Same Engine, Multiple Gears: Parallelizing Fixpoint Iteration at Different Granularities (Extended Version)

Fixpoint iteration constitutes the algorithmic core of static analyzers. Parallelizing the fixpoint engine can significantly reduce analysis times. Previous approaches typically fix the granularity of tasks upfront, e.g., at the level of program threads or procedures - yielding an engine permanently stuck in one gear. Instead, we propose to parallelize a generic fixpoint engine in a way that is parametric in the task granularity - meaning that our engine can be run in different gears. We build on the top-down solver TD, extended with support for mixed-flow sensitivity, and realize two competing philosophies for parallelization, both building on a task pool that schedules tasks to a fixed number of workers. The nature of tasks differs between the philosophies. In the immediate approach, all tasks access a single thread-safe hash table maintaining solver state, while in the independent approach, each task has its own state and exchanges data with other tasks via a publish/subscribe data structure. We have equipped the fixpoint engine of the static analysis framework Goblint with implementations following both philosophies and report on our results for large real-world programs.

💡 Research Summary

This paper, titled “Same Engine, Multiple Gears: Parallelizing Fixpoint Iteration at Different Granularities,” presents a novel approach to parallelizing the fixpoint iteration algorithm that forms the computational core of static analyzers based on abstract interpretation. The central critique of existing methods is that they predetermine and fix the granularity of parallel tasks (e.g., at the level of program threads or procedures), resulting in an engine locked into a single, potentially suboptimal, operational mode.

To overcome this limitation, the authors propose a parallelization strategy that is parametric in task granularity. This allows the same fixpoint engine to operate in different “gears,” adapting the concurrency model to the specific characteristics of the program being analyzed. The foundation for this parallelization is an enhanced version of the top-down solver TD, called TL_TD. Key improvements include consolidating multiple data structures into one to reduce access overhead and introducing a top-level workset. This workset manages unknowns slated for iteration, replacing TD’s immediate recursive descent with a mechanism amenable to delayed or parallel execution.

The paper then introduces and contrasts two distinct philosophies for parallelizing the TL_TD solver, both employing a task pool that schedules tasks to a fixed set of worker threads. The difference lies in how solver state is managed:

1. The Immediate Approach: All worker tasks operate directly on a single, thread-safe hash table that holds the entire solver state. Access to individual unknowns is controlled via fine-grained synchronization, ensuring strong consistency but potentially introducing lock contention overhead.
2. The Independent Approach: Each task maintains its own local copy of the solver state. Tasks exchange information and updates through a separate publish/subscribe data structure. This reduces contention on shared state and improves locality but incurs overhead from state replication and asynchronous synchronization.

A crucial aspect of both approaches is that tasks are defined by “root” unknowns. The granularity of parallelism can be adjusted by choosing different sets of roots (e.g., thread start points, function entries), enabling the engine to switch “gears” based on the analysis context.

The authors have implemented both parallelization strategies within the fixpoint engine of the Goblint static analysis framework. They report on experimental evaluations using large real-world C programs, such as Linux kernel modules. The results demonstrate the practical viability of the approaches and provide insights into their performance characteristics. For instance, the immediate approach may suffer under high contention, while the independent approach might face memory overhead. The experiments also illustrate how the choice of task granularity (the “gear”) impacts analysis time, validating the core premise that a one-size-fits-all parallelization strategy is insufficient.

In summary, this work makes significant contributions by: (a) modifying the TD solver into TL_TD to better support parallel execution, (b) formalizing two competing state-management philosophies for parallel fixpoint solvers, and (c) providing an implementation and evaluation that shows the benefits of a parameterized, multi-gear approach to parallelizing static analysis. It advances the field by separating the concerns of analysis design from parallelization algorithm details, offering analysts flexible tools to accelerate fixpoint computations.