Real-Time Computing with Lock-Free Shared Objects

Transcription

1 Real-Time Comuting with Lock-Free Shared Objects JAMES H. ADERSO, SRIKATH RAMAMURTHY, and KEVI JEFFAY University of orth Carolina This article considers the use of lock-free shared objects within hard real-time systems. As the name suggests, lock-free shared objects are distinguished by the fact that they are accessed without locking. As such, they do not give rise to riority inversions, a key advantage over conventional, lock-based object-sharing aroaches. Desite this advantage, it is not immediately aarent that lock-free shared objects can be emloyed if tasks must adhere to strict timing constraints. In articular, lock-free object imlementations ermit concurrent oerations to interfere with each other, and reeated interferences can cause a given oeration to take an arbitrarily long time to comlete. The main contribution of this article is to show that such interferences can be bounded by judicious scheduling. This work ertains to eriodic, hard real-time tasks that share lock-free objects on a unirocessor. In the first art of the article, scheduling conditions are derived for such tasks, for both static and dynamic riority schemes. Based on these conditions, it is formally shown that lock-free shared objects often incur less overhead than object imlementations based on wait-free algorithms or lock-based schemes. In the last art of the article, this conclusion is validated exerimentally through work involving a real-time deskto videoconferencing system. Categories and Subject Descritors: C.3 [Comuter Systems Organization]: Secial-Purose and Alication-Based Systems real-time systems; D.4.1 [Oerating Systems]: Process Management concurrency; multirocessing/multirogramming; mutual exclusion; scheduling; synchronization; J.7 [Comuter Alications]: Comuters in Other Systems real-time General Terms: Design, Exerimentation, Performance, Theory Additional Key Words and Phrases: Critical sections, deadline monotonic, earliest deadline first, hard real time, lock free, rate monotonic, scheduling, synchronization, wait free A reliminary version of this article aeared in the Proceedings of the 16th IEEE Real-Time Systems Symosium, Dec The first author was suorted by SF grants CCR and CCR , by an Alfred P. Sloan Research Fellowshi, and by a U.S. Army Research Office Young Investigator Award, grant DAAH The second author was also suorted by ARO grant DAAH The third author was suorted by SF grant CCR and by grants from the Intel and IBM Cororations. Authors address: Deartment of Comuter Science, University of orth Carolina, Chael Hill, C ; {anderson; ramamurt; jeffay}@cs.unc.edu. Permission to make digital / hard coy of art or all of this work for ersonal or classroom use is granted without fee rovided that the coies are not made or distributed for rofit or commercial advantage, the coyright notice, the title of the ublication, and its date aear, and notice is given that coying is by ermission of the ACM, Inc. To coy otherwise, to reublish, to ost on servers, or to redistribute to lists, requires rior secific ermission and / or a fee ACM /97/ $03.50 ACM Transactions on Comuter Systems, Vol. 15, o. 2, May 1997, Pages

2 Real-Time Comuting with Lock-Free Shared Objects ITRODUCTIO Most work on imlementing shared objects in reemtive hard real-time unirocessor systems has focused on using critical sections to ensure object consistency. One of the main roblems that arises when using critical sections is that of riority inversion. A riority inversion exists when a given task must wait on a task of lower riority to release a critical section. In a hard real-time system, unless riority inversions are carefully controlled, it may be difficult or imossible to ensure that task deadlines are always met. Most conventional mechanisms for controlling riority inversions rely on the kernel to dynamically adjust task riorities to ensure that a task within a critical section executes at a riority that is sufficiently high to bound the duration of any riority inversion. Schemes that work in this way include the riority inheritance rotocol [Rajkumar 1991; Sha et al. 1990], the riority ceiling rotocol (PCP) [Baker 1991; Rajkumar 1991; Sha et al. 1990], the dynamic PCP [Chen and Lin 1990], and the earliestdeadline-first scheme with dynamic deadline modification (EDF/DDM) [Jeffay 1992]. Although these schemes rovide a general framework for real-time synchronization, this generality comes at a rice secifically, added oerating system overhead. In this article, we consider interrocess communication in object-based, hard real-time systems. Our main contribution is to show that lock-free shared objects [Bershad 1993; Herlihy 1993; Lamort 1977; Massalin 1992] i.e., objects that are not critical-section based are a viable alternative to lock-based schemes such as the PCP in such systems. We establish this through a combination of formal analysis and exerimentation. We begin by establishing scheduling conditions for hard real-time, eriodic tasks that share lock-free objects on a unirocessor under either ratemonotonic (RM) or earliest-deadline-first (EDF) scheduling [Liu and Layland 1973]. We also briefly resent a slight variation of our RM condition that holds for the deadline-monotonic (DM) riority scheme [Leung and Whitehead 1982], and an EDF condition that holds when deadlines and eriods do not coincide. (See Table I for a descrition of the scheduling schemes considered in this article.) After resenting our scheduling conditions, we comare lock-free and lock-based aroaches for imlementing objects, both formally, based on our scheduling conditions, and exerimentally, based on work involving a real-time deskto videoconferencing system. We also comare lock-free objects with wait-free objects. As exlained below, wait-free objects are also imlemented without critical sections, but are required to satisfy some additional conditions not required of lock-free objects. Our formal analysis and exerimental work both lead to the same conclusion: lock-free shared objects often incur less overhead than object imlementations based on wait-free algorithms or lock-based schemes. In addition, our scheduling conditions show that lock-free objects can be alied without detailed knowledge of which secific tasks access which objects. This makes them easier to aly than lock-based schemes. Also,

