ComputerAssisted Construction Of Linearizable Algorithms

1
Computer-Assisted Construction Of
Linearizable Algorithms
Martin Vechev Eran Yahav Greta Yorsh
IBM Research
Some tasks are best done by machine, while others
are best done by human insight and a properly
designed system will find the right balance. D.
Knuth
Cambridge May 2nd 2008
2
Goal

• Generate efficient and correct concurrent
  algorithms for specialized domains
• Verification/checking integrated into the design
  process
• Realistic goal
• Improve efficiency
• Involve designer (assisted by computer)
• Focus on concurrent kernels

3
Sequential to CAS
bool remove(int key) atomic Entry
pred,curr,r
locate(pred,curr,key) k
(curr-gtkey ? key) if (k) return false r
curr-gtnext pred-gtnext r return true
bool contains(int key) atomic Entry
pred,curr locate(pred,curr,key)
k (curr-gtkey key) if (k)
return true return false
bool add(int key) atomic Entry
pred,curr,entry
locate(pred,curr,key) k
(curr-gtkey key) if (k) return false
entry new Entry() entry-gtnext curr
pred-gtnext entry return true
A story of improving efficiency (raises many
questions)
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
k (curr-gtkey key) if
(k) return false entry new Entry()
entry-gtnext curr valCAS(pred-gtnext,?curr,0?,?
entry,0?) if (?val) goto restart return true
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
k (curr-gtkey ? key) if
(k) return false ltr,mgt curr-gtnext
lvalCAS(curr-gtnext, ?r,m?,?r,1?) if (?lval)
goto restart pvalCAS(pred-gtnext,?curr,0?,?r,0?)
if (?pval) goto restart return true
4
Many Questions

• What can be automated ?
• Implementation detail vs. Fundamental insight ?
• Any repeatable steps ?
• How would a tool best assist a designer ?
• Adaptations vs. Re-construction ?
• Variations vs. Algorithms
• What does efficient mean ?
• How to compare algorithms ?

5
Current state in construction of algorithms
Correctness Efficiency Automation

• Universal Methodologies
• Example Herlihy93, STM (naïve)
• Formal Derivation
• Re-construction
• Example B, VDM
• Design First, Verify Later
• Current approach
• Many concurrent algorithms

6
Case Study Concurrent sets

• Some existing algorithms
• Harris (DISC01)
• Michael (PODC02)
• Heller et. al (OPODIS05)
• Set encoded as a sorted linked list of keys
• Assume presence of garbage collection
• Assistant Tool
• Bounded checking
• Minimal atomic sections
• Linearizability (two ways to check by definition
  and with linearization points)

A a A5 B b A4 C B1 b D
B2 a with (A,B), (C lt D)
atomic B b A4 A a A5 D
B2 a C B1 b
ASSISTANT TOOL
7
Step 1 Optimistic Concurrency
atomic read, update
bool remove(int key) atomic Entry
pred,curr,r
locate(pred,curr,key) k
(curr-gtkey ? key) if (k) return false r
curr-gtnext pred-gtnext r return true
bool add(int key) atomic Entry
pred,curr,entry
locate(pred,curr,key) k
(curr-gtkey key) if (k) return false
entry new Entry() entry-gtnext curr
pred-gtnext entry return true
Step 1 Optimistic (Kung
Robinson81)
read atomic validate, update
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
atomic if (validateAdd) UpdateAdd
goto restart
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
atomic if (validateRemove) UpdateRemove
goto restart
8
Step 2 Find Validation Conditions
Step 1 Optimistic
Step 2a weakest
(validateAdd validateRemove true)
9
Step 2 Find Validation Conditions
Step 1 Optimistic
Step 2a weakest
(validateAdd validateRemove true)
10
Step 2 Find Validation Conditions

• Designer observes counter-example and
• manually produces a new validation condition

