Software Correctness Verification on Relaxed Memory Hardware

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing approaches have not been able to effectively prove the correctness of systems software on Arm relaxed memory hardware, which poses a growing security risk due to the complexity of system software and memory access bottlenecks.

Innovation Solution

The mechanisms involve evaluating software using a sequentially consistent hardware model and a relaxed memory hardware model, with conditions such as data-race-free kernel, no-barrier-misuse, memory-isolation, transactional-page-table, write-once-kernel-mapping, and weak-memory-isolation conditions to determine software correctness, using proof assistants like Coq to verify kernel-level system software and ensure synchronization and memory access properties.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If relaxed memory hardware is used to alleviate memory access bottlenecks, then memory access performance is improved, but software correctness verification becomes impossible with existing approaches

Engineering Contradiction:

Improvememory access performanceVSAvoidsoftware correctness verification

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent introduces an intermediary verification framework that bridges relaxed memory hardware and formal verification. This framework uses memory models as intermediaries to translate relaxed memory behaviors into verifiable properties, enabling correctness verification while maintaining performance benefits. The verification framework acts as a mediator between the hardware relaxation and software correctness requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent changes the verification parameters by introducing new verification conditions specifically designed for relaxed memory models. Instead of using traditional sequential consistency assumptions, the system verifies software under relaxed memory semantics with modified correctness criteria that account for reordering and relaxation behaviors while ensuring operational correctness.

Inventive Principle:

Principle #35Parameter changes

2Reliability

If formal verification is applied to ensure software correctness, then security and reliability are improved, but the complexity of verification increases significantly

Engineering Contradiction:

Improvesoftware correctnessVSAvoidverification complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the verification process into distinct modular components: memory model verification, synchronization primitive verification, and high-level correctness verification. This segmentation allows each component to be verified independently using appropriate methods and tools, reducing overall verification complexity while maintaining comprehensive correctness guarantees.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The verification framework employs self-service mechanisms where the system automatically generates verification conditions, selects appropriate verification methods, and performs correctness checks without requiring manual intervention for each verification task. This automation reduces the complexity burden on users while maintaining rigorous verification standards.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If sequential consistency model is used for verification, then verification simplicity is improved, but the model does not reflect actual relaxed memory hardware behavior

Engineering Contradiction:

Improveverification simplicityVSAvoidhardware model accuracy

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The patent implements a dynamic verification approach that adapts the verification model to match the actual hardware execution model. The system can switch between different memory model assumptions and verification strategies based on the specific hardware architecture and software requirements, providing both simplicity when possible and accuracy when needed.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS12079102B2Systems, methods, and media for proving the correctness of software on relaxed memory hardware

Publication Date: 2024.09.03 THE TRUSTEES OF COLUMBIA UNIV IN THE CITY OF NEW YORK

AI summary

Mechanisms for proving the correctness of software on relaxed memory hardware are provided, the mechanisms comprising: receiving a specification, a hardware model, and an implementation for the software to be executed on the relaxed memory hardware; evaluating the software using a sequentially consistent hardware model; evaluating the software using a relaxed memory hardware model and at least one of the following conditions: a data-race-free (DRF)-kernel condition; a no-barrier-misuse condition; a memory-isolation condition; a transactional-page-table condition; a write-once-kernel-mapping condition; and a weak-memory-isolation condition; and outputting an indication of whether the software is correct based on the evaluating the software using the sequentially consistent hardware model and the evaluating the software using the relaxed memory hardware model.