Sudheendra Hangal

Tracking down software bugs using automatic anomaly detection

This paper introduces DIDUCE, a practical and effective tool that aids programmers in detecting complex program errors and identifying their root causes. By instrumenting a program and observing its behavior as it runs, DIDUCE dynamically formulates hypotheses of invariants obeyed by the program. DIDUCE hypothesizes the strictest invariants at the beginning, and gradually relaxes the hypothesis as violations are detected to allow for new behavior. The violations reported help users to catch software bugs as soon as they occur. They also give programmers new visibility into the behavior of the programs such as identifying rare corner cases in the program logic or even locating hidden errors that corrupt the programs results.We implemented the DIDUCE system for Java programs and applied it to four programs of significant size and complexity. DIDUCE succeeded in identifying the root causes of programming errors in each of the programs quickly and automatically. In particular, DIDUCE is effective in isolating a timing-dependent bug in a released JSSE (Java Secure Socket Extension) library, which would have taken an experienced programmer days to find. Our experience suggests that detecting and checking program invariants dynamically is a simple and effective methodology for debugging many different kinds of program errors across a wide variety of application domains.

TSOtool: A Program for Verifying Memory Systems Using the Memory Consistency Model

In this paper, we describe TSOtool, a program to check the behavior of the memory subsystem in a shared memory multiprocessor. TSOtool runs pseudo-randomly generated programs with data races on a system compliant with the total store order (TSO) memory consistency model; it then checks the results of the program against the formal TSO specification. Such analysis can expose subtle memory errors like data corruption, atomicity violation and illegal instruction ordering. While verifying TSO compliance completely is an NP-complete problem, we describe a new polynomial time algorithm which is incorporated in TSOtool. In spite of being incomplete, it has been successful in detecting several bugs in the design of commercial microprocessors and systems, during both pre-silicon and post-silicon phases of validation.

IODINE: a tool to automatically infer dynamic invariants for hardware designs

We describe IODINE, a tool to automatically extract likely design properties using dynamic analysis. A practical bottleneck in the formal verification of hardware designs is the need to manually specify design-specific properties. IODINE presents a way to automatically extract properties such as state machine protocols, request-acknowledge pairs, and mutual exclusion between signals from design simulations. We show that dynamic invariant detection for hardware designs can infer relevant and accurate properties.

PrPl: a decentralized social networking infrastructure

This paper presents PrPl, a decentralized infrastructure that lets users participate in online social networking without loss of data ownership. PrPl, short for private-public, has a person-centric architecture--each individual uses a Personal-Cloud Butler service that provides a safe haven for ones personal digital assets and supports sharing with fine-grain access control. A user can choose to run the Butler on a home server, or use a paid or ad-supported vendor of his choice. Each Butler provides a federation of data storage; it keeps a semantic index to data that can reside, possibly encrypted, in other storage services. It uses the standard, decentralized OpenID management system, so users can use their established personas in accessing the data. One pre-requisite to the success of a platform is the availability of applications, which means that ease of application development is essential. We have developed a language called SociaLite, based on Datalog, that allows developers to use a simple declarative database query to access the large collection of private data served up by the Butlers in our social circle running under different administrative domains. We have developed a prototype of the PrPl infrastructure and implemented a number of simple social applications on the system. We found that the applications can be written in a small number of lines of code using SociaLite. Preliminary experimental results suggest that it is viable to enable sharing of private social data between close friends with a decentralized architecture.

Testing implementations of transactional memory

Transactional memory is an attractive design concept for scalable multiprocessors because it offers efficient lock-free synchronization and greatly simplifies parallel software. Given the subtle issues involved with concurrency and atomicity, however, it is important that transactional memory systems be carefully designed and aggressively tested to ensure their correctness. In this paper, we propose an axiomatic framework to model the formal specification of a realistic transactional memory system which may contain a mix of transactional and non-transactional operations. Using this framework and extensions to analysis algorithms originally developed for checking traditional memory consistency, we show that the widely practiced pseudo-random testing methodology can be effectively applied to transactional memory systems. Our testing methodology was successful in finding previously unknown bugs in the implementation of TCC, a transactional memory system. We study two flavors of the underlying analysis algorithm, one incomplete and the other complete, and show that the complete algorithm while being theoretically intractable is very efficient in practice.

