Index: doc/bibliography/pl.bib =================================================================== --- doc/bibliography/pl.bib (revision 45af7e1145e9631b244b43c9e04278d852a2e414) +++ doc/bibliography/pl.bib (revision ca0f061f0dc280b51c4572a629d65c65d8bdc442) @@ -1141,4 +1141,17 @@ } +@inproceedings{Tarditi18, + keywords = {Checked C}, + contributer = {a3moss@uwaterloo.ca}, + author = {Tarditi, David and Elliott, Archibald Samuel and Ruef, Andrew and Hicks, Michael}, + title = {Checked C: Making C Safe by Extension}, + booktitle = {2018 IEEE Cybersecurity Development (SecDev)}, + publisher = {IEEE}, + year = {2018}, + month = seep, + pages = {53-60}, + url = {https://www.microsoft.com/en-us/research/publication/checkedc-making-c-safe-by-extension/}, +} + @book{Yourdon79, keywords = {software engineering}, @@ -1301,5 +1314,8 @@ journal = sigplan, year = 1986, - month = oct, volume = 21, number = 10, pages = {19-28}, + month = oct, + volume = 21, + number = 10, + pages = {19-28}, note = {Object Oriented Programming Workshop} } @@ -7791,4 +7807,19 @@ % Y +@article{Boehm12, + keywords = {memory model, race condition}, + contributer = {pabuhr@plg}, + author = {Boehm, Hans-J. and Adve, Sarita V.}, + title = {You Don'T Know Jack About Shared Variables or Memory Models}, + journal = cacm, + volume = 55, + number = 2, + month = feb, + year = 2012, + pages = {48--54}, + publisher = {ACM}, + address = {New York, NY, USA}, +} + % Z Index: doc/papers/concurrency/Paper.tex =================================================================== --- doc/papers/concurrency/Paper.tex (revision 45af7e1145e9631b244b43c9e04278d852a2e414) +++ doc/papers/concurrency/Paper.tex (revision ca0f061f0dc280b51c4572a629d65c65d8bdc442) @@ -228,5 +228,5 @@ } -\title{\texorpdfstring{Concurrency in \protect\CFA}{Concurrency in Cforall}} +\title{\texorpdfstring{Advanced Control-flow in \protect\CFA}{Advanced Control-flow in Cforall}} \author[1]{Thierry Delisle} @@ -241,14 +241,14 @@ \abstract[Summary]{ -\CFA is a modern, polymorphic, \emph{non-object-oriented}, backwards-compatible extension of the C programming language. -This paper discusses the concurrency and parallelism features in \CFA, and its runtime system. +\CFA is a modern, polymorphic, non-object-oriented, backwards-compatible extension of the C programming language. +This paper discusses the advanced control-flow features in \CFA, which include concurrency and parallelism, and its supporting runtime system. These features are created from scratch as ISO C's concurrency is low-level and unimplemented, so C programmers continue to rely on the C pthreads library. -\CFA provides high-level control-flow mechanisms, like coroutines and lightweight (user) threads, and monitors for mutual exclusion and synchronization. -A unique contribution of this work is allowing multiple monitors to be safely acquired \emph{simultaneously}. +\CFA provides high-level control-flow mechanisms, like coroutines and user-level threads, and monitors for mutual exclusion and synchronization. +A unique contribution of this work is allowing multiple monitors to be safely acquired \emph{simultaneously} (deadlock free), while integrating this capability with all monitor synchronization mechanisms. All features respect the expectations of C programmers, while being fully integrate with the \CFA polymorphic type-system and other language features. Experimental results show comparable performance of the new features with similar mechanisms in other concurrent programming-languages. }% -\keywords{concurrency, parallelism, coroutines, threads, monitors, runtime, C, \CFA (Cforall)} +\keywords{coroutines, concurrency, parallelism, threads, monitors, runtime, C, \CFA (Cforall)} @@ -261,34 +261,62 @@ \section{Introduction} -This paper discusses the design of the high-level concurrency and parallelism features in \CFA, and its runtime. -\CFA is a modern, polymorphic, \emph{non-object-oriented}, backwards-compatible extension of the C programming language~\cite{Moss18}. -Within the \CFA framework, new concurrency features were created from scratch. -While ISO \Celeven defines concurrency~\cite[\S~7.26]{C11}, it is largely wrappers for a subset of the pthreads library~\cite{Butenhof97,Pthreads}. -Furthermore, \Celeven and pthreads concurrency is simple: create/join threads in a function and a few locks, which is low-level and error prone; +This paper discusses the design of advanced, high-level control-flow extensions (especially concurrency and parallelism) in \CFA and its runtime. +\CFA is a modern, polymorphic, non-object-oriented\footnote{ +\CFA has features often associated with object-oriented programming languages, such as constructors, destructors, virtuals and simple inheritance. +However, functions \emph{cannot} be nested in structures, so there is no lexical binding between a structure and set of functions (member/method) implemented by an implicit \lstinline@this@ (receiver) parameter.