Is Parallel Programming Hard, And, If So, What Can You Do About It?

E.5. PROMELA EXAMPLE: LOCKING 2491 #define spin_lock(mutex) \2 do \3 :: 1 -> atomic { \4 if \5 :: mutex == 0 -> \6 mutex = 1; \7 break \8 :: else -> skip \9 fi \10 } \11 od1213 #define spin_unlock(mutex) \14 mutex = 0Figure E.8: Promela Code for Spinlock2. Statereduction. Ifyouhavecomplexassertions,evaluate them under atomic. After all, theyare not part of the algorithm. One example ofa complex assertion (to be discussed in moredetail later) is as shown in Figure E.6.There is no reason to evaluate this assertionnon-atomically, since it is not actually part ofthe algorithm. Because each statement contributesto state, we can reduce the number ofuseless states by enclosing it in an atomic blockas shown in Figure E.73. Promela does not provide functions. You mustinstead use C preprocessor macros. However,you must use them carefully in order to avoidcombinatorial explosion.Now we are ready for more complex examples.E.5 Promela Example: LockingSince locks are generally useful, spin_lock() andspin_unlock() macros are provided in lock.h,which may be included from multiple Promela models,asshowninFigureE.8. Thespin_lock()macrocontains an infinite do-od loop spanning lines 2-11,courtesy of the single guard expression of “1” on line3. The body of this loop is a single atomic blockthat contains an if-fi statement. The if-fi constructis similar to the do-od construct, except that it takesa single pass rather than looping. If the lock is notheld on line 5, then line 6 acquires it and line 7breaks out of the enclosing do-od loop (and also exitsthe atomic block). On the other hand, if the lockis already held on line 8, we do nothing (skip), andfall out of the if-fi and the atomic block so as to takeanother pass through the outer loop, repeating untilthe lock is available.The spin_unlock() macro simply marks the lockas no longer held.NotethatmemorybarriersarenotneededbecausePromelaassumesfullordering. InanygivenPromelastate, all processes agree on both the current stateand the order of state changes that caused us to arriveat the current state. This is analogous to the“sequentially consistent” memory model used by afewcomputersystems(suchasMIPSandPA-RISC).As noted earlier, and as will be seen in a later example,weakmemoryorderingmustbeexplicitlycoded.These macros are tested by the Promela codeshown in Figure E.9. This code is similar to thatusedtotesttheincrements, withthenumberoflockingprocesses defined by the N_LOCKERS macro definitionon line 3. The mutex itself is defined on line5, an array to track the lock owner on line 6, andline 7 is used by assertion code to verify that onlyone process holds the lock.The locker process is on lines 9-18, and simplyloops forever acquiring the lock on line 13, claimingit on line 14, unclaiming it on line 15, and releasingit on line 16.The init block on lines 20-44 initializes the currentlocker’s havelock array entry on line 26, startsthe current locker on line 27, and advances to thenext locker on line 28. Once all locker processes arespawned, the do-od loop moves to line 29, whichchecks the assertion. Lines 30 and 31 initialize thecontrol variables, lines 32-40 atomically sum thehavelock array entries, line 41 is the assertion, andline 42 exits the loop.We can run this model by placing the above twocode fragments into files named lock.h and lock.spin, respectively, and then running the followingcommands:spin -a lock.spincc -DSAFETY -o pan pan.c./panThe output will look something like that shown inFigure E.10. As expected, this run has no assertionfailures (“errors: 0”).Quick Quiz E.1: Why is there an unreachedstatement in locker? After all, isn’t this a full statespacesearch???Quick Quiz E.2: What are some Promela codestyleissues with this example?