Quarantining Weakness

In sequential computing, every method of an object can be described in isolation via preconditions and postconditions. However, reasoning in a concurrent setting requires a characterization of all possible interactions across method invocations. Herlihy and Wing [1990]’s notion of linearizability simplifies such reasoning by intuitively ensuring that each method invocation “takes effect” between its invocation and response events. This approach had two basic shortcomings. Firstly, in Herlihy and Wing’s definition of linearizability, the interfaces are not expressive enough to codify external calls emanating from the component. Thus, objects are closed and passive. Secondly, the definitions are for a memory model with a global total order on memory operations, thus satisfying sequential consistency (SC). SC is not realized by all architectures or runtime systems [Adve and Gharachorloo 1996; Adve and Boehm 2010], motivating models of relaxed memory in hardware, such as TSO [Sewell et al. 2010], PSO [SPARC, Inc. 1994], Power [Sarkar et al. 2011], and runtime systems, such as Java [Manson et al. 2005; Sevcík 2008] and C++ [Boehm and Adve 2008; Batty et al. 2011]. This has motivated recent definitions of linearizability specific to the TSO [Burckhardt et al. 2012; Gotsman et al. 2012] and C11 [Batty et al. 2013] memory models. We propose new definitions to address both of these limitations. Our methodology aims to keep the interfaces free of the intricacies of particular relaxed memory models. Our approach has the following characteristics. (1) We model calls to component functions process-algebraically. This allows us to treat callbacks and to give a symmetric definition of composition between clients and libraries. Thus, our definitions encompass active components (that can evolve autonomously even without input from the environment) and open components (that invoke methods on components provided by the environment) and environment assumptions (pre/postconditions and the permitted sequences of method calls to a component). (2) Our definitions are not specific to a particular memory model. Rather, we identify the criteria that a relaxed memory model needs to satisfy in order to fit into our framework: the examples that satisfy our criteria include SC, TSO, PSO and a variant of the Java Memory Model (JMM).