A SAT-BASED BOUNDED MODEL CHECKER FOR CONCURRENT ASSEMBLY PROGRAMS. Guodong Li, Ganesh Gopalakrishnan, Konrad Slind

Transcription

1 A SAT-BASED BOUNDED MODEL CHECKER FOR CONCURRENT ASSEMBLY PROGRAMS Guodong L, Ganesh Gopalakrshnan, Konrad Slnd School of Computng, Unversty of Utah ABSTRACT A SAT-based bounded model checker s developed to verfy safety propertes of smple concurrent ARM assembly programs and ther abstracts over predcates. Transton relatons for both concrete systems and abstract systems are bult automatcally accordng to the operatonal semantcs of nstructons and control flow of the programs. The unfolded transton relatons (wthn a specfc nterval) along wth safe propertes are represented by a logcal formula that s then dumped to a SAT solver for satsfablty check. Predcate abstracton s calculated usng a SAT solver rather than makng calls to a theorem prover. We show the applcaton of these technques to realstc concurrent ARM assembly programs. We also explore how to adjust the model checker to relaxed memory consstent models.. INTRODUCTION In classcal model checkng for software, the targets under consderaton are usually programs wrtten n hgh level language, esp. C. Snce they would be compled to bnary codes for underlyng archtectures, the models bult from these programs may not represent accurately the behavors of real executons on hardware. In partcular, when mult-processes or mult-threads are executed on shared-memory machnes, the analyss on programs n hgh-level languages lacks suffcent granularty to acqure accurate nformaton about the nterleavng of memory access operatons. As an example, consder the followng statement n C: a = b + c These methods assume that the addton of b and c and the assgnment of the sum of b and c to a are performed atomcally n an ndvsble step. However, n a real machne model, ths statement may be mplemented by a sequence of machne nstructons: ldr r, [fp, #] ; load a ldr r, [fp, #] ; load b add r, r, r ; a + b str r, [fp,#2] ; store the sum to c Apparently, when these four nstructons are executng, other processes may take ther turns to execute ther own memory access nstructons that modfy the values of some shared varables. For nstance, after a s loaded nto r and before b nto r, the value at [fp,#] may be altered by other processes, makng the value loaded nto r not equal to the orgnal value of b. Workng at assembly level enables more accurate modelng of the nterleavng behavors of executons on real machnes. And, most modern archtectures support ndrect address modes (the address of a memory slot s based on a base regster, and the value of the base regster may change from tme to tme). Ths makes the analyss based on varable names (as n the methods dealng wth C programs) nstead of actual memory locatons naccurate. Thus, t s desrable to work at assembly language level when we desgn a model checker. Concurrency errors (as well as errors caused by the nondetermnstc executon) are among the most dffcult to fnd by testng. For nstance, date races are a major source n concurrent programs, and detectng them by hand or automatcally s a bg challenge. Exstng race checkers fall nto two categores: statc, type-based tools and dynamc, lockset-based tools. However, these tools often report false postves (.e. fnd a false race). We may model accurately the behavors of the current programs by constructng concrete transton relatons over machne states so that no false postve wll be reported. On the other hand, n order to reduce the sze of state space, we can abstract the system whle preservng the propertes of the orgnal system, then model check the abstract system. In ths approach, refnement s appled to remove spurous counter-examples so as to elmnate false postves. We employ two approaches to model the system: wthout predcate abstracton and wth predcate abstracton. The former approach bulds, accordng to the operatonal semantcs of the nstructons, a transton

2 relaton on machne states consstng of all regsters and memory locatons accessed by a process. Ths method has the advantage of accurate modelng: no nformaton s lost durng the modelng and thus no false postve wll occur. The predcate-abstracton based approach [-7], nstead, abstracts the program nto a Boolean program based on the atomc predcates detected automatcally or gven by the users. Abstracton reduces the state space by dealng wth abstract states rather than machne states, and t maps concrete transtons over machne states to abstract transtons over predcates. If the set of predcates s too small, over-approxmaton may happen durng abstracton. For ths, refnement by ncludng more predcates s performed repeatedly untl an accurate abstracton s acheved. Obtanng accurate abstracton s not an easy job. Exstng software verfcaton tools [-5] have to call a theorem prover for each potental assgnment to the current and next state predcates, thus requrng an exponental number of theorem prover calls to obtan precse relaton. What s more, exstng tools model program varables as unbounded nteger values, thus neglectng possble