Reachable State Spaces of Distributed Deadlock Avoidance Protocols

Transcription

1 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols CÉSAR SÁNCHEZ and HENNY B. SIPMA Stanfod Univesity We pesent a family of efficient distibuted deadlock avoidance algoithms with applications to distibuted eal-time and embedded systems (DREs), which subsumes peviously known solutions as special instances. Then we use this family to study the eachable set of states and the allocation sequences allowed by the diffeent potocols. This esult enables a new poof method fo showing feedom fom deadlock of vaiations of deadlock avoidance potocols. Distibuted deadlock avoidance is a had poblem and geneal solutions ae consideed impactical due to the high communication ovehead. In pevious wok, howeve, we showed that pactical solutions exist when all possible sequences of esouce equests ae known a pioi in the fom of call gaphs; in this case, potocols can be constucted that pefom safe esouce allocation based on local data only, that is, no communication between components is equied. The most basic algoithm Basic-P, pefoms only one opeation pe equest using one counte pe site. The potocol Live-P, which also guaantees liveness globally, needs to pefoms a logaithmic numbe of opeations pe equest, using a linea numbe of countes in each site (in tems of the total ammount of esouces). The family of algoithms that we intoduce hee, called k-efficient-p, subsumes these as special cases. This family allows us to compae the potocols accoding to the set of eachable states and thei legal allocation sequences. We pove that, even though the moe libeal algoithms allow moe concuency, all algoithms can each the same set of states. We captue this set of states as a netwok invaiant. Categoies and Subject Desciptos: D.4.1 [Softwae]: Opeating Systems Pocess management; D.1.3 [Softwae]: Pogamming Techniques Concuent pogamming Geneal Tems: Theoy, Reliability, Algoithms Additional Key Wods and Phases: Scheduling, Deadlock Avoidance, Distibuted Algoithms 1. INTRODUCTION Computations in distibuted systems often involve a distibution of method calls ove multiple sites. At each site these computations need esouces, fo example in the fom of theads, to poceed. With multiple pocesses stating and unning at diffeent sites, and a limited numbe of theads at each site, deadlock may aise. Taditionally thee methods ae used to deal with deadlock: deadlock pevention, deadlock avoidance, and deadlock detection. In deadlock pevention a deadlock state is made uneachable by violating one of the necessay conditions fo dead- Autho s addess: Césa Sánchez, Compute Science, Stanfod Univesity, Stanfod, CA cesa@theoy.stanfod.edu This is a Technical Repot. Pemission is ganted to make digital/had copy of all o pat of this mateial without fee fo pesonal o classoom use, povided that the copies ae not made o distibuted fo pofit o commecial advantage, the copyight/seve notice, the title of the publication, and its date appea. c 2006 The Authos Technical Repot REACT-TR , June 2006, Pages 1 18.

2 2 C. Sánchez and H. B. Sipma lock. Fo example, imposing a fixed ode in which esouces ae acquied, such as in monotone locking [Biell 1989], violates the condition fo a cyclic dependency among esouces. This stategy, howeve, imposes some buden on the pogamme, and often a moe impotant concen in embedded systems can substantially educe pefomance, by atificially limiting concuency. With deadlock detection methods deadlock states may occu, but ae upon detection esolved by, fo example, oll-back of tansactions. This appoach is common in databases. In embedded systems, howeve, this is usually not an option, especially in systems inteacting with physical devices. Deadlock avoidance methods take a middle oute. At untime a potocol is used to decide whethe a equest fo esouces is ganted based on cuent esouce availability and possible futue equests of pocesses in the system. A esouce is ganted only if it is safe, that is, if all pocesses still have a stategy to complete. To make this test feasable, pocesses that ente the system must infom the potocol about thei expected esouce usage. The best known algoithm following this stategy is Dijksta s Banke s algoithm [Dijksta 1965; Habemann 1969; Havende 1968; Stallings 1998; Silbeschatz et al. 2003], whee a pocess upon ceation epots the maximum numbe of esouces of each type that it can equest duing its execution. This infomation is used to decide whethe to gant esouce equests. When esouces ae distibuted acoss multiple sites, howeve, deadlock avoidance is hade, because the diffeent sites may have to consult each othe to detemine whethe a paticula allocation is safe. Because of this need fo distibuted ageement, a geneal solution to distibuted deadlock avoidance is consideed impactical [Singhal and Shivaati 1994]; the communication costs involved simply outweigh the benefits gained fom deadlock avoidance ove deadlock pevention. In this pape we study a distibuted deadlock avoidance algoithm that does not equie any communication between sites. The algoithm is applicable to distibuted systems in which pocesses pefom method invocations at diffeent sites and lock local esouces (theads) until all emote calls have etuned. In paticula, if the chain of emote calls aives back to a site peviously visited, then a new esouce is needed. This model aises, fo example, in distibuted eal-time and embedded (DRE) achitectues that use the WaitOnConnection policy fo nested up-calls [Schmidt 1998; Schmidt et al. 2000; Subamonian et al. 2004]. The algoithm s ability to povide deadlock avoidance using only opeations ove local data is made possible by poviding the potocol with additional infomation about esouce usage in the fom of call gaphs that epesent all possible sequences of emote invocations. In DRE systems, this infomation can usually be extacted fom the component specifications o fom the souce code diectly by static analysis. In [Sánchez et al. 2005; Sánchez et al. 2006; Sánchez et al. 2006] we pesented a fist vesion of such a deadlock avoidance algoithm based on an annotated global call gaph and showed that the conditions imposed on these annotations wee tight: a violation could lead to deadlock. The est of this document is stuctued as follows. Section 2 intoduces the computational model and the necessay notation and shows why deadlocks can be eachable if no allocation manage is used. Section 3 pesents a netwok invaiant that deadlock avoidance algoithms maintain, estates the peviously known po-