3 136 James H. Anderson et al. Table I. Real-Time Scheduling Schemes Scheme Definition a Deadline Monotonic (DM) A static-riority scheme in which tasks with shorter relative deadlines b have higher riorities. Rate Monotonic c (RM) A static-riority scheme in which tasks with shorter eriods have higher riorities. Earliest Deadline First c (EDF) A dynamic-riority scheme in which, at any given instant, the task that has the closest deadline has highest riority. a These schemes are riority based, i.e., the rocessor always executes the highest-riority task available for execution. A eriodic task is a sequential rogram that is invoked reeatedly. Successive invocations are searated by a constant amount of time, called the task s eriod. b The relative deadline of a task is the elased time between the beginning of an invocation of that task and the deadline of that invocation. A task s relative deadline is assumed to be less than or equal to its eriod. c Under the RM and EDF schemes, it is assumed that task deadlines and eriods coincide, i.e., each invocation of a task must comlete execution before the next invocation of that task begins. (At the end of Section 4, however, we do consider EDF scheduling when deadlines and eriods do not coincide.) with lock-free objects, new tasks can be added dynamically to a system with very little effort. In contrast, adding new tasks with lock-based schemes entails recomuting certain oerating system tables (e.g., tables required by the PCP to record the highest-riority task that locks each semahore). Lock-free oerations are usually imlemented using retry loos. Figure 1 deicts a lock-free enqueue oeration that is imlemented in this way. An item is enqueued in this imlementation by using a two-word comare-andswa (CAS2) instruction 1 to atomically udate a tail ointer and either the next ointer of the last item in the queue or a head ointer, deending on whether the queue is emty. This loo is executed reeatedly until the CAS2 instruction succeeds. ote that the queue is not actually locked by any task. An imortant roerty of lock-free imlementations such as this is that oerations may interfere with each other. An interference results in the enqueue examle when a successful CAS2 by one task results in a failed CAS2 by another task. In this article, we use the term lock free to refer to object imlementations based on an unbounded retry loo structure like that deicted in Figure 1. 2 Some lock-free imlementations do not adhere to this characterization. For examle, there exists an imortant secial class of lock-free imlementations known as wait-free imlementations [Herlihy 1991; 1993; Lamort 1986; Peterson 1983] in which oerations must satisfy a strong form of lock-freedom that recludes all waiting deendencies among tasks, 1 The first two arameters of CAS2 secify addresses of two shared variables; the next two arameters are values to which these variables are comared; and the last two arameters are new values to assign to the variables if both comarisons succeed. ote that it is ossible to simulate the CAS2 instruction in software, as discussed in Section 7. 2 Some authors use the term nonblocking to refer to such imlementations.

4 Real-Time Comuting with Lock-Free Shared Objects 137 Fig. 1. Lock-free enqueue imlementation. including otentially unbounded retry loos. 3 Although one motivation for work on wait-free objects has been their otential use in real-time systems, our results show that lock-free objects are often suerior for real-time comuting on unirocessors. From a real-time ersective, lock-free object imlementations are of interest because they avoid riority inversion and deadlock with no underlying oerating system suort for object sharing. On the surface, however, it is not immediately aarent that lock-free shared objects can be emloyed if tasks must adhere to strict timing constraints. In articular, reeated interferences can cause a given oeration to take an arbitrarily long time to comlete. onetheless, we show that if tasks on a unirocessor are scheduled aroriately, then lock-free retry loos are indeed bounded. We now exlain intuitively why such bounds exist. For the sake of exlanation, let us call an iteration of a retry loo a successful udate if it successfully comletes, and a failed udate otherwise. Thus, a single invocation of a lock-free oeration consists of any number of failed udates followed by one successful udate. Consider two tasks T i and T j that access a common lock-free object B. Suose that T i causes T j to exerience a failed udate of B. On a unirocessor, this can only haen if T i reemts the access of T j and then udates B successfully. Thus, there is a correlation between failed udates and task reemtions. The maximum number of task reemtions within a time interval can be determined from the timing requirements of the tasks. Using this information, it is ossible to determine a bound on the number of failed udates in that interval. Intuitively, a set of tasks that share lock-free objects is schedulable if there is enough free rocessor time to accommodate the failed udates that can occur over any interval. The formal analysis that we resent establishes a fundamental tradeoff between lock-free and lock-based aroaches. This tradeoff essentially hinges on the cost of a lock-free retry loo and on the cost of the oerating 3 More recisely, individual wait-free oerations are required to be starvation free. In contrast, lock-free objects guarantee only systemwide rogress: if several tasks concurrently access such an object, then some access will eventually comlete.

