Checking Concurrent Java Programs

Transcription

1 Checking Concurrent Java Programs On Event Spaces Néstor CATAÑO INRIA Sophia-Antipolis, France ModoCop,1st July 2002 p.1/22

2 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.2/22

3 Concurrent Java programs Threads ModoCop,1st July 2002 p.3/22

4 Concurrent Java programs Threads Shared variables ModoCop,1st July 2002 p.3/22

5 Concurrent Java programs Threads Shared variables synchronized ModoCop,1st July 2002 p.3/22

6 Concurrent Java programs Threads Shared variables synchronized notifyall ModoCop,1st July 2002 p.3/22

7 Concurrent Java programs Threads Shared variables synchronized notifyall wait ModoCop,1st July 2002 p.3/22

8 Concurrent Java programs Threads Shared variables synchronized notifyall wait notify ModoCop,1st July 2002 p.3/22

9 Threads communication protocol Main memory M.M. buffer Local buffer Working memory ModoCop,1st July 2002 p.4/22

10 Threads communication protocol Main memory M.M. buffer read Local buffer Working memory ModoCop,1st July 2002 p.4/22

11 Threads communication protocol Main memory M.M. buffer read load Local buffer Working memory ModoCop,1st July 2002 p.4/22

12 Threads communication protocol Main memory M.M. buffer read load Local buffer use Working memory ModoCop,1st July 2002 p.4/22

13 Threads communication protocol Main memory M.M. buffer read load Local buffer use Working memory assign ModoCop,1st July 2002 p.4/22

14 Threads communication protocol Main memory M.M. buffer read load store Local buffer use Working memory assign ModoCop,1st July 2002 p.4/22

15 Threads communication protocol write Main memory M.M. buffer read load store Local buffer use Working memory assign ModoCop,1st July 2002 p.4/22

16 Threads communication protocol write lock Main memory M.M. buffer read load store Local buffer use Working memory assign ModoCop,1st July 2002 p.4/22

17 Threads communication protocol write lock Main memory M.M. buffer read load store unlock Local buffer use Working memory assign ModoCop,1st July 2002 p.4/22

18 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.5/22

19 Event Spaces [ Pietro Cenciarelli, Alexander Knapp, Bernhard Reus, Tatjana Hein, Marting Wirsing] at LMU Universität München. ModoCop,1st July 2002 p.6/22

20 Event Spaces [ Pietro Cenciarelli, Alexander Knapp, Bernhard Reus, Tatjana Hein, Marting Wirsing] at LMU Universität München. The actions performed by the main memory for any one variable are totally ordered; that is, for any two actions performed by the main memory on the same variable, one action precedes the other. ModoCop,1st July 2002 p.6/22

21 Event Spaces [ Pietro Cenciarelli, Alexander Knapp, Bernhard Reus, Tatjana Hein, Marting Wirsing] at LMU Universität München. The actions performed by the main memory for any one variable are totally ordered; that is, for any two actions performed by the main memory on the same variable, one action precedes the other. Formally where and are instances of {Write(,l,v), Read(,l,v)} ModoCop,1st July 2002 p.6/22

22 Event Spaces The actions performed by any one thread are totally ordered; that is, for any two actions performed by a thread, one action precedes the other. Formally where and are instances of {Lock( Use( Load(,obj), Unlock(,l,v), Assign(,l,v), Store(,obj),,l,v),,l,v)} ModoCop,1st July 2002 p.7/22

23 Operational Semantics ModoCop,1st July 2002 p.8/22

24 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.9/22

25 Constructing Event Spaces class C int a=1, b=2; } synchronized void p(){ a=b; } synchronized void q(){ b=a; } ModoCop,1st July 2002 p.10/22

26 Constructing Event Spaces synchronized void p(){a=b;} a=b ModoCop,1st July 2002 p.11/22

27 Constructing Event Spaces use b synchronized void p(){a=b;} assign a ModoCop,1st July 2002 p.11/22

28 Constructing Event Spaces use b assign a synchronized void p(){a=b;} A thread must perform an assign or load action on a variable before performing a use or store ModoCop,1st July 2002 p.11/22

29 Constructing Event Spaces load b use b synchronized void p(){a=b;} assign a ModoCop,1st July 2002 p.11/22

30 Constructing Event Spaces load b use b assign a synchronized void p(){a=b;} For every load action performed by any thread on its working copy of a variable, there must be a corresponding preceding read action by the main memory on the master copy of, and the load action must put into the working copy the data transmitted by the corresponding read action ModoCop,1st July 2002 p.11/22

