210 likes | 347 Views
Proving L inearizability via Refinement Heike Wehrheim University of Paderborn Joint work with John Derrick (U. of Sheffield), Gerhard Schellhorn (U. of Augsburg). Motivation. Concurrent objects = data structures accessed by concurrent processes
E N D
ProvingLinearizability via Refinement Heike Wehrheim University of Paderborn Joint workwith John Derrick (U. of Sheffield), Gerhard Schellhorn (U. of Augsburg)
Motivation Concurrentobjects = datastructuresaccessedbyconcurrentprocesses Examples: stacks, sets, queues, … Implementedby: linkedlists, hashtables, … Questions: • implementationcorrect? • whatis „correctness“?
Set – Abstract Data Type add(4,true) contains(3,true) remove(1,true) Atomicoperations: add, remove, contains {1,3} {1,3,4} {1,3,4} {3,4}
Set - Implementation -1 2 4 6 1 head tail • Nodes: • val (values) • next (pointer) • lock (lockedor not) • marked(deletedor not) (algorithm due to Heller et al., HHLMSS) Linkedlist
Implementation ofadd -1 2 4 6 1 head 3 tail add(e) n1, n3 : locate(e); if n3.val != e then n2 := newNode(e); n2.next := n3; n1.next := n2; result := true else result := false; n1.unlock(); n2.unlock(); returnresult n2 add(3) n1 n3 locate: lockstwoadjacentnodes
In addition … removesimilar • locate, and • thenfirstmarking, thenphysicallyremovingnode Concurrency: - severalprocessesaccessingthelinkedlistatthe same time
Correctness? Implementation shouldbehaveasspecified in theabstractdata type, e.g., • addreallyadds an element, removereallyremovesit etc. • whatifremove(4,), add(4,), contains(4,) areexecutedconcurrently?
Linearizability „Linearizability provides the illusion that each operation applied by concurrent processes takes effect instantaneously at some point between its invocation and response.“ Herlihy, Wing, 1990
Linearizationpoints Linearizationpoint: add(3,true) Linearizationpoint: remove(3,true) invoke: add(3,) return: add(3,true) return: remove(3,true) invoke: remove(3,) Not linearizable return: add(3,true) invoke: add(3,) invoke: remove(3,) return: remove(3,false)
First Idea add(e) n1, n3 := locate(e); if n3.val != e then n2 := newNode(e); n2.next := n3; n1.next := n2; result := true else result := false; n1.unlock(); n2.unlock(); returnresult Find linearizationpoint (LP) foreveryoperation Show sequenceofLPstomakeup a valid executionsequenceoftheabstractdata type (proofbyrefinement)
Refinementgraphically Abstract Concrete P1 LP P2 LP P3 LP
Task Given: • Abstract Set: AState, AOp1, AOp2 • ConcreteSet: CState, COp1, COp2, COp3 Show refinementbyprovingconcretesettosimulateabstractset
Refinementprovenbysimulation R: abstractionrelationrelatingabstractandconcretestatespace AOp(true) R R R R R R COp3 InvOp COp1 COp2 RetOp(true) Find matchingstepsofconcreteoperations in abstractspecification LP
Difficulty What´stheconcretestatespace? • head, tail, linkedlistandlocal variables of all processes? • Whatare “all processes“? Oursolution: • Localproofobligations • Consideringatmosttwoprocessesat a time However, still provinglinearizabilityfor an arbitrarynumberofconcurrentprocesses
Simulation conditions AOp as as´ R ls: localstateofoneprocess R COp gs´,ls´ gs,ls Concretestatesplitintoglobal stateGS (head, tailandlinkedlist) andlocalstateLS (n1, n2, …) 8as : AS, gs, gs´ : GS, ls,ls´ : LS: R(as,gs,ls) ÆCOp(gs,ls,gs´,ls´) ) R(as,gs´,ls´) ÆAOp(as,as´) Æ R(as´,gs´,ls´)
Non-interference 8as : AS, gs,gs´: GS, lsp,lsp`,lsq : LS: R(as,gs,lsp) ÆR(as,gs,lsq)ÆCOp(gs,lsp,gs´,lsp´) ÆAOp(as,as´) )R(as´,gs´,lsq) Stepsofoneprocess do not interferewithsimulationproofsofotherprocesses
In addition Provedisjointnessoflocalstatestobekept Prove an invarianttobemaintained (e.g., tailalwaysreachablefromhead)
Operation contains contains(e): curr := head; while (curr.val < e) curr := curr.next; ifcurr.marked thenresult := false; elseresult := (curr.cal == e); returnresult Usesnolockingat all! Whereisthe LP ofcontains?
Example contains(4) started -1 2 4 6 1 curr LP ofcontainscannotbestaticallydetermined; it‘ssometimessetbyotherprocesses! remove(4) -1 2 4 6 1 add(4) 4 -1 2 4 6 1
Solution Potential LPs • containspotentiallylinearizesseveraltimes • refinementcondition: • every potential LP hastohave a matchingabstractstep • The thusconstructedsequenceofabstractoperationsmightcontainseveral potential LPs; the last oneistheactualone ) all operationsarelinearizable
Conclusion All proofsmechanised: KIV, interactiveprover (U of Augsburg) Results: • Localproofobligations hold for • Set with lock coupling • Lazyset • Stack • Localproofobligationsactuallyguaranteelinearizability