1. Thread-Modular Verification Shaz Qadeer Joint work with Cormac Flanagan Stephen Freund Shaz Qadeer Joint work with Cormac Flanagan Stephen Freund

2. Calvin project  Check properties of systems code –operating systems kernel, file systems,...  Apply to multithreaded programs –deadlocks, data races,... –manifest in variety of ways –hard to recognize, locate, fix  For all inputs and all interleavings, program behaves “correctly” –no deadlocks, no races, invariants hold

3. Thread-modular verification  Modular –each thread verified separately –leverage techniques for reasoning about sequential programs  Expressive –handles variety of synchronization mechanisms  Low annotation overhead –many fewer annotations than the Owicki-Gries- Lamport method

4. SimpleLock program  Mutex lock  Verify that the assert never fails

5. Owicki-Gries-Lamport method  Sequential correctness  Non-interference X = {pre(X)} X {post(X)} {pre(Y) and pre(X)} Y {pre(X)} Y =

6. Why is Thread 1 correct? Thread 1 view: acq(mx); * * x := x * x; * x := x + 2; * assert x > 1; * rel(mx); 1-abstraction A i  (mx = i  mx’ = i  x’ = x) acq(mx); x := x * x; x := x + 2; assert x > 1; rel(mx); A1;A1; * A1;A1; * A1;A1; * A1;A1; * A1;A1; * A2A2 A2A2 A2A2 A2A2 A2A2 1-abstraction acq(mx); x := x * x; x := x + 2; assert x > 1; rel(mx); A1;A1; A1;A1; A1;A1; A1;A1; A1;A1; A2A2 A2A2 A2A2 A2A2 A2A2

7. Why is Thread 2 correct? Thread 2 view: acq(mx); * x := 0; rel(mx); 2-abstraction A i  (mx = i  mx’ = i  x’ = x) acq(mx); x := 0; rel(mx); A2;A2;A2;A2;A2;A2; A1A1 A1A1 A1A1 **

8. Assume-guarantee reasoning  Environment assumption (A t ) –expectation on every step taken by other threads  Guarantee (G t ) –conjunction of assumptions of other threads  Translate thread t into sequential t-abstraction –assume A t satisfied by steps of other threads –prove G t satisfied by each step of thread t –check using sequential techniques  Parallel program correct, if all sequential t-abstractions are correct –circularity resolved by induction over time

9. Summary of method Thread 1 Thread 2 Thread n 1-abs 2-abs n-abs ESC/Java... yes

10. Thread-modular verification theorem  If each t-abstraction of P is correct, then P is correct.  Generalize to invariant checking –want to show validity of data invariants –if no t-abstraction violates invariant I, then P does not violate invariant I

11. Thread-modular verification in practice  Assumptions parameterized by thread id  Assumptions reflexive and transitive  Scales with complexity of synchronization patterns, not size of program A i  (mx = i  mx’ = i  x’ = x)

12. Frangipani [Thekkath-Mann-Lee]  block is not allocated to inode  block allocated to inode m_inode block = null m_busy busy = false data = 0 inodeblock m_inode block m_busy busy = true data = 52 inodeblock

13. Frangipani  Assumption for thread i:

14. Current status  Theory understood  Built prototype for Java [with Seshia] –applied to Mercator (Heydon-Najork) –verified Mercator’s readers-writer lock class –checked the code of worker threads and checkpointing thread  Thread-modular verification with method calls across abstraction boundaries [with Flanagan and Seshia]

15. Related work  Owicki-Gries axiomatic semantics –replace control predicates with environment assumption  Assume-guarantee decomposition –[Abadi-Lamport 95, Jones 83,...] –designed proof system to leverage automated verification tools like ESC/Java  RCC/Java, Warlock [Sterling], ESC/Java –explicate simple locking strategy –can not easily express other idioms –data invariants