[Paper Review] Portability Analysis for Axiomatic Memory Models. PORTHOS: One Tool for all Models

Hernán Ponce-de-León, Florian Furbach+2 more|arXiv (Cornell University)|Feb 22, 2017

Formal Methods in Verification27 references3 citations

TL;DR

porthos is the first tool to detect porting bugs in performance-critical code by analyzing consistency across different weak memory models. It uses bounded model checking with SMT solving to detect executions valid on a target architecture (e.g., Power) but invalid on the source (e.g., TSO), efficiently encoding recursive memory model semantics and quantifier alternations via existential queries.

ABSTRACT

We present Porthos, the first tool that discovers porting bugs in performance-critical code. Porthos takes as input a program and the memory models of the source architecture for which the program has been developed and the target model to which it is ported. If the code is not portable, Porthos finds a bug in the form of an unexpected execution - an execution that is consistent with the target but inconsistent with the source memory model. Technically, Porthos implements a bounded model checking method that reduces the portability analysis problem to satisfiability modulo theories (SMT). There are two main problems in the reduction that we present novel and efficient solutions for. First, the formulation of the portability problem contains a quantifier alternation (consistent + inconsistent). We introduce a formula that encodes both in a single existential query. Second, the supported memory models (e.g., Power) contain recursive definitions. We compute the required least fixed point semantics for recursion (a problem that was left open in [47]) efficiently in SMT. Finally we present the first experimental analysis of portability from TSO to Power.

Motivation & Objective

• To address the challenge of detecting porting bugs in performance-critical code when moving between architectures with different memory models.
• To provide a scalable, automated method for verifying that all target-architecture executions are also valid under the source architecture’s memory model.
• To solve two key technical challenges: encoding quantifier alternation in portability checks and efficiently computing least fixed points in recursive memory model definitions.
• To enable verification of high-level program portability despite low-level code differences due to architecture-specific compilation.

Proposed method

• porthos reduces the portability analysis problem to satisfiability modulo theories (SMT), using a single existential query to encode the alternation between consistency on the target and inconsistency on the source.
• It introduces a novel SMT encoding for least fixed points in recursive memory model definitions (e.g., Power model), using integer difference logic to avoid costly unrolling.
• The tool projects low-level executions back to high-level program events via a function hlinst, ensuring semantic correspondence between compiled and source code.
• It formulates execution projection (execproj) as a conjunction of constraints ensuring event mapping, relation preservation (rf, co), and completeness.
• The approach avoids unsatisfiability checks for cyclicity by introducing auxiliary variables to guess cycles, reducing cycle detection to satisfiability.
• It supports user-defined memory models expressed in the CAT language, enabling analysis across diverse architectures like x86 (TSO) and Power.

Experimental results

Research questions

• RQ1 Can a single tool detect porting bugs across different weak memory models by verifying that all target executions are also valid on the source?
• RQ2 How can quantifier alternation in portability checks (consistent on target, inconsistent on source) be encoded efficiently in SMT?
• RQ3 What is an efficient SMT encoding for computing least fixed points in recursive memory model definitions, such as those in the Power memory model?
• RQ4 To what extent do differences in low-level compilation affect portability, and how can high-level semantics be preserved in analysis?

Key findings

• porthos successfully detects porting bugs by identifying executions that are valid under the target memory model (e.g., Power) but invalid under the source model (e.g., TSO).
• The tool’s SMT encoding for least fixed points in recursive memory models is significantly more efficient than naive unrolling, enabling scalable verification.
• The approach reduces the portability check to a single existential SMT query, avoiding the need for nested quantifier solving or unsatisfiability checks.
• The experimental analysis confirms that the proposed encoding for cycle detection via auxiliary variables is both correct and efficient in practice.
• The study shows that state-based portability is algorithmically harder (beyond SAT) but that the proposed execution-based definition yields comparable results empirically.