3 research outputs found
Modularising opacity verification for hybrid transactional memory
Transactional memory (TM) manages thread synchronisation to provide an illusion of atomicity for arbitrary blocks of code. There are various implementations of TM, including hardware (HTM) and software (STM). HTMs provide high performance, but are inherently limited by hardware restrictions; STMs avoid these limitations but suffer from unpredictable performance. To solve these problems, hybrid TM (HyTM) algorithms have been introduced which provide reliable software fallback mechanisms for hardware transactions. The key safety property for TM is opacity, however a naive combination of an opaque STM and an opaque HTM does not necessarily result in an opaque HyTM. Therefore, HyTM algorithms must be specially designed to satisfy opacity. In this paper we introduce a modular method for verifying opacity of HyTM implementations. Our method provides conditions under which opacity proofs of HTM and STM components can be combined into a single proof of an overall hybrid algorithm. The proof method has been fully mechanised in Isabelle, and used to verify a novel hybrid version of a transactional mutex lock
Modularising Verification Of Durable Opacity
Non-volatile memory (NVM), also known as persistent memory, is an emerging
paradigm for memory that preserves its contents even after power loss. NVM is
widely expected to become ubiquitous, and hardware architectures are already
providing support for NVM programming. This has stimulated interest in the
design of novel concepts ensuring correctness of concurrent programming
abstractions in the face of persistency and in the development of associated
verification approaches.
Software transactional memory (STM) is a key programming abstraction that
supports concurrent access to shared state. In a fashion similar to
linearizability as the correctness condition for concurrent data structures,
there is an established notion of correctness for STMs known as opacity. We
have recently proposed durable opacity as the natural extension of opacity to a
setting with non-volatile memory. Together with this novel correctness
condition, we designed a verification technique based on refinement. In this
paper, we extend this work in two directions. First, we develop a durably
opaque version of NOrec (no ownership records), an existing STM algorithm
proven to be opaque. Second, we modularise our existing verification approach
by separating the proof of durability of memory accesses from the proof of
opacity. For NOrec, this allows us to re-use an existing opacity proof and
complement it with a proof of the durability of accesses to shared state
Defining and Verifying Durable Opacity: Correctness for Persistent Software Transactional Memory
Non-volatile memory (NVM), aka persistent memory, is a new paradigm for
memory that preserves its contents even after power loss. The expected ubiquity
of NVM has stimulated interest in the design of novel concepts ensuring
correctness of concurrent programming abstractions in the face of persistency.
So far, this has lead to the design of a number of persistent concurrent data
structures, built to satisfy an associated notion of correctness: durable
linearizability.
In this paper, we transfer the principle of durable concurrent correctness to
the area of software transactional memory (STM). Software transactional memory
algorithms allow for concurrent access to shared state. Like linearizability
for concurrent data structures, opacity is the established notion of
correctness for STMs. First, we provide a novel definition of durable opacity
extending opacity to handle crashes and recovery in the context of NVM. Second,
we develop a durably opaque version of an existing STM algorithm, namely the
Transactional Mutex Lock (TML). Third, we design a proof technique for durable
opacity based on refinement between TML and an operational characterisation of
durable opacity by adapting the TMS2 specification. Finally, we apply this
proof technique to show that the durable version of TML is indeed durably
opaque. The correctness proof is mechanized within Isabelle.Comment: This is the full version of the paper that is to appear in FORTE 2020
(https://www.discotec.org/2020/forte