Proving highly-concurrent traversals correct

Abstract

Modern highly-concurrent search data structures, such as search trees, obtain multi-core scalability and performance by having operations traverse the data structure without any synchronization. As a result, however, these algorithms are notoriously difficult to prove linearizable, which requires identifying a point in time in which the traversal's result is correct. The problem is that traversing the data structure as it undergoes modifications leads to complex behaviors, necessitating intricate reasoning about all interleavings of reads by traversals and writes mutating the data structure. In this paper, we present a general proof technique for proving unsynchronized traversals correct in a significantly simpler manner, compared to typical concurrent reasoning and prior proof techniques. Our framework relies only on sequential properties of traversals and on a conceptually simple and widely-applicable condition about the ways an algorithm's writes mutate the data structure. Establishing that a target data structure satisfies our condition requires only simple concurrent reasoning, without considering interactions of writes and reads. This reasoning can be further simplified by using our framework. To demonstrate our technique, we apply it to prove several interesting and challenging concurrent binary search trees: the logical-ordering AVL tree, the Citrus tree, and the full contention-friendly tree. Both the logical-ordering tree and the full contention-friendly tree are beyond the reach of previous approaches targeted at simplifying linearizability proofs.

The Commutativity Quotients of Concurrent Objects

“…We assume that it is abstracted with the postcondition at line 3 in insert stating that y is the successor of x, the input k is in between x.key and y.key, and that at some point between the invocation of the operation and "now", x resides on a valid search path for k that starts at the head of the list, denoted as ⋅ head k → x. Recent work [9,10] shows that this postcondition can be derived easily by showing that roughly, list nodes are never updated once they become unreachable. Therefore, the implementations of insert and delete are as follows:…”

Proving Linearizability Using Linearizations of Delete Operations

“…There has been a great deal of work on linearizability verification [15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34]. However, proving linearizability of sophisticated concurrent data structures is still challenging.…”

Verifying concurrent multicopy search structures

“…Moreover, searches have fixed linearization points. This structure can therefore be handled, in principle, using the single-copy framework of Krishna et al [2020a] (by building on the formalization of the RCU semantics developed in [Gotsman et al 2013] and the high-level proof idea for the Citrus tree of Feldman et al [2020]).…”

“…Several other works present generic proof arguments for verifying concurrent traversals of search structures that involve dynamic linearization points [Drachsler-Cohen et al 2018;Feldman et al 2018Feldman et al , 2020O'Hearn et al 2010]. However, these approaches focus on single-copy structures and rely on global reasoning based on graph reachability.…”