Linearizability with ownership transfer

Size: px

Start display at page:

Download "Linearizability with ownership transfer"

Phoebe Tucker
6 years ago
Views:

1 Linearizability with ownership transfer Hongseok Yang University of Oxford Joint work with Alexey Gotsman (IMDEA Software Institute, Spain)

2 Concurrent libraries Encapsulate efficient concurrent algorithms. - Java: java.util.concurrent - C++: Threading Building Blocks - C#: System.Collections.Concurrent Implement stacks, queues, skip lists, hash tables, etc. But it is not easy to understand why they are correct.

3 Non-blocking stack: (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push)

4 Non-blocking stack: Why is it OK to return empty here? (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push)

5 Non-blocking stack: It can also return no (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(no)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push)

6 A binary relation L L on libraries L and L. Usually, L is an impl. and L is a spec.

7 Problem

8 Shared address space C ret m(0) call m(42) L

9 Shared address space C ret m(0) call m(42) L Linearizability assumes a complete isolation between the library and its client.

10 Shared address space C ret m(0) call m(42) L Linearizability assumes a complete isolation between the library and its client. If client and library share address space, they can corrupt each other.

11 Ownership transfer C ret m(ok) call m(node* p) L Boundary between data structures owned by the library and its client is not static. Ownership = right to access. Ownership of cells transferred between library and client.

12 Example: container Typically stores pointers to data structures. Thread 1 Thread 2 A B C L

13 Example: container Typically stores pointers to data structures. Thread 1 A Thread 2 C L B

14 Example: container Typically stores pointers to data structures. Thread 1 Thread 2 A B C L

15 Example: container Typically stores pointers to data structures. Thread 1 Thread 2 A B C L Can t access B after transferring its ownership!

16 Our paper 1. We generalised linearizability to a realistic setting: shared address space, ownership transfer. 2. Our generalisation gives the Abstraction Theorem: L v L Can replace L by L in a proof of C in C(L). C L C L

17 Review of linearizability

18 Histories H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) (t1, call push(42))(t2, call pop)(t1, ret push)(t2, ret pop(42))(t2,call push(11))...

19 Histories H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push)

20 Linearization relation H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t2, call pop) (t2, ret pop(42)) (t1, call isempty) (t2, call push(11)) (t1, ret isempty(yes)) (t2, ret push) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

21 Linearization relation H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t2, call pop) (t2, ret pop(42)) (t1, call isempty) (t2, call push(11)) (t1, ret isempty(yes)) (t2, ret push) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

22 Linearization relation H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t2, call pop) (t2, ret pop(42)) (t1, call isempty) (t2, call push(11)) (t1, ret isempty(yes)) (t2, ret push) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

23 Linearization relation H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(no)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) (t1, call isempty) (t1, ret isempty(no)) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

24 Linearization relation H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(no)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t1, call isempty) (t2, call pop) (t1, ret isempty(no)) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

25 Linearization relation L v L 0 () 8H 2 JLK. 9H 0 2 JL 0 K.H v H 0 H (t1, call push(42)) (t1, ret push) (t1, call isempty) (t1, ret isempty(no)) (t2, call pop) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H 0 (t1, call push(42)) (t1, ret push) (t1, call isempty) (t2, call pop) (t1, ret isempty(no)) (t2, ret pop(42)) (t2, call push(11)) (t2, ret push) H v H 0 We can permute calls and returns by different threads. But non-overlapping method invocations can t be rearranged.

26 Our results

27 Specified library L : Γ Γ defines a light-weight specification {pm}m{qm} for every method m in L. E.g. {n _}push(n){emp}, {emp}pop{res _}. pm determines cells transferred from client to library. qm determines cells transferred from library to client.

28 Histories with ownership transfer (t1, call push([10:0])) (t1, ret push) (t1, call isempty) (t1, ret isempty(yes)) (t2, call pop) (t2, ret pop([10:0])) (t2, call push([20:0])) (t2, ret push) Before: (t, call m(k)), (t, ret m(k)) for k in Integer. Now: (t, call m(θ)), θ pm; (t, ret m(θ)), θ qm. Linearizability as before.

29 Why were we surprised? Important properties of standard linearizability rely on the movability of call and ret actions.

30 Why were we surprised? Important properties of standard linearizability rely on the movability of call and ret actions.

31 Why were we surprised? Important properties of standard linearizability rely on the movability of call and ret actions. (t1, ret pop([10:0])) (t2, push([10:0])) But this movability might not hold in the presence of transferred cells.

32 Well-balanced histories Histories that have correct accounting of cells owned by library and its client. (t1, call push([10:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([10:0]))

33 Well-balanced histories Histories that have correct accounting of cells owned by library and its client. (t1, call push([10:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([10:0])) (t1, call push([20:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([30:0]))

34 Well-balanced histories Histories that have correct accounting of cells owned by library and its client. (t1, call push([10:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([10:0])) (t1, call push([20:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([30:0])) (t1, call push([20:0])) (t1, ret push) (t2, call push([10:0])) (t2, ret push) (t2, call pop()) (t2, ret pop([20:0]))

35 Semantics of specified library L:Γ 0 1 n k k=1 while (true) { if (nondet()) {new p 1 ; m 1 (nondet()); delete q 1 ;} else if (nondet()) {new p 2 ; m 2 (nondet()); delete q 2 ;}... else {new p l ; m l (nondet()); delete q l ;} } C A

36 Semantics of specified library L:Γ Any number of threads n k k=1 0 Any methods, in any order, with any parameters while (true) { if (nondet()) {new p 1 ; m 1 (nondet()); delete q 1 ;} else if (nondet()) {new p 2 ; m 2 (nondet()); delete q 2 ;}... else {new p l ; m l (nondet()); delete q l ;} } 1 C A

37 Semantics of specified library L:Γ Any number of threads n k k=1 0 Any methods, in any order, with any parameters while (true) { if (nondet()) {new p 1 ; m 1 (nondet()); delete q 1 ;} else if (nondet()) {new p 2 ; m 2 (nondet()); delete q 2 ;}... else {new p l ; m l (nondet()); delete q l ;} } 1 C A new p: allocates an arbitrary state satisfying p. delete q: removes the part of state satisfying q.

38 Semantics of specified library L:Γ 0 1 n k k=1 while (true) { if (nondet()) {new p 1 ; m 1 (nondet()); delete q 1 ;} else if (nondet()) {new p 2 ; m 2 (nondet()); delete q 2 ;}... else {new p l ; m l (nondet()); delete q l ;} } C A L:Γ consists of histories generated by this most general client. Lemma: Only well-behaved histories are generated.

39 Linearizability L v L 0 () 8H 2 JLK. 9H 0 2 JL 0 K.H v H 0 Generated from the most-general client Libraries L and L have the same specifications Γ.

40 Abstraction Theorem Assume: Client C and libraries L, L : Γ are safe. L Then v L. client(jc(l)k) client(jc(l 0 )K) Can replace L by L in a proof of C: C L C L C(L 0 ) = P C(L) = P

41 Abstraction Theorem Client and library do not corrupt each other. Assume: Client C and libraries L, L : Γ are safe. L Then v L. client(jc(l)k) client(jc(l 0 )K) Can replace L by L in a proof of C: C L C L C(L 0 ) = P C(L) = P

Concurrent library abstraction without information hiding

Universidad Politécnica de Madrid Escuela técnica superior de ingenieros informáticos Concurrent library abstraction without information hiding Artem Khyzha Advised by Manuel Carro and Alexey Gotsman Madrid