A Simple Model of Communication APIs Application to Dynamic Partial-order Reduction

Transcription

1 Simple Model of Communication PIs pplication to Dynamic Patial-ode Reduction Cistian Rosa Stephan Mez Matin Quinson VOCS /09/ / 18

2 Motivation Distibuted lgoithms ae had to get ight: lack of a shaed clock lack of a global view of the state Eos ae had to find and epoduce State-exploation techniques exhaustive counte-examples epoducible 2 / 18

3 Model-checking Distibuted Systems We define a Distibuted System (DS) as: pocesses unning distibuted acoss seveal netwoked hosts no shaed clock no shaed memoy communication by message exchange 3 / 18

4 Model-checking Distibuted Systems We define a Distibuted System (DS) as: pocesses unning distibuted acoss seveal netwoked hosts no shaed clock no shaed memoy communication by message exchange We veify the eal C implementation of the pogams: no models, no abstaction, the pocesses ae eally executed fom a given initial state state space geneated by the inteleaving of the messages exploation is depth bounded (useful fo debugging anyway) It its mandatoy to apply patial-ode techniques! 3 / 18

5 Happened-befoe Relation Conside the following pocesses: s a l a a 0 a 1 a 2 c 0 c 1 c 2 s b l b b 0 b 1 b 2 C Execution taces: 4 / 18

6 Happened-befoe Relation Conside the following pocesses: s a l a a 0 a 1 a 2 c 0 c 1 c 2 s b l b b 0 b 1 b 2 C Execution taces: a 0 sa a1 la a2 C b 0 sb b1 lb b2 c 0 c1 c2 4 / 18

7 Happened-befoe Relation Conside the following pocesses: s a l a a 0 a 1 a 2 c 0 c 1 c 2 s b l b b 0 b 1 b 2 C Execution taces: a 0 sa a1 la a2 a 0 sa a1 la a2 b 0 sb b1 b2 lb b 0 sb b1 b2 lb C c 0 c1 c2 C c 0 c1 c2 4 / 18

8 Depth-fist Seach Exploation a 0 sa a1 la a2 a 0 sa a1 la a2 b 0 sb b1 b2 lb b 0 sb b1 b2 lb C c 0 c1 c2 C c 0 c1 c2 sb sa lb la sa sb la lb 5 / 18

9 Depth-fist Seach Exploation a 0 sa a1 la a2 a 0 sa a1 la a2 b 0 sb b1 b2 lb b 0 sb b1 b2 lb C c 0 c1 c2 C c 0 c1 c2 sb sa lb la sa sb la lb Depth-fist seach state exploation algoithm: lb lb a 0 a 0 a 0 a 1 a 1 a sb s a lb 1 la b 0 b1 b1 b1 b1 b2 c 0 c 0 c1 c1 c2 c2 s a s a la a 2 b2 c2 5 / 18

10 Depth-fist Seach Exploation a 0 sa a1 la a2 a 0 sa a1 la a2 b 0 sb b1 b2 lb b 0 sb b1 b2 lb C c 0 c1 c2 C c 0 c1 c2 sb sa lb la sa sb la lb Depth-fist seach state exploation algoithm: lb lb a 0 a 0 a 0 a 1 a 1 a sb s a lb 1 la b 0 b1 b1 b1 b1 b2 c 0 c 0 c1 c1 c2 c2 s a s a la a 2 b2 c2 sb s a la lb It s anothe seialization of the same patial-ode! 5 / 18

11 Dynamic Patial-ode Reductions by Example What ae the tansitions that we should inteleave? o equivalently... How do we geneate a seialization of a diffeent patial-ode? 6 / 18

12 Dynamic Patial-ode Reductions by Example What ae the tansitions that we should inteleave? o equivalently... How do we geneate a seialization of a diffeent patial-ode? Inteleaving dependent tansitions! D(t i, t j ) = I (t i, t j ) t i t j t j t i 6 / 18

13 Computing D Efficiently How do we get the pedicate D? Using the semantics of the tansitions Poof of independence theoems fo each pai of tansitions The I pedicate is the disjunction of these cases I (t i, t j ) = (t i = t j = )... 7 / 18

14 Computing D Efficiently How do we get the pedicate D? Using the semantics of the tansitions Poof of independence theoems fo each pai of tansitions The I pedicate is the disjunction of these cases I (t i, t j ) = (t i = t j = )... It can be oveapoximated by a D such that D(, ) D (, ) but the convese might not be tue D (, ) D(, ) If we don t know if I (t i, t j ) we assume D (t i, t j ) (fo soundness). 7 / 18

15 PI Functions as Tansitions The tansitions ae the calls to the communication PI The poblem: almost no PI has a fomal specification of thei semantics Manual specification is equied based on: infomal PI efeences expeiments use expeience It is a tedious and time consuming job (i.e pages fo a subset of MPI [PGK + 07]) It should be done fo each PI 8 / 18

16 Contibutions The contibutions of this wok ae: coe set of five netwoking pimitives Fomal specification in TL + of it s semantics Theoems of independence between cetain pimitives Implementation of the netwoking coe inside of SimGid simulato [CLQ08] DPOR exploation algoithm using the SimGid simulation famewok 9 / 18

17 The Communication Model The communication model is based on mailboxes: pocesses post send/eceive equest into mailboxes equests ae queued and matched in FIFO ode 10 / 18