Step 1 Optimistic
Step 2a weakest
(validateAdd validateRemove true)
Step 2b strengthen guards
(validateAdd validateRemove pred-gtnext
curr)
11
Step 2 Find Validation Conditions
Step 1 Optimistic
Step 2a weakest
(validateAdd validateRemove true)
Step 2b strengthen guards
(validateAdd validateRemove pred-gtnext
curr)
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
atomic if (pred-gtnext curr) UpdateAdd
goto restart
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
atomic if (pred-gtnext curr)
UpdateRemove goto restart

12
Step 2 Find Validation Conditions
Step 1 Optimistic
Step 2a weakest
(validateAdd validateRemove true)
Step 2b strengthen guards
(validateAdd validateRemove pred-gtnext
curr)
How to deal with removed nodes ?
13
Step 3 Produce Schema
Step 1 Optimistic
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
ADD return true ADD A
val(pred-gtnextcurr) B k(curr-gtkeykey) C
if (k) return false D pred-gtnextentry E
entry new Entry() F entry-gtnext curr G if
(?val) goto restart with (A,G)(B,C), C lt
D, G lt D
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
REMOVE return
true REMOVE H val(pred-gtnextcurr)
I k (curr-gtkey ? key) J if (k) return
false K r curr-gtnext L curr-gtnext null
M pred-gtnext r N if (?val) goto restart
Step 2a weakest
Step 2b strengthen guards
Step 3 add null

• Mark Deleted Nodes by setting next field to null
  
• Null a distinct value, with same space

14
Step 4 Run Tool
Step 1 Optimistic
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
ADD return true ADD k(curr-gtkeykey)
if (k) return false entry new Entry()
entry-gtnext curr atomic val(pred-gtnextcur
r) if (?val) goto restart pred-gtnextentry

bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
REMOVE return
true REMOVE k (curr-gtkey ? key) if
(k) return false atomic val(pred-gtnextcurr)
if (?val) goto restart r curr-gtnext
curr-gtnext null pred-gtnext r
Step 2a weakest
Step 2b strengthen guards
Step 3 add null
Step 4 run tool

• A variation of least atomic intermediate
  null-algorithm

15
Step 5 Atomic to CAS/DCAS
Step 1 Optimistic
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
ADD return true ADD k(curr-gtkeykey)
if (k) return false entry new Entry()
entry-gtnext curr
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
REMOVE return
true REMOVE k (curr-gtkey ? key) if
(k) return false
Step 2a weakest
Step 2b strengthen guards
Step 3 add null
r curr-gtnext valDCAS(pred-gtnext,curr-gtnext,
curr,r,r,null) if (?val) goto
restart
Step 4 run tool
valCAS(pred-gtnext, curr,entry) if (?val) goto
restart

Step 5 Atomic to
CAS/DCAS
CAS/DCAS

• Can we improve DCAS ?

16
Step 6 Adding coordination metadata
Step 1 Optimistic

• Add a new field to each node
• Pattern from CGC07
• Add building blocks to update/read the field
• curr-gtmarked true
• mp pred-gtmarked
• mc curr-gtmarked

Step 2a weakest
Introduce Distinct Value
Step 2b strengthen guards
key
next
key
next
marked
Step 3 add null
Step 6 add marked
Step 4 run tool

Step 5 Atomic to
CAS/DCAS
CAS/DCAS
17
Step 7 Run Tool
Step 1 Optimistic
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
ADD return true ADD k
(curr-gtkeykey) if (k) return false entry
new Entry() entry-gtnext curr atomic mp
?pred-gtmarked val(pred-gtnextcurr) ? mp if
(?val) goto restart pred-gtnextentry
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
REMOVE return
true REMOVE k (curr-gtkey ? key) if
(k) return false curr-gtmarked true r
curr-gtnext atomic mp ?pred-gtmarked
val(pred-gtnextcurr) ? mp if (?val) goto
restart pred-gtnext r
Step 2a weakest
Step 2b strengthen guards
Step 3 add null
Step 6 add marked
Step 4 run tool
Step 7 Run tool


