Methods, Systems, and Media for Protecting Applications from Races

Abstract

Methods, systems, and media for protecting applications from races are provided. In some embodiments, methods for protecting applications from races are provided, the methods comprising: adding to at least one cycle of the application an update check to determine when an update to the application is to be made; adding an update engine to the application, wherein the update engine is configured to: receive an update plan that is based on an execution filter that specifies how operations of the application are to be synchronized; and cause synchronization operations to be added to the application based on the update plan that prevent the race from occurring.

Description

CROSS REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No. 13/189,263 filed Jul. 22, 2011, which claims the benefit of U.S. Provisional Patent Application No. 61/366,900, filed Jul. 22, 2010, both of which are hereby incorporated by reference herein in their entireties.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

This invention was made with government support under CNS-1012633 and CNS-0905246 awarded by the National Science Foundation, and under FA8650-10-C-7024 and FA8750-10-2-0253 awarded by the Air Force Research Lab. The government has certain rights in the invention.

TECHNICAL FIELD

This application relates to methods, systems, and media for protecting applications from races.

BACKGROUND

Deployed multithreaded applications can contain many races because these applications are difficult to write, test, and debug. These races include data races, atomicity violations, order violations, and any other concurrency errors. They can cause application crashes and data corruptions. Worse, the number of deployed races may drastically increase due to the popularity of multicore and the immaturity of race detectors.

To address such races, software updates are typically employed. A problem with such updates, however, is that they typically require an application restart, and thus are at odds with high availability demand. Live update systems are also used to address races. Such systems allow a user to avoid a restart by adapting conventional al patches into hot patches and applying them to live applications or kernels.

However, a reliance on conventional patches can have two problems. First, due to the complexity of multithreaded applications, race-fix patches can be unsafe and introduce new errors such as new races or deadlocks. Safety is crucial for encouraging users to adopt live updates and install fixes early, yet automatically ensuring safety is difficult because conventional patches are created from general, difficult-to-analyze languages. Second, even if the root cause of a race is reasonably clear, producing a good patch for the race can still take time, leaving buggy applications unprotected before the patch is ready. Many factors contribute to the delays. At a minimum level, a public software release demands time-consuming code review and testing, which contribute to the delays between fix and release. Moreover, despite the many available options for fixing a race (e.g., lock-free flags, fine-grained locks, and coarse-grained locks), conventional patches often have to be reasonably efficient for source maintainers to accept them, contributing to the delays between diagnosis and fix, Performance pressure is perhaps why many races have not been fixed by adding locks, and why some have taken years to correctly fix.

SUMMARY

Methods, systems, and media for protecting applications from races are provided. In some embodiments, methods for protecting applications from races are provided, the methods comprising: adding to at least one cycle of the application an update check to determine when an update to the application is to be made; adding an update engine to the application, wherein the update engine is configured to: receive an update plan that is based on an execution filter that specifies how operations of the application are to be synchronized; and cause synchronization operations to be added to the application based on the update plan that prevent the race from occurring.

In some embodiments, methods for protecting, applications from races are provided, the methods comprising: executing in at least one cycle of the application an update check to determine when an update to the application is to be made; receiving an update plan that is based on an execution filter that specifies how operations of the application are to be synchronized; and performing synchronization operations based on the update plan that prevent the race from occurring.

In some embodiments, methods for protecting, applications from races are provided, the methods comprising: creating an execution filter that specifies how operations of an application are to be synchronized; generating, an update plan that is based on the execution filter; and causing synchronization operations to be performed at the application based on the update plan that prevent the race from occurring.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an overview diagram of an example mechanism for addressing races in accordance with some embodiments.

FIG. 2 shows an example of a race that can be addressed in accordance with some embodiments.

FIG. 3 shows an example of execution filters in accordance with some embodiments.

FIG. 4 shows another example of a race that can be addressed in accordance with some embodiments.

FIG. 5 shows another example of an execution filter in accordance with some embodiments.

FIG. 6 shows examples of constructs and syntax for an execution filter language in accordance with some embodiments.