arthmetc overflow. Ths wll leads to false postves. To crcumvent these lmtatons, we use a SAT solver to calculate the abstracton such that the abstract transton s obtaned by satsfyng checks. For both approaches, we apply the bounded model checkng technques [-9] to reduce the complexty of verfcaton: the basc dea s to search for a counterexample n executons whose length s bounded by some nteger k. If no bug s found then k s ncreased untl ether a bug s found, or some pre-defned upper bound,.e. the threshold, s reached. The verfcaton problem can be effcently reduced to a propostonal satsfablty problem, and can therefore be solved by SAT methods effcently. SAT solvers are hghly effcent and allow a large number of varables, and do not suffer from the space exploson problem of BDD-based methods. The bounded model checker (BMC) begns wth organzng the nstructons n each program (or process) nto blocks. Then for each block a transton relaton s obtaned by analyzng the operatonal semantcs of all nstructons n the block and the control flow of these nstructons. And then a symbolc representaton of the transton relaton of the entre system over a fnte nterval s obtaned and encoded as a propostonal formula. Next the Boolean formula s constructed from the relatons by replacng arthmetc operatons and logcal operatons on typed data structures wth equvalent bt-wse operatons. Fnally, the approach enumerates symbolcally on the values of the Boolean varables, usng a SAT solver, to locate a counter-example. As shown n fgure, ths procedure s repeated untl a real bug s found or the threshold s reached. Note that the predcate abstracton approach requres extra work ncludng dentfcaton of approprate predcates and abstracton of the concrete system over these predcates. k = k=k+ Obtan a transton relaton for ndvdual block Convert the unrolled transton relaton to a Boolean formula no Group nstructons nto blocks Unfold the transton relaton for the entre system for k rounds Convert the Boolean formula to Defntonal CNFs Dump the CNFs to Zchaff Fnd a soluton? yes report a bug Fgure. Procedure of bounded model checkng The proposed BMC s desgned for sequentally consstent shared memory model. We also explore the deas to extend our BMC to more relaxed memory consstency models that are supported by commercally avalable archtectures such as Dgtal Alpha, SPARC V8 and V9, IBM PowerPC and Intel Itanum [9,2]. The rest of the artcle s structured as follows. In the next secton we ntroduce the ARM assembly language. In secton 3 we descrbe the BMC for concrete transton systems. Secton 4 descrbes the technque of abstractng programs over predcates to obtan abstract transton systems. In secton 5 we dscuss how to buld transton relatons on relaxed memory consstent models. We survey related work and gve the concluson n secton 6 and secton 7 respectvely. 2. CONCURRENT ASSEMBLY PROGRAMS We use ARM assembly language as the source language. One of ts key features s that only load and store nstructons can access memory, and arthmetc and logcal nstructons can only operate on regsters. Specfcally, the sngle data transfer nstructons ldr and str load and store the content of a sngle regster to and from memory. The memory address s based on a base regster (r n the examples below) plus an offset: str r7, [r, #2] All nstructons are executed condtonally on the state of the Current Program Status Regster (CPSR) ncludng flag Z, C and so on. Instructon cmp r, r updates flags n CPSR based on the result of r - r. Some of the condton codes are eq set Z (equal) 2

3 ne clear Z (not equal) For nstance, nstructon beq label sets the value of pc to label f Z s set and pc+ otherwse. The followng shows the assembly codes generated by the GCC crosscompler arm-elf-gcc (an extenson of GCC that comples C programs nto ARM assembly programs) wth opton S (Comple only; do not assemble or lnk; our analyzer wll do the lnkng for shared memory models) and O2 (optmze) for the Peterson algorthm: Source program n C vod ThreadA () { locka = true; turn = false; whle (lockb && (!turn)) { locka = false; Object program n ARM assembly language ; the ntal value of locka = ThreadA: ldr r,.l6 ldr r2,.l6+4 mov r3, # str r3, [r, #] ldr r2, [r2, #].L3: cmp r2, # beq.l4 ldr r3, [r, #] cmp r3, # beq.l3.l4: ldr r3,.l6+8 mov r2, # str r2, [r3, #] mov pc, lr.l7:.algn 2.L6:.word turn.word lockb.word locka ThreadB: (Symmetrc to the code of ThreadA).comm locka,4,4.comm lockb,4,4.comm turn,4,4 There are three shared varables: locka, lockb and turn (prefxed by the drectve.comm). turn specfes who s supposed to run next: f turn = then t s ThreadB s turn; otherwse t s ThreadA s turn. Intally ThreadA sets locka to be and turn be (thus forfetng the turn to B), then keeps watng when condton lockb && (!turn) s true. Its counterpart ThreadB behaves n a symmetrc way: sets lockb to be and turn to be (thus forfets the turn) before enterng the loop spnnng on locka && turn. Above program accesses only three memory slots, turn, lockb, and locka. From now on we use 32-word based addresses rather