1. 1 1 Nastaran Shafiei VERIFICATION OF A NON-BLOCKING ARRAY-BASED QUEUE ALGORITHM

2. 2 2  Algorithm Description  Algorithm Implementation  Verification  Simulating Shared Variables  Linearizability  Java Pathfider Results Outline

3. 3 3  Finite array, Q  Counters, FRONT and REAR  Operations: enqueue, dequeue  Elements of the queue  Using compare-and-swap The Algorithm

4. 4 NonblockingQueue L: int Q: AtomicLongArray REAR: AtomicLong FRONT: AtomicLong Enqueue v al: int Enqueue(int value) void run() Dequeue void run() Thread … … getValPart(long queue) getRefPart(long var) getQueueItem(int val, int ref) main(String[] args) Implementation

5. 5 5 Shared Variables public static AtomicLongArray Queue; public static AtomicLong REAR; public static AtomicLong FRONT; Atomic variables Extend the concept of volatile variables compareAndSet() not supported by java pathfinder

6. 6 6 Simulating Atomic Variables AtomicLongArray long array AtomicLong long Using volatile keyword Simulating compareAndSwap() synchronized method Atomic execution methods  beginAtomic() and endAtomic()  Declared in gov.nasa.jpf.jvm.Verify  Atomic block with respect to the whole program

7. 77 Linearizability Correctness condition Definition: every concurrent execution = some legal sequential execution Linearization point (enqueue) AB Enqueue process: C Queue.compareAndSet( i, expected, newItem) = true

8. 88 Linearizability Linearization point (dequeue) To prove linearizability  Invariants were developed describing expected properties of the shared variables. AB Dequeue process: C Queue.compareAndSet( i, expected, emptyItem)=true

9. 99 Linearizability Auxiliary variablesShared Variables long rREAR long fFRONT long aq[]Q[]

10. 10 Linearizability At enqueue linearization point: aq[r%L] = newItem r++ At dequeue linearization point: aq[f%L] = emptyItem f++

11. 11 Linearizability InvariantPlace of assertion REAR == r-1Enqueue linearization point FRONT == f-1 Dequeue linearization point aq[r%L] == Q[REAR%L] synchronized CAS of REAR aq[f%L] == Q[FRONT%L]synchronized CAS of FRONT Assertion method Declared in gov.nasa.jpf.jvm.Verify public static void assert ( boolean b) Checks that b evaluates to true

12. 12 Java Pathfinder Results Using beginAtomic() and endAtomic()  Purpose: Simulate CAS/cut down state space Jpf killed a thread and exited (even for 1 thread) Using synchronized method to simulate CAS  Up to 3 threads: no errors detected  4 threads: DFS : no errors detected BFS gave Out.MemoryError : GC overhead limit exceeded  More: Out.MemoryError

13. 13 Questions?