3 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 3 tocols in tems of this invaiants. This genealization allows the definition of the family of potocols k-efficient-p. Sections 4 and 5 compae the diffeent algoithms accoding the global sequences of legal allocations they allow, and the set of global states they can each. Finally, Section 6 explains a new poof technique fo coectness of deadlock avoidance schemas deived fom the esults in this pape, sketches some open poblems and the conclusions. 2. COMPUTATIONAL MODEL To study deadlock avoidance potocols we view a distibuted system as a set of sites that pefom computations and a set of call gaphs that descibe how and at which site these computations ae to be pefomed. The esouces we conside ae the theads. In classical opeating systems teminology, the esouces ae guaded by counting semaphoes. The call gaphs povide a static epesentation of all possible esouce usage pattens. Fomally, a distibuted system is modeled by a tuple S : R, G consisting of R : { 1,..., R }, a set of sites, and G : {G 1,..., G G }, a set of distinct call gaphs. Each call gaph G i is a finite tee V i, i whee each node n: epesents a method that uns in site. We also say that node n esides in site. If two nodes eside in the same site we wite n R m. An edge fom n: to m:s denotes that method n, in the couse of its execution may invoke method m in site s. We assume that evey pai of call gaphs is disjoint: V i V j = and i j = wheneve i j. We also use V fo i V i and fo i i, and call (V, ) the call gaph of system S. We assume that each site has a fixed numbe of pe-allocated esouces. Although in many moden opeating systems theads can be spawned dynamically, it is common in eal-time systems to bound esouces. Many DRE systems pe-allocate a fixed sets of theads to avoid the elatively lage and vaiable cost of thead ceation and initialization. Each site stoes a set of local vaiables V that includes the constant T 1 denoting the numbe of esouces pesent in, and a vaiable t that epesents the numbe of available esouces. Initially, t = T. The execution of a system consists of pocesses, which can be ceated dynamically, executing computations that only pefom emote calls accoding to the edges in the call gaph. When a new pocess is spawned it announces the call gaph node whose outgoing paths descibe the emove calls that the pocess will pefom. All invocations to a call gaph node equie a new esouce in the coesponding site, while call etuns elease the esouce. We impose no estiction on the topology of the call gaph o on the numbe of pocess instances, and thus deadlocks can be eached if all equests fo esouces ae immediately ganted. Example 2.1. Conside a system with two sites R = {, s}, a call gaph with fou nodes V = {n 1, n 2, m 1, m 2 }, and edges n 1 n 2 s and m 1 s m 2. If sites s and each handle exactly one esouce (T = T s = 1) and two pocesses ae ceated, one in n 1 and one in m 1, no moe esouces ae available afte each pocess