FIG. 7 shows examples of inconsistency scenarios that can be addressed in accordance with some embodiments.

FIG. 8 shows an example of a thread that can cause an inconsistency scenario in accordance with some embodiments.

FIG. 9 shows an example of a process for identifying unsafe locations to block a thread, blocking a thread, and updating an application in accordance with some embodiments.

FIG. 10 shows examples of (a) an interprocedural control flow graph (ICFG), (b) cycle checks and preventing blocking calls from blocking updates, and (c) slot function calls and hot backup switching in accordance with some embodiments.

FIG. 11 shows an example of pseudo code of instrumentation code for checking for updates in accordance with some embodiments.

FIG. 12 shows examples of pseudo code of a slot function and functions for managing blocking calls in accordance with some embodiments.

FIG. 13 shows an example of hardware that can be used in accordance with some embodiments.

DETAILED DESCRIPTION

Methods, systems, and media for protecting application from races are provided.

In accordance with some embodiments, mechanisms for apply synchronization controls that address race conditions in multi-threaded applications are provided. In accordance with some embodiments, to use such mechanisms, an application is first compiled to gather information about the application and to include an update engine and the necessary instrumentation or modifications to facilitate the synchronization controls. At runtime, to work-around a race, an execution filter can be written that synchronizes portions of the application to filter out racy thread interleavings. These filters can be kept separate from the source code for the application. The filter can then be downloaded and installed into the application without restart to protect the application from the race.

In some embodiments, the mechanisms disclosed herein can be used for a variety of purposes. For example, in some embodiments, some conventional patches can be converted into execution filters and can be installed into live applications. As another example, in some embodiments, before a permanent fix a correct source patch) is available, an execution filter can be created as a temporary fix to a race to provide more-immediate protection to highly critical applications. As yet another example, in some embodiments, when a potential race is reported (e.g., by automated race detection tools or users of an application), a filter can be installed to prevent the race suspect. Later, if the race suspect is diagnosed to be false or benign, the filter can be removed. As still yet another example, in some embodiments, users can write and share filters with other users. As still yet another example, in some embodiments, execution filters can be selected for installation or not on a site-by-site (or machine-by-machine) basis based on a site's (or machine's) ability to afford the filter (which can be based on monetary cost, processing time cost, etc. As still yet another example, in some embodiments, execution filters cart be used to demonstrate a race by forcing a corresponding racy thread interleaving. As still yet another example, in some embodiments, using execution filters, “concurrency” test cases can be constructed and used to test applications.

FIG. 1 presents an overview of a mechanism 100 for addressing races in accordance with some embodiments. To use mechanism 100 for addressing races, in some embodiments, an application 106 is first statically prepared during compilation at 102. This compilation and preparation can be performed on a compiler device, such as, for example, a general purpose computer or a server, and can use and create data, source code, object code, application binaries, etc. stored on a storage device, and can be performed by a compiler, such as, for example, the LLVM compiler 116 (or any other suitable compiler) with a plug-in 118 (although the plug-in functionality could additionally or alternatively be incorporated into the compiler), in some embodiments. For example, in some embodiments, this preparation can collect and store control flow graphs (CHO 108 and symbol information 110 of the application so that these can later be used by a live-update process 104. The compilation and preparation can also add an update engine 112 to the application binary 114 of the application in some embodiments.

The application binary and update engine can then be run on any suitable user device in some embodiments.

Later, to fix a race, an execution filter 120 in a suitable filter language can be written and distributed for installation at the application. Any suitable mechanism for writing and distributing the filter can be used in some embodiments. The filter can then be installed to protect the application. Any suitable mechanism for installing the filter can be used in some embodiments. For example, in some embodiments, a filter can be installed by running the following command:

% loomctl add <pid> <filter-file>

In this command, “loomed” can be a user-space controller program 122 that interacts with users and initiates live update sessions, “pid” can denote the process ID of an application instance 124 with a race condition, and “filter-file” can be a file containing execution filter 120. Controller 122 can then compile the execution filter down to a safe update plan 126 using CFGs 108 and symbol information 110. This update plan can include three parts: (1) synchronization operations to enforce the constraints described in the filter and information indicating where in the application to add the operations; (2) safety pre-conditions that must hold for installing the filter; and (3) error checking code to detect potential errors in the filter. The controller can then send the update plan to an update engine 128 (which can be running as a thread inside the application's address space), which can then monitor the runtime states of the application and carry out the update plan only when all the safety preconditions are satisfied to produce a patched application 130.

