Verifying Deadlock Freedom Duy-Khanh LE , Wei-Ngan CHIN, Yong-Meng - PowerPoint PPT Presentation

An Expressive Framework for Verifying Deadlock Freedom Duy-Khanh LE , Wei-Ngan CHIN, Yong-Meng TEO {leduykha,chinwn,teoym} [at] comp.nus.edu.sg 11 th International Symposium on Automated Technology for Verification and Analysis (ATVA), Hanoi, Vietnam, Oct 15 – 18, 2013

Outline  Motivation  Related Work  Objective & Contributions  Approaches  Precise locksets  Delayed lockset checking  Combining lockset and locklevel  Implementation & Preliminary Experiment  Conclusion An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 2

Motivation  Deadlock is a notoriously important issue  6,500 reports out of 198,000 ( ∼ 3%) of Sun’s bug report database containing the keyword “deadlock” [ICSE’09]  Existing formal reasoning frameworks  focus on partial correctness  and mostly ignore deadlocks  Need to formally reason about deadlock- freedom An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 3

Types of Deadlocks  Deadlocks are often defined as “states in which each thread in a set blocks waiting for others to finish, but neither ever does”  D1 : Double lock acquisition  D2 : Interactions between thread and lock operations  D3 : Unordered locking An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 4

Related Work  Formal reasoning frameworks  Often use abstract predicates (e.g. locked(x) ) to represent states of locks  Partial correctness [APLAS’07, ESOP’08, POPL’11, etc]  Chalice [ESOP’09, ESOP’10] can prevent D1&D3  Dynamic analyses (e.g ICSE’12)  Cannot guarantee the absence of deadlocks  Static analyses and type systems (e.g. ICSE’09, TLDI’12)  Tend to be less expressive than specification logics  Ignore D2 An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 5

Objective  Propose an expressive logical framework for ensuring deadlock-freedom from various deadlock scenarios (D1, D2, and D3) An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 6

Contributions  C1 : Advocate precise locksets as a deadlock-aware abstraction  for reasoning about concurrent programs that manipulate non-recursive locks (D1)  C2 : Propose delayed lockset checking technique  to help reasoning about interactions between thread and lock operations (D2)  C3 : Combine locksets with the locklevels  to form an expressive framework (D3) An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 7

C1: Precise Lockset as an Abstraction  Lockset  A verification concept (denoted as LS )  A thread-local ghost variable capturing the set of locks held by a thread. An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 8

C1: Precise Lockset as an Abstraction  Precise Lockset // ??? Under-approximation: Over-approximation: Precise lockset: An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 9

D1: Double Lock Acquisition An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 10

D1: Double Lock Acquisition An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 11

D1: Double Lock Acquisition An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 12

D2: Interactions between Thread and Lock Ops  deadlocked  deadlock-free An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 13

D2: Traditional Verification Fails   Verified but deadlocked ! An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 14

D2: Traditional Verification Fails  Deadlock-free but not verified ! An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 15

D2: Traditional Verification Fails   Observations  Verified but deadlocked ! Deadlock-free but not verified ! An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 16

C2: Delayed Lockset Checking /* DELAY */ /* DELAY */ /* CHECK, error */ /* CHECK, ok */  Verified => deadlock-free  Deadlocked => not verified An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 17

Exercise – Deadlocked or Deadlock-free? void thread1(lock l) void thread2(lock l,int tid1) { { acquire(l); join(tid1); release(l); } } void main() { lock l = new lock(); int tid1 = fork(thread1,l); acquire(l); int tid2 = fork(thread2,l,tid1); release(l); join(tid2); } Note: - 3 PhD students need > 15 minutes to figure out (with several attempts) - Answer given in the last slide An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 18

D3: Unordered Locking An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 19

D3: Unordered Locking  An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 20

C3: Encoding Waitlevel Using Lockset An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 21

Programming Language An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 22

Specification Language  Example An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 23

Verification Rules (1) (standard) An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 24

Verification Rules (2) (delayed lockset checking) (precise lockset) An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 25

Guarantee on Deadlock Freedom An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 26

