Static Lock Capabilities for Deadlock-Freedom Colin S. Gordon - - PowerPoint PPT Presentation

▶

static lock capabilities for deadlock freedom

Static Lock Capabilities for Deadlock-Freedom Colin S. Gordon - - PowerPoint PPT Presentation

May 25, 2023 49 likes •649 views

Static Lock Capabilities for Deadlock-Freedom Colin S. Gordon csgordon@cs.washington.edu University of Washington TLDI, January 28, 2012 Joint work with Michael D. Ernst and Dan Grossman Colin S. Gordon (University of Washington) Lock

slide-1

SLIDE 1

Static Lock Capabilities for Deadlock-Freedom

Colin S. Gordon csgordon@cs.washington.edu

University of Washington

TLDI, January 28, 2012 Joint work with Michael D. Ernst and Dan Grossman

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 1 / 16

slide-2

SLIDE 2

Verifying Deadlock Freedom

Deadlock

A cycle of threads, each blocked waiting for a resource held by the next thread in the cycle. T1 → T2 → . . . → Tn, T1 = Tn

Goal

Statically verify deadlock freedom for fine-grained locking Balanced binary trees Resizable hash tables Array elements Circular lists

Approach

A static (capability) type system

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 2 / 16

slide-3

SLIDE 3

Deadlock-Free Code

Assuming n2 == n1.left and n3 == n1.right: Thread1 : sync n2 {} Thread2 : sync n3 {} Thread3 : sync n1 {sync n1.left {sync n1.right {}}} Thread4 : sync n1 {sync n1.right {sync n1.left {}}} n1 ւ ց n2 n3

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 3 / 16

slide-4

SLIDE 4

Deadlock-Free Code

Assuming n2 == n1.left and n3 == n1.right: Thread1 : sync n2 {} Thread2 : sync n3 {} Thread3 : sync n1 {sync n1.left {sync n1.right {}}} Thread4 : sync n1 {sync n1.right {sync n1.left {}}} n1 ւ ց n2 n3 Prior static approaches require either: A total ordering on n1’s children (rejects T3 or T4), or Disallow interior pointers (n2, n3, rejecting T1 and T2) Lock capabilities impose neither restriction.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 3 / 16

slide-5

SLIDE 5

Lock Capabilities

Lock Capability

A static capability that permits acquiring additional locks Baked into a type-and-effect system Proved sound (they prevent deadlock) Straightforward extensions Scale to handle a set of diverse structures

◮ with the help of some extensions to plumb singleton types Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 4 / 16

slide-6

SLIDE 6

Intuition: Tree-Based Ordering

Fine-grained locking in a binary tree: Acquiring one lock while holding none avoids deadlock; “First lock is free”

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 5 / 16

slide-7

SLIDE 7

Intuition: Tree-Based Ordering

Fine-grained locking in a binary tree: Acquiring one lock while holding none avoids deadlock; “First lock is free” Following tree order deeply through the tree avoids deadlock.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 5 / 16

slide-8

SLIDE 8

Intuition: Tree-Based Ordering

Fine-grained locking in a binary tree: Acquiring one lock while holding none avoids deadlock; “First lock is free” Following tree order deeply through the tree avoids deadlock.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 5 / 16

slide-9

SLIDE 9

Intuition: Tree-Based Ordering

Fine-grained locking in a binary tree: Acquiring one lock while holding none avoids deadlock; “First lock is free” Following tree order deeply through the tree avoids deadlock. Assuming children are acquired

nly while holding the parent

lock, locking siblings avoids deadlock.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 5 / 16

slide-10

SLIDE 10

Intuition: Tree-Based Ordering

Fine-grained locking in a binary tree: Acquiring one lock while holding none avoids deadlock; “First lock is free” Following tree order deeply through the tree avoids deadlock. Assuming children are acquired

nly while holding the parent

lock, locking siblings avoids deadlock.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 5 / 16

slide-11

SLIDE 11

Generalizing Beyond Trees

Trees → Tree-shaped Partial Orders In an immutable tree-shaped partial ordering, a thread may acquire a lock l when: It holds no other locks, or It holds a lock l′ and l is a child of l′

