Verifying Correctness of Persistent Concurrent Data Structures

Abstract

Non-volatile memory (NVM), aka persistent memory, is a new paradigm for memory preserving its contents even after power loss. The expected ubiquity of NVM has stimulated interest in the design of persistent concurrent data structures, together with associated notions of correctness. In this paper, we present the first formal proof technique for durable linearizability, which is a correctness criterion that extends linearizability to handle crashes and recovery in the context of NVM. Our proofs are based on refinement of IO-automata representations of concurrent data structures. To this end, we develop a generic procedure for transforming any standard sequential data structure into a durable specification. Since the durable specification only exhibits durably linearizable behaviours, it serves as the abstract specification in our refinement proof. We exemplify our technique on a recently proposed persistent memory queue that builds on Michael and Scott's lock-free queue.

View-Based Owicki–Gries Reasoning for Persistent x86-TSO

“…For instance, Abdulla et al [1] have proven that state-reachability for persistent x86 is decidable, thus opening the door to automatic verification of persistent programs, and Gorjiara et al [18] and Kokologiannakis et al [25] have developed model checkers for finding bugs in persistent programs. Recent works have considered durable atomic objects such as concurrent data structures [17] and transactional memory [3] and their verification [3,14,15], which have been designed to satisfy conditions such as durable linearizability [20,24] and durable opacity [3]. These proofs assume persistency under SC; our work provides foundations for extending these proofs to persistent x86-TSO.…”

Persistent Owicki-Gries reasoning: a program logic for reasoning about persistent programs on Intel-x86

“…Both [Friedman et al 2018;Zuriel et al 2019] argue that their implementations are correct by providing an informal argument at the level of program traces. Derrick et al [2019] provided a formal correctness proof of the queue implementation by Friedman et al [2018]; this proof is also at the level of program traces. Moreover, all three of [Derrick et al 2019;Friedman et al 2018;Zuriel et al 2019] assume that the underlying memory model is sequential consistency (SC) [Lamport 1979], rather than Intel x86-TSO.…”

“…Derrick et al [2019] provided a formal correctness proof of the queue implementation by Friedman et al [2018]; this proof is also at the level of program traces. Moreover, all three of [Derrick et al 2019;Friedman et al 2018;Zuriel et al 2019] assume that the underlying memory model is sequential consistency (SC) [Lamport 1979], rather than Intel x86-TSO. recently developed a persistent transactional library on top of the ARM architecture; they later adapted this implementation to the Px86 sim architecture.…”

Intermittent Computing with Peripherals, Formally Verified

“…Another line of work focuses on proving the linearizability of fine-grained concurrent data-structures subject to wholesystem crash [16,19]. Durable linearizability requires that upon a crash, only completed operations are guaranteed to remain visible.…”