1. Round-Up:
Runtime Checking Quasi Linearizability
of Concurrent Data Structures
Lu Zhang (Virginia Tech)
Arijit Chattopadhyay (Virginia Tech)
Chao Wang (Virginia Tech)
1

2. Concurrent Data Structures
2
Queues, stacks,… can be parallelized, but should
behave like their sequential counterparts.
Now a de facto
correctness standard

3. Linearizability: The Definition
3

4. Linearizability: The Idea
Each method call should “take effect” instantaneously at
some moment between its invocation and its response.
4
4
q.enq(x)
time
q.enq(y)
Linearization Point

5. Case I: Is this linearizable?
q.enq(x)
q.enq(y)
q.deq(y)
time
q.deq(x)
Yes!
5
q.enq(x) q.enq(y) q.deq(x) q.deq(y)

6. 6
6
q.enq(x) q.deq(y)
time
q.enq(y)
q.deq(x)
Case II: Is this linearizable? No!

7. Example: Linearizability Violation
temp=count+1;
count=temp;
count = 0;
count =2;
Thread 1: inc()
temp=count+1=1;
count=temp=1;
Thread 2: inc()
temp=count+1=2;
count=temp=2;
A correct execution
Thread 2: inc()
temp=count+1=1;
count=temp=1;
Thread 1: inc()
temp=count+1=1;
count=temp=1;
count = 0;
count =1;
A buggy execution
7

8. Outline
• Motivation
• What is (quasi) linearizability
• How to check it
• Experiments
• Conclusions
8

9. Problem: Linearizability can be expensive
• Imposes undue synchronization …
– Performance issues
– Scalability issues
• … that often can be relaxed in many applications
– Scheduler in a task pool
• strict FIFO queue is not required
– Data caching in web
• stale data is acceptable if delay is bounded
– ID generator in distributed systems
• may be out-of-order occasionally
– Shared counter
• Not necessary to be strictly ordered
9

10. Quasi Linearizability
10
Bounded out-of-order
behaviors
Significant performance
increase

11. Our Contribution
• First method for checking quasi linearizability in the C/C++
code of concurrent data structure implementations
• Implementation based on
• Clang/LLVM -- for code instrumentation
• Inspect -- a systematic concurrency testing tool
• Detected previously unknown bug
– Scal benchmarks
11

12. Some Related Work
12
• Theorem Proving
– [V. Vafeiadis VMCAI 2009 ]
… requires significant manual effort
• Model Checking
– [Liu et al FM 2009]
… works only on models, not on the actual source code
implementation
• Runtime Verification
– [S. Burckhardt et al PLDI 2010]
… checks standard linearizability only

13. Outline
• Motivation
• What is quasi linearizability
• How to check it
• Experiments
• Conclusions
13

14. Example: Quasi Queue
1. Conceptual Model:
2. Implementation:
14
Quasi Factor=4

15. Example: Legal Histories
15
Quasi Factor=1
Linearizable
Quasi
Linearizable

16. Concurrent
Histories
Onion Ring Relationship
16
Linearizable
Histories
Quasi Linearizable
Histories
Our Method
Buggy
Histories
Existing Methods

17. Outline
• Motivation
• What is quasi linearizability
• How to check it
– Phase 1: generate sequential histories
– Phase 2: generate concurrent histories
• Experiments
• Conclusions
17

18. 3 Verification Levels
In this work, we focus on L1 and L2.
18

19. Input and Output
• Input
– C/C++ code of the concurrent data structure
– C/C++ code of the test program
– Quasi factor
• Output
– Whether there is a (quasi) linearizability violation
• Debugging info to help understand the violation
19

20. Overall Workflow
20

21. Linearizing A Concurrent History
• We compute the linearizations (sequential permutation) by
repeatly untangling the overlapping events
• Overlapping Pattern: … [inv1] … [inv2] … [resp1] …
21

22. Computing Quasi Permutations
Quasi Queue , k=1
22

23. Computing Quasi Permutations (alg.)
• Use a doubly linked list to represent the state stack
• Each method call moves object from one state to another
• Use a backtrack exploration to find all quasi permutations
…
deq(3)
deq(1)
23
Quasi Queue , k=1

24. Newly Enabled Set
• How earlier each method call can occur
24
k=0
k=1
k=2
Restriction 1 Guaranteed!

25. Lateness Of Method Calls
• How later each method call can occur
• Assign Lateness when enabled
25
Lateness < 0
Lateness = 0
Lateness > 0
k=1
New Enabled:
deq(1), L= 0
deq(2), L= -1
New Enabled:
deq(3), L= -1
New Enabled:
Lateness +1 when not selected
Lateness should always <= quasi factor
Lateness is unique in each state

26. Backtrack Exploration, K=1
26
Enabled:
deq(1), L=0
deq(2), L= -1
Enabled:
deq(3), L= -1
deq(2), L= -1+1=0
Enabled:
deq(3), L=0
s1 s2 s3
Last backtrack point
Enabled:
deq(1), L=0
deq(2), L= -1
s1 s2
Enabled:
deq(3), L= -1
deq(2), L= -1+1=0
Original
history
s3'
Enabled:
deq(2), L=0+1=1
Last backtrack point
…
…
History: deq(1) deq(2) deq(3)

27. Must-Select Event
• Lateness should always <= k(quasi factor)
• If the lateness of a method call reaches k, then we
must select it at that state.
• Backtrack Exploration Done!
27
Enabled:
deq(1), L=0
deq(2), L= -1
s1 s2''
Enabled:
deq(3), L= -1
deq(1), L= 0+1=1
L = 1 = k, we must select it !
Restriction 2 Guaranteed!
s3''
Enabled:
deq(3), L= -1+1=0
…
No more backtrack points

28. Check Quasi Linearizability
28

29. Outline
• Motivation
• What is quasi linearizability
• How to check it
– Phase 1: generate sequential histories
– Phase 2: generate concurrent histories
• Experiments
• Conclusions
29

30. Experiments
• The Round-Up tool
– LLVM
– Inspect
• Evaluated on two sets of benchmarks
– Textbook examples
– The Scal benchmarks
30

31. Results (1)
31

32. Results (2)
• Results on the Scal benchmark examples
32

33. The k-stack bug
2
Thread 1:
push(2)
Thread 2:
pop()
2
Empty
Segment!
Push the item
in
Try to remove
Segment
Double check
push: Fail !
Double check
remove: Fail !
Need to retry,
push again
Normal push
…
Normal pop
…
To be removed
2
2
2
33

34. Outline
• Motivation
• What is quasi linearizability
• How to check it
– Phase 1: generate sequential histories
– Phase 2: generate concurrent histories
• Experiments
• Conclusions
34

35. Conclusions
• First method for checking quasi
linearizability of C/C++ code of concurrent
data structures
– Fully automated
– Sound, no false positives
• Future work
– Scalability remains a bottleneck
• Add new symmetry reduction techniques and
improve the existing partial order reduction
• Avoid generating redundant quasi permutations
35

36. Questions?
36

37. Some Related Work
37
• Theorem Proving
– [V. Vafeiadis VMCAI 2009 ]
– [V. Vafeiadis et al PPOPP 2006]
… requires manual effort
• Model Checking
– [Liu et al FM 2009]
– [M. T. Vechev et al SPIN 2009]
– [P. Cern′y et al CAV 2010]
– [K. Adhikari et al SPIN 2013]
… works on models, not on the actual source code
implementation
• Runtime Verification
– [S. Burckhardt et al PLDI 2010]
– [M. Pradel et al PLDI 2012]
… checks standard linearizability