31 Constructing Event Spaces read b load b use b synchronized void p(){a=b;} assign a ModoCop,1st July 2002 p.11/22

32 Constructing Event Spaces read b load b use b assign a synchronized void p(){a=b;} Before executing a synchronized method, the corresponding object must be locked ModoCop,1st July 2002 p.11/22

33 Constructing Event Spaces lock c read b load b use b synchronized void p(){a=b;} assign a ModoCop,1st July 2002 p.11/22

34 Constructing Event Spaces lock c read b load b use b assign a synchronized void p(){a=b;} Between an assign action by on and a subsequent unlock action by on, a store action by on must intervene; moreover, the write action corresponding to that blue store must precede the unlock action, as seen by main memory ModoCop,1st July 2002 p.11/22

35 Constructing Event Spaces lock c read b load b use b synchronized void p(){a=b;} assign a store a write a unlock c ModoCop,1st July 2002 p.11/22

36 Constructing Event Spaces lock c read b load b use b assign a synchronized void p(){a=b;} synchronized void q(){b=a;} store a write a unlock c ModoCop,1st July 2002 p.11/22

37 Constructing Event Spaces lock c read b load b use b load a use a lock c read a synchronized void p(){a=b;} assign a store a assign b store b synchronized void q(){b=a;} unlock c write a unlock c write b ModoCop,1st July 2002 p.11/22

38 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.12/22

39 Chec.spec. using Event Spaces public class Sample{ int a=1, b=2; ensures(this): this.a==this.b; synchronized void p(){ a=b; } //@ ensures(this): this.b==this.a; synchronized void q(){ b=a; } /*@ forall[s:sample, thp:myrunnerp, thq:myrunnerq]. AG((MyRunnerP_INSTANCE(s) AND MyRunnerQ_INSTANCE(s)) --> AG((MyRunnerP_RUN(thp) MyRunnerQ_RUN(thq)) --> AF(s.a==1 AND s.b==1) OR (s.a=2 AND s.a==2==s.b))) */ public static void main(string args[]){ Sample s = new Sample(); MyRunnerP thp = new MyRunnerP(s); MyRunnerQ thq = new MyRunnerQ(s); thp.start(); thq.start(); } } ModoCop,1st July 2002 p.13/22

40 Check.spec. using Event Spaces public class MyRunnerP extends java.lang.thread{ Sample mysample_p; ensures mysample_p == s; MyRunnerP(Sample s){ super(); mysample_p = s; } } //@ ensures Sample_p_ENS(mysample_p); public void run(){ mysample_p.p(); } ModoCop,1st July 2002 p.14/22

41 Check.spec. using Event Spaces lock c read b load b use b assign a store a write a unlock c lock c read a load a use a assign b store b write b unlock c ModoCop,1st July 2002 p.15/22

42 Check.spec. using Event Spaces lock c read b load b use b assign a store a write a lock c read a load a use a assign b store b write b read a write a, write b read b unlock c unlock c ModoCop,1st July 2002 p.15/22

43 Check.spec. using Event Spaces lock c read b load b use b assign a store a write a load a use a assign b store b lock c read a write b read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) unlock c unlock c ModoCop,1st July 2002 p.15/22

44 Check.spec. using Event Spaces lock c read b load b use b assign a store a write a load a use a assign b store b lock c read a write b read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b unlock c unlock c ModoCop,1st July 2002 p.15/22

45 Check.spec. using Event Spaces lock c read b load b use b assign a store a write a load a use a assign b store b lock c read a write b read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b (pa=2,pb=2,ma=2,mb=2,qa=2,qb=2) unlock c unlock c ModoCop,1st July 2002 p.15/22

46 Check.spec. using Event Spaces lock c read b load b use b load a use a lock c read a read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b (pa=2,pb=2,ma=2,mb=2,qa=2,qb=2) assign a assign b write b read b, write a read a store a store b unlock c write a unlock c write b ModoCop,1st July 2002 p.15/22

47 Check.spec. using Event Spaces lock c read b load b use b load a use a lock c read a read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b (pa=2,pb=2,ma=2,mb=2,qa=2,qb=2) assign a assign b write b read b, write a read a store a write a store b (It is not permitted for an action to follow itself) write b unlock c unlock c ModoCop,1st July 2002 p.15/22