If a problem with a filter is detected through an error check, the filter can automatically be removed from the application in some embodiments. When the filter is to be removed, the live update process can wait for any needed safety preconditions to be met before removing the filter.

In some embodiments, a user can also remove a filter manually. This may be desirable if for example, a race that a filter intends to fix turns out to be benign. For example, in some embodiments, a user can remove a filter by running the following Linux commands:

% loomctl ls <pid>

% loomctl remove <pid> <filter-id>

The first of these commands (“loomctl ls”) can be used to return a list of installed filter IDs within a given process “pid”. The second of these commands (“loomctl remove”) can be used to remove a filter identified by “filter-id” from the process identified by “pid”.

In some embodiments, an installed filter can be replaced with a new filter. For example, this may be desirable when, for example, the new filter fixes the same race but has less performance overhead. This can be done in some embodiments using the following Linux command:

% loomctl replace <pid> <old-id> <new-file>

where “pid” is the ID of a process containing an installed filter, “old-id” is the ID of the installed filter, and “new-file” is a file containing a new filter.

In order to remove or update an execution filter, the update controller can create a corresponding update plan and send the update plan to the update engine for execution against the application.

Turning to FIGS. 2-5, two examples of application races and execution filters that can be used to fix them in accordance with some embodiments are described.

In the first example, shown in FIG. 2, a race in MySQL causes the MySQL on-disk transaction log to miss records. The code on the left 202 of FIG. 2 (function new file( ) rotates MySQL's transaction log file by closing the current log file and opening a new one. This code is called when the transaction log has to be flushed. The code on the right 204 of FIG. 2 is used by MySQL to append a record to the transaction log. It uses double-checked locking and writes to the log only when the log is open. A race occurs if “is_open( )” (T2, line 3 206) catches a closed log when thread T1 202 is between “close( )” (T1, line 5 208) and “open( )” T1, line 6 210).

FIG. 3 shows examples of several execution filters that can be used to fix the race illustrated in connection with FIG. 2. As shown, execution filter 1 302 is the most conservative of the three filters and makes the code region between T1 line 5 and T1, line 6 atomic against all code regions, so that when a thread executes this region, all other threads must pause. This synchronization constraint can be referred to as a unilateral exclusion in contrast to a mutual exclusion that requires that participating threads agree on the same lock. In this example, the operator “< >” expresses a mutual exclusion constraint, its first operand “{log.cc:5, log.cc:6}” specifies a code region to protect, and its second operand “*” represents all code regions.

Execution filter 2 304 reduces overhead by refining the “” operand to a specific code region, function “MYSQL LOG::is open( ).” This filter makes the two code regions mutally exclusive, regardless of what memory locations they access.

Execution filter 3 306 further improves performance by specifying the memory location accessed by each code region.

In the second example of an application race, shown in FIG. 4, a race causes PBZip2 to crash due to a use-after-free error. The crash occurs when “fifo” 402 is de-referenced (line 10) after it is freed 404 (line 5). The root cause of this crash is that the “main( )” thread 406 on the left of FIG. 4 does not wait for the “decompress( )” thread 408 on the right of FIG. 4 to finish. To fix this race, a filter 502, such as that shown in FIG. 5, which requires that line 5 of PBZip2 pseudo-code must not run and thus wait if need be before “numCPU” times after line 10 of PBZip2 pseudo-code runs.

