Is Parallel Programming Hard, And, If So, What Can You Do About It?

E.6. PROMELA EXAMPLE: QRCU 2531 init {2 int i;34 atomic {5 ctr[idx] = 1;6 ctr[!idx] = 0;7 i = 0;8 do9 :: i < N_QRCU_READERS ->10 readerprogress[i] = 0;11 run qrcu_reader(i);12 i++13 :: i >= N_QRCU_READERS -> break14 od;15 i = 0;16 do17 :: i < N_QRCU_UPDATERS ->18 run qrcu_updater(i);19 i++20 :: i >= N_QRCU_UPDATERS -> break21 od22 }23 }Figure E.15: QRCU Initialization Processupdaters readers # states MB1 1 376 2.61 2 6,177 2.91 3 82,127 7.52 1 29,399 4.52 2 1,071,180 75.42 3 33,866,700 2,715.23 1 258,605 22.33 2 169,533,000 14,979.9Table E.2: Memory Usage of QRCU ModelE.6.1 Running the QRCU ExampleTo run the QRCU example, combine the code fragmentsin the previous section into a single filenamed qrcu.spin, and place the definitions forspin_lock() and spin_unlock() into a file namedlock.h. Then use the following commands to buildand run the QRCU model:spin -a qrcu.spincc -DSAFETY -o pan pan.c./panThe resulting output shows that this model passesall of the cases shown in Table E.2. Now, it would benice to run the case with three readers and three updaters,however, simple extrapolation indicates thatthiswillrequireontheorderofaterabyteofmemorybest case. So, what to do? Here are some possibleapproaches:1. See whether a smaller number of readers andupdaters suffice to prove the general case.2. Manually construct a proof of correctness.3. Use a more capable tool.4. Divide and conquer.The following sections discuss each of these approaches.E.6.2 How Many Readers and UpdatersAre Really Needed?One approach is to look carefully at the Promelacode for qrcu_updater() and notice that the onlyglobal state change is happening under the lock.Therefore, only one updater at a time can possiblybe modifying state visible to either readers orother updaters. This means that any sequences ofstate changes can be carried out serially by a singleupdater due to the fact that Promela does a fullstate-space search. Therefore, at most two updatersare required: one to change state and a second tobecome confused.The situation with the readers is less clear-cut,as each reader does only a single read-side criticalsection then terminates. It is possible to argue thatthe useful number of readers is limited, due to thefact that the fastpath must see at most a zero anda one in the counters. This is a fruitful avenue ofinvestigation, in fact, it leads to the full proof ofcorrectness described in the next section.E.6.3 Alternative Approach: Proofof CorrectnessAn informal proof [McK07b] follows:1. Forsynchronize_qrcu()toexittooearly, thenby definition there must have been at least onereader present during synchronize_qrcu()’sfull execution.2. The counter corresponding to this reader willhave been at least 1 during this time interval.3. The synchronize_qrcu() code forces at leastone of the counters to be at least 1 at all times.