Interfaculty BTT Master Broadband Telecommunication Technologies [email protected]
Operating Systems 2006/2007johanl/educ/2R230/OS-02-CommSync.pdfJohan J. Lukkien, [email protected]...
Transcript of Operating Systems 2006/2007johanl/educ/2R230/OS-02-CommSync.pdfJohan J. Lukkien, [email protected]...
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
1
Operating Systems2006/2007
Communication and Synchronization(part 1)
Johan Lukkien
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
2
Questions from exams• When may we regard a statement in a programming
language as atomic?• A POSIX semaphore admits inspection of the value,
to be used in tests. Give positive and negative aspects of these.
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
3
Exercise#include <stdio.h>#include <pthread.h>
int x;
void Count_100 (){
int i, s;for (i = 0; i < 100; i ++) {x = x+1;
} }
void main (){pthread_t thread_id;
x = 0;pthread_create (&thread_id, NULL, Count_100, NULL);Count_100 ();pthread_join (thread_id, NULL);printf ("x = %d\n", x);
}
• Is statement ‘x=x+1’ atomic? Motivate your answer.
• Replace it with a sequence that can be regarded as atomic.
• What are possible final values of x?
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
4
Agenda• Concurrency concepts• Action synchronization
– formalization– Semaphores– producer/consumer– mutual exclusion– bounded buffer
• Condition synchronization– condition variables– monitors
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
5
Concepts in concurrency• Atomic action: finest grain of detail, indivisible
– typically, assignments and tests in a program
– sufficient at program level: single reference to shared variable in statement
• Parallel execution: interleaving of atomic actions
• Shared variables: accessible to several threads
• Local variables: accessible only to a single thread
• Interference: disturbing assumptions about the state– usually, caused by “unexpected” interleaving
– particularly difficult and unexpected with shared memory
• Race conditions (critical races): situation in which correctness depends on the execution order of concurrent activities (“bad interference”)– activity: any level – circuit, hardware component, thread, ...– often associated with forms of busy waiting
• while (! IntrptFlag) /* wait */; /*assume IntrptFlag */
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
6
Reasoning about parallel programs• Annotation:
– assertions at control points
• Assertion:– predicate (boolean function) in terms of the program variables
• e.g. x=y, x≥0
• Control point:– place in the program text where one might inspect the current state
(i.e., values of variables) – between atomic actions– Meaning: “when the program is started in a state that satisfies the
initial assertion then, when a control point is reached during execution, the corresponding assertion holds”
• Invariant:– special assertion that holds at every control point
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
7
Communication & synchronization• Synchronization
– coordination of execution such as to let this execution satisfy a certain invariant
• or just steering the execution to have some property– typically, by sometimes blocking thread execution until an assertion
has become true
• Action (or event) synchronization– the invariant refers to ordering
• Condition synchronization– the invariant refers to a certain state
• Communication– exchange of data (in addition)
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
8
Examples• Invariant: A datastructure (more general: resource)
is accessed only by a single thread at a time– “mutual exclusion”– usually, to remove unwanted interference
• Assertion (before accessing): no other thread is accessing the resource
• Invariant: x or y must be positive• Corresponding assertions: e.g. before x := x-10,
“y>0 or x >= 10” must hold
CSO/PP3: Condition synchronizationJohan J. Lukkien, [email protected]
TU/e Informatica, System Architecture and Networking
9
Example: Vendor and Machine
0 ≤ Stock ≤ MAXVendor(Load)
Machine`Load’ items 1 item
Proc Vendor =|[ while true do
DriveToFactory; await (Stock+Load ≤ MAX);{ Stock+Load ≤ MAX }Stock := Stock+Load;DriveBack;ReLoad
od]|
Proc Machine =|[ while true do
await (Stock>0);{ Stock>0 }Stock := Stock-1;Manufacture
od]|
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
10
Issues around the example• Simply, repeated testing works if
– the assignments are atomic and ...• however, usually, the update is a sequence of actions – i.e., a critical section,
which is not atomic ... needs mutual exclusion– x := x+1 becomes r := x; r := r+1; x := r where r is an internal register with
atomic assignments– ... at most one Vendor and one Machine exists
• Busy waiting, when done at the level of an OS application, costsperformance
– hence, rely on OS primitives to solve this
• May introduce extra variables to steer behavior– e.g. no Machine when Vendor is waiting
• This is an ordering problem (why?)