FIG. 6 gives examples of constructs 602 and syntax 604 for an execution filter language in accordance with some embodiments. As shown, these filters can express synchronization constraints on events 606 and regions 608. For example, a filter can express a synchronization constraint on a dynamic instance of a static program statement (an event), identified by file name and line number, using the syntax “file:line”.

As another example, a filter can express a synchronization constraint on such an event by “file:line,” and an additional “(expr)” component and/or an “{n}” component, where “expr” can be used to identify different dynamic instances of program statements to be synchronized and “n” can be used to specify the number of occurrences of an event.

As still another example, a filter can express a synchronization constraint on a dynamic instance of a static code region identified by a set of entry and exit events or an application function, As a still further example, a filter can express a synchronization constraint on such a region representing a function call using an additional “(args)” component to distinguish different calls to the same function.

In some embodiments, a synchronization constraint can be an execution order constraint, a mutual exclusion constraint, or a unilateral exclusion constraint. As illustrated in FIG. 6, an execution order constraint 610 in some embodiments can be used to make an event e₁ happen before an event e₂ using the syntax “e₁>e²”, an event e₂ happen before an event e₃ using the syntax “e₂>e₃”, and so forth. In order to effect such a constraint of “e_i>e_i+1”, for example, a semaphore up( ) operation can be inserted at e_i and a semaphore down( ) operation can be inserted at e_i+1.

A mutual exclusion constraint 612 in some embodiments can be used to make pairs of code regions r_i and r_j mutually ally exclusive with each other using, the syntax “r_i < > r_j”. In order to effect such a constraint of “r_i < > r_h”, a lock( ) can be created and inserted at each region entry and an unlock( ) can be created and inserted at each region exit.

A unilateral exclusion constraint 614 in some embodiments can be used to make the execution of a code region r single-threaded using the syntax “r < > *”. In order to effect such a constraint “r < > *”, non-r regions executing at the same time as region r can be paused at safe locations and resumed when the execution of region r has completed. For example, an evacuation mechanism as described below can be used for this purpose in some embodiments.

In some embodiments, locks and semaphores for the constraints can be created on demand. For example, the first time a lock or semaphore is referenced, the lock or semaphore can be created based the ID of the filter, the ID of the constraint, and the value of “expr” if present. In some embodiments, locks can be initialized to an unlocked state. In some embodiments, semaphores can be initialized to 0 or n−1 if {n}, the number of occurrences, is specified. In some embodiments, the values of “expr” and “n” can be calculated using debugging symbol information.

In some embodiments, to increase safety, additional error checking code can be inserted into an application as part of an update plan. For example, given a code region c in a mutual exclusion constraint, such error checking code can check for errors such as an unlock( ) for region c releasing a lock not acquired by a lock( ) for region c—i.e., a deadlock. More particularly, error checking can check for such a deadlock by determining if a filter causes a thread to stall for too long. In the event that such a deadlock, is detected, the filter can be uninstall by breaking this synchronization variable in some embodiments.

Turning to FIG. 7, three examples of inconsistency scenarios 702, 704, and 706 that can be handled in some embodiments are illustrated. As shown, for a mutual exclusion constraint filter on two or more code regions, a filter installation process can ensure that no thread is executing within any of the code regions when installing the filter to avoid double-unlock errors (as illustrated by 702 of FIG. 7) that can occur.

Similarly, for an execution order constraint filter “e₁>e₂”, a filter installation process can ensure either of the following two conditions when installing the filter: (1) both e₁ and e₂ have occurred; or (2) neither event has occurred. In this way, the process can prevent an “up( )” inserted at event e₁ from getting skipped (as illustrated by 704 of FIG. 7) or waking up a wrong thread (as illustrated by 706 of FIG. 7).

A more particular example of an inconsistency scenario is illustrated in the contrived database worker thread code of FIG. 8. As shown, a function process client( ) 802 is the main thread function and takes a client socket as input and repeatedly processes requests from the socket in a loop. For each such request, function process client( ) opens the corresponding database table by calling open_table( ) 804, serves the request, and closes the table by calling close_table( ) 804. A race occurs in this code when multiple clients concurrently access the same table.