4 4 C. Sánchez and H. B. Sipma stats its execution. Hence a deadlock is eached, since none of the pocesses can poceed. Ou deadlock avoidance solution consists of two pats: (1) the offline computation of call-gaph annotations, maps fom call-gaph nodes to natual numbes; and (2) a un time potocol that contols esouce allocations and deallocations based on call-gaph annotations. Infomally, annotations measue the amount of esouces that the computation of a node equies. The potocols gant a equest based on the emaining local esouces (and possibly othe local vaiables) and the annotation of the equesting node. 2.1 Potocol A potocol fo contolling the esouce allocation in node n: is implemented by a pogam executed in befoe and afte method n is dispatched. This code can be diffeent fo two call-gaph nodes even if they eside in the same site. The schematic stuctue of a potocol fo a node n: is: l 0 : n :: l 1 : when En n (V ) do In n (V, V ) f() } enty section } method invocation } l 2 : Out n (V, V ) exit section l 3 : The enty and exit sections implement the esouce allocation policy. Upon invocation, the enty section checks esouce availability by inspecting local vaiables V of site. If the pedicate En n (V ), called the enabling condition, is satisfied we say that the enty section is enabled. In this case, the equest can be ganted and the esouce assigned to the pocess updating the local vaiables accoding to the elation In n (V, V ), whee V stands fo the local vaiables afte the action is taken. We assume that the enty section is executed atomically, as a test-and-set. The method invocation section executes the code of the method, hee epesented as f(), which may include emote invocations accoding to the edges outgoing fom node n in the call gaph. The method invocation teminates afte all its descendants in the call gaph have teminated and etuned. The exit section eleases the esouce and may update some local vaiables in site, accoding to the elation Out n (V, V ). In n is called the enty action and Out n is called the exit action 2.2 Annotations Given a system S and annotation α, the annotated call-gaph (V,, ) is obtained fom the call gaph (V, ) by adding one edge n m between any two nodes that eside in the same site with annotation α(n) α(m). A node n depends on a node m, which we epesent n m, if thee is a path in the annotated gaph fom n to m that follows at least one edge. The annotated gaph is acyclic if no node depends on itself, in which case we say that the annotation is acyclic.

5 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 5 3. A FAMILY OF LOCAL PROTOCOLS We study potocols that pevent deadlock in all scenaios, tying to utilize the esouces as much as possible, while equiing no communication between the sites. These ae called local potocols. We say that a potocol is completely local if all the enabling conditions ae detemined by: (1) the annotation of the equested node, and (2) the numbe of active pocesses in the local site and thei coesponding annotations. Fo completely local potocols, the effect of the input (esp. output) action on futue enabling conditions is detemined by the effect of adding (esp. emoving) an enty at the coesponding annotation fom the set of active pocesses. All the deadlock avoidance potocols suggested to date ae completely local. We use the following notation to fo active pocesses: a [k] stands fo the numbe of active pocesses unning in site in a node with annotation k. We also use A [k] as a shot fo j k a [j], that is, A [k] stands fo the numbe of active pocesses unning in site executing nodes with annotation k o highe. The potocol Basic-P was intoduced in [Sánchez et al. 2005]. An allocation attempt at node n: with annotation α(n) = i, is contolled by: n :: f() t ++ [ when i t do t -- ] Befoe assigning a esouce, Basic-P checks whethe the povision of esouces is lage enough, as indicated by the annotation i. This check ensues that pocesses (local o emote) that could potentially be blocked if the equested esouce is ganted, have actually enough esouces to complete. The counte t keeps tack of the emaining esouces in site. The coectness of Basic-P is based on the acyclicity of the annotations: Theoem 3.1 (Annotation Theoem fo Basic-P [Sánchez et al. 2005]). Given a system S and an acyclic annotation, if Basic-P is used to contol esouce allocations then all executions of S ae deadlock fee. The potocol Basic-P can be impoved obseving that pocesses equesting esouces in nodes with annotation 1 can always teminate, in spite of any othe pocess in the system. This obsevation leads to Efficient-P, which uses two countes: t, as befoe; and p, to keep tack of the potentially ecoveable esouces, which include not only the available esouces but also the esouces ganted to pocesses in nodes with annotation 1. The potocol Efficient-P that contols

6 6 C. Sánchez and H. B. Sipma the allocation at a node n: with annotation i is: [ ] [ ] when 1 t do when i p 1 t do n :: t -- f() n :: p --, t -- f() t ++ t ++, p ++ If i = 1 If i > 1 A vesion of the Annotation Theoem also exists fo Efficient-P establishing that in the absence of dependency cycles, Efficient-P can each no deadlocks. These poofs of coectness ae based on popeties of the sets of active pocesses in the system, in states eachable by the potocols. The poof of the Annotation Theoem fo Basic-P and Efficient-P elies on showing that the following invaiant ϕ is maintained: ϕ def = A [k] T (k 1). R k T We use ϕ as an alias fo k T A [k] T (k 1), and ϕ [k] fo each of its clauses. The fact that ϕ is an invaiant is used to show, fo example, that if a equest fo annotation i is denied, then thee must be an active pocess unning in a node with annotation i o lowe. A legitimate question is whethe the most libeal potocol, that only guaantees that ϕ is an invaiant, still povides absence of deadlocks in the pesence of an acyclic annotation. The answe (see [Sánchez et al. 2006]) is that this potocol, called Live-P, guaantees not only absence of deadlock but also liveness unde some simple fainess assumptions about the local schedules. Live-P simply checks whethe ganting a equest at node n: with annotation i keeps the system in an ϕ state. Live-P fo a node n: with annotation i is: [ ] (i) when ϕ do a [i]++ n :: f() a [i]-- Hee, the fomula ϕ (i) stands fo the fomula that esults fom ϕ when a [i] is incemented. That is, ϕ (i) is the weakest pecondition fo ϕ unde the tansition that assigns the esouce. The fomula ϕ (i) can easily be stated: A [k] T (k 1) Again, we use ϕ (i) that ϕ (i) ϕ (i) def = k>i. A [k] + 1 T (k 1) k i [j] fo the clause of ϕ (i) that coesponds to annotation j. Obseve [j] is equivalent to ϕ [j] fo j > i since the expessions ae identical.

