Scaling Model Checking of Dataraces Using
Dynamic Information
Ohad ShachamTel Aviv University
IBM Haifa Lab
Mooly SagivTel Aviv University
Assaf SchusterTechnion
Datarace Happens when two threads access a
memory location concurrently At least one access is a write
Unpredictable results Can indicate bugs Hard to detect Hard to reproduce
Datarace example
TicketPurchase(NumOfTickets){ if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else
Print “Full”; }
Datarace example
Thread I Thread II
TicketPurchase(2)
if (NumOfTickets · FreeTickets)
TicketPurchase(4)
if (NumOfTickets · FreeTickets)
FreeTickets -= NumOfTickets
FreeTickets -= NumOfTickets
{FreeTickets = -2}
{FreeTickets = 4}
TicketPurchase(NumOfTickets){ if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else
Print “Full”; }
Datarace example
TicketPurchase(NumOfTickets){ Lock(lockFreeTickets) if (NumOfTickets · FreeTickets) FreeTickets -= NumOfTickets else
Print “Full”; Unlock(lockFreeTickets) }
Datarace detection
Static datarace detection tools Racex [Engler and Ashcraft] TVLA [Sagiv et. al.]
Dynamic datarace detection tools: Lamport’s happens-before partial
order (Djit) Lock based techniques (Lockset)
Difficulties in model checking dataraces Infinite state space Huge number of interleavings Huge transition systems Size problem
Observation
Programs maintaining a locking discipline are dataraces free
Hybrid solution
Dynamically check a locking discipline
Produce witnesses for dataraces using a model checker Explore suffixes of the trace
Basic idea
Algorithm flow
Lockset
Multithreaded program
List of Warnings
Find a1
1 2
Model Checker
Lockset
Savage et. al. SOSP 1997 Lockset invariant
multiple accesses to a specific memory location are guarded by a unique lock
Lockset example
Lock(lockx)X = 7Unlock(lockx)Lock(locky)Z = Y
Lock(locky)Y = 2Unlock(locky)Lock(locky)Y = X
{lockx}
{locky}
{locky}
Thread I Thread II C(X)
{lockx, locky}{lockx}
{locky}
Unlock(locky)
Locks I Locks II
Lockset
Advantage Predict dataraces which may occur in
a different thread interleaving Disadvantages
Spurious dataraces Hard to use
Lack of trace
Lockset strength
Lock(lockx);X = 7;Unlock(lockx);Lock(locky);Z = Y;
Lock(locky);Y = 2;Unlock(locky);Lock(locky);Y = X;
{lockx}
{locky}
{locky}
Thread I Thread II C(X)
{lockx, locky}{lockx}
{locky}
Unlock(locky);
Locks I Locks II
Our hybrid solution
Combine Lockset & Model Checking Provide witnesses for dataraces
Rare dataraces Dataraces in large programs
Model CheckingProvide witnesses for rare DR
Locksetscale for large programs+
A witness for a datarace
a1
a2
1
2
ma1 = ma2 a1=Write Ç a2=Write
Required data from Lockset
X=7
Y=2
Z=Y
Y=X
Thread I Thread II
Lockset provides for each warning only a single access event a2
Find a prior access event a1 which can take part in a race with a2
a1
a2
Using Lockset data
Using Lockset data
X = 7
Z = Y
Y = 2
Y = X
A Warning on X
X=7
Z=Y
Y=2
Y=X
{lockx}
{locky}
{locky}
{locky}
Prefix
a1
a2
MODEL without t1
Building a model
a1
Using a model checker
a1
1
a2
Is a2 reachable by t2 ?
Using a model checker
a2
a1
a1
Reduce the model checker cost
Reduction in the model size Elimination of thread t1
Providing a single new initial configuration
Heuristically reducing the number of steps that the model checker should carry out
Example
Lock(lockx);X = 7;Unlock(lockx);Lock(locky);Z = Y;
Lock(locky);Y = 2;Unlock(locky);Lock(locky);Y = X;
{lockx}
{locky}
{locky}
Thread I Thread II C(X)
{lockx, locky}{lockx}
{locky}
Unlock(locky);
Lock(locky);Y = 2;Unlock(locky);Lock(locky);Y = X;
1
2
X = 7;
Locks I Locks II
Prototype implementation
A prototype tool based on IBM tools
Lockset – The IBM Watson tool Wolf – IBM Haifa’s software model
checker
Prototype implementation
Lockset
Multi-threaded program
List of Warnings
Find a1 Extend 1 Wolf
1 2
Benchmark programsProgramDescriptionLines
Tsptraveling salesman from ETH
706
Our_tspEnhanced traveling salesman
708
mtrtMultithreaded raytracer from specjvm98
3751
HedcWeb Crawler Kernel from ETH
29948
SortArrayParallel sort362
PrimeFinderFinds prime numbers in a given interval
129
ElevsimElevator simulator150
DQueriesShared DB simulator166
Experimental results
Program2 threads3 threads4 threadsTime (sec)
Memory (MB)
Time (sec)
Memory (MB)
Time (sec)
Memory (MB)
our_tsp35069
353 Mem Out Mem Out
SortArray569.31231334.93
396 Mem Out
PrimeFinder888.71162645.51434547.1168
ElevSim33.022867.9233147.948
DQueries140.160201.889585.97136
Hedc2.66117.3312917
tsp35243
377 Mem
Out Mem Out
Conclusion
Hybrid technique which combines dynamic datarace detector and a model checker
Provide witnesses for dataraces which occur only in rare interleavings
Helps the user in analyzing the datarace
No spurious dataraces
