Detecting Atomicity Violations via Access Interleaving Invariants AVIO Detecting Atomicity Violations via Access Interleaving Invariants S. Lu, J. Tucek, F. Qin and Y. Zhou UIUC

Outline Introduction Algorithm Implementation Evaluation Conclusion

Motivation Concurrency bugs hard to detect Appear only with specific interleaving Hard to detect during development Or even to repeat for post-mortem analysis CMP architecture is only going to make matters worse

Problem Tools like LockSet and Happens Before not enough Some buggy programs are actually race-free. Too many false positive Data Races NOT always bug! (benign races) Require knowledge of program synchronization semantics Barriers etc cause headaches

Problem - Example Race-free but buggy program. Data-Race detection is not enough What programmers want is not race-free program, but atomicity! What actually happened What the programmer wanted

AVIO idea - Atomicity ATOMICITY: The data manipulation of concurrently executed actions is equivalent to that of some serial execution of them Using locks, the programmer is actually trying to enforce atomicity. Bugs come from violation of unconscious atomicity intention

Access-Interleaving (AI) Invariance If an access to a variable and the previous access to the same variable from the same thread are NEVER interleaved unserializably (example a), then we have an Access-Interleaving Invariance. Example b cannot be interleaved serializably.

Access-Invariant Violation Violation of Access-Invariant when the programmer wanted atomic access, but failed to ensure that with locks, or other mechanisms Atomicity Violation types: P 1: Read X 1: Write X 2: Write X 2: Read X I

Access-Invariant Violation (cont)

Capturing Atomicity Intention AVIO automatically extracts AI invariants Run the program N times N different interleaves will probably be produced If the atomicity of two consecutive accesses to the same variable from the same thread has been violated at least T times, assume that the programmer does NOT wish atomic access. T times will ensure that a bug will not be considered acceptable.

Capturing Atomicity Intention

AVIO Implementation 2 implementations: Hardware Software The hardware implementation is fast, but coarse-grained The software is fine-grained, but sloooooow.

AVIO-H(ardware) CMP, physically indexed (?) private L1, unified L2. Invalidation-based cache coherence protocol Minimal changes to L1 (0.4% space increase) and the coherence protocol Add bit to I-instructions to identify them and notify L1

AVIO-H cont. INV=1: someone recently wrote to this line and invalidated my copy DG=1: someone downgraded my exclusive rights. PI: type of previous instr. of the same thread accessing the same line. Note: unserializable access must contact L2 to either get the copy, or upgrade rights → hide latency

AVIO-H drawbacks False sharing Padding, or increase granularity (at the expense of space) Cache Evictions, Context Switches, load-store queue, write-coalescing Happen way too rare, improbable between two accesses that were supposed to be atomic → Sweep, sweep, sweep and under the rug. It will catch violations caused by OoO issues Wait till retirement to raise the exception PREFETCH? What if someone prefetches X (and downgrades my rights) and does not use it?

AVIO-S(oftware) Pin binary instrumentation tool More precise than the AVIO-H, deals with the problems of the latter. Obviously, far more slower.

Evaluation - Platform AVIO-S runs on 4 Intel processors (which ones?) AVIO-H on Simics/SimFlex 4 core CMP, in-order x86, cycle-accurate 0.4% slowdown due to increased L1-size T = 0, during 100 training runs (with different inputs)

Evaluation – Applications tested

Evaluation – Bug Detection Detects more bugs than other methods Note that AVIO was trained on different inputs.

Evaluation – False Positives Less false positives than all other methods AVIO-S better than AVIO-H T = 0 can mask bugs, if bugs occurred during training runs

Evaluation - Overhead AVIO-H has minimum overhead (0.5%) AVIO-S better than other methods (25x)

Evaluation – Training Sensitivity 100 training runs seem to be enough.

AVIO Drawbacks Mainly the same problems with profilers: If initial input not correctly chosen, or not all path exercised, AVIO will fail. Unable to detect atomicity violations that involve multiple variables (as most tools) (Software) Training overhead could be problematic

Conclusion AVIO is a fast tool to detect atomicity violations AVIO-H may be worth its hardware cost As long as training overhead (not reported) remains reasonable. Questions