7 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 7 Moeove, fo j i, the condition is stengthened: ϕ (i) [j] ϕ [j]. In ode to compae the potocols, we use the notation intoduced fo Live-P to estate the definition of the potocols Basic-P and Efficient-P. The following is an invaiant of Basic-P: T = t + A [1], since A [1] coesponds to the total numbe of active pocesses in. The enabling condition of Basic-P fo a node n: with annotation i can be estated as: A [1] T (i 1) As we will see, this is an stengthening of ϕ (i). We define the k-th stengthening fomula fo a equest in node n: with annotation i as: ψ (i) def [k] It is easy to see that the following holds: ψ (i) = A [k] T (i 1) [k] ϕ(i) [j] fo all k j i, (1) Theefoe, ψ (i) [k] k j i ϕ (i) [j]. (2) Now, ϕ (i) [j] holds vacuously fo all i j, since the fomulas fo ϕ (i) [j] and ϕ [j] ae identical in this case. Hence: ψ (i) [k] ϕ (i) [j]. (3) k j Finally, if ϕ (i) be concluded: [j] is satisfied fo all values at most k, and ψ (i) [k] is ensued, ϕ (i) can ( j<k ϕ (i) [j]) ψ (i) [k] ( j<k ϕ (i) [j] ϕ (i). Theefoe, if a potocol ensues j<k ϕ(i) ϕ (i) [j]) ( j k ϕ (i) [j]) [j] ψ (i) [k] fo some k, then ϕ is an invaiant. In geneal, the lowe the value of the stengthening point k, the less computation is needed to compute the pedicate (the numbe of compaison ae educed) but the less libeal the enabling condition becomes. In the case of k = 1 the stengthening

8 8 C. Sánchez and H. B. Sipma is ψ (i) [1] ϕ (i), and the following potocol, equivalent to Basic-P, is obtained: when ψ(i) [1] do a [i]++ n :: f() a [i]-- It must be noted that this potocol is logically equivalent to Basic-P: the esult of the enabling condition, and the effect of the input and output actions on futue tests ae equivalent. The diect implementation of Basic-P intoduced ealie in this section uses a single counte t, while in this estated vesion, seveal countes ae appaently needed: a [i] and A [1]. Howeve, the effect of the incements and decements of a [i] on A [1] ae the same, independently of i. Theefoe, these actions can be implemented as A [1]++ and A [1]-- espectively. With a stengthening point of k = 2 we obtain a potocol equivalent to Efficient- P: when ϕ(i) n :: f() a [i]-- [1] ψ (i) a [i]++ [2] do In geneal, if an abitay k is picked as the stengthening point, the following potocol, that we call k-efficient-p is obtained: when ( ϕ (i) [j]) ψ (i) [k] do j<k a [i]++ n :: f() a [i]-- In the exteme, if the stengthening point is highe than the numbe of esouces T, then Live-P is obtained: when ( ϕ (i) [j]) do a [i]++ n :: f() a [i]--

9 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 9 The potocol k-efficient-p can be diectly implemented using k countes, obtaining a unning time of O(k) and needing a stoage space of O(k log T ) bits. Using an active tee data-stuctue, (see [Sánchez et al. 2006]), k-efficient-p can be implemented in O(log k) unning time pe allocation and still needing O(k log T ) bits in each site. We emak hee that the In and Out actions of all these potocols (Basic-P, Efficient-P, k-efficient-p and Live-P) ae identical. Since this potocols ae completely local, the effects that they have in the successo states ae the same as with the standad pesentations using the exta vaiables t, p, etc. 4. ALLOCATION SEQUENCES Hee we establish the basic foundations to compae the eachable states and the possible allocation sequences allowed by a deadlock avoidance potocol. We define a language whose stings coespond to sequences of (global) allocations and deallocations. Then we define the language that a potocol accepts as the legal sequences allowed by the potocol. Given a call gaph G : (V, ) we define the alphabet Σ = V V whee V contains one element n fo evey node n in V. We assume that V and V ae disjoint, V V =. We efe to the elements of V as allocation symbols, to the elements of V as deallocation symbols and the elements of Σ simply as symbols. Given a sting s in Σ and a symbol v, we use s v to denote the numbe of occuences of v in s, and s n as a shot fo s n s n. Definition 4.1 (Well-Fomed Allocation Stings). A sting s in Σ is called well-fomed if fo evey pefix p of s, and fo evey allocation symbol n, o, equivalently, p n 0. p n p n, An admissible allocation sequence is one that coesponds to a possible execution of the system, which not only equies the sting to be well-fomed but it also equies that evey allocation of a non-oot node is peceded by a coesponding annotation in its paent node. Essentially, a pocess must be executing in the calling node fo the actual call to exist. Diffeent semantics fo emote calls ae possible, and each is captued by a diffeent language estiction. Fo example, asynchonous calls allow a pocess to continue unning while a emote call is being executed, while synchonous calls block the calle until the call etuns. Multiple call semantics allow a emote call expessed by a edge to be epeated indefinitely, while exactly-once semantics establish that all descendants must be invoked, and using at-most-once a call can eithe be ignoed o poduced once 1. We descibe hee asynchonous, at-most-once calls. Many of these esults can also be obtained fo othe call semantics. Definition 4.2 (Admissible Stings). A well-fomed allocation sting s is called admissible if fo evey pefix p of s, and evey emote call n m: p n p m. 1 The only estiction all semantics must satisfy is that all pocesses must teminate if scheduled infinitely often.