• Problems can be traced to the shared variables– essential non-compositionality: when the program is modified everything
must be verified again– ‘distributed’ realization, with one ‘maintainer’ per shared variable
better/easier
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
11
Requirements on solutions• Correctness: satisfy the given specification.
• Minimal waiting: waiting only when correctness is in danger.
• Absence of deadlock: don’t manoeuvre the system into a state such that progress is no longer possible.
• (Absence of livelock: ensure convergence towards a decision in a synchronization protocol)
• Fairness in competition: eventually, each competing waitershould be admitted to proceed.– note: absence of fairness is often called: danger for starvation
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
12
Communication & synchronization facilities (primitives)
• Shared memory [with multi-threading]– just shared variables, e.g., event flags– semaphores, mutexes– condition variables– readers/writers locks– monitors
• Message passing– streaming: pipes, fifos, sockets– structured: message queues– asynchronous, buffered or synchronous
• Signals– asynchronous messages, i.e., interrupt the flow of control
• notice: two interpretations of (a)synchronous– may regard the signal handler as a concurrent thread, that is
(synchronously) waiting for an event
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
13
Agenda• Concurrency concepts• Action synchronization
– formalization– Semaphores– producer/consumer– mutual exclusion– bounded buffer
• Condition synchronization– condition variables– monitors
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
14
Specifying synchronization
Invariant: assertion that holds at all control points
Examples:• I: “mutual exclusion is maintained”
• I: y ≤ x in
Initially: x=0 ∧ y=0
while true do x := x+1; y := y+1 od||
while true do y := y-1; x := x-1 od
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
15
Counting executions
Naming of actions
Initially: x=0 ∧ y=0
while true do A: x := x+1; B: y := y+1 od||
while true do C: y := y-1; D: x := x-1 od
If A is an action in the program, cA denotes the number of completed executions of A. cA can be regarded as an auxiliary variable that is initially 0 and is incremented each time A is executed.
A → A; cA := cA+1
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
16
Topology properties
Topology invariants: derived directly from the program text
Example: two actions always occurring one after the other
Initially: x=0 ∧ y=0
while true do A: x := x+1; B: y := y+1 od||
while true do C: y := y-1; D: x := x-1 od
Invariants:I0: x = cA - cD I2: 0 ≤ cA - cB ≤ 1I1: y = cB - cC I3: 0 ≤ cC - CD≤ 1
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
17
Example
Showing invariance of I: y ≤ xy ≤ x
= { I0, I1 }cB - cC ≤ cA - cD
= { I2: cB ≤ cA, I3: cD ≤ cC }true
Note: such a proof must refer somehow to topology because the property relies on it.
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
18
Semaphores (Dijkstra)• Semaphore s is an integer s with initial value s0 ≥ 0 and
atomic operations P(s) and V(s). The effect of these operations is defined as follows:
P(s): < await(s>0); s := s-1 >V(s): < s := s+1 >
(here we used “< >” to denote atomicity)
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
19
Semaphore invariants
From the definition we derive four properties (invariants):
S0: s ≥ 0S1: s = s0 + cV(s) - cP(s)
S0, S1: functional properties (“safety”). Combining:S2: cP(s) ≤ s0 + cV(s)
hence, semaphores realize a synchronization invariant by definition
Progress: blocking is allowed only if the safety properties would be violated
Semaphores may be fair (called strong, e.g. FIFO) or unfair (called weak).
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
20
Producer/consumer problem
PX = x := 0;while true do
A: x := x+1od
PY = y := 0;while true do
B: y := y+1od
||
Synchronize PX and PY such that invariantI0: x ≤ y
is maintained.
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
21
Program topology
Use the program topology:x = cA and y = cB
hence, I0 can be rewrittenI0: cA ≤ cB
Introduce semaphore s; let A be preceded by P(s) and B be followed byV(s). Topology:
I1: cA ≤ cP(s)I2: cV(s) ≤ cB
Combine with semaphore invariant S4: cA ≤ cP(s) ≤ s0 + cV(s) ≤ s0 + cB
Hence, choosing s0 = 0 does the job.
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
22
More restrictionsSuppose that we also want:
I3: y ≤ x+10, i.e., cB ≤ cA+10
Introduce a new semaphore t. Let A be followed by V(t) and B be preceded by P(t). Then,
cB ≤ cP(t) ≤ t0 + cV(t) ≤ t0 + cA
Choose t0 = 10.