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 6 / 16

slide-12

SLIDE 12

Generalizing Beyond Trees

Trees → Tree-shaped Partial Orders In an immutable tree-shaped partial ordering, a thread may acquire a lock l when: It holds no other locks, or It holds a lock l′ and l is a child of l′ Notice: No ordering imposed between siblings No restriction on aliases

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 6 / 16

slide-13

SLIDE 13

Generalizing Beyond Trees

Trees → Tree-shaped Partial Orders In an immutable tree-shaped partial ordering, a thread may acquire a lock l when: It holds no other locks, or It holds a lock l′ and l is a child of l′ Notice: No ordering imposed between siblings No restriction on aliases Harder: Early lock releases Modifying the partial order

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 6 / 16

slide-14

SLIDE 14

Lock Capabilities

c l a s s TreeNode { guardedBythis TreeNode left ; guardedBythis TreeNode right ; }

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 7 / 16

slide-15

SLIDE 15

Lock Capabilities

c l a s s TreeNode { guardedBythis TreeNode left ; guardedBythis TreeNode right ; }

← − Parent lock x grants capability x

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 7 / 16

slide-16

SLIDE 16

Lock Capabilities

c l a s s TreeNode { guardedBythis TreeNode left ; guardedBythis TreeNode right ; }

← − Parent lock x grants capability x ← − Child type includes the guarding capability: x.right : guardedByx TreeNode

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 7 / 16

slide-17

SLIDE 17

Lock Capabilities

c l a s s TreeNode { guardedBythis TreeNode left ; guardedBythis TreeNode right ; }

← − Parent lock x grants capability x ← − Child type includes the guarding capability: x.right : guardedByx TreeNode lock (x) in lock (x.right) in . . . May only acquire lock of type guardedByx when holding lock x (or no locks at all).

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 7 / 16

slide-18

SLIDE 18

Lock Capabilities

c l a s s TreeNode { guardedBythis TreeNode left ; guardedBythis TreeNode right ; }

← − Parent lock x grants capability x ← − Child type includes the guarding capability: x.right : guardedByx TreeNode lock (x) in lock (x.right) in . . . May only acquire lock of type guardedByx when holding lock x (or no locks at all). Deadlock freedom follows from the capability granting relation being a forest

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 7 / 16

slide-19

SLIDE 19

Structures with Cycles

A forest-shaped capability granting relation doesn’t require forest-shaped data structures. For example, here is a circular list: This circular list has cycles in the heap, but a tree-shaped capability granting relation.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 8 / 16

slide-20

SLIDE 20

Structures with Cycles

A forest-shaped capability granting relation doesn’t require forest-shaped data structures. For example, here is a circular list: This circular list has cycles in the heap, but a tree-shaped capability granting relation.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 8 / 16

slide-21

SLIDE 21

Supporting Mutable Structures

Lock relationships can change dynamically, so we need:

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 9 / 16

slide-22

SLIDE 22

Supporting Mutable Structures

Lock relationships can change dynamically, so we need: Strong Updates = ⇒ weakened form of uniqueness

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 9 / 16

slide-23

SLIDE 23

Supporting Mutable Structures

Lock relationships can change dynamically, so we need: Strong Updates = ⇒ weakened form of uniqueness Preserving Acyclicity = ⇒ track shape of capability-granting relation

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 9 / 16

slide-24

SLIDE 24

Supporting Mutable Structures

Lock relationships can change dynamically, so we need: Strong Updates = ⇒ weakened form of uniqueness Preserving Acyclicity = ⇒ track shape of capability-granting relation Releasing Out-Of-Order = ⇒ restrictions on lock acquisition

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 9 / 16

slide-25

SLIDE 25

Supporting Mutable Structures

Lock relationships can change dynamically, so we need: Strong Updates = ⇒ weakened form of uniqueness Preserving Acyclicity = ⇒ track shape of capability-granting relation Releasing Out-Of-Order = ⇒ restrictions on lock acquisition

◮ No time to discuss out-of-order releases Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 9 / 16

slide-26

SLIDE 26

Changing Capability Grants

The capability granting relation that determines each lock’s guard must allow changes.

