model is challenging because of the weak consistency guarantees these models provide. The first program logics for the verification of such programs have recently been proposed, but their usage has been limited thus far to manual proofs. Automating proofs in these logics via first-order solvers is non-trivial, due to features such as higher-order assertions, modalities and rich permission resources.

Highlights

Reasoning about programs running on weak memory is challenging because weak memory models admit executions that are not sequentially consistent, that is, cannot be explained by a sequential interleaving of concurrent threads
Weak-memory programs employ a range of operations to access memory, which require dedicated reasoning techniques. These operations include fences as well as read and write accesses with varying degrees of synchronisation. Some of these challenges are addressed by the first program logics for weakmemory programs, in particular, Relaxed Separation Logic (RSL) [38], GPS [36], Fenced Separation Logic (FSL) [17], and FSL++ [18]
These logics apply to interesting classes of C11 programs, but their tool support has been limited to c The Author(s) 2018 D

Summary

Introduction

Reasoning about programs running on weak memory is challenging because weak memory models admit executions that are not sequentially consistent, that is, cannot be explained by a sequential interleaving of concurrent threads. We encode large fractions of RSL, FSL, and FSL++ (collectively referred to as the RSL logics) into the intermediate verification language Viper [27], and use the existing Viper verification backends to reason automatically about the encoded programs. This encoding reduces all concurrency and weak-memory features as well as logical features such as higherorder assertions and custom modalities to a much simpler sequential logic. Jacobs [20] proposed a program logic for the TSO memory model that has been encoded in VeriFast [21] This encoding requires a substantial amount of annotations, whereas our approach provides a higher degree of automation and handles the more complex C11 memory model. A prototype implementation of our encoding (with all examples) is available as an artifact [4]

Non-atomic Locations

Release-Acquire Atomics

Relaxed Memory Accesses and Fences

Compare and Swap

Soundness and Completeness

Examples and Evaluation

Conclusions and Future Work