5 138 James H. Anderson et al. system overhead that arises in lock-based schemes (which can be substantial). An imortant question, then, is how costly lock-free retry loos are likely to be. Any general methodology for constructing lock-free objects must be based on universal lock-free constructions [Herlihy 1991; 1993]. Such a construction can be emloyed to imlement any object in a lock-free manner. Unfortunately, this generality can lead to exensive imlementations. For examle, in the universal lock-free construction of Herlihy [1993], numerous coies of the imlemented object are ket. The current coy is indicated by a shared object ointer. Each task s retry loo consists of the following stes: first, the shared object ointer is read using a load-linked oeration, and a local coy of the object is made; then the desired oeration is erformed on the local coy; finally, a store-conditional oeration is erformed to attemt to make the shared object ointer oint to the local coy. This retry loo can be exensive for certain large objects, due to the overhead of coying. Fortunately, techniques have been recently develoed that can be alied to substantially reduce this coying overhead [Alemany and Felten 1992; Anderson and Moir 1995]. Also, as shown in Massalin [1992], many common objects, including most that would be of use in a real-time system, can be imlemented with very short retry loos, such as that deicted in Figure 1. Finally, recent work by the first two authors and colleagues has shown that, in real-time systems, the riority structure that exists often can be exloited to simlify object imlementations, eliminating coying overhead entirely [Anderson et al. 1997; Ramamurthy et al. 1996]. The lock-free aroach to real-time object sharing that we esouse is actually rooted in work done by Sorenson and Hamacher in the real-time systems community some 20 years ago [Sorensen 1974; Sorensen and Hemachar 1975]. Their work involved a real-time communication mechanism based on wait-free read/write buffers. In their aroach, all buffer management is done within the oerating system, so it suffers from many of the same shortcomings as conventional lock-based aroaches. Unfortunately, the thread of research on wait-free and lock-free communication begun by Sorenson and Hamacher was lost in the real-time systems community for many years. Recently, however, this thread of research resurfaced in Koetz and Reisinger [1993] and in Johnson and Harathi [1994]. In the former aer, a simle lock-free, one-writer, read/ write buffer is resented, and scheduling conditions are given for tasks sharing the buffer. In the latter aer, the rimary focus is on imlementations of lock-free algorithms rather than scheduling. Our work deals almost exclusively with scheduling, and it significantly extends the work of Koetz and Reisinger by focusing on arbitrary task sets and objects. The rest of this article is organized as follows. In Section 2, we resent definitions and notation and rove some key lemmas. We use these lemmas to derive scheduling conditions for the RM and DM riority schemes in Section 3 and the EDF riority scheme in Section 4. We then comare the overhead of lock-free synchronization with that of several other aroaches, on a formal basis in Section 5, and on an exerimental basis in

6 Real-Time Comuting with Lock-Free Shared Objects 139 Section 6. In these comarisons, we consider lock-based objects imlemented using the PCP [Rajkumar 1991] and the EDF/DDM scheme [Jeffay 1992] and wait-free objects imlemented using the constructions of Herlihy [1993]. We end with concluding remarks in Section PRELIMIARIES We use the term task to refer to a sequential rogram that is invoked reeatedly. A single execution of a task is called a job. The time at which a job arrives for execution is called its release time. A task is eriodic if and only if the interval between job releases is constant. In our analysis, we assume that all tasks are eriodic and share a single rocessor; however, our scheduling conditions also aly if tasks are soradic, in which case a minimum searation (but no maximum searation) is assumed between job releases. We also assume that time is discrete, i.e., all release times, eriods, and comutation costs are integers. We say that a task executes at time t if it executes during the interval [t, t 1). We imlicitly assume that tasks share a set of objects imlemented by using lock-free algorithms. ote that there is no need to exlicitly include such objects in our model, because oerations on lock-free objects are imlemented by task-level code sequences. For simlicity, we assume that jobs can be reemted at arbitrary oints during their execution, and we ignore system overheads like context switch times, interrut handler overheads, etc. Techniques to account for system overheads have been described elsewhere [Jeffay and Stone 1993; Katcher et al. 1993], and such techniques can be alied to the scheduling conditions derived in this article. (In fact, we emloy the techniques of Jeffay and Stone [1993] in analyzing the videoconferencing system described in Section 6.) We say that a job is interfered with (or exeriences an interference) ifit executes a lock-free retry loo that does not successfully comlete. For now, we assume that the deadline of a job of a task is the end of the corresonding eriod of that task. Later, at the end of Sections 3 and 4, we briefly consider scheduling conditions in which this assumtion is relaxed. A task set is schedulable if and only if all jobs of all tasks meet their deadlines. The following is a list of symbols used in deriving our scheduling conditions. : The number of tasks in the system. We use i and j as task indices. Unless stated otherwise, we assume that i and j are universally quantified over {1,...,}. T i : The ith task in the system. i : The eriod of task T i. Tasks are sorted in nondecreasing order by their eriods, i.e., i j f i j. r i (k): The release time of the kth job of T i, where r i (k) r i (1) (k 1) i. We use k as a job index. Unless stated otherwise, we assume that k is universally quantified with range k 1. J i,k : The kth job of task T i.

7 140 James H. Anderson et al. c i : The worst-case comutational cost (execution time) of task T i when it is the only task executing on the rocessor, i.e., when there is no contention for the rocessor or for shared objects. s: The execution time required for one loo iteration in the imlementation of a lock-free object, which for simlicity is assumed to be the same for all objects. Under RM scheduling, we assume that if two tasks have the same eriod, then the task with the smaller task index has higher riority. Under EDF scheduling, we assume that if two jobs have the same deadline, then the job with the earlier release time has higher riority; if two such jobs are released at the same time, then the one with the smaller index has higher riority. We obtain conditions for schedulability by determining the worst-case unfulfilled demand of each task. The unfulfilled demand of task T i at time t is the remaining comutation time of T i s current job. The unfulfilled demand of T i decreases by one from time t to time t 1 if a job of T i executes at time t. When a job of task T i is released, T i s unfulfilled demand increases by c i. Task T i s unfulfilled demand can also increase due to interferences exerienced by its jobs. Such increases are characterized by the following interference assumtions: IA1. A job J exeriences an interference at time t if and only if, for some t t, (1) J executes at time t 1, (2) J is reemted at time t by some higher-riority job, (3) only higher-riority jobs execute in the interval [t, t], (4) no higher-riority job that accesses an object in common with J is released in [t, t), and (5) at least one such job is released at time t. (This imlies that job J can be interfered with at most once during any interval when it is reemted.) IA2. Each interference exerienced by a job J i,k increases the unfulfilled demand of T i by s. IA1 is essimistic because the reemted job J may not, in fact, be accessing any shared object when reemted. IA2 is essimistic because the cost of executing one iteration of the retry loo of any object is assumed to be s units. If retry loo costs are not the same, IA2 essentially requires that the unfulfilled demand of a task T i be increased by the cost of the largest retry loo, for each interference in jobs of T i. In the roofs of our scheduling conditions, we also use the notion of task demand, which is related to the notion of unfulfilled demand. The demand laced by a task T i on the rocessor in an interval [t, t] is the amount of rocessing time required by jobs of T i in that interval [Jeffay et al. 1991]. In articular, task T i s demand in [t, t] includes T i s unfulfilled demand at time t, c i time units for each job release of T i in (t, t], and s time units for each interference occurring within (t, t] in jobs of task T i.a task is said to be inactive at time t if it laces no demand on the rocessor