10 10 C. Sánchez and H. B. Sipma Admissible stings ensue that the numbe of childen pocesses (callees) is not moe than the numbe of paents (calle pocesses), so that thee is a possible match. Fo bevity, we simply use sting to efe to admissible sting. We define a global state of a system as a the numbe of the active pocesses fo each site and annotation. This is enough to captue all effects of completely local potocols. The initial condition Θ of the system establishes that thee ae no active pocess: a [i] = 0 fo all sites and annotations i. If a state σ satisfies a pedicate θ we wite σ θ. A potocol P can each a system state σ afte executing the sequence of opeations descibed by the sting s (which we epesent by σ = P (s)) if: (1) s = ɛ and σ Θ. (2) s = s 1 n, σ 1 = P (s 1 ), and σ = In n (σ 1 ) with σ 1 En n. (3) s = s 1 n, σ 1 = P (s 1 ), and σ = with σ 1 En n. (4) s = s 1 n, σ 1 P (s 1 ), and σ = Out n (σ 1 ). Initiation is encoded by (1): befoe any opeation is executed the systems is the initial state. Consecution of an allocation is encoded by (2) if the allocation is possible, o (3) if it is not a legal allocation. Deallocations ae always legal, and encoded by (4). The special state is intoduced hee to indicate that s does not epesent a legal sequence of opeations fo potocol P. We extend the input and output actions to peseve, and foce all enable conditions to be false in. A sting s is accepted by a potocol P, and we wite s L(P ) if P (s). We define a patial ode on potocols based on language inclusion: P Q wheneve L(P ) L(Q). Lemma 4.3. The following ae equivalent: (1 ) L(P ) L(Q). (2 ) Fo all stings s and allocation symbols n, if En P n (P (s)) then En Q n (Q(s)). Poof. Assume L(P ) L(Q), let s be an abitay sting and n an abitay symbol, with En P n (P (s)). Fist, s L(P ) and consequently s L(Q); second, s n L(P ) and then s n L(Q). Hence, En Q n (Q(s)). Assume now (2). We show by induction on stings that if s L(P ) then s L(Q). Fist, both ɛ L(P ) and ɛ L(Q). Let s n L(P ). Then En P n (P (s)), so also En Q n (Q(s)). Hence, s n L(Q). Let s n L(P ). This implies s L(P ) and by inductive hypothesis s L(P ). Then s n L(P ), as desied. Theefoe (1) and (2) ae equivalent. Let P, Q be any two of Basic-P, Efficient-P, k-efficient-p and Live-P. We showed in Section 3 that the input and exit actions ae identical fo all these potocols. Theefoe, if s is in the language of both P and Q then the states eached ae the same, i.e., P (s) = Q(s). It follows that if fo all states σ, En P n (σ) implies En Q n (σ), then L(P ) L(Q). Consequently, compaing the enabling conditions fo abitay states allows to conclude language containments.

