Verification of Static and Dynamic Barrier Synchronization using Bounded Permissions
Duy-Khanh LE, Wei-Ngan CHIN, Yong-Meng TEO {leduykha,chinwn,teoym} [at] comp.nus.edu.sg
15th International Conference on Formal Engineering Methods (ICFEM), Queenstown, New Zealand, Oct 29 - Nov 1 2013
Outline Background Motivation Objective Proposed Approach Bounded permissions Verification of static barriers Verification of dynamic barriers Experiments Related and Conclusion October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
2
Background: Software Barriers
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
3
Barriers in Mainstream Languages fixed number of participants
dynamic number of participants (can be changed)
Static Barriers
Dynamic Barriers
pthread_barrier_t (C/C++)
1990s
October 31, 2013
…
CyclicBarrier (Java 5)
Sep 2004
Barrier (.NET 4.0)
Apr 2010
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
Phaser (Java 7)
Jul 2011
4
Why Barriers are Important? [ISCA’95] All 12 programs use at least one barrier
[MoSB’09] All 5/13 programs
[SPLASH’11 workshop] Java FLOSS in SoureForge
[FSE’12] .NET repositories
[ICECCS’13] Java FLOSS in Qualitas Corpus
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
5
Motivation: Why Verifying Barriers? Barrier synchronization is commonly-used
Verifying correct barrier synchronization is useful Reduce false sharing [PACT’94], MHP analysis [IWOMP’05], data race detection [LCPC’05] But verifying correct barrier synchronization is hard, especially in fork/join programs, due to Correct number of participants (static vs dynamic) Correct phasing
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
6
Objective
Propose an approach for statically verifying correct synchronization of static and dynamic barriers in fork/join programs Bounded permissions + phase numbers Local/modular reasoning
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
7
Approach: Take-home Message - Permission accounting: partial vs. full - Permission control: read vs. write/destroy - Boundedness guarantee
Dynamic Barriers Static Barriers Bounded permissions (static #participants)
Phase numbers (Phasing)
Dynamic bounded permissions (Dynamic #participants)
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
8
Bounded Permissions: Def and Example Wanted: maximum 2 threads accessing x
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
9
Bounded Permissions: Def and Example (write/destroy) (read-only)
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
10
Bounded Permissions: Property
Bounded permission system is general In this paper, we use it to verify barrier synchronization
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
11
Verification of Static Barriers: Definition Definition 1 (Correct Synchronization) A program is correctly synchronized with respect to a static barrier b iff: There is exactly a predefined number of threads participating in the barrier b’s wait operations. Participating threads operate on b in the same numbers of phases. Bounded permissions + unit
October 31, 2013
Phase numbers
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
12
Verification of Static Barriers: Examples Bounded permissions
October 31, 2013
Phase number
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
13
Verification of Static Barriers: Formalism
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
14
Consistency of Static Barriers Supports for local reasoning: each procedure is verified separately once
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
15
Dynamic Barriers: Example 2 participants
2 participants 2+1=3 participants
2+1-1=2 participants 2+1-1-1=1 participants
1 participants
We need to capture this information modularly Dynamic Bounded Permissions October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
16
Dynamic Bounded Permissions
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
17
Verification of Dynamic Barriers: Example
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
18
Verification of Dynamic Barriers: Example
Each thread has a proportional share of a (important for soundness)
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
19
Verification of Dynamic Barriers: Example 2 participants 2 participants 2+1=3 participants
2+1-1=2 participants 2+1-1-1=1 participants
1 participants
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
20
Dynamic Barriers: Permission Rules Non-zero Proportional
2 full-participations
1 full-p + 1 drop-out
2 drop-outs
Re-order full permissions
Separation
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
21
Consistency of Dynamic Barriers
2 full-participations
1 full-p + 1 drop-out
Note: db-consistency subsumes b-consitency
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
22
Static Verification as Good Practice
correct but rejected
blocked
October 31, 2013
blocked
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
23
Experiments
Download or try VeriBSync online at http://loris-7.ddns.comp.nus.edu.sg/~project/veribsync/
Verifying all but one Reasonable verification time and annotation overhead October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
24
Related Work Access permissions No existing notion of boundedness Verification of barriers Most existing works [PPoPP’07, IWOMP’05, IFIP’94, LCPC’05] focus on SPMD programs Closely related work [LMCS’12] is heavy-weight • For partial correctness of programs with static barriers • Require a global specification
The first time verification is applied to dynamic barriers in fork/join programs Verification of X10’s clocks [CONCUR’05] and phasers [ICS’08] is in the context of async/finish of X10’s programs October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