8 Real-Time Comuting with Lock-Free Shared Objects 141 Fig. 2. Illustration of the task set defined in Examles 2.1 and 2.2. at that time. The following examles illustrate some of the subtleties of our task model. Examle 2.1. Let a task T i be given by the tule (r i (1), c i, i ). Consider the following set of eriodic tasks scheduled under the RM scheme. T 1 3, 4, 11 T 2 0, 4, 18 T 3 1, 7, 35 Assume that object S 1 is accessed by T 2 and T 3, and S 2 is accessed by T 1, T 2, and T 3. Tasks T 1 and T 2 access S 1 and S 2 in that order. Also, assume that s 2. The execution of the above task set is illustrated in Figure 2(a). In this figure, u-arrows reresent job releases, down-arrows reresent job comletions, and shaded regions reresent shared object accesses. Because the deadline of a job of a task corresonds to the release of the next job of that task, u-arrows also denote job deadlines. We see that job J 3,1 exeriences an interference at time 14, when job J 1,2 is released. This is because job J 1,2 is the earliest job that (1) accesses an object in common with J 3,1 and (2) is released in the closed interval between J 3,1 s reemtion at time 14 and its subsequent resumtion at time 22. Thus, J 3,1 s oeration on S 2 that begins at time 13 fails. This oeration is retried at time 18, when it is successfully comleted. Observe that J 3,1 exeriences only one interference in the interval [14, 22], even though two jobs ( J 1,2 and J 2,2 ) are released in that interval that can otentially interfere with J 3,1 s object access. By IA1, we assume that J 2,4 interferes with J 3,2 at time 54 (because J 2,4 reemts J 3,2 ), even though J 3,2 is not actually accessing a shared object at that oint. Thus, the uer bound on interference costs in the analysis resented later is rather essimistic.

9 142 James H. Anderson et al. Task T 3 s unfulfilled demand increases by 7 units at time 1 due to a job release and increases by 2 units at time 14 due to an interference by J 1,2. Also, task T 3 s unfulfilled demand decreases by 1 unit at every instant in the interval [11, 14] because it executes on the rocessor. The demand laced by T 3 on the rocessor in the interval [5, 37] is 16 units: 7 units due to T 3 s unfulfilled demand at time 5, 2 units due to an interference in J 3,1 at time 14, and 7 units due the release of J 3,2 at time 36. Examle 2.2. Consider the following set of eriodic tasks scheduled under the EDF scheme. T 1 4, 4, 11 T 2 1, 4, 18 T 3 0, 7, 33 Assume that object S 1 is accessed by T 1 and T 3, and S 2 is accessed by T 1 and T 2. Task T 1 accesses S 1 and S 2 in that order; T 3 accesses S 1 twice. As in the revious examle, we assume that s 2. The execution of the above task set is illustrated in Figure 2(b). We see that job J 3,1 exeriences an interference at time 4 while accessing S 1, when job J 1,1 is released. J 1,1 has an earlier deadline than J 3,1 and is the first job that accesses an object in common with J 3,1 and that is released in the closed interval between J 3,1 s reemtion at time 1 and its subsequent resumtion at time 11. Observe that J 2,1 also exeriences an interference at time 4 while accessing object S 2 due to the release of J 1,1. The total demand laced in the interval [0, 25] by jobs with deadlines at or before 25 is 10 units: 4 and 6 units due to tasks T 1 and T 2, resectively. Of the 6 units of T 2 s demand, 2 units are due to an interference in T 2 at time 4. ote that we do not include the demand due to jobs J 1,2, J 2,2, and J 3,1 because their deadlines are after time 25. Before we resent our scheduling conditions, we rove several lemmas used in the roofs of these conditions. Liu and Layland [1973] show that for indeendent tasks (i.e., tasks that do not share objects), the longest resonse time of a task occurs at a critical instant of time, at which jobs of that task and all higher-riority tasks are released. However, this is not necessarily the case if tasks share lock-free objects, as illustrated in Examle 2.1. In this examle, the longest resonse time of task T 3 does not occur when its job is released along with higher-riority jobs at time 36. The job released at time 1 has a longer resonse time. Instead of defining the critical instant, we introduce the notion of a busy oint. The busy oint b i (k) of job J i,k is the latest oint in time at or before r i (k) when jobs that have riority at least that of J i,k are either inactive or have a job release. For examle, in Figure 2, the busy oint of J 3,1 occurs at time 0, i.e., b 3 (1) 0. Because each task is either inactive or releases a job at time 0, b i (k) is well defined for any i and k. Our scheduling conditions are obtained by inductively counting interferences over intervals of time. A busy oint rovides a convenient instant at which to start such an inductive argument, because tasks that are inactive or that have just released a job have exerienced no interferences.

