Kill-Safe Synchronization Abstractions Matthew Flatt Robert Bruce - PowerPoint PPT Presentation

Kill-Safe Synchronization Abstractions Matthew Flatt Robert Bruce Findler University of Utah University of Chicago 1

Sibling Food-Sharing Protocol 2

Sibling Food-Sharing Protocol 3

Sibling Food-Sharing Protocol 4

Sibling Food-Sharing Protocol 5

Sibling Food-Sharing Protocol 6

Sibling Food-Sharing Protocol 7

Sibling Food-Sharing Protocol • By inspection, the protocol is fair • No parental supervision required 8

Sharing among Processes 9

Sharing among Processes 10

Sharing among Processes 11

Sharing among Processes 12

Sharing among Processes • Queue should be safe and fair • Should require no kernel supervision 13

Sharing in Java synchronized 14

Sharing in Java synchronized Thread.stop ⇒ synchronized isn't enough 15

Sharing in Java synchronized Thread.stop ⇒ synchronized isn't enough 16

Sharing in Java synchronized ... Thread.stop ⇒ synchronized isn't enough 17

Sharing in Java synchronized ... Thread.stop ⇒ synchronized isn't enough ∴ Java has no Thread.stop 18

Why Terminate? • Execute code in a programming environment (DrScheme) 19

Why Terminate? • Execute code in a programming environment (DrScheme) • Cancel actions that allocate resources (HTML browser) 20

Why Terminate? • Execute code in a programming environment (DrScheme) • Cancel actions that allocate resources (HTML browser) • Stop misbehaving servlets (web server) 21

Building Kill-Safe Abstractions abstraction abstraction thread-safe thread-safe abstraction abstraction kill-safe kill-safe thread-safe thread-safe abstraction abstraction 22

Building Kill-Safe Abstractions abstraction abstraction Programmer effort — but generally understood thread-safe thread-safe abstraction abstraction kill-safe kill-safe thread-safe thread-safe abstraction abstraction 23

Building Kill-Safe Abstractions abstraction abstraction Programmer effort — but generally understood thread-safe thread-safe abstraction abstraction Programmer effort kill-safe kill-safe — the subject of this talk thread-safe thread-safe abstraction abstraction 24

Building Kill-Safe Abstractions abstraction abstraction Start with Concurrent ML [Reppy 88] thread-safe thread-safe abstraction abstraction kill-safe kill-safe thread-safe thread-safe abstraction abstraction 25

Building Kill-Safe Abstractions abstraction abstraction Start with Concurrent ML [Reppy 88] thread-safe thread-safe abstraction abstraction Add MzScheme's custodians kill-safe kill-safe and a little more thread-safe thread-safe abstraction abstraction 26

Sharing in Concurrent ML 27

Sharing in Concurrent ML 28

Sharing in Concurrent ML 29

Sharing in Concurrent ML Abstraction-as-process naturally supports termination 30

Sharing in Concurrent ML Abstraction-as-process naturally supports termination Remaining problem: who controls the abstraction's process? 31

Managing Processes and Threads 32

Managing Processes and Threads 33

Managing Processes and Threads = custodian = capability to execute 34

Managing Processes and Threads = custodian = capability to execute 35

Managing with Custodians 36

Managing with Custodians 37

Managing with Custodians 38

Managing with Custodians 39

Managing with Custodians Queue terminated with servlet 40

Thread-Safe Abstractions A language to support abstractions: • Concurrent ML primitives for thread communication • Custodians for process hierarchy Each abstraction: • Manager thread for state 41

Towards Kill Safety with Custodians 42

Towards Kill Safety with Custodians 43

Towards Kill Safety with Custodians Not kill-safe among servlets 44

Kill Safety through Joint Custody 45

Kill Safety through Joint Custody 46

Kill Safety through Joint Custody 47

Kill Safety through Joint Custody 48

Kill Safety through Joint Custody Queue runs exactly as long as servlets 49

Why a Thread can have Multiple Custodians 50

Why a Thread can have Multiple Custodians 51

Why a Thread can have Multiple Custodians 52

Why a Thread can have Multiple Custodians 53

Why a Thread can have Multiple Custodians 54

Why a Thread can have Multiple Custodians Queue is only mostly dead 55

Why a Thread can have Multiple Custodians Queue is only mostly dead 56

Why a Thread can have Multiple Custodians Use queue ⇒ grant custodian 57

Kill-Safe Abstractions A language to support abstractions: • Concurrent ML primitives for thread communication • Custodians for process hierarchy • Operation to grant a thread another custodian Each abstraction: • Manager thread for state • Each action grants custodian to manager thread 58

Non-Solution #1 — Atomic Region = atomic 59

Non-Solution #1 — Atomic Region Queue might harm = atomic other servlets 60

Non-Solution #2 — Disjoint Process 61

Non-Solution #2 — Disjoint Process 62

Non-Solution #2 — Disjoint Process 63

Non-Solution #2 — Disjoint Process Queue runs forever 64

Non-Solution #3 — Meta-Servlet 65

Non-Solution #3 — Meta-Servlet Merely moves the “kernel” 66

Solution — Joint Custody 67

Details (See Paper) • Custodians granted through thread-resume • CML's guard-evt a natural place for thread-resume • Improved nack-guard-evt for two-step protocols • Kill-safe does not always imply break-safe, nor vice-versa 68

A Thread-Safe Queue (define-struct safe-q (define (safe-get sq) (put-ch get-ch)) (channel-recv (safe-q-get-ch sq))) (define (safe-queue) (define q (queue)) (define (safe-put sq v) (define get-ch (channel)) (channel-send (define put-ch (channel)) (safe-q-put-ch sq) v)) (define (q-loop) (sync (choice-evt (wrap-evt (channel-send get-ch (peek q)) (lambda () (get q))) (wrap-evt (channel-recv put-ch) (lambda (v) (put q v))))) (q-loop)) (spawn q-loop) (make-safe-q put-ch get-ch)) 69

A Kill-Safe Queue (define-struct safe-q (define (safe-get sq) (manager-t put-ch get-ch)) (resume sq) (channel-recv (define (safe-queue) (safe-q-get-ch sq))) (define q (queue)) (define get-ch (channel)) (define (safe-put sq v) (define put-ch (channel)) (resume sq) (define (q-loop) (channel-send (sync (safe-q-put-ch sq) v)) (choice-evt (wrap-evt (define (resume sq) (channel-send get-ch (peek q)) (thread-resume (lambda () (get q))) (safe-q-manager-t sq) (wrap-evt (current-thread))) (channel-recv put-ch) (lambda (v) (put q v))))) (q-loop)) (define manager-t (spawn q-loop)) (make-safe-q manager-t put-ch get-ch)) 70