25
Conclusion: Take-home - Permission accounting: partial vs. full - Permission control: read vs. write/destroy - Boundedness guarantee
Dynamic Barriers Static Barriers Bounded permissions (static #participants)
Phase numbers (Phasing)
Dynamic bounded permissions (Dynamic #participants) Good expressiveness when applying the prototype implementation, VeriBSync, to SPLASH-2 suite October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
26
Future Work Barrier synchronization vs partial correctness Resource redistribution Existential phase numbers Deadlock freedom of multiple barriers Correct synchronization w.r.t all barriers in a program Synthesis of barrier specification: partial correctness deadlock freedom October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
27
Examples Barrier synchronization vs partial correctness
Deadlock Freedom in the presence of multiple barriers barrier b1 = new barrier(2); barrier b2 = new barrier(2); Thread 1: Thread 2: wait(b1); wait(b2); October 31, 2013
wait(b2); wait(b1);
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
28
Q&A
THANK YOU
[email protected] Download or try VeriBSync online at http://loris-7.ddns.comp.nus.edu.sg/~project/veribsync/
END October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
29
References (1) [PACT’94] Jeremiassen, T.E., Eggers, S.J.: Static Analysis of Barrier Synchronization in Explicitly Parallel Programs. In: PACT, pp. 171–180 (1994) [IWOMP’05] Lin, Y.: Static Nonconcurrency Analysis of OpenMP Programs. In: Mueller, M.S., Chapman, B.M., de Supinski, B.R., Malony, A.D., Voss, M. (eds.) IWOMP 2005/2006. LNCS, vol. 4315, pp. 36–50. Springer, Heidelberg (2008) [LCPC’05] Kamil, A., Yelick, K.: Concurrency Analysis for Parallel Programs with Textually Aligned Barriers. In: Ayguad´e, E., Baumgartner, G., Ramanujam, J., Sadayappan, P. (eds.) LCPC 2005. LNCS, vol. 4339, pp. 185–199. Springer, Heidelberg (2006) [PPoPP’07] Zhang, Y., Duesterwald, E.: Barrier Matching for Programs with Textually Unaligned Barriers. In: PPoPP, pp. 194– 204 (2007) October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
30
References (2) [LMCS’12] Hobor, A., Gherghina, C.: Barriers in concurrent separation logic: Now with tool support? Logical Methods in Computer Science 8(2) (2012) [CONCUR’05] Saraswat, V.A., Jagadeesan, R.: Concurrent Clustered Programming. In: Abadi, M., de Alfaro, L. (eds.) CONCUR 2005. LNCS, vol. 3653, pp. 353–367. Springer, Heidelberg (2005) [ICS’08] Shirako, J., Peixotto, D.M., Sarkar, V., Scherer III, W.N.: Phasers: A Unified Deadlock-free Construct for Collective and Point-to-point Synchronization. In: ICS, pp. 277–288 (2008)
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
31
Backup Slides and miscellaneous stuff
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
32
Background: Software Barriers Barrier Usage
Static barriers fixed number of participants e.g. pthread_barrier_t, CyclicBarrier in Java Dynamic barriers dynamic number of participants (can be changed) e.g. Barrier in .NET, Phaser in Java October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
33
Motivation: Why Barriers? Barrier synchronization is ubiquitous Mainstream languages such as C/C++ (with Pthreads), Java, .NET Barriers are used often • SPLASH-2 : all 12 programs use at least 1 barrier, 5 of them use more than 1 barrier • PARSEC-2.1 : 5 out of 13 programs • Real-world projects
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
34
Programming Language
(Syntactic sugar) parallel composition: October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
35
Background: Separation Logic (SL) A logic for reasoning about resources SL + permissions for local reasoning about shared resources Empty heap: Singleton heap: Permission-based heap: (full vs partial) Frame rule:
Parallel composition rule: Note: s || no-op;
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
36
Verification of Static Barriers Definition 1 (Correct Synchronization) A program is correctly synchronized with respect to a static barrier b iff: There is exactly a predefined number of threads participating in the barrier b’s wait operations. Participating threads operate on b in the same numbers of phases. Our methodology: Using phase numbers for phasing Using bounded permissions for participating but bounded permissions alone can only ensure “at most”, but “exactly” Solution: unit permission as the basis to wait on a barrier October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
37
Verification of Static Barriers: Example
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
38
Soundness of Dynamic Bounded Permissions
Naïve splitting 3,2,1
2,2,0 (Full)
October 31, 2013
Our sound splitting 3,2,1
(Full)
1,2,1 (Partial)
2,2,2/3
(Full)
1,2,1/3
(Partial)
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
(Partial)
39
Related Work: Access Permissions
Fractional permissions
Counting permissions
Bounded permissions
1.0
0
3,3
0.4
0.6
0.2 ... ...
-1 ...
-2
1 1
Unbounded splitting
October 31, 2013
2,3
1,3
1,3
1,3
Bounded splitting
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
40
Conclusion An approach to verifying static and dynamic barrier synchronization in fork/join programs Bounded permissions + phase numbers Bounded permissions for reasoning a bounded number of concurrent accesses Expressiveness when applying the prototype implementation, VeriBSync, to SPLASH-2 suite
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
41
END
October 31, 2013
Verification of Static and Dynamic Barrier Synchronization Using Bounded Permissions
42