Capable: Capabilities for Scalability Current state of design Elias Castegren , Tobias Wrigstad forename.surname@it.uu.se IWACO 2014, Uppsala 1 / 22
Introduction ◮ Safe parallel programming using capabilities ◮ Scalability and performance rather than verification 2 / 22
Background ◮ Ownership types prescribe structure 3 / 22
Background ◮ Ownership types prescribe structure 3 / 22
Background ◮ Ownership types prescribe structure 3 / 22
Background ◮ Ownership types prescribe structure ◮ Effect systems describe usage 3 / 22
Background ◮ Ownership types prescribe structure ◮ Effect systems describe usage 3 / 22
Background ◮ Ownership types prescribe structure ◮ Effect systems describe usage 3 / 22
Background ◮ Ownership types prescribe structure ◮ Effect systems describe usage 3 / 22
Background ◮ Ownership types prescribe structure ◮ Effect systems describe usage ◮ We’re aiming somewhere in-between: Any structure is allowed as long as all aliases are non-interfering. 3 / 22
Outline ◮ Introduction ◮ Background ◮ Capabilities ◮ Traits and classes ◮ Composition, splitting and merging ◮ Nesting and parametricity ◮ Composition as abstract memory layout specification 4 / 22
Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... Capabilities ◮ A capability governs access to some resource 5 / 22
Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... Capabilities ◮ A capability governs access to some resource ◮ Capability ≃ (Reference, { allowed operations } ) 5 / 22
Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... Capabilities ◮ A capability governs access to some resource ◮ Capability ≃ (Reference, { allowed operations } ) Capability 5 / 22
Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... Capabilities ◮ A capability governs access to some resource ◮ Capability ≃ (Reference, { allowed operations } ) Capability Exclusive Non-exclusive 5 / 22
Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... Capabilities ◮ A capability governs access to some resource ◮ Capability ≃ (Reference, { allowed operations } ) Capability Exclusive Non-exclusive Safe Unsafe 5 / 22
Capabilities ◮ A capability governs access to some resource ◮ Capability ≃ (Reference, { allowed operations } ) Capability Exclusive Non-exclusive Safe Unsafe Locks Transactions Immutable Lock-free ... 5 / 22
Safety ◮ Orthogonal to the design of our system: Plug in your favorite synchronization mechanism! 6 / 22
Safety ◮ Orthogonal to the design of our system: Plug in your favorite synchronization mechanism! ◮ Baseline: ◮ No write-write conflicts outside of unsafe capabilities ◮ Exclusive capabilities are (and remain) exclusive 6 / 22
Safety ◮ Orthogonal to the design of our system: Plug in your favorite synchronization mechanism! ◮ Baseline: ◮ No write-write conflicts outside of unsafe capabilities ◮ Exclusive capabilities are (and remain) exclusive ◮ Our focus: Lock-free capabilities with static support for speculation and publication of values (see paper for more details) 6 / 22
Traits ◮ Capabilities are introduced using traits: safe trait Get { require int value; int get() { return this.value; } } 7 / 22
Traits ◮ Capabilities are introduced using traits: safe trait Get { require int value; int get() { return this.value; } } ◮ Traits are exclusive by default: trait Set { require int value; void set(int val) { this.value = val; } } 7 / 22
Classes trait Set { safe trait Get { require int value; require int value; void set(int val)... int get()... ◮ Classes are formed by composing traits: class Cell = Set ⊕ Get ∗ { provide int value; } 8 / 22
Classes trait Set { safe trait Get { require int value; require int value; void set(int val)... int get()... ◮ Classes are formed by composing traits: class Cell = Set ⊕ Get ∗ { provide int value; } ◮ Class types are composite capabilities: Cell c = new Cell; c.set(42); c.get(); // = 42 8 / 22
= and ⊗ = Pair Cell Cell Composition and splitting ◮ A disjunction can be split into either of its components: = or ⊕ = Cell Set Get* 9 / 22
42 x å p 42 42 z f x y x Composition and splitting ( Cell = Set ⊕ Get ∗ ) x = new Cell; x 10 / 22
