Accelerating Dynamic Data Race Detection Using Static Thread Interference Analysis

Transcription

1 Accelerating Dynamic Data Race Detection Using Static Thread Interference Peng Di and Yulei Sui School of Computer Science and Engineering The University of New South Wales 2052 Sydney Australia March 12-13, / 18

2 Outline Motivation phases Evalution 1 / 18

3 Dynamic Data Race Detector: ThreadSanitizer ThreadSanitizer (TSan) finds data races in multithreaded programs by inserting instrumentations at compile-time to perform runtime checks for all memory accesses. void foo(int *p) { *p = 42; } Orignial C code void foo(int *p) { tsan_func_entry( builtin_return_address(0)); tsan_write4(p); *p = 42; tsan_func_exit(); } Code after instrumentation 2 / 18

4 TSan performance slowdown over native code for SPLASH2 benchmarks (under compiler option -O0) 4 Threads 16 Threads 40 x 20 x 0 x barnes fft lu cb lu ncb ocean cp ocean ncp radiosity radix raytrace water nsquared water spatial average Machine: Ubuntu Linux generic Intel Xeon Quad Core HT, 3.7GHZ, 64GB 3 / 18

5 Outline Motivation phases Evalution 3 / 18

6 Framework Source Clang Front-End bc file Analyses s bc file Memory Pairs Collection Call Graph Construction Reachability Memory pairs Reachable pairs Interleaving Interleaving MHP pairs Pointer Alias Aliased pairs Thread-Local Thread-Local Lockset Lockset Escaped pairs Unlocked pairs Guided Instrumentation Instrumented bc file Code Generation Binary 4 / 18

7 Framework Source Clang Front-End bc file Analyses s bc file Memory Pairs Collection Call Graph Construction Reachability Memory pairs Reachable pairs Interleaving Interleaving MHP pairs Pointer Alias Aliased pairs Thread-Local Thread-Local Lockset Lockset Escaped pairs Unlocked pairs Guided Instrumentation Instrumented bc file Code Generation Binary 4 / 18

8 Framework Source Clang Front-End bc file Analyses s bc file Memory Pairs Collection Call Graph Construction Reachability Memory pairs Reachable pairs Interleaving Interleaving MHP pairs Pointer Alias Aliased pairs Thread-Local Thread-Local Lockset Lockset Escaped pairs Unlocked pairs Guided Instrumentation Instrumented bc file Code Generation Binary 4 / 18

9 Framework Source Clang Front-End bc file Analyses s bc file Memory Pairs Collection Call Graph Construction Reachability Memory pairs Reachable pairs Interleaving Interleaving MHP pairs Pointer Alias Aliased pairs Thread-Local Thread-Local Lockset Lockset Escaped pairs Unlocked pairs Guided Instrumentation Instrumented bc file Code Generation Binary 4 / 18

10 Framework Source Clang Front-End bc file Analyses s bc file Memory Pairs Collection Call Graph Construction Reachability Memory pairs Reachable pairs Interleaving Interleaving MHP pairs Pointer Alias Aliased pairs Thread-Local Thread-Local Lockset Lockset Escaped pairs Unlocked pairs Guided Instrumentation Instrumented bc file Code Generation Binary 4 / 18

11 Refining Pairs Only statements in the paris that are not filtered are instrumented for runtime check. bc file Memory Pairs Collection Memory Pairs Reachable Pairs MHP Pairs Alised Pairs Escaped Pairs Unlocked Pairs Guided Instrumentation Instrumented bc file 5 / 18

12 Context-Sensitive Abstract Threads An abstract thread t refers to a call of pthread create() at a context-sensitive fork site during the analysis. void main(){ cs1: cs2: } foo(); foo(); t1 refers to fork site under context [1,3] void foo(){ cs3: fork(t1, bar); } t1' refers to fork site under context [2,3] void main(){ } for(i=0;i<10;i++){ fork(t[i], foo) } t1 and t1' are context-sensitive threads t is multi-forked thread 6 / 18

13 Context-Sensitive Abstract Threads An abstract thread t refers to a call of pthread create() at a context-sensitive fork site during the analysis. void main(){ cs1: cs2: } foo(); foo(); t1 refers to fork site under context [1,3] void foo(){ cs3: fork(t1, bar); } t1' refers to fork site under context [2,3] void main(){ } for(i=0;i<10;i++){ fork(t[i], foo) } t1 and t1' are context-sensitive threads t is multi-forked thread A thread t always refers to a context-sensitive fork site, i.e., a unique runtime thread unless t M is multi-forked, in which case, t may represent more than one runtime thread. 6 / 18

14 Outline Motivation phases Thread Interleaving Alias Thread Local Lock Evalution 6 / 18

15 Context-sensitive Thread Interleaving (t 1, c 1, s 1 ) (t 2, c 2, s 2 ) holds if: { t 2 I(t 1, c 1, s 1 ) t 1 I(t 2, c 2, s 2 ) if t 1 t 2 t 1 M otherwise where I(t, c, s): denotes a set of interleaved threads may run in parallel with s in thread t under calling context c, M is the set of multi-forked threads. 7 / 18

16 Interleaving Computing I(t, c, s) is formalized as a forward data-flow problem (V,, F). V : the set of all thread interleaving facts. : meet operator ( ). F: V V transfer functions associated with each node in an ICFG. 8 / 18

