Shaz Qadeer Microsoft Research One Microsoft Way Redmond

Shaz Qadeer Microsoft Research One Microsoft Way Redmond, WA 98052 Dinghao Wu Department of Computer Science Princeton University Princeton, NJ 08544 1 Guy Martin, OSLab, GNU 09 [Qa. Wu 04] KISS: KEEP IT SIMPLE AND SEQUENTIAL

AGENDA Background KISS, Keep It Simple and Sequential [Qa. Wu 04] An Overview Instrumentation Procedure The Architecture Abstract SLAM, an overview A Parallel Language for KISS, Program Transformation Race Detection KISS, Evaluation Related Work Conclusion 2

BACKGROUND Thesis: Existing Model Checking methods for bugs detection in concurrent programs have high computational complexity. Why? Because they are thread interleaving-based. Exploration of all possible thread interleaving which increases their complexity since the number of thread interleaving also increases exponentially with the number of threads. Solution: KISS, translates a concurrent program P into a sequential program P’ that simulates the execution of a large subset of the behaviors of P. [Qa. Wu 04] 3

KISS, AN OVERVIEW T 1 T 2 Tn Multithreaded Program Each Thread has its own Execution Stack [Qa. Wu 04] T 2 Sequential Program: Single Stack The frame of the stack is partitioned into contiguous blocks: one block per thread. Tn The generated sequential program simulates the original concurrent program and runs under the control of a nondeterministic scheduler. 4

KISS, AN OVERVIEW 2 -functions based nondeterministic scheduler Terminate [Qa. Wu 04] or resume a thread execution Call another thread by its starting function Stack-based algorithm with 2 main ideas Nondeterministic termination of a thread at any time during its execution usage of a Boolean raise 1 Schedule a nondeterministic chosen number of existing threads at any time during the executing time usage of variable set ts 2 1 Encodes 2 Is The number of simulated behaviors of P depends deeply of the size of the global state space of P’ the effect of raising an exception, initialized to false and precedes every statement in a function. a bounded-size multiset of the starting functions of threads that have been forked but not scheduled. 5

KISS, INSTRUMENTATION PROCEDURE Whenever the concurrent program invokes the function f asynchronously, f is added to ts if ts is not full. The execution of f happens later If the set ts is full, then the asynchronous call to f is replaced with a synchronous call to f, thus executing it immediately. [Qa. Wu 04] The instrumentation code nondeterministically chooses a function from the set ts, invokes it, and sets raise to false when it returns. 6

KISS, THE ARCHITECTURE Concurrent C Program [Qa. Wu 04] Instrumentation Sequential C Program SLAM Error Trace No Bug Found 7

KISS, ABSTRACT KISS reduces parallel analysis into sequential analysis By simulates a subset of parallelism in P Simulation [Qa. Wu 04] P’ translating a multithreaded program P into a sequential program P’ by P’ uses its own stack-based nondeterministic scheduler The generated sequential P’ program is analyzed in the SLAM model checker. 8

SLAM, AN OVERVIEW The goal of the SLAM 1 project is to check whether or not a program obeys "API usage rules" that specify what it means to be a good client of an API. The SLAM toolkit statically analyzes a C program to determine whether or not it violates given usage rules. The toolkit has two unique aspects: [Qa. Wu 04] it does not require the programmer to annotate the source program (invariants are inferred); it minimizes noise (false error messages) through a process known as “counterexample-driven refinement“ SLAM exploits and extends results from program analysis, model checking and automated deduction. 1 Cf. [Ba. Ra 02] 9

A PARALLEL LANGUAGE FOR KISS async vo() creates a new thread whose starting function is the value of vo asume(vo) blocks until variable vo becomes true atomic{s} executes just like s except that the execution may not be interrupted in the middle by other thread Lock procedures [Qa. Wu 04] function names f : : = f 0 | f 1 |. . . integers i : : =. . . | − 1 | 0 | 1 |. . . boolean constants b : : = true | false constants c : : = i | b | f primitives op : : = + | − | × | == variables v : : = v 0 | v 1 |. . . values u : : = v | c statements s : : = v 0 = c | v 0 = &v 1 | v 0 = ∗v 1 | ∗v 0 = v 1 | v 0 = v 1 op v 2 | assert (v 0) | assume(v 0) | atomic{s} | v = v 0() | async v 0() | return | s 1; s 2 | choice{s 1 []. . . [] sn} | iter{s} lock_acquire(l) = atomic{assume(*l==0); *l=1; } def lock_release(l) = atomic{*l=0; } Loop statements def if (v) s 1 else s 2 = choice{assume(v); s 1 [] assume(￢v); s 2} def while (v) s def = iter{assume(v); s}; assume(￢v) def 10

KISS, PROGRAM TRANSFORMATION Definitions A concurrent program is one expressible in the previous parallel language A sequential program is one expressible in the previous parallel language without using asynchronous function calls and atomic statements. [[. ]] is used to translate a concurrent program into a sequential program For any statement s, [[s]] is a statement without any asynchronous function calls and synchronization statements. For any function f with body s, a new function [[f]] is introduced with body [[s]] [Qa. Wu 04] 11