}, +backwards-compatible extension of the C programming language~\cite{Moss18}. +Within the \CFA framework, new control-flow features were created from scratch. +ISO \Celeven defines only a subset of the \CFA extensions, and with respect to concurrency~\cite[\S~7.26]{C11}, the features are largely wrappers for a subset of the pthreads library~\cite{Butenhof97,Pthreads}. +Furthermore, \Celeven and pthreads concurrency is basic, based on thread fork/join in a function and a few locks, which is low-level and error prone; no high-level language concurrency features exist. -Interestingly, 8 years since publication of the \Celeven standard, neither gcc-8 nor clang-8 (most recent versions) support \Celeven @threads.h@, indicating little interest in the C concurrency approach. -Finally, while the \Celeven standard does not state a concurrent threading-model, the strong association with pthreads suggests the threading model is kernel-level threading (1:1)~\cite{ThreadModel}. - -There has been a re-interest during the past decade in user-level (M:N, green) threading in new and old programming languages, and providing high-level constructs like coroutines, monitors, tasks, and actors for presenting advanced control-flow. +Interestingly, almost a decade after publication of the \Celeven standard, neither gcc-8, clang-8 nor msvc-19 (most recent versions) support the \Celeven include @threads.h@, indicating little interest in the C concurrency approach. +Finally, while the \Celeven standard does not state a concurrent threading-model, the historical association with pthreads suggests the threading model is kernel-level threading (1:1)~\cite{ThreadModel}. + +In contrast, there has been a renewed interest during the past decade in user-level (M:N, green) threading in old and new programming languages. As multi-core hardware became available in the 1980/90s, both user and kernel threading were examined. Kernel threading was chosen, largely because of its simplicity and fit with the simpler operating systems and hardware architectures at the time, which gave it a performance advantage~\cite{Drepper03}. -Libraries like pthreads were developed for C and the Solaris operating-system switched from user (JDK 1.1~\cite{JDK1.1}) to kernel threads. +Libraries like pthreads were developed for C, and the Solaris operating-system switched from user (JDK 1.1~\cite{JDK1.1}) to kernel threads. As a result, languages like Java, Scala~\cite{Scala}, Objective-C~\cite{obj-c-book}, \CCeleven~\cite{C11}, and C\#~\cite{Csharp} adopted the 1:1 kernel-threading model, with a variety of presentation mechanisms. From 2000 onwards, languages like Go~\cite{Go}, Erlang~\cite{Erlang}, Haskell~\cite{Haskell}, D~\cite{D}, and \uC~\cite{uC++,uC++book} have championed the M:N user-threading model, and many user-threading libraries have appeared~\cite{Qthreads,MPC,BoostThreads}, including putting green threads back into Java~\cite{Quasar}. -Because advanced control-flow (including exception handling) is pervasive in a programming language and its runtime, these features must be understood by the language (i.e., not added via a library) to prevent invalidation by sequential optimizations~\cite{Buhr95a,Boehm05}. - -The main argument for user-level threading is matching the concurrency model with the programming-language style, versus adapting language concurrency to one general approach. -For example, it is possible to provide coroutines, monitors, and tasks as specialized types in an object-oriented language, integrating these constructs to allow leveraging the type-system (static type-checking) and all other object-oriented capabilities~\cite{uC++}. -The user-threading approach facilitates a simpler concurrency construction using thread objects and leveraging sequential patterns versus call-backs and events~\cite{vonBehren03}. -As well, user-level threads are lighter weight than kernel threads, so there is less restriction on programming styles that encourage large numbers of threads performing smaller work-units to facilitate load balancing by the runtime~\cite{Verch12}. -User threading is also able to layer multiple concurrency models into a single language (locks, monitors, tasks, actors, futures), so programmers can chose the model that best fits an application. -Finally, it is possible to discretely fold locking and non-blocking I/O multiplexing into the language's I/O libraries, so threading implicitly dovetails with the I/O subsystem. -Performant user-threading implementations (both time and space) are appearing that are competitive with direct kernel-threading implementations, while achieving the programming advantages of high concurrency levels and safety. - -Adding advanced control-flow to \CFA is similar to current and future extensions in \CCeleven through to \CCtwenty. -However, we contend the \CFA extensions are demonstrably better than those proposed for \CC. -For example, a unique contribution of this work is allowing multiple monitors to be safely acquired \emph{simultaneously} (deadlock free), while integrating this capability with all monitor synchronization mechanisms. -As well, all