Causal Atomicity: Correctness conditions for weak memory Heike - PowerPoint PPT Presentation

Causal Atomicity: Correctness conditions for weak memory Heike Wehrheim Joint work with Simon Doherty, Brijesh Dongol, John Derrick Paderborn University Germany

Our interest Proving correctness of algorithms allowing seemingly atomic access to shared state  concurrent data structures  software transactional memory Correctness conditions:  linearizability  opacity Heike Wehrheim - University of Paderborn 2

Proof technique Proof of refinement: Opacity Intermediate TMS2 specification v (shown via simulation) STM implementation Simulation shown with interactive verifier (KIV, Isabelle) Heike Wehrheim - University of Paderborn 3

Opacity & linearizability I Defs based on histories:  Sequence of invocations and returns Concurrent history: h 1 : inv t1 (enq,3) inv t2 (deq) ret t2 (deq,3) ret t1 (enq) Sequential history: h 2 : inv t1 (enq,3) ret t1 (enq) inv t2 (deq) ret t2 (deq,3) Real-time order: t 1 < h2 t 2 return of t 1 in history h before invocation of t 2 Heike Wehrheim - University of Paderborn 4

Opacity & linearizability II i.e. linearizable or opaque Def.: Concurrent history hc atomic if there exists sequential legal history hs s.t. 1. 8 t: hc| t = hs| t (preservation of thread events and thread order) 2. < hc µ < hs (preservation of real-time order) legal = adheres to semantics of object ( Enq(4) Deq( ? ) – not legal, Enq(4) Deq(4) – legal) Heike Wehrheim - University of Paderborn 5

Question What correctness condition to use when executions are not histories, but partial orders? e.g. weak memory model (happens-before relation) Heike Wehrheim - University of Paderborn 6

Example TMWr – Trans.Memory write TMRd – Trans.Memory read History: inv(TMWr(x,0)) ret(TMWr) inv(TMWr(x,42)) ret(TMWr) inv(TMRd(x)) ret(TMRd(x,0)) Not atomic But partial order: TMWr(x,42) TMWr(x,0) TMRd(x,0) OK! Heike Wehrheim - University of Paderborn 7

PO-atomicity Def.: Partial order hc po-atomic if there exists sequential legal history hs s.t. 1. 8 t: hc | t = hs | t (preservation of thread events and thread order) 2. < po µ < hs (preservation of partial order) po- atomic TMWr(x,42) TMWr(x,0) hs hs TMRd(x,0) Heike Wehrheim - University of Paderborn 8

Compositionality Clients using more than one such concurrent object Objective: Individual accesses po-atomic iff combined accesses po-atomic Fails to hold: Conflict # Deq( ? ) Thread1: TMRd(x,42) # # Thread2: Enq(11) TMWr(x,42) Heike Wehrheim - University of Paderborn 9

Conflicts Conflicts between actions # = {(a,a´) j 9 w 1 ,w 2 : w 1 aa´w 2 is legal, w 1 a´aw 2 is not legal } Orderings between conflicting actions cannot be arbitrarily chosen Heike Wehrheim - University of Paderborn 10

Execution structures Def.: [Lamport, 1986] Execution structure (E, ! , Ã ) with  E: finite set of events  ! µ E £ E „precedes“  Ã µ E £ E „communicates with“, „affects“ A1. ! irreflexive partial order A2. e 1 ! e 2 implies e 1 Ã e 2 and e 2 Ã e 1 A3. e 1 ! e 2 Ã e 3 or e 1 Ã e 2 ! e 3 implies e 1 Ã e 3 A4. e 1 ! e 2 Ã e 3 ! e 4 implies e 1 ! e 4 Heike Wehrheim - University of Paderborn 11

Non-atomicity and ! e ! e´ iff 8 f 2 ¹ (e), 8 f´ 2 ¹ (e´): f < hb f´ ¹ ¹ Impl. execution „happens-before“ Heike Wehrheim - University of Paderborn 12

Non-atomicity and à e ! e´ iff 9 f 2 ¹ (e), 9 f´ 2 ¹ (e´): f < hb f´ à ¹ ¹ Impl. execution „happens-before“ Heike Wehrheim - University of Paderborn 13

Causal atomicity Def. Execution structure (E, ! , Ã ) is causally atomic if there exists sequential legal history hs s.t. 1. events( hs ) = E 2. ! µ < hs (preservation of partial order) 3. e 1 < hs e 2 and e 1 # e 2 implies e 1 Ã e 2 Heike Wehrheim - University of Paderborn 14

Back to example Individual accesses not causally atomic Conflict # Deq( ? ) Thread1: TMRd(x,42) # # Thread2: Enq(11) TMWr(x,42) Queue part: Deq( ? ) < hs Enq(11) + Enq(11) # Deq( ? ) ) Deq( ? ) Ã Enq(11) Similarly, we need: TMWr(x,42) Ã TMRd(x,42) (no proper execution structure anymore) Heike Wehrheim - University of Paderborn 15

Result Causal atomicity is compositional: Theorem. E execution structure over concurrent objects O i , 1 · i · n 8 i: E i causally atomic iff E causally atomic Heike Wehrheim - University of Paderborn 16

Causal atomicity vs linearizability Concurrent history hc to execution structure exec(hc)  e ! e´ if ret(e) < hc inv(e´) e e´  e à e´ if inv(e) < hc ret(e´) e e e´ e´ Theorem. hc linearizable iff exec(hc) causally atomic Heike Wehrheim - University of Paderborn 17

Proof technique (in progress) Proof of execution structure refinement: Causal Atomicity Intermediate CTMS specification library v (shown via simulation) STM Implementation implementation library Heike Wehrheim - University of Paderborn 18

Summary New correctness condition for concurrent objects  Compositional  Adequate for weak memory models Heike Wehrheim - University of Paderborn 19