To fix this race, an execution filter can add a lock acquisition at line 13 808 in open_table( ) and a lock release at line 18 810 in close_table( ) in some embodiments. To safely install this filter, an evacuation mechanism can be used to quiesce code regions in some embodiments. This can be accomplished, for example, by identifying a set of unsafe program locations in running threads that may interfere with the filter, blocking those threads from running when they are not in an unsafe location, installing the filter when the threads are blocked, and then resuming the threads. For example, as illustrated in FIG. 9, such a mechanism can identify unsafe locations 902 in threads 906, 908, and 910, block those threads when the program counters 912, 914, and 916 for each of the threads are outside of locations 902, install the filter when the threads are blocked, and then resume the threads.

To compute unsafe program locations for a mutual exclusion constraint, a static reachability analysis can be performed on the interprocedural control flow graph (ICFG) of an application in some embodiments. An ICFG connects each function's control flow graphs by following function calls and returns. FIG. 10(a) shows an example of an ICFG 1002 for the code in FIG. 8 in accordance with some embodiments. This static reachability analysis can first determine whether one statement can reach another statement. For example, statement s₁ reaches statement s₂ (which can be stated as “reachable(s₁, s₂)” is true) if there is a path from s₁ to s₂ on the ICFG. For example, the statement at line 13 reaches the statement at line 8 in FIG. 8. Next, given an execution filter f with mutual exclusion constraint r₁ < > r₂ < > . . . < > r_n, any statement s where “reachable(r_i.entries, s)̂reachable(s, r_i.exits)” is true for i=1 . . . n can be considered to be in an unsafe location, where r_i.entries is/are the entry statement(s) to region r_i and r_i.exits is/are the exit statement(s) from exit region r_i.

Any suitable technique for computing unsafe program locations for an execution order constraint can be used in some embodiments. For example, for a constraint e₁>e₂> . . . >e_n, unsafe program locations can be identified by first identifying all statements s_d that dominate any e_i (i.e., s_d is on every path from the program start to e_i), wherein i=1 . . . n, and then determining as unsafe any statements in any region between an s_d and a corresponding e_i.

Since e_i may be in different threads, the ICFG of an application can be augmented into a thread interprocedural control flow graph (TICFG) by adding edges for thread creation and join statements in accordance with some embodiments. A TICFG can be constructed by treating each “pthread_create(func)” statement as a function call to func( ), by adding an edge to the ICFG from the “pthread_create(func)” statement to the entry of func( ), and by adding a thread join edge to the ICFG from the exit of func( ) to the statement.

In some embodiments, in order to update application threads, the threads can be paused and resumed using a read-write lock (which can be referred to as an update lock). To update an application, the update engine can grab this lock in write node, perform the update, and release the lock. To control application threads, the application can be instrumented so that the application threads hold this lock in read mode in normal operation and checks for update once in a while by releasing, and re-grabbing this lock.

In some embodiments, update-checks can be placed inside an application to ensure timely update while not unduly increasing overhead. For example, in some embodiments, at least one update-check for each cycle in the control flow graph, including, loops and recursive function call chains, can be placed so that an application thread cycling, in one of these cycles can check for update at least once each iteration. More particularly, for example, the backedge of a loop and an arbitrary function entry in a recursive function cycle can be modified to include an update check. An example of this is shown by the call to “cycle_check( )” 1008 in 1004 of FIG. 10(b) in accordance with some embodiments.

In some embodiments, a wait flag can be assigned for each backedge of a loop and the chosen function entry of a recursive call cycle to ensure that application threads pause at safe locations. To enable/disable pausing at a safe/unsafe location, a corresponding flag can be set/cleared. The instrumentation code for each CFG cycle (e.g., the “cycle_check( )” code) can then check for updates only when the corresponding wait flag is set. These wait flags allow application threads at unsafe program locations to run until they reach safe program locations, effectively evacuating the unsafe program locations.