18 The Communication Model The communication model is based on mailboxes: pocesses post send/eceive equest into mailboxes equests ae queued and matched in FIFO ode Thee ae fou pimitives: Send asynchonous send Recv asynchonous eceive Waitny block until completion of a communication Test test fo completion without blocking 10 / 18

19 The Communication Model Netwok {} 11 / 18

20 The Communication Model Send(&x); Netwok {} 11 / 18

21 The Communication Model id Send(&x); Netwok {[id,"send",,_,&x,_]} 11 / 18

22 The Communication Model id Send(&x); Netwok Recv(&y); {[id,"send",,_,&x,_]} 11 / 18

23 The Communication Model id Send(&x); Netwok Recv(&y); id {[id,"eady",,,&x,&y]} 11 / 18

24 The Communication Model id Send(&x); Netwok Recv(&y); id {[id,"done",,,&x,&y]} Waitny({id}); y:=x; 11 / 18

25 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Netwok {} 12 / 18

26 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) id Send(&x); Netwok {[id,"send",,_,&x,_]} 12 / 18

27 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) id Send(&x); Netwok Recv(&y); id {[id,"eady",,,&x,&y]} 12 / 18

28 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Netwok {} 12 / 18

29 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Netwok Recv(&y); id {[id,"ecv",_,,_,&y]} 12 / 18

30 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) id Send(&x); Netwok Recv(&y); id {[id,"eady",,,&x,&y]} 12 / 18

31 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Netwok {[1,s],[2,s],...,[i,s]} 12 / 18

32 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Send(&x); Netwok {[1,s],[2,s],...,[i,s],[i+1,s]} 12 / 18

33 (In)Dependence Theoems Theoem ny two Send and Recv tansitions ae independent. p 1, p 2 Poc, dv 1, dv 2 RdV, d 1, d 2 dd, c 1, c 2 dd : I (Send(p 1, dv 1, d 1, c 1 ), Recv(p 2, dv 2, d 2, c 2 )) Send(&x); Netwok Recv(&y); {[1,dy],[2,s],...,[i,s],[i+1,s]} 12 / 18

34 The Pedicate I I (t i, t j ) = t i = Send(,,, ) t j = Recv(,,, ) t i = Send(p 1, dv 1,, ) t j = Send(p 2, dv 2,, ) p 1 p 2 dv 1 dv 2 t i = Recv(p 1, dv 1,, ) t j = Recv(p 2, dv 2,, ) p 1 p 2 dv 1 dv 2 t i = Waitny(, {c}) t j = Waitny(, {c}) t i = Test(, c, ) t j = Test(, c, ) t i = Waitny(, {c}) t j = Test(, c, ) t i = Local( )t j = Local( ) 13 / 18

35 SimGid s Intenals SimDag MSG SMURF SimIX netwok poxy SimIX "POSIX like" PI on a vitual platfom SURF vitual platfom simulato SMPI GRS GRS in eal wold XT 14 / 18

36 Expeiment 1 Seve code count = 0 while (count<3) { value = eceive_fom("m") count++ } asset( value == 3 ) Code of clients 1..3 client(int ID) { // do something if(done){ send_to(id, "M") } } Numbe of exploed taces: Classic DFS: With DPOR: Fist Counte-example [seve] Recv [client1] Send [client3] Send [client2] Send [seve] Wait [client1] Wait [seve] Recv [client3] Wait [seve] Wait [seve] Recv [client2] Wait [seve] Wait 15 / 18

37 Expeiment 2 Seve code // step 1 val1 = eceive_fom("m") val2 = eceive_fom("m") asset(min(val1,val2) == 1) // step 2 val1 = eceive_fom("m") val2 = eceive_fom("m") asset(min(val1,val2) == 1) Code of client 1 send_to(1,"m") // step 1 send_to(1,"m") // step 2 Code of client 2 send_to(2,"m") // step 1 send_to(2,"m") // step 2 Numbe of exploed taces: Classic DFS: With DPOR: Second Counte-example [seve] Recv [client1] Send [seve] Wait [client1] Wait [seve] Recv [client1] Send [client2] Send [seve] Wait [client1] Wait [seve] Recv [client2] Wait [seve] Wait [client2] Send / 18

38 Conclusion and Futue Wok Conclusion: Model-checking actual distibuted pogams is a cuent challenges in veification. It is feasible only if eduction algoithms such as DPOR ae employed. Realistic communication PIs fo distibuted pogamming ae lage and complex. We popose instead to identify a small set of coe pimitives that ae sufficiently expessive fo encoding ealistic PIs, with a fomal semantic. Implementation in the SimGid famewok. Futue Wok: Validate ou appoach ove lage distibuted pogams Extend it to cove moe complex popeties, including liveness popeties 17 / 18

39 ibliogaphy I Heni Casanova, naud Legand, and Matin Quinson. SimGid: a Geneic Famewok fo Lage-Scale Distibuted Expeiments. In 10th IEEE Intenational Confeence on Compute Modeling and Simulation, Mach Salman Pevez, Ganesh Gopalakishnan, Robet M. Kiby, Robet Palme, and Rajeev Thaku. Pactical model checking method fo veifying coectness of MPI pogams. In EuoPVM/MPI, pages Spinge, / 18