Partial Uniqueness

A single reference carries the guard information for an object 1 u guardedByx TreeNode “Unique” with guard information ∞ guardless TreeNode Duplicable, no guard information

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 10 / 16

slide-27

SLIDE 27

Changing Capability Grants

The capability granting relation that determines each lock’s guard must allow changes.

Partial Uniqueness

A single reference carries the guard information for an object 1 u guardedByx TreeNode “Unique” with guard information ∞ guardless TreeNode Duplicable, no guard information

Partial Strong Updates

Guard information is isolated, enabling strong updates to the guard x : u guardedByy TreeNode − → x : u guardedByz TreeNode Goal: Type system infers strong updates without explicit guidance

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 10 / 16

slide-28

SLIDE 28

Changing Tree Structure

public TreeNode { public u_guardedBythis TreeNode left; public u_guardedBythis TreeNode right; } ... guardless TreeNode a; ... lock(a) { lock(a.left) { lock(a.left.left) { let b = dread(a.left) in let c = dread(b.left) in c.left := dread(b); a.left := dread(c); } } }

Destructive Reads

dread(p) atomically assigns null to path p and returns the old value, preventing duplication.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 11 / 16

slide-29

SLIDE 29

Preserving Acyclicity

Changes to the capability-granting relation must not create cycles. We track disjointness of capability-granting trees in a flow-sensitive manner. Removing an edge produces two mutually disjoint trees Adding an edge between two mutually disjoint trees produces one tree

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 12 / 16

slide-30

SLIDE 30

The Core Type System

Core typing judgement:

Υ;Γ; L ⊢ e : τ;Υ′

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 13 / 16

slide-31

SLIDE 31

The Core Type System

Core typing judgement: tree disjointness

Υ;Γ; L ⊢ e : τ;Υ′

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 13 / 16

slide-32

SLIDE 32

The Core Type System

Core typing judgement: tree disjointness

Υ;Γ; L ⊢ e : τ;Υ′

local variable typing

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 13 / 16

slide-33

SLIDE 33

The Core Type System

Core typing judgement: tree disjointness

Υ;Γ; L ⊢ e : τ;Υ′

local variable typing held locks (≡ capabilities)

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 13 / 16

slide-34

SLIDE 34

The Core Type System

Core typing judgement: tree disjointness

Υ;Γ; L ⊢ e : τ;Υ′

local variable typing held locks (≡ capabilities) Two theorems proven for basic lock capabilities with reordering:

1 Type Preservation ◮ Long, straightforward 2 Deadlock Freedom Preservation ◮ Extended semantics with capability-use log in graph form, modeling

thread dependencies

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 13 / 16

slide-35

SLIDE 35

Proposed Extensions

“Plumbing” Extensions: Arrays (treated as object with integer-named fields)

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 14 / 16

slide-36

SLIDE 36

Proposed Extensions

“Plumbing” Extensions: Arrays (treated as object with integer-named fields) Fixed guards (no strong update, but sharing guard info)

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 14 / 16

slide-37

SLIDE 37

Proposed Extensions

“Plumbing” Extensions: Arrays (treated as object with integer-named fields) Fixed guards (no strong update, but sharing guard info) External capabilities

◮ Parameterized classes a la RCC/Java ◮ class CircularListNode<ghost List l> {

fixed_guard<l> CircularListNode<l> next; fixed_guard<l> CircularListNode<l> prev; ... }

