Making Linearizability Compositional for Partially Ordered Executions

Abstract

In the interleaving model of concurrency, where events are totally ordered, linearizability is compositional: the composition of two linearizable objects is guaranteed to be linearizable. However, linearizability is not compositional when events are only partially ordered, as in many weak-memory models that describe multicore memory systems. In this paper, we present causal linearizability, a correctness condition for concurrent objects implemented in weak-memory models. We abstract from the details of specific memory models by defining our condition using Lamport's execution structures. We apply our condition to the C11 memory model, providing a correctness condition for C11 objects. We develop a proof method for verifying objects implemented in C11 and related models. Our method is an adaptation of simulation-based methods, but in contrast to other such methods, it does not require that the implementation totally order its events. We also show that causal linearizability reduces to linearizability in the totally ordered case. * s.doherty@sheffield.ac.uk † j.derrick@sheffield.ac.uk ‡ Brijesh.Dongol@brunel.ac.uk § wehrheim@upb.de 1 Example inspired by H.-J.Boehm talk at Dagstuhl, Nov. 2017

Weak-consistency specification via visibility relaxation

“…Recently Doherty et al [2018]; proposed a notion of causal happens-before linearizability which appears to be equivalent to complete sequential happens-before consistency (SHBC), i.e., without visibility relaxation, for APIs which do not contribute to happens-before. Their definition also requires implementations to guarantee specified happens-before contributions Ð e.g., that the insertion of a given element in a Java collection happens-before its corresponding retrieval Ð which is orthogonal to return-value consistency.…”

“…Neither eventual nor causal consistency precisely capture the n = 0 outcome in the example above; causal consistency doesn't allow size to observe the first thread's remove operation without also observing its add operation; eventual consistency does not constrain n at all in this case. Second, annotating API methods requires mixtures of consistency levels since APIs generally include methods of varying consistencies; previous works, e.g., [Batty et al 2013;Doherty et al 2018;Herlihy and Wing 1990;Perrin et al 2016], develop only global consistency levels that apply to all API methods. For instance, a set's add and remove methods may guarantee atomicity even if the size method does not.…”

On library correctness under weak memory consistency: specifying and verifying concurrent libraries under declarative consistency models

“…Nevertheless, as we demonstrated in ğ2, we consider the use of total orders for specifications under WMC as overly restrictive. Doherty et al [2018] present a generalisation of linearisability that can be applied for Lamport's execution structures [Lamport 1986]. They show that, unlike naive applications of linearisability to partial orders, their definition is compositional: Lamport's execution structures can be restricted to each object, and linearisability of all such restrictions implies linearisability of the full structure.…”

Verifying Correctness of Persistent Concurrent Data Structures

“…There are numerous approaches to proving (standard) linearizability of concurrent data structures (e.g., [27,1,24]; see [9] for an overview), including specialisations to cope with weak memory models (e.g., [25,2,26,5,22,7]). The recent development of NVM has been accompanied by persistent versions of well-known concurrent constructs, including concurrent objects [11,3], synchronisation primitives [13,21] and transactional memory [16].…”