FIG. 11 shows examples of pseudo code 1102 that can be used to perform a cycle check in accordance with some embodiments.

In some embodiments, an application can be configured to release an update lock before a blocking call and re-grab it after the blocking call, so that an application thread blocking on the call for long does not delay an update. For the example, in FIG. 8, an update can be performed despite some threads being blocked in recv( ). In some embodiments, only the “leaf-level” blocking calls are modified to prevent a call from preventing an update during the call. For example, if foo( ) calls bar( ) and bar( ) is blocking, the calls to bar( ) can be modified, but the calls to foo( ) might not be modified. Calls to external functions (i.e., functions for which no source code is available) can be automatically presumed to be blocking to save user annotation effort in some embodiments. An example of this is shown by the calls to “before_blocking( )” 1010 and “after_blocking( )” 1012 in 1001 of FIG. 10(b) in accordance with some embodiments.

In some embodiments, a counter can be assigned to each blocking callsite to track how many threads are at the callsites. The counters can then be examined for calls at unsafe program locations and if one of these counters is positive, one or more attempts to release the update lock, wait, and re-grab it can be made, so that the threads blocked at unsafe locations can wake up and advance to safe locations. If some of the counters are still positive, the current update session can be aborted and retried at a later point.

FIG. 11 shows examples of pseudo code 1104 and 1106 that can be called before blocking calls and after blocking calls, respectively, to implement a counter and blocking call unlocking in accordance with some embodiments.

In some embodiments, each program location can be modified to include a slot function which interprets updates to the program location at runtime. FIG. 12 shows an example of pseudo code 1202 for such a slot function in accordance with some embodiments. This function iterates though a list of synchronization operations assigned to current statement and performs each. To update a program location at runtime, the operation list for the corresponding slot function can be modified.

Inserting the slot function at every statement may incur high runtime overhead and hinder compiler optimization. Accordingly, in some embodiments, two versions of each basic block in the application binary, an original version that is optimized, and a hot backup that is unoptimized and padded for update, can be maintained. To update a basic block at runtime, the backup can be updated and the execution switched to the backup by flipping a switch flag. In some embodiments, only function entries and loop backedges are modified to check the switch flags because doing so for each basic block can be expensive. An example of such slot function calls and hot backup switching, is shown in FIG. 10(c) in accordance with some embodiments.

FIG. 13 illustrates an example of hardware 1300 that can be used to implement some embodiments. As shown, hardware 1300 can include a storage device 1302, a compiler device 1304, a communication network 1306, user devices 1308, and a filter device 1310. Storage device 1302 can be any suitable device for storing software and/or data as described herein. For example, storage device 1302 can be a hard disk, a server, a network storage device, a memory device, etc. Compiler device 1304 can be any suitable device, such as a general purpose computer or server, for compiling, modifying, and/or instrumenting an application as described herein. For example, compiler device 1304 can include a compiler 116 and a compiler plugin 118 as described above in connection with FIG. 1. Communication network 1306 can be any suitable communication network for communicating applications, patches, execution filters, and/or any other suitable applications, parts of application, data, etc. Communication network 1306 can be any suitable one of or combination of the Internet, one or more local area networks, one or more wide area networks, one or more wireless networks, one or more wired networks, one or more satellite networks, one or more telephone networks, one or more cable television networks, etc. User devices 1308 can be any suitable devices for storing and running applications, execution filters, patches, etc. Filter writing device 1310 can be an suitable device for writing and/or storing execution filters and executing a controller program (such as controller program 122 of FIG. 1).

More particularly, for example, each of compiler device 1304, user devices 1308, and filter writing device 1310 can be any of a general purpose device such as a computer or a special purpose device such as a client, a server, etc. Any of these general or special purpose devices can include any suitable components such as a hardware processor (which can be a microprocessor, digital signal processor, a controller, etc.), memory, communication interfaces, display controllers, input devices, etc. For example, user devices 1308 can be implemented as a personal computer, a personal data assistant (PDA), a portable email device, a multimedia terminal, a mobile telephone, a smart phone, a tablet computer, a laptop, a portable media player, a set-top box, a streaming media player, a network appliance, a television, etc.

