Concurrent Library Correctness on the TSO Memory Model

Abstract

Abstract. Linearizability is a commonly accepted notion of correctness for libraries of concurrent algorithms. Unfortunately, it is only appropriate for sequentially consistent memory models, while the hardware and software platforms that algorithms run on provide weaker consistency guarantees. In this paper, we present the first definition of linearizability on a weak memory model, Total Store Order (TSO), implemented by x86 processors. We establish that our definition is a correct one in the following sense: while proving a property of a client of a concurrent library, we can soundly replace the library by its abstract implementation related to the original one by our generalisation of linearizability. This allows abstracting from the details of the library implementation while reasoning about the client. We have developed a tool for systematically testing concurrent libraries against our definition and applied it to several challenging algorithms.

Show No Weakness: Sequentially Consistent Specifications of TSO Libraries

“…TSO libraries can also be specified by abstract implementations running on TSO, which do describe this usage. In [6], we proposed the notion of TSO-to-TSO linearizability TSO→TSO between two TSO libraries, which validates the following version of the Abstraction Theorem.…”

“…We have previously proposed a generalisation of linearizability to the TSO memory model [6] (TSO-to-TSO linearizability in Section 3). Unlike TSO-to-SC linearizability, it requires specifications to be formulated in terms of low-level hardware concepts, and thus cannot be used for interfacing with high-level languages.…”

“…Unlike TSO-to-SC linearizability, it requires specifications to be formulated in terms of low-level hardware concepts, and thus cannot be used for interfacing with high-level languages. Furthermore, the technical focus of [6] was on establishing Theorem 7, not Theorem 13.…”

“…Intuitively, this is because a correct scheduler establishes the illusion that every thread owns a dedicated CPU, and flushing the store buffer at every context switch does not let a thread notice that the actual store buffers it uses change. This can be formalised using existing techniques 6 . Hence, we can restrict ourselves to reasoning in the setting where the number of CPUs is equal to the number of threads, for which the composition of client and library semantics we used is valid.…”

“…Finally, we use the following variant of Lemma 20, which is analogous to a theorem proved in [6]. It states that any pair of client-local and library-local SC computations agreeing on the history can be combined into a valid SC computation of C(L).…”