Proving Linearizability Using Partial Orders

Khyzha, Artem; Dodds, Mike; Gotsman, Alexey; Parkinson, Matthew

doi:10.1007/978-3-662-54434-1_24

Cited by 23 publications

(14 citation statements)

References 24 publications

(69 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other approaches [KDGP17,DSNB17] for proving linearizability of algorithms with future-dependent linearization points use Hoare logics with auxiliary state to track the abstract history of a program as a partial order. The crucial property is that all total extensions of the partial order result in valid linear histories of the program.…”

Section: Related Workmentioning

confidence: 99%

ReLoC Reloaded: A Mechanized Relational Logic for Fine-Grained Concurrency and Logical Atomicity

Frumin¹,

Krebbers²,

Birkedal³

2021

Logical Methods in Computer Science

View full text Add to dashboard Cite

We present a new version of ReLoC: a relational separation logic for proving refinements of programs with higher-order state, fine-grained concurrency, polymorphism and recursive types. The core of ReLoC is its refinement judgment $e \precsim e' : \tau$, which states that a program $e$ refines a program $e'$ at type $\tau$. ReLoC provides type-directed structural rules and symbolic execution rules in separation-logic style for manipulating the judgment, whereas in prior work on refinements for languages with higher-order state and concurrency, such proofs were carried out by unfolding the judgment into its definition in the model. ReLoC's abstract proof rules make it simpler to carry out refinement proofs, and enable us to generalize the notion of logically atomic specifications to the relational case, which we call logically atomic relational specifications. We build ReLoC on top of the Iris framework for separation logic in Coq, allowing us to leverage features of Iris to prove soundness of ReLoC, and to carry out refinement proofs in ReLoC. We implement tactics for interactive proofs in ReLoC, allowing us to mechanize several case studies in Coq, and thereby demonstrate the practicality of ReLoC. ReLoC Reloaded extends ReLoC (LICS'18) with various technical improvements, a new Coq mechanization, and support for Iris's prophecy variables. The latter allows us to carry out refinement proofs that involve reasoning about the program's future. We also expand ReLoC's notion of logically atomic relational specifications with a new flavor based on the HOCAP pattern by Svendsen et al.

show abstract

Section: Related Workmentioning

confidence: 99%

ReLoC Reloaded: A Mechanized Relational Logic for Fine-Grained Concurrency and Logical Atomicity

Frumin¹,

Krebbers²,

Birkedal³

2021

Logical Methods in Computer Science

View full text Add to dashboard Cite

show abstract

“…Our work bears a superficial resemblance to proof methods [8,23,37] for linearizability [19]. Our work targets the general problem of safety verification.…”

Section: Related Workmentioning

confidence: 99%

Refinement for Structured Concurrent Programs

Kragl

Qadeer

Henzinger

2020

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…Interestingly, most non-automated proofs of lock-free code rely on a garbage collector [Bäumler et al 2011;Bouajjani et al 2017;Colvin et al 2005Colvin et al , 2006Delbianco et al 2017;Derrick et al 2011;Doherty and Moir 2009;Elmas et al 2010;Groves 2007Groves , 2008Hemed et al 2015;Jonsson 2012;Khyzha et al 2017;Liang and Feng 2013;Liang et al 2012Liang et al , 2014O'Hearn et al 2010;Sergey et al 2015a,b] to avoid the complexity of memory reclamation. Henzinger et al [2013]; Schellhorn et al [2012] verify a lock-free queue by Herlihy and Wing [1990] which does not reclaim memory.…”

Section: Related Workmentioning

confidence: 99%

Decoupling lock-free data structures from memory reclamation for static analysis

Meyer

Wolff

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Verification of concurrent data structures is one of the most challenging tasks in software verification. The topic has received considerable attention over the course of the last decade. Nevertheless, human-driven techniques remain cumbersome and notoriously difficult while automated approaches suffer from limited applicability. The main obstacle for automation is the complexity of concurrent data structures. This is particularly true in the absence of garbage collection. The intricacy of lock-free memory management paired with the complexity of concurrent data structures makes automated verification prohibitive.In this work we present a method for verifying concurrent data structures and their memory management separately. We suggest two simpler verification tasks that imply the correctness of the data structure. The first task establishes an over-approximation of the reclamation behavior of the memory management. The second task exploits this over-approximation to verify the data structure without the need to consider the implementation of the memory management itself. To make the resulting verification tasks tractable for automated techniques, we establish a second result. We show that a verification tool needs to consider only executions where a single memory location is reused. We implemented our approach and were able to verify linearizability of Michael&Scott's queue and the DGLM queue for both hazard pointers and epoch-based reclamation. To the best of our knowledge, we are the first to verify such implementations fully automatically.Otherwise, this equality may not hold.Property (G5) holds by definition together with Property (P5). It remains to show Properties (G2) to (G4) and (G6).Ad Property (G2). First consider the case where we have q ∈ valid τ . By Auxiliary (A1) we also have q ∈ valid σ . We getThe second equality holds because m τ (q) = b. That is, we preserve b.data in m τ | valid τ and only need to update the mapping of p. Similarly, we getNow consider the case q valid τ . By Auxiliary (A1) we also have q valid σ . We getThe last equality holds because the update does not survive the restriction to a set which is guaranteed not to contain p. Similarly, we getWe now get:The first equality is by definition of restrictions, the second equality is due to Property (P2), the third one is by Auxiliary (A1), and the last is again by definition. This concludes the property.Ad Property (G3). Only the valuation of p is changed by both act and act ′ . So by Property (P3) it suffices to show m τ .act (p)=a ⇐⇒ m σ .act ′ (p)=a. This follows easily:where the first and last equivalence hold due to the updates up and up ′ and the second equality holds by Property (P3).Ad Property (G4). Let c ∈ m τ .act (valid τ .act ). We have c ∈ m τ (valid τ ). To see this, consider some pexp ∈ valid τ .act such that m τ .act (pexp) = c. If pexp p, then m τ .act (pexp) = m τ (pexp) and pexp ∈ valid τ by definition. So c ∈ m τ (valid τ ) follows immediately. Otherwise, in the case of pexp ≡ p, we have m τ .act (p) = m τ (q). ...

show abstract

Proving Linearizability Using Partial Orders

Cited by 23 publications

References 24 publications

ReLoC Reloaded: A Mechanized Relational Logic for Fine-Grained Concurrency and Logical Atomicity

ReLoC Reloaded: A Mechanized Relational Logic for Fine-Grained Concurrency and Logical Atomicity

Refinement for Structured Concurrent Programs

Decoupling lock-free data structures from memory reclamation for static analysis

Contact Info

Product

Resources

About