control-flow features respect the expectations of C programmers, with statically type-safe interfaces that integrate with the \CFA polymorphic type-system and other language features. -Experimental results show comparable performance of the new features with similar mechanisms in other concurrent programming-languages. +The main argument for user-level threading is that they are lighter weight than kernel threads (locking and context switching do not cross the kernel boundary), so there is less restriction on programming styles that encourage large numbers of threads performing smaller work-units to facilitate load balancing by the runtime~\cite{Verch12}. +As well, user-threading facilitates a simpler concurrency approach using thread objects that leverage sequential patterns versus events with call-backs~\cite{vonBehren03}. +Finally, performant user-threading implementations (both time and space) are largely competitive with direct kernel-threading implementations, while achieving the programming advantages of high concurrency levels and safety. + +A further effort over the past decade is the development of language memory-models to deal with the conflict between certain language features and compiler/hardware optimizations. +This issue can be rephrased as some features are pervasive (language and runtime) and cannot be safely added via a library to prevent invalidation by sequential optimizations~\cite{Buhr95a,Boehm05}. +The consequence is that a language must be cognizant of these features and provide sufficient tools to program around any safety issues. +For example, C created the @volatile@ qualifier to provide correct execution for @setjmp@/@logjmp@ (concurrency came later). +The simplest solution is to provide a handful of complex qualifiers and functions (e.g., @volatile@ and atomics) allowing programmers to write consistent/race-free programs, often in the sequentially-consistent memory-model~\cite{Boehm12}. + +While having a sufficient memory-model allows sound libraries to be constructed, writing these libraries can quickly become awkward and error prone, and using these low-level libraries has the same issues. +Essentially, using low-level explicit locks is the concurrent equivalent of assembler programming. +Just as most assembler programming is replaced with programming in a high-level language, explicit locks can be replaced with high-level concurrency constructs in a programming language. +The goal is to get the compiler to check for correct usage and follow any complex coding conventions implicitly. +The drawback is that language constructs may preclude certain specialized techniques, therefore introducing inefficiency or inhibiting concurrency. +For most concurrent programs, these drawbacks are insignificant in comparison to the speed of composition, and subsequent reliability and maintainability of the high-level concurrent program. +(The same is true for high-level programming versus assembler programming.) +Only very rarely should it be necessary to drop down to races and/or explicit locks to apply a specialized technique to achieve maximum speed or concurrency. +As stated, this observation applies to non-concurrent forms of complex control-flow, like exception handling and coroutines. + +Adapting the programming language allows matching the control-flow model with the programming-language style, versus adapting to one general (sound) library/paradigm. +For example, it is possible to provide exceptions, coroutines, monitors, and tasks as specialized types in an object-oriented language, integrating these constructs to allow leveraging the type-system (static type-checking) and all other object-oriented capabilities~\cite{uC++}. +It is also possible to leverage call/return for blocking communication via new control structures, versus switching to alternative communication paradigms, like channels or message passing. +As well, user threading is often a complementary feature, allowing light-weight threading to match with low-cost objects, while hiding the application/kernel boundary. +User threading also allows layering of implicit concurrency models (no explicit thread creation), such executors, data-flow, actors, into a single language, so programmers can chose the model that best fits an algorithm.\footnote{ +All implicit concurrency models have explicit threading in their implementation, and hence, can be build from explicit threading; +however, the reverse is seldom true, i.e., given implicit concurrency, e.g., actors, it is virtually impossible to create explicit concurrency, e.g., blocking thread objects.