than 8-bt word based address. Wthout losng generalty we can assume that ther addresses are, and 2. Then we can use the symbolc notatons m, m and m2 to refer to these memory slots. Now ThreadA s code becomes (the concept of block wll be ntroduced n next secton): ThreadA: {block {block b mov r, # ;turn s address mov r2, # ;lockb s address mov r3, # str r3, [r, #] ;reset turn ldr {block b2.l3: cmp r2, # beq.l4 {block b3 ldr cmp r3, # beq.l3 r2, [r2, #] ;load lockb s value r3, [r, #] ;load turn s value {block b4.l4: ;enter and then ext crtcal secton mov r3, #2 ;locka s address mov r2, # str r2, [r3, #] ;reset locka {block b5 mov pc, lr ;return 3. CONCRETE TRANSISTION SYSTEM We frst ntroduce the approach wthout predcate abstracton: transton relatons over concrete states are bult. 3. Blocks A concrete transton relaton maps current state to next state for each nstructon. For a process, ts state conssts of regsters, stack varables and shared varables. Consder an nstructon mov r, # the transton relaton for t should be (r = ) /\ all other varables are unchanged Unfortunately, specfyng the clam all other varables are unchanged nvolves settng up an equaton for each varable, thus ncreasng tremendously the sze of the state space. And the resultng logcal formula becomes extremely long. Hence, we adopt two approaches to reduce the length of the resultng logcal formula: () Calculate the set of regsters and memory space beng accessed durng the entre executon, and consder only ths set whle buldng the transton relatons. (2) Group 3

4 nstructons nto blocks and derve transton relaton based on blocks nstead of nstructons. Snce memory access n ARM use ndrect addressng mode, the exact addresses of memory slots depend on the value of base regsters whose values are set by prevous nstructons, we don t know exactly the constant addresses of these slots. Fortunately, as n the case of Peterson algorthm, n general we know the memory space n advance, and we can enumerate all the memory space when handlng an ndrect addressng memory access. Ths s smlar the way ponters are handled n C programs [5]. Groupng nstructons nto blocks smplfes the logcal expresson derved from transton relatons. For nstance, consder the followng program p that accesses only one memory slot, m: ; program p mov r, # mov r, r mov r, r3 add r, r, r2 str r, [r, #] Snce we am at verfyng propertes about shared varables rather than local varables, we may group nstructons nto blocks each of whch contans at most one memory access. For nstance, the frst fve nstructons of program p consttute a block. The rest load nstructon consttutes another block. Durng groupng regster renamng may be needed: whenever a regster s wrtten (.e. as the destnaton operand), we assgn t a new name by ntroducng a vrtual regster. Exceptons are for nput regsters and output regsters of the block because they should keep ther names so that neghborng blocks are able to read and wrte ther values. For nstance, after renamng, the frst block of program p becomes mov r7, # mov r8, r7 mov r, r3 add r, r8, r2 str r, [r, #] Then the transton relaton from round k to round k+ for ths block becomes r7 = /\ r8 = r7 /\ r k+ = r3 k /\ r k+ = r8+r2 k /\ r2 k+ = r2 k /\ m k+ = r k+ We remove all ntermedate regsters lke r7 and r8 r k+ = r3 k /\ r k+ = +r2 k /\ r2 k+ = r2 k /\ m k+ = r2 k+ Each block should contan at most one memory access nstructon, and the target of a jump should be the begnnng pont of a block. 3.2 Concrete Transton Relatons The bounded model checker generates a logcal formula that s satsfable f and only f the underlyng state transton system can realze a fnte sequence of state transtons that reaches certan states of nterest. If such a path segment cannot be found at a gven length, k, the search s contnued for larger k. The search s comprehensve wthn nterval [,k]: all executons whose length are less than k have been examned. For state transton system M and length bound k, the unfolded transton relaton s k k = + = [[ M ]] : Is ( ) /\ Ts ( ; s ) where I(s ) s the characterstc functon on the set of ntal states, and T(s ; s + ) s the characterstc functon of the transton relaton. A logc formula f provded by the user s checked to see whether t s vald along some computaton path of M wthn length k. Let [[ f ]] k be a formula that wll be true f and only f the formula f s vald along a path of length k. The conjuncton of [[M ]]k and [[f ]]k s the formula we should check for round k [8]. In ths paper we concern only safety propertes,.e. EF p where p s the safety property specfed by the user. For nstance, f we wsh to check whether EF p can be verfed n two tme rounds,.e., k = 2. We would then form the followng formula: [[ M, f]] : = I( s ) T( s ; s) T( s; s ) ( p( s ) p( s) p( s )) Each state s the product of the states of all processes, and each process s state conssts of a program ponter (pc), current process status regster (cpsr), regsters and memory slots ths process accessed: s = (pc, cpsr, regster set, memory slot set ) For a program whose nstructons have been grouped nto