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 14 / 16

slide-38

SLIDE 38

Proposed Extensions

“Plumbing” Extensions: Arrays (treated as object with integer-named fields) Fixed guards (no strong update, but sharing guard info) External capabilities

◮ Parameterized classes a la RCC/Java ◮ class CircularListNode<ghost List l> {

fixed_guard<l> CircularListNode<l> next; fixed_guard<l> CircularListNode<l> prev; ... }

More substantial extensions: Unstructured Locking (requires more precise capability tracking)

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 14 / 16

slide-39

SLIDE 39

Proposed Extensions

“Plumbing” Extensions: Arrays (treated as object with integer-named fields) Fixed guards (no strong update, but sharing guard info) External capabilities

◮ Parameterized classes a la RCC/Java ◮ class CircularListNode<ghost List l> {

fixed_guard<l> CircularListNode<l> next; fixed_guard<l> CircularListNode<l> prev; ... }

More substantial extensions: Unstructured Locking (requires more precise capability tracking) Combination with lock levels

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 14 / 16

slide-40

SLIDE 40

Examples

Splay Tree Rotation

◮ Captured by SafeJava and Chalice, but SafeJava special-cases Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 15 / 16

slide-41

SLIDE 41

Examples

Splay Tree Rotation

◮ Captured by SafeJava and Chalice, but SafeJava special-cases

Array Element Locking (with array extension)

◮ Only addressed by Gadara, which may over-synchronize Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 15 / 16

slide-42

SLIDE 42

Examples

Splay Tree Rotation

◮ Captured by SafeJava and Chalice, but SafeJava special-cases

Array Element Locking (with array extension)

◮ Only addressed by Gadara, which may over-synchronize

Circular Lists (with external capabilities and fixed guard extensions)

◮ List used in OS kernels ◮ Each list node guarded by a central list object ◮ Allows parallelism between threads using single nodes and one thread

using multiple

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 15 / 16

slide-43

SLIDE 43

Examples

Splay Tree Rotation

◮ Captured by SafeJava and Chalice, but SafeJava special-cases

Array Element Locking (with array extension)

◮ Only addressed by Gadara, which may over-synchronize

Circular Lists (with external capabilities and fixed guard extensions)

◮ List used in OS kernels ◮ Each list node guarded by a central list object ◮ Allows parallelism between threads using single nodes and one thread

using multiple

Dining Philosophers (with external capabilities, fixed guards, and explicit unlock)

◮ All “chopstick” locks guarded by central lock ◮ Threads “eat” by locking central lock, then chopsticks, then releasing

central lock

◮ Can build hierarchy of intermediate locks for improved parallelism Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 15 / 16

slide-44

SLIDE 44

Examples

Splay Tree Rotation

◮ Captured by SafeJava and Chalice, but SafeJava special-cases

Array Element Locking (with array extension)

◮ Only addressed by Gadara, which may over-synchronize

Circular Lists (with external capabilities and fixed guard extensions)

◮ List used in OS kernels ◮ Each list node guarded by a central list object ◮ Allows parallelism between threads using single nodes and one thread

using multiple

Dining Philosophers (with external capabilities, fixed guards, and explicit unlock)

◮ All “chopstick” locks guarded by central lock ◮ Threads “eat” by locking central lock, then chopsticks, then releasing

central lock

◮ Can build hierarchy of intermediate locks for improved parallelism

All handled cleanly by a single general approach.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 15 / 16

slide-45

SLIDE 45

Contributions

Introduced lock capabilities

◮ New approach to verifying deadlock freedom ◮ Well-suited to fine-grained locking ◮ Suitable for any verification approach, we used types

Proved soundness: lock capabilities ensure deadlock freedom Sketched useful, straightforward extensions Showed how lock capabilities can verify deadlock freedom for important, challenging examples