Efficient algorithms for verifying memory consistency

One approach in verifying the correctness of a multiprocessor system is to show that its execution results comply with the memory consistency model it is meant to implement. It has been shown in prior work, however, that accurately verifying such compliance even of a single execution result is an NP-complete problem, for an unlimited number of processors. In this paper, we present a suite of post-mortem algorithms that perform the compliance check in an efficient, although not exhaustive, manner. Our algorithms employ the concept of vector clocks together with a heuristic made from a variation of the problem in P class. An implementation of these algorithms has been successful in efficiently detecting several bugs during the course of validating the design of commercial microprocessors and systems.Although our algorithms are presented with the Total Store Order (TSO) memory model, the ideas can also be applied to other models ranging from Sequential Consistency (SC) to a more relaxed one such as Relaxed Memory Order (RMO).

Completely verifying memory consistency of test program executions

An important means of validating the design of commercial-grade shared memory multiprocessors is to run a large number of pseudo-random test programs on them. However, when intentional data races are placed in a test program, there may be many correct results according to the memory consistency model supported by the system. For popular memory models like SC and TSO, the problem of verifying correctness of an execution is known to be NP-complete. As a result, analysis techniques implemented in the past have been incomplete: violations of the memory model are flagged if provable, otherwise the result is inconclusive and it is assumed optimistically that the machines results are correct. In this paper, we describe for the first time a practical, new algorithm which can solve this problem with certainty, thus ensuring that incorrect behavior of a large, complex multiprocessor cannot escape. We present results of our analysis algorithm on test programs run on a newly designed multiprocessor system built by Sun Microsystems. We show that our algorithm performs very well, typically analyzing a program with 512 K memory operations distributed across 60 processors within a few minutes. Our algorithm runs in less than 2.6 times the time taken by an incomplete baseline algorithm which may miss errors. Our approach greatly increases the confidence in the correctness of the results generated by the multiprocessor, and allows us to potentially uncover more bugs in the design than was previously possible.

Automatic dimension inference and checking for object-oriented programs

This paper introduces UniFi, a tool that attempts to automatically detect dimension errors in Java programs. UniFi infers dimensional relationships across primitive type and string variables in a program, using an inter-procedural, context-sensitive analysis. It then monitors these dimensional relationships as the program evolves, flagging inconsistencies that may be errors. UniFi requires no programmer annotations, and supports arbitrary program-specific dimensions, thus providing fine-grained dimensional consistency checking. UniFi exploits features of object-oriented languages, but can be used for other languages as well. We have run UniFi on real-life Java code and found that it is useful in exposing dimension errors. We present a case study of using UniFi on nightly builds of a 19,000 line code base as it evolved over 10 months.

Performance analysis and validation of the picoJava processor

In the process of designing high performance microprocessors, architects and designers build processor models at varying levels of abstraction for a range of purposes. Examples of such uses are simulating and verifying the processor, predicting processor performance, and developing operating systems and applications for the processor before silicon is available. Such models can range in complexity from simple analytical performance models in spreadsheet format to the detailed design expressed in a hardware description language (HDL). Other models that fall in between on the range of complexity include instruction-accurate simulators, trace-driven performance simulators, and cycle-accurate simulators. There is usually a trade-off between runtime performance and accuracy while using these models. Developing a large number of models for a processor is an expensive proposition. Beyond the engineering resources to build the initial models, developers must verify each of the models for correctness against the design specification; they must also maintain and update the models as the design evolves. Clearly, a strategy that limits the number of models yet meets the requirements of early software developers, verification engineers, and performance analysts is desirable. During the course of the picoJava processor design, we developed a simple and effective methodology that meets the goals of both accurate performance analysis and design validation. Although we applied this technique to the picoJava processor, the technique can be applied to other processor designs.

Friends, romans, countrymen: lend me your URLs. using social chatter to personalize web search

People often find useful content on the web via social media. However, it is difficult for users to aggregate the information and recommendations embedded in a torrent of social feeds like email and Twitter. At the same time, the ever-growing size of the web and attempts to spam commercial search engines make it a challenge for users to get search results relevant to their unique background and interests. To address this problem, we propose ways to let users mine their own social chatter and extract people, pages and sites of potential interest. This information can be used to effectively personalize their web search results. Our approach has the benefits of generating personalized and socially curated results, removing web spam and preserving user privacy. We have built a system called Slant to automatically mine a users email and Twitter feeds and populate four personalized search indices that are used to augment regular web search. We evaluated these indices with users and found that the small slice of the web indexed using social chatter can produce results that are equally or better liked by users compared to personalized search by a commercial search engine. We find that user satisfaction with search results can be improved by combining the best results from multiple indices.