} +Finally, with extended language features and user-level threading it is possible to discretely fold locking and non-blocking I/O multiplexing into the language's I/O libraries, so threading implicitly dovetails with the I/O subsystem. + +\CFA embraces language extensions and user-level threading to provide advanced control-flow and concurrency. +We attempt to show the \CFA extensions and runtime are demonstrably better than those proposed for \CC and other concurrent, imperative programming languages. +The contributions of this work are: +\begin{itemize} +\item +allowing multiple monitors to be safely acquired \emph{simultaneously} (deadlock free), while seamlessly integrating this capability with all monitor synchronization mechanisms. +\item +all control-flow features respect the expectations of C programmers, with statically type-safe interfaces that integrate with the \CFA polymorphic type-system and other language features. +\item +experimental results show comparable performance of the new features with similar mechanisms in other concurrent programming-languages. +\end{itemize} \begin{comment} @@ -587,44 +615,7 @@ -\section{Concurrency} -\label{s:Concurrency} - -At its core, concurrency is based on multiple call-stacks and scheduling threads executing on these stacks. -Multiple call stacks (or contexts) and a single thread of execution, called \newterm{coroutining}~\cite{Conway63,Marlin80}, does \emph{not} imply concurrency~\cite[\S~2]{Buhr05a}. -In coroutining, the single thread is self-scheduling across the stacks, so execution is deterministic, \ie the execution path from input to output is fixed and predictable. -A \newterm{stackless} coroutine executes on the caller's stack~\cite{Python} but this approach is restrictive, \eg preventing modularization and supporting only iterator/generator-style programming; -a \newterm{stackful} coroutine executes on its own stack, allowing full generality. -Only stackful coroutines are a stepping stone to concurrency. - -The transition to concurrency, even for execution with a single thread and multiple stacks, occurs when coroutines also context switch to a \newterm{scheduling oracle}, introducing non-determinism from the coroutine perspective~\cite[\S~3]{Buhr05a}. -Therefore, a minimal concurrency system is possible using coroutines (see Section \ref{coroutine}) in conjunction with a scheduler to decide where to context switch next. -The resulting execution system now follows a cooperative threading-model, called \newterm{non-preemptive scheduling}. - -Because the scheduler is special, it can either be a stackless or stackful coroutine. -For stackless, the scheduler performs scheduling on the stack of the current coroutine and switches directly to the next coroutine, so there is one context switch. -For stackful, the current coroutine switches to the scheduler, which performs scheduling, and it then switches to the next coroutine, so there are two context switches. -A stackful scheduler is often used for simplicity and security. - -Regardless of the approach used, a subset of concurrency related challenges start to appear. -For the complete set of concurrency challenges to occur, the missing feature is \newterm{preemption}, where context switching occurs randomly between any two instructions, often based on a timer interrupt, called \newterm{preemptive scheduling}. -While a scheduler introduces uncertainty in the order of execution, preemption introduces uncertainty about where context switches occur. -Interestingly, uncertainty is necessary for the runtime (operating) system to give the illusion of parallelism on a single processor and increase performance on multiple processors. -The reason is that only the runtime has complete knowledge about resources and how to best utilized them. -However, the introduction of unrestricted non-determinism results in the need for \newterm{mutual exclusion} and \newterm{synchronization} to restrict non-determinism for correctness; -otherwise, it is impossible to write meaningful programs. -Optimal performance in concurrent applications is often obtained by having as much non-determinism as correctness allows. - -An important missing feature in C is threading\footnote{While the C11 standard defines a \protect\lstinline@threads.h@ header, it is minimal and defined as optional. -As such, library support for threading is far from widespread. -At the time of writing the paper, neither \protect\lstinline@gcc@ nor \protect\lstinline@clang@ support \protect\lstinline@threads.h@ in their standard libraries.}. -In modern programming languages, a lack of threading is unacceptable~\cite{Sutter05, Sutter05b}, and therefore existing and new programming languages must have tools for writing efficient concurrent programs to take advantage of parallelism. -As an extension of C, \CFA needs to express these concepts in a way that is as natural as possible to programmers familiar with imperative languages. -Furthermore, because C is a system-level language, programmers expect to choose precisely which features they need and which cost they are willing to pay. -Hence, concurrent programs should be written using high-level mechanisms, and only step down to lower-level mechanisms when performance bottlenecks are encountered. - - -\subsection{Coroutines: A Stepping Stone}\label{coroutine} - -While the focus of this discussion is concurrency and parallelism, it is important to address coroutines, which are a significant building