Quantitative Reasoning for Proving Lock-Freedom

Abstract

Abstract-This article describes a novel quantitative proof technique for the modular and local verification of lock-freedom. In contrast to proofs based on temporal rely-guarantee requirements, this new quantitative reasoning method can be directly integrated in modern program logics that are designed for the verification of safety properties. Using a single formalism for verifying memory safety and lock-freedom allows a combined correctness proof that verifies both properties simultaneously.This article presents one possible formalization of this quantitative proof technique by developing a variant of concurrent separation logic (CSL) for total correctness. To enable quantitative reasoning, CSL is extended with a predicate for affine tokens to account for, and provide an upper bound on the number of loop iterations in a program. Lock-freedom is then reduced to total-correctness proofs. Quantitative reasoning is demonstrated in detail, both informally and formally, by verifying the lockfreedom of Treiber's non-blocking stack. Furthermore, it is shown how the technique is used to verify the lock-freedom of more advanced shared-memory data structures that use eliminationbackoff schemes and hazard-pointers.

Modular Termination Verification for Non-blocking Concurrency

“…Theorem 1 (Hoffmann et al [10]). Given a module M, if, for all m and n, every program c ∈ C m,n terminates, then M is lock free.…”

“…Based on this observation, Gotsman et al [7] reduced lock-freedom to the termination of a simple class of programs, the bounded most-general clients (BMGCs) of a module. Hoffmann et al [10] generalised the result to apply to algorithms where the identity or number of threads is significant. An (m, n)-bounded general client consists of m threads which each invoke n module operations in sequence.…”

“…Hoffmann et al [10] introduced a concurrent separation logic for verifying total correctness. By adapting the most-general-client approach of Gotsman et al [7], they establish that modules are lock-free.…”

Compositional verification of termination-preserving refinement of concurrent programs

“…Inspired by Hoffmann et al's logic for lock-freedom [7], we introduce a counter n (i.e. the number of tokens assigned to the current thread) as a while-specific metric, which means the thread can only run the loop for no more than n rounds before it or its environment fulfils one or more source-level moves.…”

“…Our work is based on our previous compositional simulation RGSim [11] (which unfortunately cannot preserve termination), and is inspired by Hoffmann et al's program logic for lock- freedom [7] (which does not support refinement verification and has limitations on local reasoning, as we will explain in Sec. 7), but makes the following new contributions:…”