10 Real-Time Comuting with Lock-Free Shared Objects 143 LEMMA 2.3. Consider any t [b i (k), r i (k 1)) at which J i,k has ositive unfulfilled demand. Let v be the riority of J i,k. In the interval [b i (k), t], the number of interferences in jobs with riority at least v is bounded by the number of instances in the interval (b i (k), t] at which some job with riority greater than v is released. PROOF. To simlify the roof, we rove a slightly stronger statement: the number of interferences in the interval [b i (k), t] in jobs with riority at least v is bounded by the difference between (1) the number of instants in the interval (b i (k), t] at which some job with riority greater than v is released and (2) the number of reemted jobs at time t that have not been interfered with 4 and that have riority at least v. The roof is by induction on t. Basis. We show that the lemma holds at b i (k), J i,k s busy oint. There can be no interferences in the interval [b i (k), b i (k)] in jobs with riority at least v because J i,k and higher-riority jobs are either inactive or have a job release at b i (k). For the same reason, there are no reemted jobs at b i (k) with riority at least v. Clearly, there are zero instants in the interval (b i (k), b i (k)] at which some job is released that has riority greater than v. Hence, the basis of the induction holds. Induction Ste. Assume that the above lemma holds at time t 1 b i (k). Let J be some job executing at time t 1. (Such a job J must exist by the definition of b i (k).) Suose that there are f interferences in the interval [b i (k), t 1] in jobs with riority at least v and that there are w instants in the interval (b i (k), t 1] at which some job with riority greater than v is released. Also, suose that there are x reemted jobs at time t 1 that have riority at least v and that have not been interfered with. Our inductive hyothesis can be formally written as f w x. We now consider two cases. Case 1. If no job is released at time t that has riority greater than v, then by IA1, no interference can occur at that time in any job with riority at least v. Hence, there are f interferences in [b i (k), t] and w instances in (b i (k), t] at which some job is released that has riority greater than J i,k s riority. Also, the number of reemted jobs at time t is either x 1orx, deending on whether J comletes at time t or not. In either case, the lemma holds at time t because our inductive hyothesis imlies both f w ( x 1) and f w x. Case 2. If y 0 jobs are released at time t that have riority greater than v, then there are w 1 instants in the interval (b i (k), t] at which some job is released that has riority greater than v. Suose that some number q of the x reemted jobs incur an interference at time t due to some newly released job that accesses a common object. We consider three subcases: 4 ote that jobs that have been released but have not yet executed cannot be interfered with.

11 144 James H. Anderson et al. J has higher riority than all newly released jobs. It follows from IA1 that none of the jobs released at time t can interfere with J. Thus, there are f q interferences in [ b i (k), t] and x q reemted jobs that have not been interfered with. (The y jobs released at time t cannot be interfered with because they have not started execution yet.) The lemma holds at time t because our inductive hyothesis imlies f q (w 1) (x q). J is reemted at time t, but none of the newly released jobs accesses an object in common with J. By IA1, none of the newly released jobs can interfere with J. Therefore, the number of interferences in [b i (k), t] is fq. The number of reemted jobs that have not been interfered with is x q 1 (including J). The lemma holds at time t because our inductive hyothesis imlies f q (w 1) (x q 1). J is reemted at time t, and some newly released job accesses an object in common with J. It follows from IA1 that J is interfered with at time t. Hence, the number of interferences in [b i (k), t] is f q 1. The number of reemted jobs that have not been interfered with is x q. Again, our inductive hyothesis imlies f q 1 (w 1) (x q). e LEMMA 2.4. Consider any t [b i (k), r i (k 1)). Under the RM scheme, the number of interferences in T i and higher-riority tasks in the interval [b i (k), t] is at most i1 t b i k j. PROOF. From Lemma 2.3 it follows that the number of interferences in jobs with riority at least that of J i,k in the interval [b i (k), t] is bounded by the number of instances in (b i (k), t] at which some job is released that has riority greater than that of J i,k. Under the RM scheme, only jobs of tasks T 1 through T i1 have riority greater than J i,k, and the number of jobs of task T j released in the interval (b i (k), t] is at most (t b i (k))/ j. Therefore, the number of interferences in T i and higher-riority tasks in the interval [b i (k), t] is bounded by i1 tb i (k)/ j. e LEMMA 2.5. Under the RM scheme, if, at time r i (k 1) 1, T i has ositive unfulfilled demand, and the total unfulfilled demand of T i and higher-riority tasks is greater than one, then, for any t in the interval [b i (k), r i (k 1)), the difference between (1) the total demand laced on the rocessor by T i and higher-riority tasks in the interval [b i (k), t] and (2) the available rocessor time in that interval is greater than one. PROOF. The roof can be established by contradiction. To this end, suose that there exists a t [b i (k), r i (k 1)) such that the difference between the total demand laced by tasks T 1 through T i in the interval [b i (k), t] and the available rocessor time in that interval is at most one. It