11 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 11 L(Live-P) L(k-Efficient-P) L(Efficient-P) L(Basic-P) Fig. 1. Allocation sequences accepted by the diffeent potocols. 4.1 Compaing the enabling conditions The following lemma shows that the enabling condition of k-efficient-p becomes stonge as k gows. This implies that the enabling condition of Basic-P is stonge than that of Efficient-P, which in tun is stonge than k-efficient-p, which is stonge than Live-P. Lemma 4.4. If j-efficient-p allows an allocation then k-efficient-p also allows the allocation, povided j k. Poof. It follows fom the definition that if j k then ψ (i) [j] implies ψ (i) [k]. Moeove, by (3), ψ (i) [j] implies j l k ϕ(i) [l]. Consequently, l<j ϕ (i) [l] ψ (i) [j] } {{ } En j-efficient-p n l<k ϕ (i) [l] ψ (i) [k] } {{ } En k-efficient-p n Theefoe if j-efficient-p allows the equest so does k-efficient-p. Lemma 4.4 diectly implies that an allocation allowed by Basic-P is also allowed by Efficient-P, and that an allocation allowed by Efficient-P is also allowed by k-efficient-p with k 2. Moeove: Coollay 4.5. If k-efficient-p allows an allocation then so does Live-P. 4.2 Potocol Compaison by Allocation Sequences As an immediate consequence of lemmas 4.4 and 4.5 we conclude that the languages accepted by these potocols ae patially odeed as follows: Basic-P Efficient-P... k-efficient-p... Live-P The following examples shows that these language containments ae stict: Basic-P Efficient-P... k-efficient-p... Live-P which is depicted in Fig 1.

12 12 C. Sánchez and H. B. Sipma Example 4.1. Conside the following call-gaph, with initial esouces T = 2. n 2 2 n 1 1 m 1 1 The sting m 1 n 2 is accepted by Efficient-P but not by Basic-P. Example 4.2. The pevious example can be genealized to show that thee is a sting accepted by k-efficient-p but not by j-efficient-p (fo j < k). Conside the following annotated call gaph, with initial esouces T = j + 1. n j+1 j+1 n j j n j 1 j 1 n 1 1 m j j m j 1 j 1 m 1 1 The sting m j n j+1 is accepted by k-efficient-p, but is not accepted by j-efficient- P. Example A.1 in Appendix A genealizes these examples to a single scenaio that shows all the pope containments. 5. REACHABLE STATE SPACES In this section we study the notion of state space eachable by a potocol, and study a containment elation between the potocols based on thei eachable state spaces. Let P be an completely local potocol. The eachable state space of P, denoted by S(P ), is the set of global states that P can each following some legal allocation sequence. It follows immediately that if the actions of two potocols P and Q ae equivalent, then P Q implies that evey state eachable by P is also eachable by Q: any sting that witnesses the eachability of a state fo P also witnesses that the same state is eachable fo Q. Lemma 5.1. Fo evey two potocols P and Q with the same input and output actions, if P Q then S(P ) S(Q). Consequently, the eachable state spaces ae odeed by: S(Basic-P) S(Efficient-P)... S(k-Efficient-P)... S(Live-P) We show in the est of this section that this containments ae not pope, by poving that Basic-P can each all ϕ-states, which togethe with Live-P ϕ-states, implies that all eachable spaces ae actually the same: all ϕ-states. 5.1 Topological Odes of Annotated Call Gaphs. Given a call gaph, a total ode > in its nodes is called topological if it espects the descendant elation, that is, if fo evey pai of nodes n and m, if n m then n > m. Analogously, we say that an ode > espects an annotation α if fo evey pai of nodes n and m esiding in the same site, if α(n) > α(m) then n > m. A total ode that is topological and espects annotations is called compatible. Lemma 5.2. Evey call gaph annotated with an acyclic annotation has a compatible ode.

13 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 13 Poof. The poof poceeds by induction in the numbe of call-gaph nodes. The esult tivially holds fo the empty call-gaph. Assume the esult holds fo all call-gaphs with at most k nodes and take an abitay call-gaph with k + 1 nodes. Fist, thee must be a oot node whose annotation is the highest among all the nodes esiding in the same site. Othewise a dependency cycle can be fomed: take the maximal nodes fo all sites, which ae intenal by assumption, and thei oot ancestos. Fo evey maximal (intenal) node thee is + path eaching it, stating fom its coesponding oot. Similaly, fo evey oot thee is an incoming edge fom the maximal intenal node that esides in its site. A cycle exist since the (bipatite) subgaph of oots and maximal nodes is finite, and evey node has a successo (a + fo oot nodes, and a fo maximal nodes). This contadicts that the annotation is acyclic. Now, let n be a maximal oot node, and let > be a compatible ode fo the gaph that esults by emoving n, which exists by inductive hypothesis. We extend > by adding n > m fo evey othe node m. The ode is topological since n is a oot. The ode espects annotations since n is maximal in its site. 5.2 Reachable States A global state of a distibuted system is admissible if all existing pocesses (active o waiting) in a node n ae also existing, and active, in evey node ancesto of n. That is, if the state coesponds to the outcome of some admissible allocation sequence. Theoem 5.3. The set of eachable states of a system using Live-P is pecisely the set of ϕ-states. Poof. It follows diectly fom the specification of the Live-P potocol that all eachable states satisfy ϕ. Theefoe, we only need to show that all ϕ-states ae eachable. Let > be a topological ode in the nodes, compatible with the annotation as guaanteed by Lemma 5.2. Given a global state σ let σ(n) indicate the utilization of node n (the numbe of active pocesses unning node n in state σ). We patially ode the set of global states, by having σ 1 σ 2 wheneve: (1) σ 1 (n) > σ 2 (n) fo some node n, and (2) σ 1 (m) = σ 2 (m) fo all pio nodes m < n. Since the maximum utilization of any node is bounded, the ode is finitely-based, and consequently well-founded. We show by induction in that evey ϕ-state is eachable. The base of induction is the global state with no utilization in any node, which is the initial state of the system and theefoe it is eachable. Conside now an abitay ϕ-state σ with some utilization. Let n be an abitay node with an active pocess P that has no active descendant. Such a pocess is guaanteed to exist since call-gaphs ae finite, and leafs have no descendants (active o othewise). Let σ be the state that is obtained fom σ by emoving P fom being an active pocess in node n. The state σ is stictly smalle than σ in, and is also a ϕ- state. By induction hypothesis, σ is eachable. Since σ is obtained fom σ by an allocation that peseves ϕ, σ is also eachable, as desied. In tems of the allocation stings, Theoem 5.3 is equivalent to show that fo evey sequence s that aives to a ϕ-state thee is a sequence s aiving at the same state