Implementation  ParaHIP prototype for verifying correctness + deadlock freedom  Fork/join concurrency + non-recursive locks  Forking of recursive procedures  Unbounded #locks using shape predicates  Thread transfer Download or try ParaHIP online at http://loris-7.ddns.comp.nus.edu.sg/~project/parahip/ An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 27

Preliminary Experiment No Scenario Chalice ParaHIP Comments ✗ ✓ 1 no-deadlock1 Chalice cannot prove that this program is deadlock-free ✓ ✓ 2 no-deadlock2 ✗ ✓ 3 no-deadlock3 Chalice cannot prove that this program is deadlock-free ✗ ✓ 4 deadlock1 Chalice verifies this deadlock scenario as deadlock-free ✓ ✓ 5 deadlock2 ✓ ✓ 6 deadlock3 ✓ ✓ 7 disj-no-deadlock ✗ ✓ 8 disj-deadlock Chalice verifies this deadlock scenario as deadlock-free ✓ ✓ 9 ordered-locking ✓ ✓ 10 unordered-locking (*) Comparison details and implications are discussed in the paper An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 28

Conclusion (Take-home Message)  C1 : Advocate precise locksets as a deadlock-aware abstraction  C2 : Propose delayed lockset checking technique  C3 : Combine locksets with the locklevels Expressive framework for verifying deadlock-freedom An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 29

Future Work  Recursive locks  Lock bag, lock sequence  Other constructs, e.g. barriers  Single barrier (to appear in ICFEM’2013)  Multiple barriers  Multiple barriers, multiple locks An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 30

Answer: It is Deadlock-free  See the example “ no-deadlock-nonlexical ” in our webpage: http://loris-7.ddns.comp.nus.edu.sg/~project/parahip/ An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 31

Answer: It is Deadlock-free An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 32

Q&A  THANK YOU FOR LISTENING leduykha@comp.nus.edu.sg Download or try ParaHIP online at http://loris-7.ddns.comp.nus.edu.sg/~project/parahip/ END An Expressive Framework for Verifying Deadlock Freedom 18 October 2013 33

References (1) [APLAS’07] Gotsman, A., Berdine, J., Cook, B., Rinetzky, N., Sagiv, M.: Local Reasoning for Storable Locks and Threads. In: Shao, Z. (ed.) APLAS 2007. LNCS, vol. 4807, pp. 19 – 37. Springer, Heidelberg (2007) [ESOP’08] Hobor, A., Appel, A.W., Nardelli, F.Z.: Oracle Semantics for Concurrent Separation Logic. In: Drossopoulou, S. (ed.) ESOP 2008. LNCS, vol. 4960, pp. 353 – 367. Springer, Heidelberg (2008) [ESOP’09] Leino, K.R.M., M ¨ uller, P.: A Basis for Verifying Multi-threaded Programs. In: Castagna, G. (ed.) ESOP 2009. LNCS, vol. 5502, pp. 378 – 393. Springer, Heidelberg (2009) [ESOP’10] Leino, K.R.M., M ¨ uller, P., Smans, J.: Deadlock-Free Channels and Locks. In: Gordon, A.D. (ed.) ESOP 2010. LNCS, vol. 6012, pp. 407 – 426. Springer, Heidelberg (2010) An Expressive Framework for Verifying Deadlock Freedom 34 18 October 2013

References (2) [ICSE’09] Naik, M., Park, C.-S., Sen, K., Gay, D.: Effective Static Deadlock Detection. In: ICSE, pp. 386 – 396 (2009) [POPL’11] Jacobs, B., Piessens, F.: Expressive Modular Fine- grained Concurrency Specification. In: POPL, New York, NY, USA, pp. 271 – 282 (2011) [TLDI’12] Gordon, C.S., Ernst, M.D., Grossman, D.: Static Lock Capabilities for Deadlock Freedom. In: TLDI, pp. 67 – 78 (2012) [ICSE’12] Cai, Y., Chan, W.K.: MagicFuzzer: Scalable Deadlock Detection for Large-scale Applications. In: ICSE, pp. 606 – 616 (2012) An Expressive Framework for Verifying Deadlock Freedom 35 18 October 2013