å p 42 42 z f x y x Composition and splitting ( Cell = Set ⊕ Get ∗ ) x = new Cell; x.set(42); 42 x x 10 / 22
å p 42 z f x y Composition and splitting ( Cell = Set ⊕ Get ∗ ) x = new Cell; x.set(42); 42 x x x = (Get ∗ ) consume x; 42 x 10 / 22
Composition and splitting ( Cell = Set ⊕ Get ∗ ) x = new Cell; x.set(42); 42 x x x = (Get ∗ ) consume x; å p 42 42 z f x y x 10 / 22
Composition and splitting ◮ A disjunction can be split into either of its components: = or ⊕ = Cell Set Get* ◮ A conjunction can be split into both of its components: = and ⊗ = Pair Cell Cell 11 / 22
c1 c2 p c1 c2 Composition and splitting ( Pair = Cell ⊗ Cell ) p = new Pair; p 12 / 22
c1 c2 Composition and splitting ( Pair = Cell ⊗ Cell ) p = new Pair; Cell c1, c2 = consume p; c1 c2 p p 12 / 22
Composition and splitting ( Pair = Cell ⊗ Cell ) p = new Pair; Cell c1, c2 = consume p; c1 c2 p p c1 and c2 are aliases, but can only access “their half” of the Pair : c1 c2 12 / 22
Splitting and merging = and ⊗ = Pair Cell Cell 13 / 22
Splitting and merging and ⊗ Pair Cell Cell 13 / 22
Splitting and merging Pair Pair 13 / 22
Merging ◮ Structured split and merge Pair p = ...; split p into Cell c1, c2 in { ... // p is invalidated } ... // p is reinstated 14 / 22
Merging ◮ Structured split and merge Pair p = ...; split p into Cell c1, c2 in { ... // p is invalidated } ... // p is reinstated ◮ Unstructured split and merge Pair p = ...; Cell c1, c2 = consume p; ... p = consume c1 ⊗ consume c2 ... // c1 and c2 are invalidated 14 / 22
Merging ◮ Structured split and merge Pair p = ...; split p into Cell c1, c2 in { ... // p is invalidated } ... // p is reinstated ◮ Unstructured split and merge Pair p = ...; Cell c1, c2 = consume p; ... p = consume c1 ⊗ consume c2 ← dynamic alias check! ... // c1 and c2 are invalidated 14 / 22
Merging ◮ What about disjunction? = or ⊕ = Cell Set Get* 15 / 22
Merging ◮ What about disjunction? = = Cell Set Get* 15 / 22
Merging ◮ What about disjunction? = = Cell Get* Set 15 / 22
Merging ◮ What about disjunction? = = Cell Get* Set ◮ The Get capability is lost! 15 / 22
Splitting with Jails ◮ Cell = Set ⊕ Get ∗ means Set and Get ∗ may not be used in parallel = or ⊕ = Cell Set Get* 16 / 22
Splitting with Jails ◮ Cell = Set ⊕ Get ∗ means Set and Get ∗ may not be used in parallel and = ⊗ = Cell Set J<Get*> ◮ A jailed capability is an alias with an empty interface 16 / 22
Splitting with Jails ◮ Cell = Set ⊕ Get ∗ means Set and Get ∗ may not be used in parallel = ⊗ = Cell ◮ A jailed capability is an alias with an empty interface 16 / 22
Splitting with Jails ◮ Cell = Set ⊕ Get ∗ means Set and Get ∗ may not be used in parallel = ⊗ = Cell ◮ A jailed capability is an alias with an empty interface ◮ Jails can turn any disjunction c 1 ⊕ c 2 into a conjunction c 1 ⊗ J � c 2 � , which can be split and merged in a non-lossy way 16 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe 17 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe ◮ Traits specify behaviour and introduce capability types. 17 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe ◮ Traits specify behaviour and introduce capability types. ◮ Classes introduce composite capability types 17 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe ◮ Traits specify behaviour and introduce capability types. ◮ Classes introduce composite capability types ◮ A disjunction c 1 ⊕ c 2 can be split into either c 1 or c 2 17 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe ◮ Traits specify behaviour and introduce capability types. ◮ Classes introduce composite capability types ◮ A disjunction c 1 ⊕ c 2 can be split into either c 1 or c 2 ◮ A conjunction c 1 ⊗ c 2 can be split into both c 1 and c 2 which may be used in parallel 17 / 22
Recap ◮ Capabilities are either exclusive , safe or unsafe ◮ Traits specify behaviour and introduce capability types. ◮ Classes introduce composite capability types ◮ A disjunction c 1 ⊕ c 2 can be split into either c 1 or c 2 ◮ A conjunction c 1 ⊗ c 2 can be split into both c 1 and c 2 which may be used in parallel ◮ Merging can be used to regain composite capabilities in both structured and unstructured ways 17 / 22
Recommend
More recommend