14 14 C. Sánchez and H. B. Sipma fo which all pefixes also each to ϕ-states. The sequence s is in the language of Live-P. Pehaps moe supisingly, the set of eachable states of Basic-P is also the set of all ϕ-states. To pove this we fist need an auxiliay lemma. Lemma 5.4. In evey ϕ-state, an allocation equest in site with annotation k has the same outcome using Basic-P and Live-P, if thee is no active pocess in with annotation stictly smalle than k. Poof. Fist, in evey ϕ-state, if Basic-P gants a esouce so does Live-P, by Lemma 4.4. We show that in evey ϕ-state, if Live-P gants a equest of k and a [j] = 0 fo all j < k, then Basic-P also gants the equest. In this case, T T T t = A [1] = a [j] = a [j] = A [k], (4) j=1 and since Live-P gants the equest, then A [k]+1 T (k 1) and A [k] T k. Using (4), T t T k, and t k, so Basic-P also gants the esouce. Theoem 5.5. The set of eachable states of a system using Basic-P is pecisely the set of ϕ states. Poof. The poof is analogous to the chaacteization of the eachable states of Live-P, except that we also obseve that the constucted un to the desied state satisfies that at evey tansition the equest is pefomed in a node with no active pocess of lowe annotation. By Lemma 5.4 the equest is ganted because it is ganted by Live-P (both stating and eaching states ae ϕ-states) and the allocation picked to be in a node whose sites have no smalle active pocesses. Theoem 5.5 can also be estated in tems of allocation sequences. Fo evey admissible allocation sting that aives to a ϕ-state thee is an admissible allocation sting that, aives at the same state and (1) contains no deallocations, and (2) all the nodes occu accoding to some compatible ode. It follows fom Theoem?? that SBasic-P = ϕ-states, so: S(Basic-P) = S(Efficient-P) =... = S(k-Efficient-P) =... = S(Live-P) as depicted in Fig CONCLUSIONS AND OPEN PROBLEMS The fact that the eachable state space of k-efficient-p is all the ϕ-states can be used as a poof technique: if the decision of some potocol can be stated as a tansition into an ϕ-state, then the potocol still povides deadlock avoidance. This is used in [Sánchez et al. 2006] to ceate an efficient distibuted pioity inheitance mechanism whee annotations ae used to encode pioities; inheiting a pioity is caied out by an annotation decease. This does not compomise deadlock feedom because deceasing the annotation of an existing pocess in a ϕ-state esults into an ϕ-state. The following conjectues ae still open poblems: j=k