block of a concurrency system (but not concurrent among themselves). +\section{Coroutines: A Stepping Stone}\label{coroutine} + +Advanced controlWhile the focus of this discussion is concurrency and parallelism, it is important to address coroutines, which are a significant building block of a concurrency system (but not concurrent among themselves). Coroutines are generalized routines allowing execution to be temporarily suspended and later resumed. Hence, unlike a normal routine, a coroutine may not terminate when it returns to its caller, allowing it to be restarted with the values and execution location present at the point of suspension. @@ -1094,4 +1085,41 @@ \end{cquote} The combination of these two approaches allows an easy and concise specification to coroutining (and concurrency) for normal users, while more advanced users have tighter control on memory layout and initialization. + + +\section{Concurrency} +\label{s:Concurrency} + +At its core, concurrency is based on multiple call-stacks and scheduling threads executing on these stacks. +Multiple call stacks (or contexts) and a single thread of execution, called \newterm{coroutining}~\cite{Conway63,Marlin80}, does \emph{not} imply concurrency~\cite[\S~2]{Buhr05a}. +In coroutining, the single thread is self-scheduling across the stacks, so execution is deterministic, \ie the execution path from input to output is fixed and predictable. +A \newterm{stackless} coroutine executes on the caller's stack~\cite{Python} but this approach is restrictive, \eg preventing modularization and supporting only iterator/generator-style programming; +a \newterm{stackful} coroutine executes on its own stack, allowing full generality. +Only stackful coroutines are a stepping stone to concurrency. + +The transition to concurrency, even for execution with a single thread and multiple stacks, occurs when coroutines also context switch to a \newterm{scheduling oracle}, introducing non-determinism from the coroutine perspective~\cite[\S~3]{Buhr05a}. +Therefore, a minimal concurrency system is possible using coroutines (see Section \ref{coroutine}) in conjunction with a scheduler to decide where to context switch next. +The resulting execution system now follows a cooperative threading-model, called \newterm{non-preemptive scheduling}. + +Because the scheduler is special, it can either be a stackless or stackful coroutine. +For stackless, the scheduler performs scheduling on the stack of the current coroutine and switches directly to the next coroutine, so there is one context switch. +For stackful, the current coroutine switches to the scheduler, which performs scheduling, and it then switches to the next coroutine, so there are two context switches. +A stackful scheduler is often used for simplicity and security. + +Regardless of the approach used, a subset of concurrency related challenges start to appear. +For the complete set of concurrency challenges to occur, the missing feature is \newterm{preemption}, where context switching occurs randomly between any two instructions, often based on a timer interrupt, called \newterm{preemptive scheduling}. +While a scheduler introduces uncertainty in the order of execution, preemption introduces uncertainty about where context switches occur. +Interestingly, uncertainty is necessary for the runtime (operating) system to give the illusion of parallelism on a single processor and increase performance on multiple processors. +The reason is that only the runtime has complete knowledge about resources and how to best utilized them. +However, the introduction of unrestricted non-determinism results in the need for \newterm{mutual exclusion} and \newterm{synchronization} to restrict non-determinism for correctness; +otherwise, it is impossible to write meaningful programs. +Optimal performance in concurrent applications is often obtained by having as much non-determinism as correctness allows. + +An important missing feature in C is threading\footnote{While the C11 standard defines a \protect\lstinline@threads.h@ header, it is minimal and defined as optional. +As such, library support for threading is far from widespread. +At the time of writing the paper, neither \protect\lstinline@gcc@ nor \protect\lstinline@clang@ support \protect\lstinline@threads.h@ in their standard libraries.}. +In modern programming languages, a lack of threading is unacceptable~\cite{Sutter05, Sutter05b}, and therefore existing and new programming languages must have tools for writing efficient concurrent programs to take advantage of parallelism. +As an extension of C, \CFA needs to express these concepts in a way that is as natural as possible to programmers familiar with imperative languages. +Furthermore, because C is a system-level language, programmers expect to choose precisely which features they need and which cost they are willing to pay. +Hence, concurrent programs should be written using high-level mechanisms, and only step down to lower-level mechanisms when performance bottlenecks are encountered.