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 16 / 16

slide-46

SLIDE 46

Backup Slides

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 17 / 16

slide-47

SLIDE 47

Splay Tree Rotation

c l a s s Node { u guardedBy<t h i s >Node l e f t ; u guardedBy<t h i s >Node r i g h t ; } . . . l e t f i n a l n = . . . i n l o c k ( n ) { l e t final x = n . r i g h t i n i f ( x ) { l o c k ( x ) { i f ( x . l e f t ) { let final v name = x.left in l o c k ( x . l e f t ) { l e t v = dread( x . l e f t ) i n let final w name = v.right in l e t w = dread( v . r i g h t ) i n // v . r i g h t := x v . r i g h t := dread( n . r i g h t ) ; x . l e f t := dread(w) ; n . r i g h t := dread( v ) ; }}}}}

Differences from regular code are highlighted. Most can be inferred by a compiler.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 18 / 16

slide-48

SLIDE 48

Array-order Locking

Array-order locking is generally undecidable; lock capabilities enable a restricted form to be verified. In our core language extended with arrays and integers:

l e t f i n a l arr , unique a = new u guardedBy Object [ n ] i n . . . l o c k ( a r r ) { l o c k ( a r r [ i ] ) { l o c k ( a r r [ j ] ) { . . . } } }

Note that we don’t need to compare i and j!

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 19 / 16

slide-49

SLIDE 49

Circular Lists

The list of running processes in an OS kernel is circular It requires fine-grained locking for performance. Atomic resource transfer requires locking multiple processes. There is no sensible ordering on processes.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 20 / 16

slide-50

SLIDE 50

Orphaned Locks

Acyclic capability granting is only half of soundness:

p u b l i c TreeNode { p u b l i c u guardedBythisTreeNode l e f t ; p u b l i c u guardedBythisTreeNode r i g h t ; } . . . g u a r d l e s s TreeNode a ; . . . l o c k ( a ) { l o c k ( a . l e f t ) { l o c k ( a . l e f t . l e f t ) { l e t b = dread ( a . l e f t ) i n l e t c = dread ( b . l e f t ) i n c . l e f t := dread ( b ) ; a . l e f t := dread ( c ) ; } // r e l e a s e c lock(a.left) { // l o c k c again // do stuff } } }

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 21 / 16

slide-51

SLIDE 51

Orphaned Locks

Acyclic capability granting is only half of soundness:

p u b l i c TreeNode { p u b l i c u guardedBythisTreeNode l e f t ; p u b l i c u guardedBythisTreeNode r i g h t ; } . . . g u a r d l e s s TreeNode a ; . . . l o c k ( a ) { l o c k ( a . l e f t ) { l o c k ( a . l e f t . l e f t ) { l e t b = dread ( a . l e f t ) i n l e t c = dread ( b . l e f t ) i n c . l e f t := dread ( b ) ; a . l e f t := dread ( c ) ; } // r e l e a s e c lock(a.left) { // l o c k c again // DEADLOCK!!! } } } l o c k ( n ) { // l o c k c lock(n.left) { // l o c k b // DEADLOCK!!! } }

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 21 / 16

slide-52

SLIDE 52

Theorem: Type Preservation

Syntactic proof Extended typing rules add:

◮ Heap typing Σ ◮ Per-thread capability grants φi : Value → Variable

(or intuitively, Lock → Lock)

Requires many invariants

◮ Most are natural (e.g. well-formed environments) ◮ A few natural to preserve, subtle to state ⋆ e.g. relating multiple threads’ assertions about the capability-granting

relation

◮ Full details in TR Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 22 / 16

slide-53

SLIDE 53

Theorem: Deadlock Freedom Preservation

Deadlock freedom is a preservation proof: Build a labeled graph of how threads use capabilities Prove there is never a path between a single thread’s locks using capabilities of multiple threads. Detailed sketch in paper, full proof in TR.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 23 / 16

slide-54

SLIDE 54

Dining Philosophers

The problem: The canonical deadlock example n philosophers eating at a circular table