12 Real-Time Comuting with Lock-Free Shared Objects 145 follows that the total unfulfilled demand of tasks T 1 through T i at time t equals zero or one. Because the total unfulfilled demand of T i and higherriority tasks is greater than one at time r i (k 1) 1, t r i (k 1) 1 holds. Also, either tasks T 1 through T i are inactive at time t, or one of tasks T 1 through T i has unit unfulfilled demand and is the highest-riority job executing on the rocessor. In both cases, it follows that T i and higher-riority tasks are either inactive or have a job release at time t 1. To comlete the roof, we show that this leads to a contradiction. By the definition of a busy oint, b i (k) is the latest time at or before r i (k) at which T i and higher-riority tasks are either inactive or have a job release. Thus, it follows that t 1 cannot lie in the interval (b i (k), r i (k)]. Also, as exlained earlier, t r i (k 1) 1, i.e., t 1 r i (k 1). Hence, t 1 lies in the interval (r i (k), r i (k 1)). T i clearly cannot have a job release in the interval [t 1, r i (k 1)) because t 1 r i (k). Thus, T i is inactive and hence has no unfulfilled demand throughout the interval [t 1, r i (k 1)), contradicting our assumtion that T i has ositive unfulfilled demand at time r i (k 1) 1. e LEMMA 2.6. Under the EDF scheme, the number of interferences in jobs with a deadline at or before r i (k 1) in the interval [b i (k), r i (k 1)) is at most r ik 1 b i k 2 j. PROOF. From Lemma 2.3 it follows that the number of interferences in the interval [b i (k), r i (k 1)) is bounded by the number of instances in (b i (k), r i (k 1)) at which some job is released that has riority greater than J i,k s riority, i.e., the released job s deadline is before r i (k 1). Under the EDF scheme, the number of jobs of T j released in the interval (b i (k), r i (k 1)) that have a deadline before r i (k 1) is at most (r i (k 1) 1) (b i (k) 1)/ j. Therefore, the number of interferences in jobs with deadlines at or before r i (k 1) in the interval [b i (k), r i (k 1)) is bounded by r i (k 1) b i (k) 2/ j. e 3. STATIC-PRIORITY SCHEDULIG CODITIOS In this section, we give searate necessary and sufficient conditions for the schedulability of a set of eriodic tasks that share lock-free objects under the RM scheme. We also briefly consider the DM scheme. The following theorem gives a necessary scheduling condition for the RM scheme. The left-hand side of the quantified exression below gives the minimum demand which arises when there are no interferences laced on the rocessor by T i and higher-riority tasks in the interval [0, t], where 0 t i. The right-hand side gives the available rocessor time in that interval. For brevity, we omit the roof of this condition here, because it is

13 146 James H. Anderson et al. similar to that given for indeendent tasks in Lehoczky et al. [1989]. 5 (A formal roof within our model can be found in Anderson et al. [1995].) THEOREM 3.1 (ECESSITY UDER RM). If a set of eriodic tasks that share lock-free objects is schedulable under the RM scheme, then the following condition holds for every task T i : t i :0t i : t j jt c The next theorem gives a sufficient scheduling condition for the RM scheme. The left-hand side of the quantified exression given below gives the maximum demand laced by T i and higher-riority tasks in the interval [0, t). The first summation reresents the demand laced on the rocessor by T i and higher-riority tasks, not including the demand due to interferences. The second summation reresents the total additional demand laced on the rocessor due to interferences in T i and higher-riority tasks. The right-hand side of the exression is the available rocessor time in [0, t). Observe that this condition can be alied without knowledge of which tasks access which objects. THEOREM 3.2 (SUFFICIECY UDER RM). A set of eriodic tasks that share lock-free objects is schedulable under the RM scheme if the following condition holds for every task T i : i t :0t i : t j i1 j c t1 st j PROOF. We rove that if a task set is not schedulable, then the negation of the above exression holds. Assume that the given task set is not schedulable. Let J i,k be the first job to miss its deadline. (If several jobs simultaneously miss their deadline along with J i,k, then let J i,k be the one with highest riority, i.e., smallest task index.) Consider any t in the interval [b i (k), r i (k 1)). We begin by deriving a bound on D(b i (k), t), the total demand laced on the rocessor by T i and higher-riority tasks in the interval [b i (k), t]. D(b i (k), t) is comrised of the demand laced by job releases and the extra demand laced by interferences. Recall that at the busy oint b i (k), T i and all higher-riority tasks are either inactive or have a job release. Each job release of some task T j introduces a demand of c j on the rocessor, and there are at most (t b i (k) 1)/ j job releases of that task in the interval [b i (k), t]. Therefore, the total demand laced on the rocessor due to job releases of T i and higher-riority tasks is at most i (t b i (k) 1)/ j c j. 5 Our necessary condition differs slightly from that in Lehoczky et al. [1989] because we allow tasks to release their first jobs at arbitrary times.

14 Real-Time Comuting with Lock-Free Shared Objects 147 By Lemma 2.4, the number of interferences in jobs of T i and higherriority tasks in the interval [b i (k), t] is bounded by i1 (t b i (k))/ j. By IA2, each interference introduces s units of additional demand on the rocessor. Therefore, the total additional demand due to interferences in jobs of T i and higher-riority tasks is at most i1 (t b i (k))/ j s. Therefore, we have i Db i k, t t b i k 1 j i1 c j t b i k j s. Job J i,k will miss its deadline if and only if, at time r i (k 1) 1, T i has ositive unfulfilled demand, and the total unfulfilled demand of T i and higher-riority tasks is greater than one. By Lemma 2.5, it follows that the difference between the total demand due to T i and higher-riority tasks in the interval [b i (k), t] and the available rocessor time in that interval is greater than one. Hence, we have the following: Db i k, t t b i k 1 Using the bound on D(b i (k), t) derived above, the revious exression imlies the following: i t b i k 1 j i1 c j t b i k j s t b ik 1 The above exression holds for all t in the interval [b i (k), r i (k 1)). Because this exression is indeendent of the end oints (it is a function of the length of the interval), we can relace t b i (k) with t, where t t b i (k) and t [0, r i (k 1) b i (k)). Hence, we have the following: i t 1 j i1 c j t j s t 1 ow, relace t with t in the above exression, where t t 1 and t (0, r i (k 1) b i (k)]. Then, the following holds for all t (0, r i (k 1) b i (k)]: i t i1 j c j t 1 j s t By definition, b i (k) r i (k). Therefore, the interval (0, r i (k 1) r i (k)] is comletely contained in (0, r i (k 1) b i (k)]. Also, by definition,

