1 Thread Modular Model Checking Cormac Flanagan Systems Research Center HP Labs Joint work with Shaz Qadeer (Microsoft Research)

2 Multithreaded software Operating systems, databases, web servers, file systems, device drivers, GUI,... Correctness problem: –does the program satisfy its specification for all inputs and all interleavings ? Testing particularly weak for multithreaded software Need model checkers for multithreaded software

3 State explosion Large/infinite domains –eg. integers Infinite stack Many threads Predicate abstraction + iterative refinement SLAM, BLAST, Verifun Thread Modular Model Checking

4 Simple multithreaded program Thread 1 1: acquire(m) 2: x := 0 3: x := x + 1 4: assert x > 0 5: release(m) 6: stop Mutex m; int x := 1; Shared state H = Mutex  int Local state L tid = program counter State space Q = H  L 1 ...  L n Model checking space: O( |H|.|L| n ) Thread 2 1: acquire(m) 2: assert x > 0 3: release(m) 4: stop Thread n

5 Avoiding state explosion H L1L1 L2L2 Standard MC Space: O( |H|.|L| n ) Thread modular MC H L2L2 H L1L1 G 1  H  H guaranteeassume G 2  H  H guaranteeassume  Space: O(n.|H|.|L| + n.|H| 2 )

6 Mutex implementation Thread tid 1: acquire(m) 2: x := 0; 3: x := x + 1 4: assert x > 0 5: release(m) 6: stop int x := 1; Mutex m := 0; Mutex m = tid, if held by thread tid 0, if unheld (m=0  m’=tid) m m := 0 Guarantee G tid : (m!=tid  x’=x)  (m’=0  x’=1)  (m!=0  m!=tid  m’=m)

7 H L2L2 H L1L1 G 1  H  H guaranteeassume G 2  H  H guaranteeassume Thread modular checking of Thread 1 Abstraction for Thread 1 (m=0  m’=1) m ; x := 0; x := x + 1; assert x > 0; (m’=0) m ; * * * * * Model check abstraction for Thread 1 Also guarantee steps satisfy G 1 Repeat for other threads  Program is OK Thread tid 1: (m=0  m’=tid) m 2: x := 0; 3: x := x + 1 4: assert x > 0 5: m := 0 6: stop G 2  ; (m=0  m’=1) m ; G 2  ; x := 0; G 2  ; x := x + 1; G 2  ; assert x > 0; G 2  ; (m’=0) m ;

8 Calvin Checker Thread modular checker for multithreaded software –uses ESC/Java as back end Applications –Apprentice challenge ( 50 LOC) –java.util.Vector ( 400 LOC) –part of Mercator web crawler (1500 LOC) –Daisy file system (1500 LOC) Thread modular reasoning works well provided you can write suitable thread guarantees Can we infer thread guarantees?

9 Inferring thread guarantees H L2L2 H L1L1 G 1  H  H G 2  H  H guaranteeassume Thread 1 1: (m=0  m’=1) m 2: x := 0; 3: x := x + 1 4: assert x > 0 5: m := 0 6: stop guarantee infer infer R 1 = { (m=0,x=1,pc=1) } R 2 = { (m=0,x=1,pc=1) } G 1 = { } G 2 = { } (m=1,x=1)  (m=1,x=0) (m=0,x=1,pc=1)  1 (m=1,x=1,pc=2) (m=1,x=0,pc=3) (m=1,x=1,pc=2) (m=1,x=1,pc=1) (m=0,x=1)  (m=1,x=1)

10 Algorithm R t (H Init, L t Init ) R t (H, L t ) (H, L t )  t (H’, L t ’) R t ( H’, L t ’ ) G t (H, H’) R t (H, L t ) G u (H, H’) u != t R t (H’, L t ) Find least R t  H  L t, G t  H  H such that

11 Inferring thread guarantees H L2L2 H L1L1 G 1  H  H G 2  H  H guaranteeassume Thread 1 1: (m=0  m’=1) m 2: x := 0; 3: x := x + 1 4: assert x > 0 5: m := 0 6: stop guarantee infer infer G 1 = { } G 2 = { } (m=2,x=1)  (m=2,x=1) (m=2,x=1)  (m=0,x=1) (m=0,x=1)  (m=2,x=1) (m=1,x=1)  (m=1,x=0) (m=1,x=0)  (m=1,x=1) (m=1,x=1)  (m=1,x=1) (m=1,x=1)  (m=0,x=1) (m=0,x=1)  (m=1,x=1) Thread 2 1: (m=0  m’=2) m 2: assert x > 0 3: m := 0 4: stop

12 Inferring thread guarantees H L2L2 H L1L1 G 1  H  H G 2  H  H guaranteeassume Thread 1 1: (m=0  m’=1) m 2: x := 0; 3: x := x + 1 4: assert x > 0 5: m := 0 6: stop guarantee infer infer G 1 = { } G 2 = { } (m=2,x=1)  (m=2,x=1) (m=2,x=1)  (m=0,x=1) (m=0,x=1)  (m=2,x=1) (m=1,x=1)  (m=1,x=0) (m=1,x=0)  (m=1,x=1) (m=1,x=1)  (m=1,x=1) (m=1,x=1)  (m=0,x=1) (m=0,x=1)  (m=1,x=1) Hand-written guarantee G tid : (m!=tid  x’=x)  (m’=0  x’=1)  (m!=0  m!=tid  m’=m)

13 Soundness and Completeness Thread modular reasoning is sound Thread modular reasoning is not complete “Complete enough” for loosely-computed threads –no need for tight correlation of PCs Modeling mutexes as Tid + {0} crucial –guarantee G tid : (m!=tid  x’=x)  (m’=0  x’=1)  (m!=0  m!=tid  m’=m) –cannot model mutexes as {0,1}

14 One bit mutexes do not work! H L2L2 H L1L1 G 1  H  H G 2  H  H guaranteeassume Thread 1 1: (m=0  m’=1) m 2: x := 0; 3: x := x + 1 4: assert x > 0 5: m := 0 6: stop guarantee infer infer G 1 = { } R 2 = { } (m=0,x=1,pc=1) Thread 2 1: (m=0  m’=1) m 2: assert x > 0 3: m := 0 4: stop (m=1,x=1,pc=2) (m=1,x=0,pc=2) (m=1,x=1)  (m=1,x=0)

15 Adding procedure calls Standard MC Each thread has stack S tid Q = H  (L 1  S 1 ) ...  (L n  S n ) Undecidable H L 1 L 2 S 1 S 2 H L2L2 H L1L1 G 1  H  H G 2  H  H guaranteeassume guaranteeassume S1S1 S2S2 Thread modular MC Decidable

16 Related work Jones 83 –parallel shared-memory programs –requires manual specification of guarantee –plus Hoare-style triples Misra-Chandy 81 Abadi-Lamport 85 Alur-Henzinger 96 McMillan 97

17 Future Work Large/infinite domains –eg. integers Infinite stack Many threads Predicate abstraction + iterative refinement SLAM, BLAST, ESC, Verifun, MAGIC Thread Modular Model Checking Combine thread modular checking with predicate abstraction and iterative refinement Verifun BLAST SLAM