1. Sequential reductions for verifying serializability Hagit Attiya Technion & EPFL G. RamalingamMSR India Noam Rinetzky University of London

2. The goal Verify concurrent data structures Pre-execution static analysis E.g., linked list with hand-over-hand locking memory safety (no memory leaks) shape invariants (it’s a list) “atomicity” (serializability) Find sequential reductions  Consider only sequential executions  But conclude that properties hold in all executions

3. Serializability operation interleaved execution complete non-interleaved execution ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ thread-local views [Papadimitriou ‘79]

4. Serializability assists verification Concurrent code M Π = all executions of M cni-Π = all complete non-interleaved executions of M  Π φ = some thread-local property If M is serializable Then Π ⊨ φ  cni-Π ⊨ φ

5. How do we know that M is serializable, w/o considering all executions? I.e., checking only cni-executions Chicken and egg? If M is serializable Then Π ⊨ φ  cni-Π ⊨ φ

6. Special case: Disciplined coding Guard access to data with locks & ensure well-lockedness Follow a locking protocol that guarantees (conflict) serializability E.g., 2PL or tree (hand-over-hand) locking [Bayer & Scholnick ‘77] [Kedem & Sliberschatz ‘76] [Smadi ‘76] t1t1 H t1t1 t1t1 t2t2

7. Guard access to data with locks & ensure well-lockedness Follow a locking protocol that guarantees (conflict) serializability E.g., 2PL or tree (hand-over-hand) locking [Bayer & Scholnick ‘77] [Kedem & Sliberschatz ‘76] [Smadi ‘76] t1t1 t2t2 t2t2 Special case: Disciplined coding H t1t1

8. Is this enough? Yes! –for databases –concurrency control monitor ensures that M follows the locking policy at run-time  M is serializable No! –for static analysis –no central monitor int Y, B; void p() { acquire(B) B = 0 release(B) acquire(B) int b = B if (b) Y = 2 release(B) } void q() { acquire(B) B = 1 release(B) } Not even well-locked But only in interleaved executions How to (statically) verify that M follows a locking policy?

9. Our approach Holds for local conflict-serializable (LCS) locking protocols –Use only thread-local information E.g., two phase locking, tree locking, DAG locking… But not protocols that rely on a concurrency control monitor!

10. Our contribution: Easy step cni-Π = all complete non-interleaved executions of M  Π For any LCS locking policy LP Π ⊨ LP  ni-Π ⊨ LP non-interleaved execution For any thread-local property φ Π ⊨ φ  ni-Π ⊨ φ Two phase locking Tree locking Dynamic tree locking Dynamic DAG locking

11. acni-Π = all almost-complete non-interleaved executions of M  Π For any LCS locking policy LP Π ⊨ LP  acni-Π ⊨ LP almost complete non-interleaved execution Our contribution: Further reduction

12. Need to argue about termination Further reduction: A complication int X=0, Y=0 void p() { acquire(Y) y = Y release(Y); if (y ≠ 0) acquire(X) X = 3 release(X) } void q() { if (random(5) == 3){ acquire(Y) Y = 1 release(Y) while (true) nop } Y is set to 1 & the method enters an infinite loop Observe Y == 1 & violates 2PL

13.  Can use sequential reduction to verify termination For any “terminating” LCS locking policy LP Π ⊨ LP  acni-Π ⊨ LP Further reduction: Termination

14. Initial analysis results Shape analysis of hand-over-hand lists *Does not verify sortedness of list and fails to verify linearizability in some cases Shape analysis of hand-over-hand trees (for the first time) Our method 3.5s4.0MB TVLA prior596.1s90.3MB Separation logic* 0.4s0.2MB Our method 124.6s90.6MB

15. Why in the TM workshop? Transactions are transactions… –But we need to consider additional aspects: aborted transactions non-locking serializability (did anyone say timestamps?) –Combine with other reductions [Guerraoui, Henzinger, Jobstmann, Singh] Beyond memory transactions: –Disciplined concurrent programming –Automatic insertion of lock/unlock commands

16. Thank you!