15 148 James H. Anderson et al. r i (k 1) r i (k) i. Therefore the exression above holds for all t in (0, i ]. e In the videoconferencing system described in Section 6, tasks are soradic rather than eriodic, and job deadlines and release oints do not necessarily coincide, as we have assumed. However, as remarked earlier, the scheduling conditions that we derive also aly if tasks are soradic. In addition, the scheduling condition of Theorem 3.2 can be easily adated to aly if job deadlines and release oints do not coincide. This requires changing our model to allow the relative deadline l i of task T i to range over (0, i ] by relative deadline, we mean the elased time between a job s release time and its deadline. For simlicity, we assume that tasks are indexed in nondecreasing order by relative deadline. With this change to our model, it is ossible to rove the following static-riority scheduling condition. This condition assumes that riority is assigned by the DM scheme [Leung and Whitehead 1982], in which tasks with smaller relative deadlines have higher riorities. The two summation terms in the stated exression below give the demand due to job releases of T i and higher-riority tasks, and the additional demand due to interferences in those tasks, resectively, in an interval of length t. THEOREM 3.3 (SUFFICIECY UDER DM). A set of eriodic tasks that share lock-free objects is schedulable under the DM scheme if the following condition holds for every task T i : i t :0tl i : t j i1 j c t1 st j In comaring this condition to that given in Theorem 3.2, we see that t now ranges u to l i, the relative deadline of T i, rather than u to i, the eriod of T i. Observe that when deadlines coincide with job releases, this condition reduces to the sufficient condition for RM scheduling roved in Theorem DYAMIC-PRIORITY SCHEDULIG CODITIOS In this section, we give searate necessary and sufficient conditions for the schedulability of a set of eriodic tasks that share lock-free objects under the EDF scheme. The following theorem gives a necessary scheduling condition for the EDF scheme. According to this theorem, a task set is schedulable only if rocessor utilization is at most one. This condition is the same as that given in Liu and Layland [1973] for indeendent tasks, so for brevity its roof is omitted here. (A formal roof within our model is given in Anderson et al. [1995].)

16 Real-Time Comuting with Lock-Free Shared Objects 149 THEOREM 4.1 (ECESSITY UDER EDF). If a set of eriodic tasks that share lock-free objects is schedulable under the EDF scheme, then c i 1. i1 i The next theorem gives a sufficient condition for schedulability under the EDF scheme. It states that a task set is schedulable if rocessor utilization is at most one, when interferences are taken into account. Like the RM sufficiency condition of the revious section, this condition can be alied without knowledge of which tasks access which objects. THEOREM 4.2 (SUFFICIECY UDER EDF). A set of eriodic tasks that share lock-free objects is schedulable under the EDF scheme if the following condition holds: c j s 1 j PROOF. We rove that if a task set is not schedulable then (c j s)/ j 1 holds. Assume that the given task set is not schedulable. Let J i,k be the first job to miss its deadline. (If several jobs simultaneously miss their deadline along with J i,k, then let J i,k be the one with lowest riority.) We begin by deriving a bound on D(b i (k), r i (k 1) 1), the total demand laced on the rocessor by J i,k and higher-riority jobs, i.e., jobs with deadlines at or before r i (k 1), in the interval [b i (k), r i (k 1)). D(b i (k), r i (k 1) 1) is comrised of the demand laced by job releases and the extra demand laced by interferences. Recall that at J i,k s busy oint, all jobs of equal or higher riority either are inactive or have a job release. Each job of some task T j can lace a demand of c j on the rocessor, and there are at most (r i (k 1) b i (k))/ j job releases of that task in the interval [b i (k), r i (k 1)) that have a deadline at or before r i (k 1). Therefore, the total demand laced on the rocessor due to such jobs is at most r ik 1 b i k j c j. By Lemma 2.6, the total number of interferences in jobs with deadlines at or before r i (k 1) in the interval [b i (k), r i (k 1)) is bounded by the term (r i (k 1) b i (k) 2)/ j. By IA2, each interference requires s units of additional demand. Therefore, the total additional demand due to

17 150 James H. Anderson et al. interferences is at most r ik 1 b i k 2 s. j Job J i,k will miss its deadline if and only if the difference between the total demand due to tasks with a deadline at or before r i (k 1) in the interval [b i (k), r i (k 1)) and the available rocessor time in that interval is greater than one. Therefore, we have the following: r ik 1 b i k j c j r ik 1 b i k 2 j s r i k 1 b i k 1 1 The above exression imlies r i k 1 b i k c j j r i k 1 b i k 2 s j r i k 1 b i k, which imlies the following: r i k 1 b i k c j s r i k 1 b i k j Canceling out r i (k 1) b i (k) from both sides of the exression above yields the following exression, comleting the roof: c j s 1 e j When considering static-riority schemes in Section 3, we resented a condition that can be alied when task deadlines and eriods do not coincide. The following theorem gives a similar result for EDF scheduling. (Recall that l j is the relative deadline of task T j.) THEOREM 4.3 (SUFFICIECY UDER EDF WHE DEADLIES DIFFER FROM PERIODS). A set of eriodic tasks that share lock-free objects is schedulable