17 Interleaving Rule [I-DESCENDANT] [I-SIBLING] (c,fk i ) t t (t, c, fk i ) (t, c, l) (c, l ) = Entry(S t ) {t } I(t, c, l) {t} I(t, c, l ) t t (c, l) = Entry(S t) (c, l ) = Entry(S t ) t t t t {t} I(t, c, l ) {t } I(t, c, l) [I-JOIN] (c,jn i ) t t I(t, c, jn i ) = I(t, c, jn i )\{t } [I-CALL] (t, c, l) call i (t, c, l ) c = c.push(i) I(t, c, l) I(t, c, l ) [I-INTRA] (t, c, l) (t, c, l ) I(t, c, l) I(t, c, l ) [I-RET] (t, c, l) ret i (t, c, l ) i = c.peek() c = c.pop() I(t, c, l) I(t, c, l ) 9 / 18

18 Interleaving Rule [I-DESCENDANT] t (c,fk i ) t (t, c, fk i ) (t, c, l) (c, l ) = Entry(S t ) {t } I(t, c, l) {t} I(t, c, l ) t t' I(t,c,s) = {t'} fork s s' I(t',c',s')={t} (t,c,s) (t',c',s') 10 / 18

19 Interleaving Rule [I-JOIN] (c,jn i ) t t I(t, c, jn i ) = I(t, c, jn i )\{t } t t' fork I(t,c,s) = {t'} join I(t,c,s1) = { } (t,c,s) (t,c,s) s s1 s' I(t',c',s')={t} (t',c',s') (t,c,s1) 10 / 18

20 Interleaving Rule [I-SIBLING] t t (c, l) = Entry(S t ) (c, l ) = Entry(S t ) t t t t {t} I(t, c, l ) {t } I(t, c, l) t' t0 t I(t',c',s')={} s' fork join s fork join I(t,c,s)={} (t,c,s) (t',c',s') 10 / 18

21 Interleaving Rule [I-SIBLING] t t (c, l) = Entry(S t ) (c, l ) = Entry(S t ) t t t t {t} I(t, c, l ) {t } I(t, c, l) t' t0 t I(t',c',s')={t} s' fork join s fork join I(t,c,s)={t'} (t,c,s) (t',c',s') 10 / 18

22 Interleaving Rule [I-DESCENDANT] [I-SIBLING] (c,fk i ) t t (t, c, fk i ) (t, c, l) (c, l ) = Entry(S t ) {t } I(t, c, l) {t} I(t, c, l ) t t (c, l) = Entry(S t) (c, l ) = Entry(S t ) t t t t {t} I(t, c, l ) {t } I(t, c, l) [I-JOIN] (c,jn i ) t t I(t, c, jn i ) = I(t, c, jn i )\{t } [I-CALL] (t, c, l) call i (t, c, l ) c = c.push(i) I(t, c, l) I(t, c, l ) [I-INTRA] (t, c, l) (t, c, l ) I(t, c, l) I(t, c, l ) [I-RET] (t, c, l) ret i (t, c, l ) i = c.peek() c = c.pop() I(t, c, l) I(t, c, l ) 11 / 18

23 Outline Motivation phases Thread Interleaving Alias Thread Local Lock Evalution 11 / 18

24 Alias Obtain aliasing pairs by refining MHP store-load and store-store pairs [(t, c, s), (t, c, s )], where Alias( p, q) is the set of objects pointed to by both p and q. s : p = s : = q or q = (t, c, s) (t, c, s ) o Alias( p, q) o s s int x,y; int *p,*q,*r; p=&x; q=&x; r=&y; void main(){ fork(t, foo); s1: *p=...; s2: *r=...; } void foo(){ s3:...=*q; } 12 / 18

25 Outline Motivation phases Thread Interleaving Alias Thread Local Lock Evalution 12 / 18

26 Thread-Local An object is not thread-local, i.e. escaping, if it escapes via arguments at a forksite global pointers void main(){ int x,y; fork(t,foo,&x); s1: x=...; join(t); s3: y=...; } void foo(int* p){ s2:...=*p; } 13 / 18

27 Outline Motivation phases Thread Interleaving Alias Thread Local Lock Evalution 13 / 18

28 Lockset Statements from different lockunlock spans, are interferencefree if these spans are protected by a common lock. Our framework does this by performing a flow- and contextsensitive analysis for lock/unlock operations int x; mutex m; void main(){ fork(t,foo); s1: x=...; lock(m); s3: x=...; unlock(m); join(t); } void foo(){ lock(m); s2:...=x; unlock(m); } 14 / 18

29 Outline Motivation phases Evalution 14 / 18

30 Evaluation Implementation: On top of our previous open-source tool SVF ( Based on our previous papers CGO 16 and ICPP 15 Benchmarks: 11 SPLASH2 Pthread benchmarks Machine setup: Ubuntu Linux generic Intel Xeon Quad Core HT, 3.7GHZ, 64GB 15 / 18

31 Instrumentation Statistics (under Option -O0) Pthread API TSan Our Approach Fork Join Lock Unlock Read Write Read Write barnes fft lu cb lu ncb ocean cp ocean ncp radiosity radix raytrace water nsquared water spatial / 18

32 Speedups over Original TSan (under Option -O0) 4 Threads 16 Threads 4 x 2 x 0 x barnes fft lu cb lu ncb ocean cp ocean ncp radiosity radix raytrace water nsquared water spatial average 17 / 18

33 Thanks! Q & A 18 / 18