1. Scaling Model Checking of Dataraces Using Dynamic Information Ohad Shacham Tel Aviv University IBM Haifa Lab Mooly Sagiv Tel Aviv University Assaf Schuster Technion

2. Datarace Happens when two threads access a memory location concurrently At least one access is a write Unpredictable results Can indicate bugs Hard to detect Hard to reproduce

3. Datarace example TicketPurchase(NumOfTickets) { if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else Print “ Full ” ; }

4. Datarace example Thread IThread II TicketPurchase(2) if (NumOfTickets · FreeTickets) TicketPurchase(4) if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets {FreeTickets = -2} {FreeTickets = 4} TicketPurchase(NumOfTickets) { if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else Print “ Full ” ; }

5. Datarace example TicketPurchase(NumOfTickets) { Lock(lock FreeTickets ) if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else Print “ Full ” ; Unlock(lock FreeTickets ) }

6. Datarace detection Static datarace detection tools Racex [Engler and Ashcraft] TVLA [Sagiv et. al.] Dynamic datarace detection tools: Lamport ’ s happens-before partial order (Djit) Lock based techniques (Lockset)

7. Difficulties in model checking dataraces Infinite state space Huge number of interleavings Huge transition systems Size problem

8. Observation Programs maintaining a locking discipline are dataraces free

9. Hybrid solution Dynamically check a locking discipline Produce witnesses for dataraces using a model checker Explore suffixes of the trace

10. Basic idea

11. Algorithm flow Lockset Multithreaded program List of Warnings Find a 1 11 22 Model Checker

12. Lockset Savage et. al. SOSP 1997 Lockset invariant multiple accesses to a specific memory location are guarded by a unique lock

13. Lockset example Lock(lock x ) X = 7 Unlock(lock x ) Lock(lock y ) Z = Y Lock(lock y ) Y = 2 Unlock(lock y ) Lock(lock y ) Y = X  {lock x }  {lock y }  Thread IThread IIC(X) {lock x, lock y } {lock x }   {lock y } Unlock(lock y ) Locks I Locks II

14. Lockset Advantage Predict dataraces which may occur in a different thread interleaving Disadvantages Spurious dataraces Hard to use Lack of trace

15. Lockset strength Lock(lock x ); X = 7; Unlock(lock x ); Lock(lock y ); Z = Y; Lock(lock y ); Y = 2; Unlock(lock y ); Lock(lock y ); Y = X;  {lock x }  {lock y }  Thread IThread IIC(X) {lock x, lock y } {lock x }   {lock y } Unlock(lock y ); Locks I Locks II

16. Our hybrid solution Combine Lockset & Model Checking Provide witnesses for dataraces Rare dataraces Dataraces in large programs Model Checking Provide witnesses for rare DR Lockset scale for large programs+

17. A witness for a datarace a1a1 a2a2 11 22 m a 1 = m a 2 a 1 =Write Ç a 2 =Write

18. Required data from Lockset X=7 Y=2 Z=Y Y=X Thread IThread II

19. Lockset provides for each warning only a single access event a 2 Find a prior access event a 1 which can take part in a race with a 2 a1a1 a2a2 Using Lockset data

20. X = 7 Z = Y Y = 2 Y = X A Warning on X X=7 Z=Y Y=2 Y=X {lock x } {lock y }

21. Prefix a1a1 a2a2

22. MODEL without t 1 Building a model a1a1

23. Using a model checker a1a1 11 a2a2 Is a 2 reachable by t 2 ?

24. Using a model checker a2a2 a1a1 a1a1

25. Reduce the model checker cost Reduction in the model size Elimination of thread t 1 Providing a single new initial configuration Heuristically reducing the number of steps that the model checker should carry out

26. Example Lock(lock x ); X = 7; Unlock(lock x ); Lock(lock y ); Z = Y; Lock(lock y ); Y = 2; Unlock(lock y ); Lock(lock y ); Y = X;  {lock x }  {lock y } Thread IThread IIC(X) {lock x, lock y } {lock x }   {lock y } Unlock(lock y ); Lock(lock y ); Y = 2; Unlock(lock y ); Lock(lock y ); Y = X; 11 22 X = 7; Locks I Locks II

27. Prototype implementation A prototype tool based on IBM tools Lockset – The IBM Watson tool Wolf – IBM Haifa ’ s software model checker

28. Prototype implementation Lockset Multi-threaded program List of Warnings Find a 1 Extend  1 Wolf 11 22

29. Benchmark programs LinesDescriptionProgram 706 traveling salesman from ETH Tsp 708 Enhanced traveling salesman Our_tsp 3751 Multithreaded raytracer from specjvm98 mtrt 29948 Web Crawler Kernel from ETH Hedc 362 Parallel sort SortArray 129 Finds prime numbers in a given interval PrimeFinder 150 Elevator simulator Elevsim 166 Shared DB simulator DQueries

30. Experimental results 4 threads3 threads2 threadsProgram Memory (MB) Time (sec) Memory (MB) Time (sec) Memory (MB) Time (sec) Mem Out 35335069 our_tsp Mem Out3961334.93123569.3 SortArray 1684547.11432645.5116888.7 PrimeFinder 48147.93367.922833.02 ElevSim 136585.9789201.860140.1 DQueries 179127.33112.66 Hedc Mem OutOut Mem37735243 tsp

31. Conclusion Hybrid technique which combines dynamic datarace detector and a model checker Provide witnesses for dataraces which occur only in rare interleavings Helps the user in analyzing the datarace No spurious dataraces