KISS, PROGRAM TRANSFORMATION = schedule(); choice{skip [] RAISE}; v 0 = c = schedule(); choice{skip [] RAISE}; v 0 = &v 1 = schedule(); choice{skip [] RAISE}; v 0 = ∗v 1 = schedule(); choice{skip [] RAISE}; ∗v 0 = v 1 = schedule(); choice{skip [] RAISE}; v 0 = v 1 op v 2 = schedule(); choice{skip [] RAISE}; assert (v 0) = schedule(); choice{skip [] RAISE}; assume(v 0) = schedule(); choice{skip [] RAISE}; s = schedule(); choice{skip [] RAISE}; v = [[v 0]](); if (raise) return = schedule(); choice{skip [] RAISE}; if (size() < MAX) put(v 0) else {[[v 0]](); raise = false} [[return]] = schedule(); return [[s 1; s 2]] = [[s 1]]; [[s 2]] [[choice{s 1[]. . . []sn}]] = choice{[[s 1]] []. . . [] [[sn]]} [[iter{s}]] = iter{[[s]]} Instrumentation for assertion checking [Qa. Wu 04] [[v 0 = c]] [[v 0 = &v 1]] [[v 0 = ∗v 1]] [[∗v 0 = v 1]] [[v 0 = v 1 op v 2]] [[assert (v 0)]] [[assume(v 0)]] [[atomic{s}]] [[v = v 0()]] [[async v 0()]] 12

KISS, PROGRAM TRANSFORMATION def Check(s) Complexity 1 for Model Checking O(|C|. 2 g+l ) Theorem 1 (Completeness). Suppose the multiset ts is unbounded. If a balanced execution of a concurrent program s goes wrong by failing an assertion, then the sequential program Check(s) also goes wrong, and vice versa. 1|C|size = raise = false; ts = ∅; [[s]]; schedule(); of the control-flow graph, g is the number of global variables and l max number of local variables. [Qa. Wu 04] The maximum size of ts determines the number of possible executions of the original program that can be simulated by the translated program. 13

RACE DETECTION News variable & functions are added Access equals 0: no access, 1: read access, 2: write access checkr(x) checks that there is no race on r due to a read of the address contained in x checkw(x) checks that there is no race on r due to a write to the address contained in x. [Qa. Wu 04] An assertion in one of these calls is violated only if there are conflicting (read/write or write/write) accesses by two different threads. def Check(s) = raise = false; ts = ∅; access = 0; [[s]]; schedule(); If an assertion is violated in Check(s), there is an execution of s in which either an assertion is violated or there is a race condition on r. 14

KISS, EVALUATION Driver KLOC Fields Races # Races Driver Races 0 0. 5 3 0 3 Moufiltr 1. 0 14 7 7 Kbfiltr 0 Kbfiltr 1. 1 15 8 7 Imca 1. 1 5 1 4 Toaster/toastmon 1 Startio 1. 1 9 0 9 Diskperf 0 Toaster/toastmon 1. 4 8 1 7 1394 diag 1 Diskperf 2. 4 16 2 14 1394 vedv 1 1394 diag 2. 7 18 1 17 Fakemodem 6 1394 vedv 2. 8 18 1 17 Gameenum 1 Fakemodem 2. 9 39 6 31 Serenum 2 5 Gameenum 3. 9 45 11 24 Toaster/func Toaster/bus 5. 0 30 0 22 Mouclass 1 Serenum 5. 9 41 5 21 Kbdclass 1 1 9 Toaster/func 6. 6 24 7 17 Mouclass 7. 0 34 1 32 Fdc Kbdclass 7. 4 36 1 33 Total Mouser 7. 6 34 1 27 Second evaluation: The number of reported data races went down. Some useful information from developers have been used. Total 9. 2 92 18 54 69. 6 481 71 346 First evaluation: Many false alarms and benign Data races reported. Experiments are performed on a 2. 2 GHz PC running Windows XP Many spurious alarms and benign data races reported Flexible Solution Implementation 30 Can support many synchronization mechanisms Environment Modeling Flexible mechanisms for writing experiments Specification Mouser Fdc [Qa. Wu 04] tracedrv Moufiltr General assertion checker for concurrent program which can check other properties than races freedom 15

RELATED WORK Model Checking: Systematic exploration of the state space of a model of the concurrent program(SPIN, JPF, Bandera, Bogor, etc. ) Exponential number of state to analyze Static Analysis: tools typically based on type systems and dataflow analysis (Warlock, Rcc. Java, ESC/Java, etc. ) Less precise but more scalable than model checkers Dynamic Analysis: Instrumentation & execution of the program(Eraser, happens-before tools, etc. ) Small coverage of the program and high overhead Others: static analysis focusing on the synchronous messagepassing mechanism(Bouajjani et al) Not automated verification method [Qa. Wu 04] 16

CONCLUSION New technique which transform a concurrent program into a sequential program which simulates a large subset of the behaviors of the concurrent program Implementation in KISS, an automated checker for multithreaded C program built on top of SLAM Further work [Qa. Wu 04] Adaptation on other tools like PREfix, MC, ESP and BLAST Solve the problem of benign races by allowing programmers to annotate an access like benign or by using the ideas behind the type system for atomicity for automatic pruning of such benign race conditions. 17

KISS, LIMITATIONS Analysis of a subset of the concurrent program behavior The number of simulated behaviors of P depends deeply of the size of the global state space of P’. The stack size of the generated sequential program increase with the number of concurrent threads. [Qa. Wu 04] Hard limit on number of explored contexts e. g. , two context switches for 2 -threaded concurrent program Many spurious alarms and benign data races reported The model checking’s complexity which can be very high O(|C|. 2 g+l ) 18

THANK YOU FOR YOUR ATTENTION [Qa. Wu 04] 19