15 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 15 ϕ-states = = S(Live-P) = S(Efficient-P) = S(k-Efficient-P) = S(Basic-P) Fig. 2. Reachable state spaces of the diffeent potocols. (1) Given a completely local potocol P that guaantees deadlock avoidance fo all initial esouces, thee is a minimal annotation fo which P Live-P. This would imply an optimality esult fo Live-P and an indication that the ϕ captues the essence of deadlock avoidance. (2) Let P be a completely local potocol that guaantees deadlock avoidance fo all initial esouces, and whose enabling condition and input and exit actions can be computed using O(log T ) bits at each site. Then fo some minimal annotation P k-efficient-p fo some k. This esult would imply that k- Efficient-P is optimal among potocols that use only a constant numbe of countes. REFERENCES Biell, A. D An intoduction to pogamming with theads. Reseach Repot 35, Digital Equipment Copoation Systems Reseach Cente. Dijksta, E. W Coopeating sequential pocesses. Tech. Rep. EWD-123, Technological Univesity, Eindhoven, the Nethelands. Habemann, A. N Pevention of system deadlocks. Communications of the ACM 12, Havende, J. W Avoiding deadlock in multi-tasking systems. IBM Systems Jounal 2, Sánchez, C., Sipma, H. B., and Manna, Z Efficient distibuted deadlock avoidance with liveness guaantees. Submitted fo publication. Sánchez, C., Sipma, H. B., Manna, Z., and Gill, C. D Pioity inheitance fo distibuted eal-time and embedded systems. In pepaation. Sánchez, C., Sipma, H. B., Manna, Z., Subamonian, V., and Gill, C On efficient distibuted deadlock avoidance fo distibuted eal-time and embedded systems. In Poceedings of the 20th IEEE Intenational Paallel and Distibuted Pocessing Symposium (IPDPS 06). IEEE Compute Society Pess. Sánchez, C., Sipma, H. B., Subamonian, V., Gill, C., and Manna, Z Thead allocation potocols fo distibuted eal-time and embedded systems. In 25th IFIP WG 2.6 Intenational Confeence on Fomal Techniques fo Netwoked and Distibuted Systems (FORTE 05), F. Wang, Ed. LNCS, vol Spinge-Velag, Schmidt, D. C Evaluating Achitectues fo Multi-theaded CORBA Object Request Bokes. Communications of the ACM Special Issue on CORBA 41, 10 (Oct.),

16 16 C. Sánchez and H. B. Sipma Schmidt, D. C., Stal, M., Rohnet, H., and Buschmann, F Patten-Oiented Softwae Achitectue: Pattens fo Concuent and Netwoked Objects, Volume 2. Wiley & Sons, New Yok. Silbeschatz, A., Galvin, P. B., and Gagne, G Opeating System Concepts, Sixth ed. John Wiley & Sons, Inc. Singhal, M. and Shivaati, N. G Advanced Concepts in Opeating Systems: Distibuted, Database, and Multipocesso Opeating Systems. McGaw-Hill, Inc. Stallings, W Opeating Systems: Intenals and Design Pinciples, Thid ed. Pentice Hall. Subamonian, V., Xing, G., Gill, C. D., Lu, C., and Cyton, R Middlewae specialization fo memoy-constained netwoked embedded systems. In Poc. of 10th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS 04). IEEE Compute Society Pess.

17 Reachable State Spaces of Distibuted Deadlock Avoidance Potocols 17 A. MISSING PROOFS AND EXAMPLES Example A.1. Let k be abitay, and conside the following annotated call gaph, whee all nodes eside in site, and T = k + 1. n k+1,k+1 k+1 n k+1,k k nk+1,k 1 k 1 n k+1,1 1 n k,k k n k,k 1 k 1 n k,1 1 n k 1,k 1 k 1 n k 1,1 1 n 1,1 1 The sting n k,k n k+1,k+1 is accepted by Live-P, but is not accepted by k-efficient- P. Fo abitay j < k, the following sting is accepted by k-efficient-p but not by j-efficient-p: n j,j... n j,j n j+1,j+1 }{{} T j times This includes the following sting, which is accepted by Efficient-P but not by Basic-P: n 1,1... n 1,1 }{{} T 1 times B. A PROTOCOL THAT ACCEPTS A RUN THAT LIVE-P DOES NOT ACCEPT Conside the call gaph: n 2,2 n 1 n 2 s m 1 s m 2 The potocol stats unning as Live-P with the annotation: n 1 2 n 2 s 1 m 1 s 1 m 2 1 The fist time thee is a pocess unning in n 2 but no pocess unning in m 1, it blocks all equests in m 1 until the pocess in n 2 finishes. This is a local opeation contolled by a boolean vaiable in s. When the pocess in n 2 finishes, the output action piggybacks a token to n 1 as a pat of the etun call, and changes the annotation of m 1 to 2. Node n 1, when eceiving the token changes its annotation to 1, effectively continuing as Live-P with annotation: n 1 1 n 2 s 1 m 1 s 2 m 2 1

18 18 C. Sánchez and H. B. Sipma Obseve that thee is an inteval duing which the system is unning with the annotation: n 1 2 n 2 s 1 m 1 s 2 m 2 1 until the message of the etun call that contains the token aives to n 1. We conjectue that this un, fo lage enough numbe of esouces cannot be accepted by Live-P with any annotation whatsoeve. Howeve, this conjectue does not immediately contadict the optimality of Live-P, as stated in some section above, since the potocol pesented hee is not local: it exchanges messages as piggybacks.

19 CHANGE LOG June 1, July 25, Submitted as technical epot Modified (coection of typos)