PX = x := 0;while true do
P(s); A: x := x+1; V(t)od
PY =y := 0;while true do
P(t); B: y := y+1; V(s)od
||
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
23
And more...
Suppose that instead of I0 we wantI4: 2x ≤ y, i.e., 2cA ≤ cB
Let A be preceded by two times P(s) (denoted as P(s)2). Then ,2cA ≤ cP(s)
hence,2cA ≤ cP(s) ≤ s0 + cV(s) ≤ s0 + cB
etc....
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
24
Action Synchronization
Given: - collection of tasks executing actions A, B, C, D;- a synchronization condition (invariant)
SYNC: a⋅cA + c⋅cC ≤ b⋅cB + d⋅cD + efor non-negative constants a,b,c,d,e .
Solution: introduce semaphore s, s0 = e and replaceA → P(s)a; A B → B; V(s)b
C → P(s)c; C D → D; V(s)d
Note: during execution of A and C we have strict inequality in SYNC.
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
25
Remarks• One semaphore for each synchronization condition.• Synchronization conditions may be conflicting. A deadlock may result.
• Sometimes a deadlock can be avoided by imposing extra restrictions.
• Finding synchronization conditions can be painful.
Example: consider PX and PY withI4: 2cA ≤ cB I3: cB ≤ cA+10
After a few steps, this system deadlocks
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
26
Counting semaphores (POSIX 1003.1b)• Naming and creation
– “name” within kernel, persistent until re-boot• Posix names, for portability,
– start names with ‘/’– do not use any subsequent ‘/’
– also “unnamed” semaphores, for use in shared memory (discussed later, with filesystems)
• two interfaces for creation and destruction
sem_t *sem;sem = sem_open (name, flags, mode, init_val); /* name is system-wide */status = sem_close (sem); /* semaphore still reachable */status = sem_unlink (name); /* now it is removed */
status = sem_init (sem, pshared, init_val); /* sem must be defined, e.g. through shm */status = sem_destroy (sem); /* pshared: whether multiple processes
* access sem; should be true */
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
27
Semaphore operations• Basic interface, designed for speed
• Obtaining the value is tricky– value is unstable– negative value: interpret as number of waiters (length of
queue)
status = sem_wait (sem);status = sem_trywait (sem); /* returns error (EBUSY?) if sem == 0 */status = sem_post (sem);status = sem_getvalue (sem, &val); /* current value
* when negative: absolute value = # waiters */
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
28
Example
#include <stdio.h>#include <fcntl.h>#include <pthread.h>#include <semaphore.h>
sem_t *s, *t;
void Producer (){
int i;for (i=0; i<10; i++) {sem_wait (t); printf ("Produce "); fflush (stdout);sem_post (s); sleep (1);
} }
void Consumer (){
int i;for (i=0; i<10; i++) {sem_wait (s); printf ("Consume "); fflush (stdout);sem_post (t); sleep (2);
} }
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
29
(cnt’d)
void main (){pthread_t thread_id;
s = sem_open ("Mysem-s", O_CREAT | O_RDWR, 0, 0);if (s == SEM_FAILED) { perror ("sem_open"); exit (0); }t = sem_open ("Mysem-t", O_CREAT | O_RDWR, 0, 4);if (t == SEM_FAILED) { perror ("sem_open"); exit (0); }
pthread_create (&thread_id, NULL, Producer, NULL);Consumer ();pthread_join (thread_id, NULL);sem_close (s); sem_close (t);sem_unlink ("Mysem-s"); sem_unlink ("Mysem-t");
}
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
30
Output• Produce Consume Produce Consume Produce Produce
Consume Produce Produce Consume Produce Produce Consume Produce Consume Produce Consume Consume Consume Consume
• Question: is there a shared resource visible (and a race condition?)
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
31
ExerciseA.3 Consider the parallel execution of the three program fragments below.
while true do A: x := x+2 od
while true do B: y := y-1 od
while true do C: x := x-1; D: y := y+2 od
Initially, x = y = 0
Synchronize the system in order to maintainI0: 0 ≤ yI1: x ≤ 10
Can you give an argument for absence of deadlock? Which additional restrictions might cause deadlock?
Johan J. Lukkien, [email protected]/e Informatica, System Architecture and Networking
32
Exercise• A.8 Solve the Vendor/Machine problem.
– What to do if the assignments to Stock are not atomic? – What if there are several Vendors and several Machines (both in
case the assignments are and are not atomic)?