Reference Capabilities for Concurrency and Scalability An - - PowerPoint PPT Presentation

▶
reference capabilities for concurrency and scalability
SMART_READER_LITE
LIVE PREVIEW

Reference Capabilities for Concurrency and Scalability An - - PowerPoint PPT Presentation

Mar 11, 2024 337 likes •864 views

Reference Capabilities for Concurrency and Scalability An Experience Report Elias Castegren , Tobias Wrigstad OCAP, Vancouver October 24th 2017 sa Structured Aliasing What the CAP? Object capability An unforgeable reference to an

slide-1
SLIDE 1

Reference Capabilities for Concurrency and Scalability

An Experience Report

Elias Castegren, Tobias Wrigstad OCAP, Vancouver October 24th 2017

sa Structured Aliasing
slide-2
SLIDE 2

What the CAP?

  • Object capability

— An unforgeable reference to an object
 — The permission to perform (one or more) operations on that object

  • Reference capability

— An (unforgeable) object capability
 — The permission to perform (one or more) operations on that reference {foo, bar} {foo, bar} {...}

slide-3
SLIDE 3

This Talk

  • Reference capabilities for data-race freedom
  • Reference capabilities for atomic ownership transfer

{foo} {bar} {foo, bar} ∅

slide-4
SLIDE 4

Boom!

Warning: Aliasing May Cause Data-Races

slide-5
SLIDE 5

???

Warning: Aliasing May Cause Data-Races

slide-6
SLIDE 6

???

Warning: Aliasing May Cause Data-Races

Aliasing doesn’t cause data-races! Lack of mutual exclusion causes data-races!

slide-7
SLIDE 7

Object Capabilities Are Not Enough

  • An object capability tells you something about what you can do with an object
  • A reference capability implicitly tells you something about what others can do

{foo, bar} {foo, bar} {move}

slide-8
SLIDE 8

Kappa [ECOOP ’16]

slide-9
SLIDE 9

Reference Capabilities for Concurrency Control

  • A capability grants access to some object
  • The type of a capability defines the interface to its object
  • A capability assumes exclusive access

Thread-safety ⇒ No data-races


  • How thread-safety is achieved is


controlled by the capability’s mode x : T linear

reference

slide-10
SLIDE 10

Reference Capabilities á la Mode

  • Exclusive modes
  • Sharable modes

linear local read Globally unique Thread-local Precludes mutating aliases locked Implicit locking

!

active Asynchronous actor

slide-11
SLIDE 11

linear local read Precludes mutating aliases locked subordinate Guarantee mutual exclusion Encapsulated

⎫ ⎬ ⎭

active

Reference Capabilities á la Mode

slide-12
SLIDE 12

Encore

  • Actor-based programming language
slide-13
SLIDE 13

Encore

  • Actor-based programming language
slide-14
SLIDE 14

Encore

  • Actor-based programming language
  • Uses reference capabilities to enforce safe sharing between actors
slide-15
SLIDE 15
  • Actor-based programming language
  • Uses reference capabilities to enforce safe sharing between actors

Encore

slide-16
SLIDE 16

Switching to a Delegating Model

slide-17
SLIDE 17

Switching to a Delegating Model

slide-18
SLIDE 18

Switching to a Delegating Model

slide-19
SLIDE 19

Far References with Reference Capabilities

{copyNear, copyFar} {copy} local {foo, bar} {!foo, !bar} ”active”

slide-20
SLIDE 20

Taking Far References Further

  • Safely breaking encapsulation

!

slide-21
SLIDE 21

Taking Far References Further

  • Safely breaking encapsulation

!

slide-22
SLIDE 22

Actors without Borders [PLACES’17]

!

slide-23
SLIDE 23

Safe Object Sharing

  • Any two aliases are e.g. composable, synchronised, thread-local, encapsulated…


⇒ No data-races

  • Whoever controls the aliasing controls the concurrency!

!

. . .

slide-24
SLIDE 24

Pony [AGERE ’15] and Orca [OOPSLA’17]

Thursday@OOPSLA 11:15-11:37

slide-25
SLIDE 25

Recap

  • Object capabilities specify the permitted operations on an object
  • Reference capabilities specify the permitted operations on a reference
  • Strictly following the reference capability model gives global guarantees:

— Encapsulation — Thread-locality — Uniqueness — Absence of mutable aliases — …

f

slide-26
SLIDE 26

Refcap > Ocap? Refcap ⇒ Ocap? Refcap ⊆ Ocap?

  • Reference capabilities can be a compliment to object capabilities
  • Reference capabilities allow specifying how object capabilities may be further shared

— Shallow/transitive permission — Local/distributed permission

  • Can object capabilities ”emulate” reference capabilities?

— Only partially

  • Can a reference capability be revoked?

— Weak references

slide-27
SLIDE 27

@CartesianGlee EliasC eliasc.github.io

slide-28
SLIDE 28
  • Relying on locks...
  • Relying on isolation…
  • Relying on immutability…
  • …bans shared mutable state altogether

Ensuring Mutual Exclusion

slide-29
SLIDE 29
  • Relying on locks...
  • Relying on isolation…
  • Relying on immutability…
  • …bans shared mutable state altogether

Ensuring Mutual Exclusion

Too restrictive?

slide-30
SLIDE 30

Example: A Treiber Stack

struct Node { var elem : T; val next : Node; } next elem struct Stack { var top : Node; } Stack N N N T T T top

slide-31
SLIDE 31

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T top

slide-32
SLIDE 32

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop

top

slide-33
SLIDE 33

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-34
SLIDE 34

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-35
SLIDE 35

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-36
SLIDE 36

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-37
SLIDE 37

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-38
SLIDE 38

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-39
SLIDE 39

Example: A Treiber Stack

Stack N N N def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T

  • ldTop
  • ldTop

top

slide-40
SLIDE 40

Fine-Grained Concurrency ≠ Mutual Exclusion

Stack N N N T T T Shared Mutable state! def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } }

slide-41
SLIDE 41

def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } }

Treiber Stack with Reference Capabilities

Stack N

{readElem} ∅ {compare {speculate} and swap}

slide-42
SLIDE 42

def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } }

Treiber Stack with Reference Capabilities

Stack N

{readElem} ∅ {compare {speculate} {… } and swap } …

slide-43
SLIDE 43

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T {…} {…}

slide-44
SLIDE 44

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T {…} {…} ∅

slide-45
SLIDE 45

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T {…} {…} ∅

slide-46
SLIDE 46

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T {…} {…}

slide-47
SLIDE 47

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T T {…} {…} ∅

slide-48
SLIDE 48

Capability Transfer with Compare-and-Swap

Stack N N N top def pop(s : Stack) : T { while(true) { val oldTop = s.top; if(CAS(s.top, oldTop, oldTop.next)) return oldTop.elem; } } T T ∅ {…}

slide-49
SLIDE 49

LOLCAT [ECOOP ’17]

  • Linear Ownership:

— At most one capability may access an object’s mutable fields

  • Three fundamental lock-free data-structures

— Treiber Stack
 — Michael—Scott Queue
 — Tim Harris List

  • No uncontrolled data-races!
slide-50
SLIDE 50

A Taxonomy of Reference Capabilities

Capability Shared Atomic Immutable Unsafe Lock-Free Active Subordinate

Optimistic Pessimistic

Oblivious Local Locked Read Exclusive Linear … Safe

slide-51
SLIDE 51

@CartesianGlee EliasC eliasc.github.io