Step 5 Atomic to
CAS/DCAS
CAS/DCAS

• Concurrent set algorithm using a marked bit

18
Step 8 Transform to CAS
Step 1 Optimistic
Step 2a weakest
Step 2b strengthen guards
Step 3 add null
Step 6 add marked
Step 4 run tool
Step 7 Run tool


Step 5 Atomic to
CAS/DCAS
Step 8 Atomic to CAS
6. Convert to CAS
CAS
CAS/DCAS
19
Sequential to CAS
bool remove(int key) atomic Entry
pred,curr,r
locate(pred,curr,key) k
(curr-gtkey ? key) if (k) return false r
curr-gtnext pred-gtnext r return true
bool contains(int key) atomic Entry
pred,curr locate(pred,curr,key)
k (curr-gtkey key) if (k)
return true return false

• Non-fixed linearization points (many
  candidates)
• Instrumented a model and checked it for
  linearizability
• Marked bit (a synchronization mechanism)
• Our derived algorithm has simpler restart
  conditions than Heller05
• Making it lock-free in the add/remove requires
  clean-up.
• Will shift the linearization points. (Some
  instances will lead to Maged02).

bool add(int key) atomic Entry
pred,curr,entry
locate(pred,curr,key) k
(curr-gtkey key) if (k) return false
entry new Entry() entry-gtnext curr
pred-gtnext entry return true
bool add(int key) Entry pred,curr,entry
restart locate(pred,curr,key)
k (curr-gtkey key) if
(k) return false entry new Entry()
entry-gtnext curr valCAS(pred-gtnext,?curr,0?,?
entry,0?) if (?val) goto restart return true
bool remove(int key) Entry pred,curr,r
restart locate(pred,curr,key)
k (curr-gtkey ? key) if
(k) return false ltr,mgt curr-gtnext
lvalCAS(curr-gtnext, ?r,m?,?r,1?) if (?lval)
goto restart pvalCAS(pred-gtnext,?curr,0?,?r,0?)
if (?pval) goto restart return true
20
Concurrent Set Algorithms Recap
Step 1 Optimistic
Schema
Correct Algorithm
Step 2a weakest
run tool
Incorrect Algorithm
Step 2b strengthen guards
Manual step
run tool
Automated step
Step 3 add null
Step 6 add marked
Step 4 run tool
Step 7 Run tool

Prio-Q

Restriction
Step 5 Atomic to
CAS/DCAS
Step 8 Atomic to CAS
Stack
CAS
CAS/DCAS
CAS/DCAS
CAS
21
What did we learn and what will we do about it ?

• Need to find the right level of representation
• Encoding insight as text is limited (difficult to
  specify steps)
• Many similarities in the construction process
  with CGC
• Some of the steps seem automatable
• Exploring semantic-based constructions
• Israeli94, Attiya02
• Tool helpful in directing construction
• Computer-assistant tools for concurrency
• (w/ Ohad Shacham, Maged Michael)
• Instrumentation for non-fixed linearization
  points is tricky
• Alternative correctness criteria
• (w/ Hagit Attiya, Noam Rinetzky)

22
Thanks
More details in

• Deriving Linearizable Fine-Grained Concurrent
  ObjectsVechev M., Yahav Eto appear in PLDI 2008
• Computer-Assisted Construction of Efficient
  Concurrent AlgorithmsVechev M., Yahav E.,
  Michael M., Attiya H., Yorsh Gto appear in EC2
  CAV 2008 workshop

• Maged Michael, David Bacon, Mooly Sagiv, Noam
  Rinetzky, Gerard Holzmann, Dragan Bosnacki,
  Steven German

23
The End.
24
Invited Questions

• Are the algorithms practical (interesting) ?
• What about verification ?
• What are the limitations of this approach ?
• What about progress ?
• What about locks vs. CAS ?
• Experimental results ?