The Weakest Failure Detector to Solve Wait-Free Dining under Eventual Weak Exclusion

1. The Weakest Failure Detector to Solve Wait-Free Dining under Eventual Weak Exclusion Srikanth Sastry* Scott M. Pike Jennifer Welch Texas A&M University

2. Arbitrary graph topology Nodes = processes (diners) Edges = potential conflicts Generalized Dining Philosophers Diners cycle among three states Thinking Hungry Eating • Dining Constraints • Thinking may last forever • Eating must be finite for correct diners

3. Wait-Free Dining under Eventual Weak Exclusion • Wait Freedom (WF) • Every correct hungry process eventually eats • Regardless of process crashes • Eventual Weak Exclusion (◊WX) • Eventually, no two live neighbors eat simultaneously • Intuitively, ◊WX permits only finitely many scheduling mistakes in any run

4. History • [PSS 08]1 • Proved ◊P is sufficient to solve WF-◊WX • Used forks and dynamic process priorities • [SP 07]2 • Also showed that ◊P solves WF-◊WX • Additionally, provided eventual k-fairness • Used static process priorities with a wait-free asynchronous doorway Pike, Song, Sastry, ICDCN 2008 Song, Pike, DSN 2007

5. Eventually Perfect Failure Detector (◊P) • Strong Completeness: • Every crashed process is eventually and permanently suspected by every correct process • Eventual Strong Accuracy: • Every correct process is eventually and permanently trusted by every correct process

6. Related Work • [GKK 06]3 • Proved ◊P is sufficient to solve wait-free contention management in shared memory • Also claimed that ◊P is necessary • Claim is correct, but… • The accompanying reduction and proof of correctness are both flawed Guerraoui, Kapalka, Kouznetsov, DISC 2006

7. Our Contribution • We prove ◊P is necessary to solve WF-◊WX • First correct reduction and proof of correctness • Our result also generalizes [GKK 06] from: • Contention management  dining philosophers • Shared memory systems  message passing • In conjunction with [SP 07] and [PSS 08] • ◊P is the weakest failure detector for WF-◊WX • Alternatively, ◊P and WF-◊WX encapsulate equivalent temporal assumptions

8. Methodology to Demonstrate Necessity of ◊P for WF-◊WX • Based on results from [CHT 96] • Suppose D is strictly weaker than ◊P • And D can solve WF-◊WX • If ◊P can be extracted from WF-◊WX • Then ◊P can be extracted from D • Contradiction! WF-◊WX D ◊P Assumption Construction

9. [GKK 06] Construction to Extract ◊P • Witness W monitors the liveness of subject S • S and W compete in a (black-box) dining instance • S: Upon eating, never exit • Send heartbeats periodically while eating • W: Upon eating, suspect S and exit • Upon receiving a heartbeat, trust S and become hungry S W W never eats. Hence, W trusts S permanently W stops receiving heartbeats. W suspects S permanently ◊WX established

10. Counter-Example Algorithm [PSS 08] • ◊P-based algorithm for WF-◊WX • Might not satisfy ◊WX if some correct process has an infinite eating session • Each process pair shares a unique fork • Hungry processes request missing forks only from trusted neighbors • Process X can eat if for each neighbor Y • X holds the fork shared with Y, or • Y is suspected by the ◊P module at X

11. Counter Example (cont.) • Eventually ◊P stops making mistakes • Weak exclusion guaranteed subsequently If S eats for an infinite duration, then ◊WX may never be established! ! S Ψ W ◊WX established ◊P converges

12. New Construction: Requirements • Eating sessions must be finite • But when subject S is not eating, witness W can eat unboundedly many times • If so, W could suspect S infinitely often • Need a mechanism to throttle the witness W S W Trust S ... Suspect S! Trust S ... Suspect S! ◊WX established

13. New Construction: Throttling The Witness • Introduce another subject-witness pair • W has two witnesses to detect the liveness of S • Each subject-witness pair throttles the other • Careful hand-off of eating sessions Dining0 S0 W0 Dining1 S1 W1 S W

14. Witness Actions • Wi becomes hungry • Upon eating • Trusts S if alive bit is true • Else, suspects S • Resets alive bit to false • Enables W1-i to become hungry • Exits eating • Upon receiving ping from Si • Set alive bit to true • Send an ack to Si Dining0 S0 W0 Dining1 S1 W1 W S Legend Thinking Hungry Eating

15. Witness Actions – Timeline . . . w0 1 3 Enable Enable Enable Enable . . . . . . w1 2 4 Legend Thinking Hungry Eating

16. Subject Actions • Si becomes hungry • Upon eating • Waits until S1-i exits eating • Sends ping to Wi • Waits for ack • Upon receiving ack • Enables S1-i to become hungry • Waits until S1-i is eating • Exits eating Dining0 S0 W0 PING ACK Dining1 S1 W1 PING ACK W S Legend Thinking Hungry Eating

17. Subject Actions - Timeline w0 ACK ACK ACK . . . PING PING PING s0 1 3 5 . . . s1 2 4 6 PING PING PING ACK ACK ACK w1 Legend Enable Thinking Hungry Eating

18. Correctness • Claim: Proposed construction extracts ◊P • Proof obligations: Show that the construction satisfies the following • Strong Completeness • Every crashed process is eventually and permanently suspected • Eventual Strong Accuracy • Every correct process is eventually and permanently trusted

19. Strong Completeness . . . Suspect S .... Trust S Suspect S w0 Crash! ACK . PING s0 . . s1 ACK PING . . . w1 Suspect S Suspect S .... Trust S Legend Enable Thinking Hungry Eating

20. Eventual Strong Accuracy Trust S Trust S w0 1 3 ACK ACK ACK . . . PING PING PING s0 1 3 5 . . . s1 2 4 6 PING PING PING w1 ACK ACK ACK 2 4 Trust S Trust S Legend ◊WX established Enable Thinking Hungry Eating

21. Conclusion and Significance • ◊P is necessary and the weakest failure detector for solving wait-free dining under ◊WX • The reduction technique itself is of interest • Can be used to reason about other variants of the dining philosophers problem • In conjunction with the result in [SP 07] • There exist asynchronous transformations to convert arbitrary WF-◊WX to bounded-overtaking WF-◊WX

22. Srikanth Sastry sastry@cse.tamu.edu http://srikanth.sastry.name Thank You!