Compositional verification of termination-preserving refinement of concurrent programs

Abstract

Many verification problems can be reduced to refinement verification. However, existing work on verifying refinement of concurrent programs either fails to prove the preservation of termination, allowing a diverging program to trivially refine any programs, or is difficult to apply in compositional thread-local reasoning. In this paper, we first propose a new simulation technique, which establishes termination-preserving refinement and is a congruence with respect to parallel composition. We then give a proof theory for the simulation, which is the first Hoare-style concurrent program logic supporting termination-preserving refinement proofs. We show two key applications of our logic, i.e., verifying linearizability and lockfreedom together for fine-grained concurrent objects, and verifying full correctness of optimizations of concurrent algorithms.

Modular Termination Verification for Non-blocking Concurrency

“…This method involves a thread passing "tokens" to other threads whose lock-free operations are impeded by modifications to the shared state. Subsequent approaches [1,12] also use some form of tokens that are used up in loops or function calls. These approaches require special proof rules for the tokens.…”

“…Liang et al [12] have developed a proof theory for termination-preserving refinement, applying it to verify linearisability and lock-freedom. Their approach constrains impedance by requiring that impeding actions correspond to progress at the abstract level.…”

A Generic Logic for Proving Linearizability

“…Linearizability has since been generalised to also specify liveness properties [9]. Another direction of future work is to generalise our logic to handle liveness, possibly building on ideas from [19].…”

“…Consequently, there exist a method m with its argument a such that C = L(m, a, r) and: safe t (v t , C, Q(t, L(m, a, r)) i ) ∧ ((∆(t) = todo(L(m, a, r)) ∧ T (t) = (L(m, a, r), r)) ∨ (∆(t) = done(L(m, a, r)) ∧ T (t) = (skip, r))). (19) It is easy to see that whenever there is a transition C, σ t,α − −−− ։ C ′ , σ ′ , there also is a stateless transition C α − −→ C ′ . By Definition 3 of safe t (v t , C, Q(t, L(m, a, r)) i ), if C α − −→ C ′ , then there exists a view v ′ t such that α t {v t }{v ′ t } and safe t (v ′ t , C ′ , Q(t, L(m, a, r)) i ).…”

Specifying concurrent programs in separation logic: morphisms and simulations

“…The main problem when formally reasoning about concurrent data structures is achieving compositionality of proofs: how to ensure that methods of a data structure, once verified, can be used in a larger context without re-verification. There exist many solutions to the problem, roughly divided into two kinds: linearizability [Herlihy and Wing 1990], or more generally contextual refinement [Filipović et al 2010a;Liang and Feng 2018;Liang et al 2014], and Concurrent Separation Logic (CSL) [Brookes 2007;O'Hearn 2007], and its many recent extensions to fine-grained (i.e., lock-free) concurrency [da Rocha Pinto et al 2014;Dinsdale-Young et al 2010;Jung et al 2015;Nanevski et al 2014;Svendsen and Birkedal 2014;Svendsen et al 2013]. More recently, some approaches [Frumin et al 2018;Turon et al 2013] employed variants of separation logic to establish linearizability and contextual refinement themselves, suggesting separation logic as a general-purpose method for reasoning about concurrent programs.…”