block, we smplfy the structure of the state by replacng the pc wth the block number blk and removng the cpsr nformaton: s = (bn, regster set, memory slot set ) The transton relaton for ndvdual block s obtaned by symbolcally executng the nstructons n ths block. Note that the new state for block contanng branch s the conjuncton of the possble two outcomes of the branch. The formula for an arthmetc or logcal operaton nstructon op dst, src, src2, s dst = op_f (src,src2, ) where op_f s the characterstc functon relevant to the operator. For nstance, the formula for add r, r2, r s (r = r2 + r). The formula for memory access nstructon needs to enumerate all possble address. For nstance, the formula for ldr r, [r2+2] s \/ k k (2 r + 2 = k/\ r = m ). The effect of a jump nstructon s modeled by the relaton between the old block number and the new block number (.e from the old blk to the new blk). 4

5 The transton from current state s to state s + for the blocks n ThreadA (wth pd ) s as followng. block5 s gnored because t nvolves no data processng. T(s ; s + ) block = blk = /\ blk + = /\ r + = /\ r2 + = /\ r3 + = /\ m_ + = /\ m_ + = m_ /\ m2_ + = m2_ T(s ; s + ) block = blk = /\ blk + = 2 /\ ((r2 = /\ r2 + = m_ ) \/( r2 = /\ r2 + = m_ ) \/ (r2 = 2 /\ r2 + = m2_ )) /\ r + = r /\ r3 + = r3 /\ ( mk + = mk ) /\ k =,,2 T(s ; s + ) block2 = blk = 2 /\ ((r2 = /\ blk + = 3) \/ (~(r2 = ) /\ blk + = 4)) /\ ( rk + = rk ) /\ /\ k =,2,3 /\ ( mk + = mk ) k =,,2 T(s ; s + ) block3 = blk = 3 /\ ( r = k /\ r3 + = mk ) /\ \/ k =,,2 ((r3 + = /\ blk + = 2) \/( ~(r3 + = ) /\ blk + = 4)) /\ r + = r /\ r2 + = r2 /\ ( mk = mk ) /\ + k =,,2 T(s ; s + ) block4 = blk = 4 /\ blk + = 5 /\ r + = r /\ r2 + = /\ r3 + = 2 /\ (m2_ + = ) /\ (m_ + = m_ ) /\ (m_ + = m_ ) s Then the characterstc functon for the entre ThreadA \/ blockk T(s ; s + ) _ = T( s, s + ) k =,...,4 Analogously, we get the characterstc functon for the entre process ThreadB, T(s ; s + )_. Then, snce ThreadA and ThreadB execute n an nterleavng fashon, at each tme ether ThreadA or ThreadB could make a transton whle the other stays (that s, ts state doesn t change). Thus the overall characterstc functon for the entre system s T(s ; s + ) = (T(s ; s + )_ /\ STAY_ ) \/ (T(s ; s + )_ /\ STAY_ ) where /\ k k j=,2,3 STAY_ k = ((blk_ k _ + = blk_ k _ ) /\ ( rj + = rj )) Note that predcates about memory slots are not ncluded n the STAY_ k because they have been specfed by the actve process and should not be ncluded n the STAY formulas. 3.3 Safety Propertes We check safety propertes wthn certan rounds of transton. For the Peterson algorthm, suppose we want to check whether there s an executon whose length s less than k that volates the mutual excluson requrement. The clam for ths s blk_ = 4 /\ blk_ = 4. That s, both ThreadA and ThreadB enter ther crtcal sectons. Then p(s) = p( s ) \/ =,..., k, k+ where p(s ) = blk = 4 /\ blk = 4 The ntal condton s I(s ) = blk = /\ blk = /\ m_ = /\ m2_ = The unfolded transton relatons are combned wth the ntal condton and the clam for satsfyng check: k I(s ) /\ /\ T( s; s + ) /\ p(s) = 3.4 Boolean Formulas and Defntonal CNF We buld crcut representaton for basc arthmetc operatons and logcal operatons on bt-vectors so that logcal formulas nvolvng these operatons could be converted to equvalent Boolean formulas. For an n-bt varable x, we represent t wth n Boolean varables: x = (x n-,x n-2,,x ). In practce, basc arthmetc operatons and logcal operatons are mplemented by crcuts. The Boolean formula for the equaton a = b where both a and b are n-bt vectors s: a n- = b n- /\ a n-2 = b n-2 /\ /\ a = b For nstance, x = 7 s converted to x 3 = F /\ x 2 = T /\ x = T /\ x = T As another example, addton over n-bt words, Z = X+Y, s mplemented as an n-bt carry rpple adder: Z = (X /\~Y /\~C ) \/ (~X /\Y /\~C ) \/ (~X /\~Y /\C ) \/ (X /\Y /\C ) and C + = X /\Y \/ X /\C \/ Y /\C for =,,,n- Many propostonal decson procedures assume the nput problem to be n CNF (conjunctve normal form). Usually, t s a goal to reduce the sze of the CNF verson of the formula, although ths may not always reduce the complexty of the search. A formula f n CNF s represented as a set of clauses. Each clause s a set of lterals, and each lteral s ether a postve or negatve propostonal varable. In other words, a formula s a conjuncton of clauses, and a clause s a dsjuncton of lterals. The sze of the converted formula can be exponental wth respect to the sze of f, and the worst case s when f s n dsjunctve normal form. We convert Boolean formulas to a format of defntonal CNF: a normal form smlar to CNF n whch the result formulas are only lnearly larger than the nput formulas. For nstance, Boolean formula ~(a:bool = (b:bool = c:bool)) 5