48 Check.spec. using Event Spaces lock c read b load b use b load a use a lock c read a read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b (pa=2,pb=2,ma=2,mb=2,qa=2,qb=2) assign a assign b write b read b, write a read a store a write a store b (It is not permitted for an action to follow itself) write b read b write b, read a write a unlock c unlock c ModoCop,1st July 2002 p.15/22

49 Check.spec. using Event Spaces lock c read b load b use b load a use a lock c read a read a write a, write b read b (pa=1,pb=1,ma=1,mb=1,qa=1,qb=1) write a read a, read b write b (pa=2,pb=2,ma=2,mb=2,qa=2,qb=2) assign a assign b write b read b, write a read a store a write a store b (It is not permitted for an action to follow itself) write b read b write b, read a write a [lock-unlock] unlock c unlock c ModoCop,1st July 2002 p.15/22

50 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.16/22

51 What is JINI Lookup Service Sproxy 1. The service S registers a Sproxy to the lookup service 2. Requiring a service fulfilling the type SInterface Service S 3. Requiring directly services Client C SInterface Sproxy by using the proxy Sproxy Sproxy ModoCop,1st July 2002 p.17/22

52 Checking JINI Properties Class LookupDiscovery is composed by thread inner classes that communicate with each other by shared variables ModoCop,1st July 2002 p.18/22

53 Checking JINI Properties Class LookupDiscovery is composed by thread inner classes that communicate with each other by shared variables Shared variables correspond to instances of collection classes: Collection, ArryList, HashMap, etc. ModoCop,1st July 2002 p.18/22

54 Checking JINI Properties Class LookupDiscovery is composed by thread inner classes that communicate with each other by shared variables Shared variables correspond to instances of collection classes: Collection, ArryList, HashMap, etc. If a certain client carries out successfully a matching protocol, then whenever there exists an adequate announcement coming from the net, the client will be informed. ModoCop,1st July 2002 p.18/22

55 Checking JINI Properties /* * forall[b:lookupdiscovery, inc:incomingmulticastannouncement]. * AG(if(b.LookupDiscovery_LookupDiscovery_CALL(String groups[]) & * b.lookupdiscovery_adddiscoverylistener_call(listener list) * ) --> * AF(forall[inc:IncomingMulticastAnnouncement]. * if(inc.serviceid IN registrars & * groupsoverlap(b,inc.groups) & * inc.locator!in b.pendingdiscoveries * ) --> * AF(if(list.groups IN inc.groups) * if(list.eventtype == LookupDiscovery.DISCOVERED) * list.discovered(); * else if(list.eventtype == LookupDiscovery.DISCARDED) * list.discarded(); * else if(list.eventtype == LookupDiscovery.CHANGED) * list.changed(); * ) * ) ModoCop,1st July 2002 p.19/22

56 Outline Concurrent Java programs Event Spaces Constructing Event Spaces Checking specifications using Event Spaces Checking JINI Properties Future work ModoCop,1st July 2002 p.20/22

57 Future work loops: if( ){ }, while( ){ }, and so on. ModoCop,1st July 2002 p.21/22

58 Future work loops: if( ){ }, while( ){ }, and so on. Generate automatically Event Spaces for Java programs. ModoCop,1st July 2002 p.21/22

59 Future work loops: if( ){ }, while( ){ }, and so on. Generate automatically Event Spaces for Java programs. Establish whether an Event Space respects a property. ModoCop,1st July 2002 p.21/22

60 Future work loops: if( ){ }, while( ){ }, and so on. Generate automatically Event Spaces for Java programs. Establish whether an Event Space respects a property. Compute Event Spaces parameterized by the property we check. ModoCop,1st July 2002 p.21/22

61 Future work loops: if( ){ }, while( ){ }, and so on. Generate automatically Event Spaces for Java programs. Establish whether an Event Space respects a property. Compute Event Spaces parameterized by the property we check. Event spaces and JavaCard 2.2: there is limited concurrency. ModoCop,1st July 2002 p.21/22

62 Future work loops: if( ){ }, while( ){ }, and so on. Generate automatically Event Spaces for Java programs. Establish whether an Event Space respects a property. Compute Event Spaces parameterized by the property we check. Event spaces and JavaCard 2.2: there is limited concurrency. Diving into the Jini problem. ModoCop,1st July 2002 p.21/22

63 Thanks Any suggestions? ModoCop,1st July 2002 p.22/22