18 Real-Time Comuting with Lock-Free Shared Objects 151 under the EDF scheme if the following condition holds: t : t 0: tl j j c j j t1l j j st j As formulated above, the exression in Theorem 4.3 cannot be verified because the range of t is unbounded. However, there is an imlicit bound on t. For examle, if all tasks are released at time 0, then we only need to consider values less than or equal to the least common multile of the task eriods. If tasks are released at different times, an imlicit bound still exists, but it is more comlex [Baruah et al. 1993]. Also, if an uer bound on the utilization available for the tasks is known, then we can restrict t to a much smaller range [Baruah et al. 1993]. Observe that the summation terms in both Theorems 4.2 and 4.3 range from 1 to. As a result, we are allowing for the fact that any of the tasks can cause interferences in other tasks. However, by our task model, T cannot cause any interferences in other tasks. It is a straightforward exercise to tighten both conditions to account for this fact. 5. FORMAL COMPARISO In this section, we comare lock-free objects to lock-based synchronization schemes and wait-free objects. This comarison is based uon the scheduling conditions resented in the revious two sections and scheduling conditions for lock-based schemes found in the literature. For simlicity, we assume that all accesses to lock-based objects require r units of time and that there are no nested object calls. (We reconsider the subject of nested calls later in Section 7.) Thus, the comutation time c i of a task T i can be written as c i u i m i t acc, where u i is the comutation time not involving accesses to shared objects; m i is the number of shared object accesses by T i ; and t acc is the maximum comutation time for any object access, i.e., s for lock-free objects and r for lock-based objects. (Recall that c i is the comutation time of T i when it is the only task executing on the rocessor, i.e., it does not include blocking terms associated with riority inversions in the lock-based case or interference costs in the lock-free case.) As exlained below, recent studies that evaluate the erformance of lockfree objects [Massalin 1992] and lock-based objects [Gallmeister and Lanier 1991] indicate that s is likely to be less than r for many common objects. This is confirmed by the exerimental results resented in Section Static-Priority Scheduling We begin by comaring the overhead of lock-free object sharing under RM scheduling with the overhead of the lock-based riority ceiling rotocol (PCP) [Rajkumar 1991]. When tasks synchronize by locking, a higherriority job can be blocked by a lower-riority job that accesses a common object; the maximum blocking time is called the blocking factor. Under the

19 152 James H. Anderson et al. PCP, the worst-case blocking time equals the time required to execute the longest critical section. Since we do not consider nested critical sections, the blocking factor equals r, the time to execute a single critical section. We denote the schedulability condition for eriodic tasks using the PCP by the redicate sched_pcp, which on the basis of the analysis in Rajkumar [1991] is defined as follows: i sched_pcp i t :0t i :r t j u jm j rt In the above equation, the first term on the left-hand side reresents the blocking factor. In the second term, u j m j r reresents the comutation time of task T j. The exression on the left-hand side reresents the maximum demand due to T i and higher-riority tasks in a interval of length t. We now derive conditions under which lock-free objects are guaranteed to erform at least as well as lock-based objects under the PCP. Consider the following derivation: f f j : j i :(m j 1) s m j r sched_pcp {Substituting (m j 1) s for m j r in sched_pcp} i i t :0t i : i i i t :0t i : t j u jm j s t j srt t j u jm j s i1 (1) t1 st j (2) Because c j u j m j s in the lock-free case, the last exression in this derivation is equivalent to the scheduling condition of Theorem 3.2. ote that s r/ 2 imlies that j : j i :(m j 1) s m j r because, for ositive m j,1/2m j /(m j 1) 1. Thus, if the time taken to execute one iteration of a lock-free retry loo is less than half the time it takes to access a lock-based object under the PCP, then any task set that is schedulable under the PCP is also schedulable when using lock-free objects. This also imlies that there are certain task sets that are schedulable when lock-free objects are used, but not under the PCP. Since the above comarison between lock-free objects and the PCP rests on r and s values, it is instructive to take a closer look at what these values are actually comrised of in ractice. s is the cost of one lock-free retry loo. For most simle data structures like read/write buffers, queues, and stacks, s is often simly the cost of a simle, straight-line code sequence. For more

20 Real-Time Comuting with Lock-Free Shared Objects 153 comlex data structures like linked lists and balanced trees, a lock-free imlementation would be more comlicated, and corresonding s values might be relatively high. In some alications, s might also include either the time taken to coy the imlemented object if a universal construction were being used or the time taken to simulate a synchronization rimitive such as CAS2 if such rimitives were not rovided in hardware. Under the PCP, r includes the cost of a system call to modify the calling task s riority before accessing an object, the cost of actually erforming the shared-object oeration, and the cost of a system call to restore the calling task s riority after an access. What are tyical values of s and r? A erformance comarison of various lock-free objects is given by Massalin [1992], who reorts that, given hardware suort for rimitives like comare-and-swa, s varies from 1.3 microseconds for a counter to 3.3 microseconds for a circular queue. In the absence of hardware suort, such rimitives can be simulated by a tra, adding an additional 4.2 microseconds. Massalin s conclusions are based on exeriments run on a 25MHz, one-wait-state memory, cold-cache CPU. In contrast, lock-based imlementations fared much worse in a recent erformance comarison of commercial real-time oerating systems run on a 25MHz, zero-wait-state memory CPU [Gallmeister and Lanier 1991]. In this comarison, the imlementation of semahores on LynxOS took microseconds to lock and unlock a semahore in the worst case. The corresonding figure for POSIX mutex-style semahores was microseconds. Although these figures cannot be regarded as definitive, they do give some indication as to the added overhead when oerating-systembased locking mechanisms are used. For the videoconferencing system described in Section 6, the situation is very similar. In this system, s is 37 microseconds, while r is 151 microseconds. In deriving (2) from (1) in the comarison above, we droed the term r, effectively ignoring the effect of blocking under the PCP. If blocking times are considerable, then lock-free objects would be more cometitive than this comarison indicates. It should also be noted that our scheduling analysis is very essimistic. In reality, a reemted task need not be accessing a shared object and hence may not necessarily have an interference as we have assumed. 5.2 Dynamic-Priority Scheduling We now comare the overhead of lock-free objects with the dynamic deadline modification (DDM) scheme under EDF scheduling (EDF/DDM) [Jeffay 1992], which is a lock-based rotocol for dynamic-riority schemes. Under this scheme, tasks are divided into one or more hases. During each hase, a task accesses at most one shared resource. Before a task T i accesses a shared object S m, its deadline is modified to the deadline of some task T j that accesses S m and that has the smallest deadline of all tasks that access S m. Uon comleting a shared object access, T i s deadline is restored to its original value. In our comarison, we assume that hases in