6 s equvalent to the followng defntonal CNFs (x \/ a \/ v) /\ (x \/ ~a \/ ~v) /\ (a \/ ~v \/ ~x) /\ (v \/ ~a \/ ~x) /\ (v \/ b \/ ~c) /\ (v \/ ~b \/ c) /\ (b \/ c \/ ~v) /\ (~c \/ ~b \/ ~v) /\ x Next, the CNF-based formulas are dumped to a SAT solver, e.g. Zchaff [8], for satsfablty check. 4. BMC WITH PREDICATE ABSTRACTION As a method for systematc abstracton, predcate abstracton s wdely appled to a varety of systems [- 9]. It maps concrete data types to abstract data types through predcates over the concrete data. The abstract system may over-approxmate the concrete system and thus leads to spurous counter-examples. In ths case, refnement s requred to be performed by adjustng the set of predcates to rule out the spurous counter-examples. 4. SAT-based Predcate Abstracton In the exstng software verfcaton tools such as SLAM [9], the generaton of the abstract Boolean program from a program n hgh level language and a set of predcates requres an exponental number of theorem prover calls to obtan precse transton relaton. And varables are modeled as unbounded nteger values, neglectng possble arthmetc overflow. They also only provde a lmted support for ndrect addressng. In fact, the possble assgnments to the values of the predcates can be searched by the SAT solver, and the hgh effcency of SAT solvers enables checkng many more possble assgnments, resultng n a more precse abstract transton relaton. Snce the abstracton s based on bt vectors nstead of ntegers, false postves due to the naccurate assumpton that the range of varable values s avoded. We apply SAT-based approach n fndng accurate predcates for blocks. The predcates are added n current and next state form to the concrete relaton, resultng n a Boolean formula. Then we enumerate symbolcally on the values of the predcates, usng a SAT solver. Let P = {p,..., p n be the gven set of predcates, and let B = {b,..., b n be the correspondng set of boolean varables. The abstracton s performed by applyng exstental abstracton: let T(cs,cs ) be the concrete relaton relatng old concrete state cs and new concrete state cs, and f s the projectve functon mappng a concrete state cs to the correspondng abstract state as. The abstract transton relaton T (as, as ) relates as to as by T (as,as ) ff cs,cs.t(cs,cs ) /\ f(cs)= as /\ f(cs ) =as To fnd the set of predcates, we nspect the structure of a program to look for canddates. Consder the control flow of ThreadA, the nstructon "cmp r2, #" gves us a hnt that r2 = s a canddate predcate, the nstructon "ldr r3, [r, #]" followed by "cmp r3, #" leads to canddates m =, m = and m2 = snce r3 s value may be loaded from slot, slot or slot 2. Another load nstructon ldr r2, [r2, #] ndcates that r2 s value may loaded from memory slot (when r2 = ), (when r2 = ) and 2 (when r2 = 2). Thus addng predcate r2 = may be approprate. After r2 = and r2 = have been added t s unnecessary to add r2 = 2 because (r2 = ) /\ (r2 = ) => (r2 = 2) provded that r2 s used as base regster and there are only three memory slots avalable. Snce r serves as the base regsters of two memory access nstructons str r3, [r,#] and ldr r3, [r,#], r = may be another canddate to be added. In sum, we have the followng set of predcates P = {p = (r = ), p = (r2 = ), p2 = (r2 = ), p3= (m = ), p4 = (m = ), p5 = (m2 = ) To abstract the frst block of ThreadA, we frst add the constrants for the predcates n P to ths block s concrete transton relaton b = p /\ b = p /\ b2 = p2 /\ b3 = p3 /\ b4 = p4 /\b5= p5 /\ r /\ ;mov r, # r2 /\ ;mov r2, # r3 /\ ;mov r3, # [] r3 /\ ;str r3, [r, #] b = p /\ b = p /\ b 2 = p2 /\ b 3 = p3 /\ b 4 = p4 /\ b 5=b5 The correspondng logcal formula s b = (r = ) /\ b = (r2 = ) /\ b2 = (r2 = ) /\ b3 = (m_ = ) /\ b4 = (m_ = ) /\ b5 = (m2_ = ) /\ r + = /\ r2 + = /\ r3 + = /\ m_ + = /\ m_ + = m_ /\ m2_ + = m2_ /\ b = (r + = ) /\ b = (r2 + = ) /\ b 2 = (r2 + = ) /\ b 3 = (m_ + = ) /\ b 4 = (m_ + = ) /\ b 5 = (m2_ + = ) The satsfyng assgnments for ths equaton over the varables b,, b 5, b,, b 5 are: b b b2 b3 b4 b5 b' b' b' 2 b' 3 b' 4 b' 5 x x x2 x3 x2 x3 x x x2 x3 x2 x3 x x x x x x where x, x, are Boolean varables whose values could be or. Ths table ndcates that the followng assgnments over b,, b 5, b,, b 5 n that order are all vald:,,,, Ths table s obtaned by havng the SAT solver fnd out all satsfyng assgnments. However, once the SAT solver dentfes a vald assgnment, t wll stop searchng by default. Thus we need to add the negaton of dentfed 6

7 assgnment as a blockng clause, and then contnue searchng untl no more satsfyng assgnment s found. Technques to modfy the SAT solver to enumerate a complete set of vald assgnments have been commonly used [] [2]. To make t more readable, we gve a Boolean formula correspondng to above truth table ~(b /\ b 2 ) /\ b /\ ~b /\ b 2 /\ b 3 /\ b 4 = b 4 /\ b 5 = b 5 Takng the control flow nto account, we obtan the abstract relaton for ths block T(s ; s + ) block = blk = /\ blk + = /\ ~(b /\ b2 ) /\ b + /\ ~b + /\ b2 + /\ b3 + /\ b4 + = b4 /\ b5 + = b5 In a smlar way, we get the assgnment table for block consstng of one sngle load nstructon b b b2 b3 b4 b5 b' b' b' 2 b' 3 b' 4 b' 5 x x x2 x x x x2 x x x2 x x x2 x x x2 x x x x2 x x x2 x x x2 x x x2 x x x x2 x x x x x x 2 2 Ths table descrbes a Boolean formula: ~(b /\ b 2 ) /\ ((~b /\ ~b 2 /\ b 2 = b 5 ) \/ ( ~b /\ b 2 /\ b 2 = b 3 ) \/ (b /\ ~b 2 /\ b 2 = b 4 ) /\ ~(b 2 /\ b ) /\ (b = b ) /\ (b 3 = b 3 ) /\ (b 4 = b 4 ) /\ (b 5 = b 5 ) Thus the abstract relaton for block s T(s ; s + ) block = blk = /\ blk + = 2 /\ ~(b /\ b2 ) /\ ( (~b /\ ~b2 /\ b2 + = b5 ) \/ (~b /\ b2 /\ b2 + = b3 ) \/ (b /\ ~b2 /\ b2 + = b4 )) /\ ~(b2 + /\ b + ) /\ ( bk = bk ) /\ + k =,3,4,5 By applyng ths technque we get the abstract transton relaton for other blocks: T(s ; s + ) block2 = blk = 2 /\ ~(b /\ b2 ) /\ (b2 /\ blk + = 4) /\ (~b2 /\ blk + = 3) /\ ( bk = bk ) /\ + k =,,..,5 T(s ; s + ) block3 = blk = 3 /\ ~(b /\ b2 ) /\ (b /\ b3 /\ blk + = 2) /\ (b /\ ~b3 /\ blk + = 4) /\ ( bk = bk ) /\ + k =,,..,5 T(s ; s + ) block4 = blk = 4 /\ blk + = 5 /\ ~(b /\ b2 ) /\ ~b + /\ b2 + /\ b5 + /\ ( bk = bk ) /\ + k =,3,4 The remanng phases of the BMC are the same as what we have done n the prevous secton for concrete transton system. Suppose agan we want to check the mutual excluson property on the abstract system, we unroll the abstract transtons, buld a logcal formula, and dump t to the SAT solver for satsfablty check. The BMC doesn t fnd a bug wth small thresholds. Our method s a conservatve over-approxmaton of the orgnal program wth respect to the set of gven predcates. Ths method produces consderable reductons n the state space but may produce a spurous counterexample that does not correspond to a concrete counterexample. For nstance, f the set of gven predcates s {p = (m=), p2 = (m=), p3 = (m2=), then the abstracted transton for block2 over these predcates s ( bk = bk ). Thus the nformaton /\ + k =,,2 about r2 s lost durng the abstracton. Then ThreadA advances to ts crtcal secton no matter what the values of m, m and m2 are because the condton r2 = s always satsfable. In a smlar way ThreadB enters ts crtcal secton at the same tme, thus leadng to a spurous volaton of the mutual excluson. To rule out ths false postve, refnement s needed by addng extra predcates to remove ths spurous counter-example. A basc prncple f always to add predcates correspondng to the condtons of condtonal jumps. How to derve addtonal approprate predcates s left for future research. 4.2 Resolvng Alas for Memory Access Compared wth languages allowng only drectaddressng modes, ARM assembly language support only ndrect-addressng, makng the state space grow rapdly and abstracton of the program much more complcated. Fortunately, most ARM programs could be converted nto equvalent programs wth alas of memory access beng resolved by mappng ndrect addresses to correspondng drect addresses. Although load and store nstructons are based on ndrect addressng mode, wthout the scope of a procedure the values of base regsters are easy to know (e.g. these values are set at the begnnng of the procedure), by addng ther values and the offsets together we know the drect addresses of nvolved memory slots. In other words, the alas s resolved by mappng an ndrect address to a drect address that can be represented by constants. After that, nstructons for settng the values of base regsters may be deleted. For nstance, after all alases are resolved, the code ThreadA becomes: ; m turn ; m lockb ; m2 locka { block : mov r3, # : str r3, m (m = ) { block 2: ldr r2, m (r2 = m) 7

8 { block2.l3: 3: cmp r2, # (r2 = )? 4: beq.l4 { block3 5: ldr r3, m 6: cmp r3, # (m = )? 7: beq.l3.l4: { block4 8: mov r2, # 9: str r2, m (m = ) Then by analyzng the control flow and data flow of ths program we nfer a set of predcates for ThreadA: P = {m =, r2_ = m, r2_ =, m = ; analogously the set of predcates for ThreadB s {m =, r2_ = m2, r2_ =, m2 =. The unon of these two sets,{r2_ = m, r2_ = m2, r2_ =, r2_ =, m =, m =, m2 =, s an approprate set of predcates over whch abstracton s performed. It s easy to abstract the program over these predcates snce there s no ndrect-addressng any more. 5. RELAXED MEMORY CONSISTENCY MODELS Up to now our proposed approach targets at the tradtonal shared memory model: all memory access nstructons are executed n the order specfed by the control flow of the orgnal program. These tradtonal models satsfes sequental consstency [22][23]: the result of any executon s the same as f the operatons of all the processors were executed n some sequental order, and the operatons of each ndvdual processor appear n ths sequence n the order specfed by ts program. The BMC we have developed perform comprehensve checkng for sequentally consstent memory models: Clam. For each fnte executon allowed by sequentally consstent memory model, our BMC s able to generate an executon that s dstngushable from t n the vew of users. That s, for ths model, the searchng performed by our BMC s comprehensve. Snce sequental consstency enforces a strct order among shared memory operatons, t dsallows many possble hardware and compler optmzatons. For ths reason, a number of more relaxed memory consstency models have been proposed, ncludng some that are supported by commercally avalable archtectures such as Dgtal Alpha, SPARC V9, and IBM PowerPC [22]. There are two ways to relax memory consstency models: relax the program order requrement, and relax the wrte