◮ Only n chopsticks, one to each side of each philosopher ◮ Must share chopsticks (locks) with neighbors ◮ Philosophers are greedy and won’t put down chopstick (release lock)

until they’ve eaten

There is no way to put a consistent structural ordering on chopsticks (locks)

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 24 / 16

slide-55

SLIDE 55

Dining Philosophers

The problem: The canonical deadlock example n philosophers eating at a circular table

◮ Only n chopsticks, one to each side of each philosopher ◮ Must share chopsticks (locks) with neighbors ◮ Philosophers are greedy and won’t put down chopstick (release lock)

until they’ve eaten

There is no way to put a consistent structural ordering on chopsticks (locks) With support for lock capabilities with unstructured locking: Capability-granting relation identical to the circular list With releasing “global” lock early:

◮ Serializes acquisition ◮ Allows parallelism between threads holding multiple locks

Verifiably deadlock-free solution that allows some parallelism with simple code

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 24 / 16

slide-56

SLIDE 56

Background: Lock Levels

The program’s locks are partitioned into levels, and the programmer specifies a partial

rder on levels.

Lock Levels Locking Protocol

A thread may acquire a lock l when: It holds no other locks, or l is in a lock level ordered after the level of all locks held Limitations: Requires total ordering on any set of locks held concurrently. Can’t deal with reordering, except for SafeJava and Chalice.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 25 / 16

slide-57

SLIDE 57

Comparing Lock Levels and Lock Capabilities

Fundamental philosophical difference: with lock levels, acquiring a lock restricts the set of locks the thread may then acquire, while with lock capabilities, acquiring a lock extends the set of locks the thread may then acquire.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 26 / 16

slide-58

SLIDE 58

Comparing Lock Levels and Lock Capabilities

Fundamental philosophical difference: with lock levels, acquiring a lock restricts the set of locks the thread may then acquire, while with lock capabilities, acquiring a lock extends the set of locks the thread may then acquire. Lock Capabilities Are well-suited to fine-grained locking and reordering locks Allow some locking without total orderings Poorly-suited for locking unrelated “distant” locks Lock Levels Are well-suited to locking unrelated “distant” locks Require total ordering on locks held simultaneously Poorly suited for fine-grained locking, or reordering locks

◮ Except Chalice, which has a

very smart variation

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 26 / 16

slide-59

SLIDE 59

Comparing Lock Levels and Lock Capabilities

Fundamental philosophical difference: with lock levels, acquiring a lock restricts the set of locks the thread may then acquire, while with lock capabilities, acquiring a lock extends the set of locks the thread may then acquire. Lock Capabilities Are well-suited to fine-grained locking and reordering locks Allow some locking without total orderings Poorly-suited for locking unrelated “distant” locks Lock Levels Are well-suited to locking unrelated “distant” locks Require total ordering on locks held simultaneously Poorly suited for fine-grained locking, or reordering locks

◮ Except Chalice, which has a

very smart variation

It is possible to integrate the two for a more expressive system.

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 26 / 16

slide-60

SLIDE 60

Chalice (Leino & M¨ uller, ESOP’09, ’10)

Combines a clever variant of levels with fractional permissions: Uses a dense lattice of levels, not discrete

◮ For any levels l0, l1, exists l′

s.t. l0 ⊏ l′ ⊏ l1

Uses fractional permissions on a ghost field µ to reorder These add great flexibility over other lock level systems.

class TreeNode { TreeNode left , right; // declare full permission // on left.µ, right.µ } ... lock (n) { reorder n.left.µ after n.µ; lock (n.left) { reorder n.right.µ after n.left.µ; lock (n.right) {...} } }

Approaches lock capabilities, but Requires explicit reordering Full permissions for reordering loses external references Fails to exploit that this structure doesn’t need ordering on children

Colin S. Gordon (University of Washington) Lock Capabilities for Deadlock Freedom TLDI’12 27 / 16