🤖 AI Summary
Prior work lacks mechanized metatheoretical verification of Jayanti et al.’s “forward-reasoning” linearizability proof technique, preventing end-to-end verifiable linearizability proofs.
Method: We present the first full formalization and metatheoretic verification of this technique in Rocq, rigorously establishing its soundness and completeness. Integrating the TLA+ forward-reasoning framework, we model concurrent data structures—including registers—in Rocq and construct fully mechanized, end-to-end linearizability proofs from concrete implementations to atomic reference specifications.
Contribution/Results: Our work delivers the first machine-checked, end-to-end linearizability proof instance; significantly reduces the trusted computing base; and provides a reusable, formally verified infrastructure for high-assurance verification of concurrent data structures.
📝 Abstract
In the past decade, many techniques have been developed to prove linearizability, the gold standard of correctness for concurrent data structures. Intuitively, linearizability requires that every operation on a concurrent data structure appears to take place instantaneously, even when interleaved with other operations. Most recently, Jayanti et al. presented the first sound and complete "forward reasoning" technique for proving linearizability that relates the behavior of a concurrent data structure to a reference atomic data structure as time moves forward. This technique can be used to produce machine-checked proofs of linearizability in TLA+. However, while Jayanti et al.'s approach is shown to be sound and complete, a mechanization of this important metatheoretic result is still outstanding. As a result, it is not possible to produce verified end-to-end proofs of linearizability. To reduce the size of this trusted computing base, we formalize this forward reasoning technique and mechanize proofs of its soundness and completeness in Rocq. As a case study, we use the approach to produce a verified end-to-end proof of linearizability for a simple concurrent register.