atomcty requrement. We study only the case of program order relaxaton. There are three common relaxatons wth respect to program order: relax the order from a wrte to a followng read (raw relaxaton), between two wrtes, and fnally from a read to a followng read or wrte. To an extreme degree, full relaxaton relaxes the order between read and wrte. In all cases, the relaxaton only apples to operaton pars wth dfferent addresses. It s easy to see that the Peterson algorthm doesn t guarantee mutual excluson on full relaxaton models snce the wrte on locka and lockb may happen before ThreadA and ThreadB start spnnng. It s desrable to develop a model checker beng able to check executons on relaxed models. In order to adjust our BMC model to relaxed memory consstency models, we frst construct the dependence graph of a program to represent the control flow of nstructons wth respect to relaxed models. It s ensured that the reorderng of the executons of these nstructons s consstent wth the relaxed models. In the dependence graph, nodes correspond to nstructons, and drected edges (arrows) specfy the dependence between nstructons. The nstructon at the end of the arrow must be executed before the nstructon at the head. How to construct automatcally dependence graphs s out of the scope of ths paper. In general modern complers support creatng dependence graphs for relaxed memory models and out-of-order processors. Consder the followng program p2 : str r, m : ldr r, m 2: add r2, r, r 3: str r, m 4: ldr r, m2 5: str r, m The dependence graphs on raw relaxed memory models and full relaxed memory model are shown n fgure raw relaxaton full relaxaton Fgure 2. Dependency Graphs for Relaxed Memory Consstent Models In prevous sectons we descrbe how to obtan the logcal expresson representng the transton relaton related to an nstructon by nvestgatng ts operaton semantcs. The same technque s appled here to obtan the relaton transts from round to round + for the k th nstructon, e.g. tr(,+,k). For a block consstng of n nstructons, varable flag s a n-bt vector recordng whch nstructons have been executed. Predcate setf k ndcates that the th bt of flag s set to be (true),.e. setf k = (flag + = flag n ), where s the btwse dsjuncton, and n denotes a word wth all bts except for bt 8

9 beng. Predcate readf k ndcates that the value of bt n flag s. Now, the transton relatons n the raw relaxaton case are T(s ; s + )_ = ~(readf ) /\ (setf ) /\ tr(,+,) T(s ; s + )_ = ~(readf ) /\ setf /\ tr(,+,) T(s ; s + )_ 2 = ~(readf ) /\ (readf ) /\ (readf ) /\ setf 2 /\ tr(,+,2) T(s ; s + )_ 3 = ~(readf 3) /\ (readf ) /\ setf 3 /\ tr(,+,2) T(s ; s + )_ 4 = ~(readf 4) /\ setf 4 /\ tr(,+,4) T(s ; s + )_ 5 = ~(readf 5) /\ (readf ) /\ (readf 3) /\ (readf 4) /\ setf 5 /\ tr(,+,5) The ntal state s characterzed by I(S ) = (flag = ) Then our BMC s able to model check ths confguraton. We are tryng to ncorporate ths technque nto our BMC, and the long term goal s to provde a mechanzed BMC for a varety of relaxed memory consstency models. 6. RELATED WORKS Bounded Model Checkng (BMC), was frst proposed by Bere et al. n 999 [], and bounded model checkng wth satsfablty solvng [2] [3] has been shown to have remarkable effcency n fndng counterexamples on systems that BDD based model checkng methods are dffcult for. And t requres less by-hand manpulaton from the user than BDD based verfcatons do. Intel developed a bounded model checker THUNDER (based on a SAT solver called SIMO) for crcut desgns. [4]. Compaq used bounded model checkng wth the PROVER SAT solver for fndng bugs n the memory system of an advanced Alpha mcroprocessor [5]. G. Audemard et al. [6] extended bounded model checkng to tmed systems by extendng the SAT solver to deal wth lnear constrants over real varables. To make BMC complete for a large class of hardware desgns, Baumgartener et al. [7] performed a structural analyss of the desgn n order to derve an over approxmaton of the reachablty dameter. They showed that the reachablty dameters of many crcuts are small and sutable for bounded model checkng. E. Clarke el al. [8] developed a bounded model checker to support automated checkng of safety propertes of crcut desgn. For these BMCs, experments have shown that t can solve many cases that cannot be solved by BDD-based technques. Specfcally, f k s small enough (typcally not more than 6 to 8 cycles, dependng on the model tself and the SAT solver), t outperforms BDD-based technques. A. Bere et al. gave a good survey on Bounded Model Checkng technques [9]. However, no bounded checker s developed for concurrent assembly programs so far, not to menton abstractng them over predcates and then modelng the abstract system. Predcate abstracton was frst proposed by Graf and Sad []. S. Bensalem el al. [] has used predcate abstracton n the verfcaton of cache coherence protocols. Both of these works target at languages wth guarded commands. Earler abstract nterpretaton approach [-3] reled on the user to supply predcates, and general-purpose theorem provng s utlzed to compute the abstract program. A method for constructng abstract models from Java programs has been developed n the Bandera project [4]. T.Ball el al. [5] demonstrated automatc predcate abstracton on C programs. A tool called C2bp automatcally creates a Boolean program whch s an abstracton of C programs ncludng structures such as ponters and procedures. Ther abstracton mantans the control-flow structure of programs. E. Clarke et al. [6][7] proposed to use a SAT solver to generate the abstract program for ANSI C programs so that the potentally exponental number of theorem prover calls s replaced by a sngle SAT nstance. Ther approach s smlar to what we present n ths paper. The dfference s that we work at ARM assembly programs. 