In some embodiments, any suitable computer readable media can be used for storing instructions for performing the processes described herein. Such computer readable media can be present in, attached to, and/or removable from storage device 1302, compiler device 1304, user devices 1308, and/or filter writing device 1310 in some embodiments. For example, in some embodiments, computer readable media can be transitory or non-transitory. For example, non-transitory computer readable media can include media such as magnetic media (such as hard disks, floppy disks, etc.), optical media (such as compact discs, digital video discs, Blu-ray discs, etc, semiconductor media (such as flash memory, electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), etc.), any suitable media that is not fleeting or devoid of any semblance of permanence during transmission, and/or any suitable tangible media. As another example, transitory computer readable media can include signals on networks, in wires, conductors, optical fibers, circuits, any suitable media that is fleeting and devoid of any semblance of permanence during transmission, and/or any suitable intangible media.

Although the invention has been described and illustrated in the foregoing illustrative embodiments, it is understood that the present disclosure has been made only by way of example, arid that numerous changes in the details of implementation of the invention can be made without departing from the spirit and scope of the invention, which is only limited by the claims which follow. Features of the disclosed embodiments can be combined and rearranged in various ways.

Claims

1. A method for protecting an application from a race, comprising:

adding to at least one cycle of the application an update check to determine when a software update to software of the application is to be made; and

adding an update engine to the application, wherein the update engine is configured to: receive an update plan that is based on an execution filter that specifies how operations of the application are to be synchronized; and cause synchronization operations to be added to the application as part of a software update based on the update plan that prevent the race from occurring.

2. The method of claim 1, further comprising adding a mechanism to prevent blocking calls from blocking updates.

3. The method of claim 1, further comprising adding at least one slot function that adds synchronization operations to the application based on the update plan.

4. The method of claim 1, further comprising adding an instrumented copy of at least a part of the application that can be executed instead of the at least a part of the application in response to the update plan.

5. The method of claim 1, wherein the execution filter controls execution order of at least two portions of the application.

6. The method of claim 1, wherein the execution filter causes the execution of at least two portions of the application to be mutually exclusive.

7. The method of claim wherein the execution filter causes a single portion of the application to be unilaterally executed.

8. A method for protecting an application from a race, comprising:

executing in at least one cycle of the application an update check to determine when a software update to software of the application is to be made;

receiving an update plan that is based on an execution filter that specifies how operations of the application are to be synchronized; and

performing synchronization operations as part of a software update based on the update plan that prevent the race from occurring.

9. The method of claim 8, further comprising preventing blocking calls from blocking updates.

10. The method of claim 8, further comprising adding synchronization operations to the application based on the update plan.

11. The method of claim 8, further comprising executing an instrumented copy of at least a part of the application instead of the at least a part of the application in response to the update plan.

12. The method of claim 8, wherein the execution filter controls execution order of at least two portions of the application.

13. The method of claim 8, wherein the execution filter causes the execution of at least two portions of the application to be mutually exclusive.

14. The method of claim 8, wherein the execution filter causes a single portion of the application to be unilaterally executed.

15. A method for protecting an application from a race, comprising:

creating an execution filter that specifies how operations of an application are to be synchronized;

generating an update plan for updating the software of the application that is based on the execution filter; and

causing synchronization operations to be performed at the application as part of a software update based on the update plan that prevent the race from occurring.

16. The method of claim 15, further comprising causing synchronization operations to be added to the application based on the update plan.

17. The method of claim 15, further comprising causing an instrumented copy of at least a part of the application to be executing instead of the at least a part of the application in response to the update plan.

18. The method of claim 15, wherein the execution filter controls execution order of at least two portions of the application.

19. The method of claim 15, wherein the execution filter causes the execution of at least two portions of the application to be mutually exclusive.

20. The method of claim 15, wherein the execution filter causes a single portion of the application to be unilaterally executed.