7. CONCLUSION We present a SAT-based bounded model checker to model check concurrent ARM assembly programs. It has several advantages: () SAT tools do not requre exponental space and large desgns can be checked very fast (snce the state space s searched n an arbtrary order). (2) It s able to fnd paths of mnmal length, makng understandng of the counter-example easer. (3) It apples predcate abstract to attack the state space exploson problem. (4) Abstracton s SAT-based and no theorem prover call s necessary. And we explore the ssue of performng checkng over relaxed memory consstent models. REFERENCES [] A. Bere, A. Cmatt, E. Clarke, and Y. Zhu. Symbolc model checkng wthout BDDs. In Proc. of the Workshop on Tools and Algorthms for the Constructon and Analyss of Systems (TACAS 99), 999. [2] A. Bere, E. M. Clarke, R. Ram, and Y. Zhu. Verfyng Safety Propertes of a PowerPC Mcroprocessor Usng Symbolc Model Checkng wthout BDDs. In Intl. Conference on Computer-Aded Verfcaton (CAV 99), July, 999. [3] A. Bere, A. Cmatt, E. M. Clarke, M. Fujta, and Y. Zhu. Symbolc Model Checkng usng SAT procedures nstead of BDDs. In Proc. of Desgn Automaton Conference, (DAC 99), June,

10 [4] F. Copty, L. Fx, R. Fraer, E. Gunchgla, G. Kamh, A. Tacchella, and M. Y. Vard. Benefts of bounded model checkng at an ndustral settng. In Intl. Conference on Computer Aded Verfcaton (CAV ), 2. [5] P. Bjesse, T. Leonard, and A. Mokkedem. Fndng bugs n an alpha mcroprocessor usng satsfablty solvers. In Intl. Conference on Computer Aded Verfcaton (CAV ), 2. [6] G. Audemard, A. Cmatt, A. Kornlowcz, and R. Sebastan. Bounded model checkng for tmed systems. In 22nd Jont Internatonal Conference on Formal Technques for Networked and Dstrbuted Systems (FORTE 22), November 22. [7] J. Baumgartner, A. Kuehlmann, and J. Abraham. Property Checkng Va Structural Analyss. In Intl. Conference on Computer Aded Verfcaton (CAV 2), 22. [8] E. Clarke, A. Bere, R. Ram, and Y. Zhu. Bounded model checkng usng satsfablty solvng. Formal Methods n System Desgn, 9():7--34, 2. [9] A. Bere, A. Cmatt, E. M. Clarke, O. Strchman and Y. Zhu., Bounded Model Checkng. Vol. 58 of Advances n Computers, 23. Academc Pres [] S. Graf and H. Sad. Constructon of abstract state graphs wth PVS. In Proc. Intl. Conference on Computer Aded Verfcaton (CAV 97), 997. [] S. Bensalem, Y. Lakhnech, and S. Owre. Computng abstractons of nfnte state systems compostonally and automatcally. In Intl. Conference on Computer Aded Verfcaton (CAV 98), 998. [2] M. Colon and T.E. Urbe. Generatng fnte-state abstractons of reactve systems usng decson procedures. In Intl. Conference on Computer Aded Verfcaton (CAV 98), 998. [3] S. Das, D. L. Dll, and S. Park. Experence wth predcate abstracton. Intl. Conference on Computer Aded Verfcaton (CAV 99), 999. [4] M. Dwyer, J. Hatcl, R. Joehanes, S. Laubach, C. Pasareanu, Robby, W. Vsser, and H. Zheng. Tool-supported program abstracton for fnte-state verfcaton. In Internatonal Conference on Software Engneerng (ICSE ), 2 [5] T. Ball, R. Majumdar, T.D. Mllsten, and S.K. Rajaman. Automatc predcate abstracton of C programs. In SIGPLAN Conference on Programmng Language Desgn and Implementaton (PLDI ), 2 [6] E. Clarke, D. Kroenng, N. Sharygna and K. Yorav. Predcate Abstracton of ANSI C Programs usng SAT. Formal Methods n System Desgn, 24. [7] E. Clarke, D. Kroenng, N. Sharygna and K. Yorav. SAT- Based Predcate Abstracton of Programs. Techncal Report CMU/SEI-25-TR-6. [8] E.M. Clarke, O. Grumberg, S. Jha, Y. Lu, and H. Veth. Counterexample-guded abstracton refnement. In Intl. Conference on Computer Aded Verfcaton (CAV ), 2 [9] S. Lahr, T. Ball and B. Cook. Predcate Abstracton va Symbolc Decson Procedures. In Intl. Conference on Computer Aded Verfcaton (CAV 5), 25 [2] M.W. Moskewcz, C. Madgan, Y. Zhao, L. Zhang and S. Malk. Chaff: Engneerng an Effcent SAT Solver. In Proceedngs of Desgn Automaton Conference (DAC ), 2. [2] K.L. McMllan. Applyng SAT methods n unbounded symbolc model checkng. In Intl. Conference on Computer Aded Verfcaton (CAV 2.), 22. [22] S.V. Adve and K. Gharachorloo. Shared memory consstency models: a tutoral. IEEE Computer, 29(2), pp.66-76, December 996. [23] M. Ahamad, R. Bazz, R. John, P. Kohl, and G. Neger. The Power of Processor Consstency. In Proc. of the 5th ACM Symp. on Parallel Algorthms and Archtectures (SPAA'93), 993.